Function at 0x140065bb0
Capabilities:
Compare security identifiers
Create thread
Enumerate process modules
Enumerate services
Get system information on windows
Patch process command line

Disassembly:
push rsi
push rdi
mov eax, 0x16598
call fcn.140101da0
sub rsp, rax
mov rax, qword [0x1401cf518]
xor rax, rsp
mov qword [rsp + 0x16580], rax
mov dword [rsp + 0x74], 0
lea rdx, [0x14014ccc0]
lea rcx, [rsp + 0x2be8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2be8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xfc], al
lea rcx, [rsp + 0x2be8]
call fcn.140003860
movzx eax, byte [rsp + 0xfc]
test eax, eax
je 0x140065c2f
lea rcx, str._nGetProcessList
call fcn.14000ad70
mov dword [rsp + 0x4b70], 0
lea rax, [rsp + 0x4b74]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rsp + 0x4aa8], 0
lea rcx, [0x14014cdf0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQuerySystemInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xb90], rax
mov dword [rsp + 0x130], 0x10000
mov edx, 0x18
lea rcx, [rsp + 0x4dc0]
call fcn.1400079b0
lea rcx, [rsp + 0x1a2]
call fcn.140003030
mov qword [rsp + 0xb88], rax
mov byte [rsp + 0xfd], 0
mov eax, dword [rsp + 0x130]
mov r9, qword [rsp + 0xb88]
lea r8, [rsp + 0xfd]
mov edx, eax
lea rcx, [rsp + 0x4dc0]
call fcn.140034380
nop
mov dword [rsp + 0x4b78], 0
mov rax, qword [rsp + 0xb90]
mov qword [rsp + 0xb98], rax
lea rcx, [rsp + 0x4dc0]
call fcn.1400b3f80
lea r9, [rsp + 0x4b78]
mov r8d, dword [rsp + 0x130]
mov rdx, rax
mov ecx, 5
call qword [rsp + 0xb98]
mov dword [rsp + 0x204], eax
cmp dword [rsp + 0x204], 0
jge 0x140065db1
cmp dword [rsp + 0x204], 0xc0000004
jne 0x140065d81
mov eax, dword [rsp + 0x4b78]
add eax, 0x1000
mov dword [rsp + 0x130], eax
mov byte [rsp + 0xff], 0
mov eax, dword [rsp + 0x130]
lea r8, [rsp + 0xff]
mov edx, eax
lea rcx, [rsp + 0x4dc0]
call fcn.1400c2160
jmp 0x140065db3
lea rcx, str.Enumerating_processes
call fcn.1400c0f20
mov dword [rsp + 0x8c0], 0
lea rcx, [rsp + 0x4dc0]
call fcn.14003d030
mov eax, dword [rsp + 0x8c0]
jmp 0x14007a0f0
jmp 0x140065dbe
xor eax, eax
cmp eax, 1
jne 0x140065cea
lea rdx, [rsp + 0x4b70]
lea rcx, [rsp + 0x4dc0]
call fcn.140092ad0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1401d19f8], eax
lea rcx, str._nObtaining_running_tasks_in_memory..._n
call fcn.14000ad70
call fcn.1400066d0
lea rcx, str.Obtaining_process_handles_in_memory..._n
call fcn.14000ad70
call fcn.140060090
lea rcx, str.Obtaining_NET_assemblies_in_memory..._n
call fcn.14000ad70
call fcn.140009b60
lea rdx, [0x14014cf60]
lea rcx, [rsp + 0x5570]
call fcn.140005fd0
nop
mov edx, 8
lea rcx, [rsp + 0x4b58]
call fcn.1400079b0
lea rdx, [rsp + 0x2a50]
lea rcx, [0x1401d19e0]
call fcn.1400b5ef0
mov rax, qword [rax]
mov qword [rsp + 0x4b58], rax
jmp 0x140065e72
xor r8d, r8d
lea rdx, [rsp + 0x2a58]
lea rcx, [rsp + 0x4b58]
call fcn.1400421d0
lea rdx, [rsp + 0x2a60]
lea rcx, [0x1401d19e0]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b58]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006600b
lea rcx, [rsp + 0x4b58]
call fcn.140042040
add rax, 0x10
mov qword [rsp + 0xbb0], rax
lea rcx, [rsp + 0x4b58]
call fcn.140042040
add rax, 0x10
mov qword [rsp + 0xba0], rax
xor r8d, r8d
lea rdx, [0x14014cf64]
mov rcx, qword [rsp + 0xba0]
call fcn.1400bc850
mov qword [rsp + 0xba8], rax
mov r9, qword [rsp + 0xba8]
xor r8d, r8d
lea rdx, [rsp + 0x3180]
mov rcx, qword [rsp + 0xbb0]
call fcn.14000ac90
nop
lea rcx, [rsp + 0x4b58]
call fcn.140042040
add rax, 0x30
mov rdx, rax
lea rcx, [rsp + 0x31a0]
call fcn.140005f30
nop
lea rdx, [rsp + 0x3180]
lea rcx, [rsp + 0x3b30]
call fcn.1400092c0
mov qword [rsp + 0xbb8], rax
mov rax, qword [rsp + 0xbb8]
mov qword [rsp + 0xbc0], rax
mov rax, qword [rsp + 0xbc0]
mov qword [rsp + 0xbc8], rax
lea rcx, [rsp + 0x4b58]
call fcn.140042040
add rax, 8
mov qword [rsp + 0xbd0], rax
mov r8, qword [rsp + 0xbc8]
mov rdx, qword [rsp + 0xbd0]
lea rcx, [rsp + 0x4190]
call fcn.140008fa0
mov qword [rsp + 0xbd8], rax
mov rax, qword [rsp + 0xbd8]
mov qword [rsp + 0xbe0], rax
mov r8, qword [rsp + 0xbe0]
lea rdx, [rsp + 0x2a68]
lea rcx, [0x1401d1980]
call fcn.140008f60
nop
lea rcx, [rsp + 0x4190]
call fcn.140009660
nop
lea rcx, [rsp + 0x3b30]
call fcn.1400096d0
nop
lea rcx, [rsp + 0x3180]
call fcn.1400096d0
jmp 0x140065e5a
lea rcx, [0x1401d19e0]
call fcn.1400b6880
lea rcx, [rsp + 0x4dc0]
call fcn.1400b3f80
mov qword [rsp + 0x128], rax
lea rcx, [rsp + 0x55e8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x55ec]
mov dword [0x1401d6a28], eax
mov dword [rsp + 0x1c4], 0
lea rdx, [0x14014cfa0]
lea rcx, [rsp + 0x2ae8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2ae8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x100], al
lea rcx, [rsp + 0x2ae8]
call fcn.140003860
movzx eax, byte [rsp + 0x100]
test eax, eax
je 0x1400664a4
mov byte [rsp + 0x9c], 0
mov dword [rsp + 0x4b48], 0
mov edx, 0xf0
lea rcx, [rsp + 0x42b0]
call fcn.1400079b0
lea rdx, [0x14014d2f0]
lea rcx, [rsp + 0x2b08]
call fcn.140003570
nop
lea r8, [rsp + 0x2b08]
lea rdx, [rsp + 0x3140]
lea rcx, [0x1401d7c10]
call fcn.14002d570
mov qword [rsp + 0xbe8], rax
mov rax, qword [rsp + 0xbe8]
mov qword [rsp + 0xbf0], rax
mov r9d, 1
mov r8d, 1
mov rdx, qword [rsp + 0xbf0]
lea rcx, [rsp + 0x42b0]
call fcn.140031af0
nop
lea rcx, [rsp + 0x3140]
call fcn.140003860
nop
lea rcx, [rsp + 0x2b08]
call fcn.140003860
lea rdx, [rsp + 0x4b48]
lea rcx, [rsp + 0x42b0]
call fcn.140040d80
mov rax, qword [rsp + 0x42b0]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x42b0]
mov rcx, rax
call fcn.1400bc2b0
movzx eax, al
test eax, eax
je 0x14006618d
mov dword [rsp + 0x4b48], 2
imul eax, dword [rsp + 0x4b48], 0x23c34600
mov eax, eax
mov qword [rsp + 0xc00], rax
lea rcx, [0x1401d7bf0]
call fcn.1400c32b0
cmp rax, 1
jne 0x1400661e9
xor edx, edx
lea rcx, [0x1401d7bf0]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d6f88]
call fcn.1400418a0
mov rax, qword [rax]
mov qword [rsp + 0x4ad0], rax
mov byte [rsp + 0x9c], 1
jmp 0x1400662ee
lea rax, [0x1401d78d8]
mov qword [rsp + 0x918], rax
mov edx, 8
lea rcx, [rsp + 0x4be0]
call fcn.1400079b0
lea rdx, [rsp + 0x4be0]
mov rcx, qword [rsp + 0x918]
call fcn.1400b3e90
lea rdx, [rsp + 0x4ad8]
mov rcx, qword [rsp + 0x918]
call fcn.1400b3ef0
jmp 0x140066243
lea rcx, [rsp + 0x4be0]
call fcn.1400421b0
movzx edx, byte [rsp + 0x4ad8]
lea rcx, [rsp + 0x4be0]
call fcn.1400415f0
movzx eax, al
test eax, eax
je 0x1400662ee
lea rcx, [rsp + 0x4be0]
call fcn.1400420e0
mov rdx, rax
lea rcx, [rsp + 0x5620]
call fcn.140033f20
nop
xor edx, edx
lea rcx, [0x1401d7908]
call fcn.140041d40
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x5628]
call fcn.1400bc7d0
mov qword [rsp + 0xbf8], rax
cmp qword [rsp + 0xbf8], 0xffffffffffffffff
je 0x1400662dc
lea rdx, [rsp + 0x5620]
lea rcx, [0x1401d6f88]
call fcn.1400418a0
mov rax, qword [rax]
mov qword [rsp + 0x4ad0], rax
mov byte [rsp + 0x9c], 1
lea rcx, [rsp + 0x5620]
call fcn.14003ce30
jmp 0x140066236
movzx eax, byte [rsp + 0x9c]
test eax, eax
je 0x140066497
mov eax, dword [rsp + 0x4ad0]
mov dword [rsp + 0x908], eax
mov eax, dword [rsp + 0x4ad4]
mov dword [rsp + 0x90c], eax
movzx eax, word [0x14014de38]
mov word [rsp + 0x6370], ax
lea rax, [rsp + 0x6372]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xa08], 0
mov dword [rsp + 0x8c4], 0
lea rax, [rsp + 0x5458]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [0x1401d6f88]
mov qword [rsp + 0x910], rax
mov edx, 8
lea rcx, [rsp + 0x4be8]
call fcn.1400079b0
lea rdx, [rsp + 0x4be8]
mov rcx, qword [rsp + 0x910]
call fcn.1400b3e90
lea rdx, [rsp + 0x4ad9]
mov rcx, qword [rsp + 0x910]
call fcn.1400b3ef0
jmp 0x1400663c1
lea rcx, [rsp + 0x4be8]
call fcn.1400421b0
movzx edx, byte [rsp + 0x4ad9]
lea rcx, [rsp + 0x4be8]
call fcn.1400415f0
movzx eax, al
test eax, eax
je 0x140066497
lea rcx, [rsp + 0x4be8]
call fcn.140042100
lea rcx, [rsp + 0x4d98]
mov rdi, rcx
mov rsi, rax
mov ecx, reloc.WS2_32.dll_inet_ntoa
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x4da0]
shl rax, 0x20
mov ecx, dword [rsp + 0x4d9c]
add rax, rcx
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x908]
mov rcx, qword [rsp + 0x1e0]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x1e0], rax
cmp qword [rsp + 0x1e0], 0
jge 0x140066465
mov dword [rsp + 0x8c4], 1
imul rax, qword [rsp + 0x1e0], 0xffffffffffffffff
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0xc00]
cmp qword [rsp + 0x1e0], rax
jg 0x140066492
lea rdx, [rsp + 0x4d98]
lea rcx, [0x1401d7bf0]
call fcn.1400c1930
mov byte [0x1401d2a1b], 1
jmp 0x1400663b4
lea rcx, [rsp + 0x42b0]
call fcn.140043860
call fcn.1400bd4b0
mov dword [rsp + 0x21c], eax
mov dword [rsp + 0xc8], 4
cmp dword [rsp + 0x21c], 0
je 0x1400664dc
imul eax, dword [rsp + 0x21c], 0x4b
cdq
mov ecx, 0x64
idiv ecx
mov dword [rsp + 0xc8], eax
mov rax, qword [rsp + 0x128]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x41e0], eax
mov rax, qword [rsp + 0x128]
mov eax, dword [rax + 0x58]
mov dword [rsp + 0x4b2c], eax
mov rax, qword [rsp + 0x128]
mov eax, dword [rax]
mov dword [rsp + 0xa0c], eax
mov r8d, 0x104
xor edx, edx
lea rcx, [rsp + 0x5720]
call fcn.1401044f0
mov rax, qword [rsp + 0x128]
movzx eax, word [rax + 0x38]
mov r8d, eax
mov rax, qword [rsp + 0x128]
mov rdx, qword [rax + 0x40]
lea rcx, [rsp + 0x5720]
call fcn.140103030
mov eax, dword [0x1401d19f8]
cmp dword [rsp + 0x41e0], eax
jne 0x140066582
jmp 0x14007956d
movzx eax, byte [0x1401d2a1b]
test eax, eax
jne 0x14006659c
movzx eax, byte [0x1401d2a1c]
test eax, eax
je 0x140066890
mov byte [rsp + 0x9d], 1
movzx eax, byte [0x1401d2a1b]
test eax, eax
je 0x140066663
lea rdx, [rsp + 0x2a78]
lea rcx, [0x1401d7bf0]
call fcn.1400bb710
mov rax, qword [rax]
mov qword [rsp + 0xc08], rax
lea rdx, [rsp + 0x2a80]
lea rcx, [0x1401d7bf0]
call fcn.1400b60e0
mov rax, qword [rax]
mov qword [rsp + 0xc10], rax
lea r9, [rsp + 0x41e0]
mov r8, qword [rsp + 0xc08]
mov rdx, qword [rsp + 0xc10]
lea rcx, [rsp + 0x2958]
call fcn.14002cf60
mov qword [rsp + 0xc20], rax
lea rdx, [rsp + 0x2aa0]
lea rcx, [0x1401d7bf0]
call fcn.1400bb710
mov qword [rsp + 0xc18], rax
mov rdx, qword [rsp + 0xc18]
mov rcx, qword [rsp + 0xc20]
call fcn.140041570
movzx eax, al
test eax, eax
je 0x140066663
mov byte [rsp + 0x9d], 0
jmp 0x14006687f
movzx eax, byte [0x1401d2a1c]
test eax, eax
je 0x14006687f
lea rdx, [rsp + 0x5720]
lea rcx, [rsp + 0x52e0]
call fcn.140005fd0
nop
lea rax, [rsp + 0x101]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x101]
mov byte [rsp + 0x102], al
movzx eax, byte [rsp + 0x102]
mov byte [rsp + 0x103], al
movzx eax, byte [rsp + 0x103]
mov byte [rsp + 0x104], al
lea rdx, [rsp + 0x2aa8]
lea rcx, [rsp + 0x52e0]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0xc28], rax
mov rax, qword [rsp + 0xc28]
mov qword [rsp + 0xc30], rax
mov rax, qword [rsp + 0xc30]
mov qword [rsp + 0xc58], rax
lea rdx, [rsp + 0x2ab0]
lea rcx, [rsp + 0x52e0]
call fcn.1400bb630
mov rax, qword [rax]
mov qword [rsp + 0xc38], rax
mov rax, qword [rsp + 0xc38]
mov qword [rsp + 0xc40], rax
mov rax, qword [rsp + 0xc40]
mov qword [rsp + 0xc60], rax
lea rdx, [rsp + 0x2ab8]
lea rcx, [rsp + 0x52e0]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0xc48], rax
mov rax, qword [rsp + 0xc48]
mov qword [rsp + 0xc50], rax
mov rax, qword [rsp + 0xc50]
mov qword [rsp + 0xc68], rax
movzx eax, byte [rsp + 0x104]
mov byte [rsp + 0x20], al
mov r9, qword [rsp + 0xc58]
mov r8, qword [rsp + 0xc60]
mov rdx, qword [rsp + 0xc68]
lea rcx, [rsp + 0x2a20]
call fcn.14002ee30
lea rax, [0x1401d7908]
mov qword [rsp + 0x900], rax
mov rcx, qword [rsp + 0x900]
call fcn.140008ce0
mov qword [rsp + 0x278], rax
mov rcx, qword [rsp + 0x900]
call fcn.14001c8b0
mov qword [rsp + 0xc70], rax
jmp 0x140066809
mov rax, qword [rsp + 0x278]
add rax, 0x20
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0xc70]
cmp qword [rsp + 0x278], rax
je 0x140066872
mov rdx, qword [rsp + 0x278]
lea rcx, [rsp + 0x5490]
call fcn.140005f30
xor r8d, r8d
lea rdx, [rsp + 0x5490]
lea rcx, [rsp + 0x52e0]
call fcn.1400bc7d0
mov qword [rsp + 0xc78], rax
cmp qword [rsp + 0xc78], 0xffffffffffffffff
je 0x140066863
mov byte [rsp + 0x9d], 0
lea rcx, [rsp + 0x5490]
call fcn.140003890
jmp 0x1400667f5
lea rcx, [rsp + 0x52e0]
call fcn.140003890
movzx eax, byte [rsp + 0x9d]
test eax, eax
je 0x140066890
jmp 0x14007956d
mov r8d, dword [rsp + 0x41e0]
xor edx, edx
mov ecx, 0x100410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x8d0], rax
cmp qword [rsp + 0x8d0], 0
je 0x140066b30
lea r8, [rsp + 0x41f0]
mov edx, 8
mov rcx, qword [rsp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140066b22
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140066919
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140066919
jmp 0x140066b22
mov edx, 0x18
lea rcx, [rsp + 0x4da8]
call fcn.1400079b0
lea rcx, [rsp + 0x1a1]
call fcn.140003030
mov qword [rsp + 0xc80], rax
mov byte [rsp + 0x105], 0
mov eax, dword [rsp + 0x4aa8]
mov qword [rsp + 0xc88], rax
mov r9, qword [rsp + 0xc80]
lea r8, [rsp + 0x105]
mov rdx, qword [rsp + 0xc88]
lea rcx, [rsp + 0x4da8]
call fcn.140034380
nop
mov eax, dword [rsp + 0x4aa8]
mov dword [rsp + 0x8c8], eax
xor edx, edx
lea rcx, [rsp + 0x4da8]
call fcn.140041c50
mov qword [rsp + 0xc90], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0xc98], rax
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x8c8]
mov r8, qword [rsp + 0xc90]
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, qword [rsp + 0xc98]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400669fe
xor edx, edx
lea rcx, [rsp + 0x4da8]
call fcn.140041c50
mov eax, dword [rax]
mov dword [rsp + 0x10c], eax
lea rcx, [rsp + 0x2f88]
call fcn.140034230
mov qword [rsp + 0xca0], rax
mov rax, qword [rsp + 0xca0]
mov qword [rsp + 0xca8], rax
lea rdx, [rsp + 0x4da8]
mov rcx, qword [rsp + 0xca8]
call fcn.1400c3850
lea rcx, [rsp + 0x2f88]
call fcn.14003d030
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x10c], 0
jne 0x140066aba
lea rdx, [0x14014e54c]
lea rcx, [rsp + 0x2b28]
call fcn.140003570
nop
lea rdx, [rsp + 0x2b28]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x106], al
lea rcx, [rsp + 0x2b28]
call fcn.140003860
movzx eax, byte [rsp + 0x106]
test eax, eax
je 0x140066ab8
lea rcx, [rsp + 0x4da8]
call fcn.14003d030
jmp 0x14007956d
jmp 0x140066b15
lea rdx, [0x14014e624]
lea rcx, [rsp + 0x2b48]
call fcn.140003570
nop
lea rdx, [rsp + 0x2b48]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xd0], al
lea rcx, [rsp + 0x2b48]
call fcn.140003860
movzx eax, byte [rsp + 0xd0]
test eax, eax
je 0x140066b15
lea rcx, [rsp + 0x4da8]
call fcn.14003d030
jmp 0x14007956d
lea rcx, [rsp + 0x4da8]
call fcn.14003d030
mov rcx, qword [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov byte [rax + 0x45], 0
lea rdx, [0x14014e6d8]
lea rcx, [rsp + 0x2b68]
call fcn.140003570
nop
lea rdx, [rsp + 0x2b68]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xd1], al
lea rcx, [rsp + 0x2b68]
call fcn.140003860
movzx eax, byte [rsp + 0xd1]
test eax, eax
je 0x140066bc6
mov eax, dword [rsp + 0x1c4]
inc eax
mov dword [rsp + 0x1c4], eax
mov r9d, dword [rsp + 0x41e0]
lea r8, [rsp + 0x5720]
mov edx, dword [rsp + 0x1c4]
lea rcx, str._nProcess__03d:__s__PID:__d_
call fcn.1400c83f0
jmp 0x140066bf3
mov edx, 0xa
lea rcx, [0x14014e7e0]
call fcn.14004d7e0
mov r8d, dword [rsp + 0x41e0]
lea rdx, [rsp + 0x5720]
lea rcx, str._nAnalyzing:_Process:__s__PID:__d_
call fcn.1400c83f0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x46
mov qword [rsp + 0xcb0], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x8e8], eax
mov r8, qword [rsp + 0xcb0]
mov edx, dword [rsp + 0x8e8]
lea rcx, [rsp + 0x2ef8]
call fcn.1400c8740
mov qword [rsp + 0xcb8], rax
mov rax, qword [rsp + 0xcb8]
mov qword [rsp + 0xcc0], rax
mov rax, qword [rsp + 0xcc0]
mov qword [rsp + 0xcc8], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov rdx, qword [rsp + 0xcc8]
mov rcx, rax
call fcn.14003ec60
nop
lea rcx, [rsp + 0x2ef8]
call fcn.14003d0d0
mov dword [0x1401d19f4], 0
lea rdx, [0x140144175]
lea rcx, [0x1401d7788]
call fcn.140003940
lea rcx, [rsp + 0x4f00]
call fcn.1400035d0
nop
lea rdx, [0x140144176]
lea rcx, [0x1401d7320]
call fcn.140003940
lea rdx, str._div_class_detect___table_
lea rcx, [0x1401d7aa0]
call fcn.140003940
mov dword [0x1401d6a20], 0
mov dword [0x1401d6a24], 0
mov eax, dword [rsp + 0x4b2c]
mov dword [rsp + 0xac], eax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d6f88]
call fcn.1400418a0
mov rax, qword [rax]
mov qword [rsp + 0x4fe0], rax
lea rdx, [rsp + 0x4b2c]
lea rcx, [0x1401d6f88]
call fcn.1400418a0
mov rax, qword [rax]
mov qword [rsp + 0x5140], rax
lea rdx, [rsp + 0x5140]
lea rcx, [rsp + 0x4fe0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 0xffffffff
jne 0x140066d6e
mov dword [rsp + 0xac], 0xffffffff
mov r8d, dword [rsp + 0x41e0]
xor edx, edx
mov ecx, 0x100410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x41e8], rax
cmp qword [rsp + 0x41e8], 0
jne 0x140067df2
movzx eax, word [0x14014e9bc]
mov word [rsp + 0x5d40], ax
lea rax, [rsp + 0x5d42]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x2a8], 0
movzx eax, word [0x14014ea00]
mov word [rsp + 0x5a30], ax
lea rax, [rsp + 0x5a32]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x13c], 0
lea rax, [rsp + 0x6580]
mov rdi, rax
xor eax, eax
mov ecx, 0xfffe
rep stosb byte [rdi], al
mov dword [rsp + 0x4c80], 0x7fff
lea rdx, [0x140144177]
lea rcx, [rsp + 0x5160]
call fcn.140003570
nop
mov r8d, dword [rsp + 0x41e0]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x930], rax
lea r9, [rsp + 0x4c80]
lea r8, [rsp + 0x6580]
xor edx, edx
mov rcx, qword [rsp + 0x930]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140066ed7
lea rax, [rsp + 0x36e8]
mov qword [rsp + 0xce0], rax
lea rdx, [rsp + 0x6580]
mov rcx, qword [rsp + 0xce0]
call fcn.140005fd0
mov qword [rsp + 0xce8], rax
mov rdx, qword [rsp + 0xce8]
lea rcx, [rsp + 0x3120]
call fcn.140003b30
mov qword [rsp + 0xcf0], rax
mov rdx, qword [rsp + 0xcf0]
lea rcx, [rsp + 0x5160]
call fcn.14003e660
lea rcx, [rsp + 0x3120]
call fcn.140003860
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d6f88]
call fcn.1400418a0
mov rax, qword [rax]
mov qword [rsp + 0x4ad0], rax
lea rdx, [rsp + 0x4c60]
lea rcx, [rsp + 0x4ad0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x1400670c6
movzx eax, word [rsp + 0x4c6e]
movzx ecx, word [rsp + 0x4c6c]
movzx edx, word [rsp + 0x4c6a]
movzx edi, word [rsp + 0x4c68]
movzx esi, word [rsp + 0x4c66]
movzx r8d, word [rsp + 0x4c62]
movzx r9d, word [rsp + 0x4c60]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r8d
lea r8, [0x14014eaf0]
mov edx, 0x104
lea rcx, [rsp + 0x5a30]
call fcn.14009e3e0
mov dword [rsp + 0xa10], eax
mov eax, dword [rsp + 0x4ad0]
mov dword [rsp + 0x980], eax
mov eax, dword [rsp + 0x4ad4]
mov dword [rsp + 0x984], eax
lea rdx, [0x14014eba0]
lea rcx, [rsp + 0x5720]
call fcn.14010e378
test eax, eax
jne 0x140066fd0
mov rax, qword [rsp + 0x980]
mov qword [rsp + 0x4b70], rax
jmp 0x1400670c6
mov eax, dword [rsp + 0x4ad4]
shl rax, 0x20
mov ecx, dword [rsp + 0x4ad0]
add rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x4b70]
mov rcx, qword [rsp + 0x198]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x198], rax
cmp qword [rsp + 0x198], 0
jge 0x140067032
mov dword [rsp + 0x13c], 1
imul rax, qword [rsp + 0x198], 0xffffffffffffffff
mov qword [rsp + 0x198], rax
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x198]
and rcx, rax
mov rax, rcx
mov dword [rsp + 0x4cd8], eax
mov rax, qword [rsp + 0x198]
sar rax, 0x20
mov dword [rsp + 0x4cdc], eax
lea rdx, [rsp + 0x4e90]
lea rcx, [rsp + 0x4cd8]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [rsp + 0x4e9e]
movzx ecx, word [rsp + 0x4e9c]
movzx edx, word [rsp + 0x4e9a]
movzx edi, word [rsp + 0x4e98]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0x2a8]
lea r8, [0x14014ebd0]
mov edx, 0x104
lea rcx, [rsp + 0x5d40]
call fcn.14009e3e0
lea rdx, [0x14014ec04]
lea rcx, [rsp + 0x2b88]
call fcn.140003570
nop
lea rdx, [rsp + 0x2b88]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140067103
mov dword [rsp + 0x210], 1
jmp 0x14006710e
mov dword [rsp + 0x210], 0
movzx eax, byte [rsp + 0x210]
mov byte [rsp + 0xd2], al
lea rcx, [rsp + 0x2b88]
call fcn.140003860
movzx eax, byte [rsp + 0xd2]
test eax, eax
je 0x140067373
mov edx, 0xa
lea rcx, [0x14014ec10]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, [0x14014ec98]
call fcn.14004d7e0
lea rdx, [rsp + 0x5720]
lea rcx, [0x14014ecb8]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, [0x14014eccc]
call fcn.14004d7e0
mov edx, dword [rsp + 0x41e0]
lea rcx, [0x14014ecdc]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, [0x14014ecf0]
call fcn.14004d7e0
cmp dword [rsp + 0xac], 0xffffffff
jne 0x1400671d5
mov edx, 0xa
lea rcx, [0x14014ed00]
call fcn.14004d7e0
lea rdx, [0x14014ed08]
lea rcx, [0x14014ed20]
call fcn.14000ad70
jmp 0x1400671f9
mov edx, 0xa
lea rcx, [0x14014ed28]
call fcn.14004d7e0
mov edx, dword [rsp + 0xac]
lea rcx, [0x14014ed30]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, [0x14014ed38]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, [0x14014ed40]
call fcn.14004d7e0
mov dword [rsp + 0x134], 0
jmp 0x140067238
mov eax, dword [rsp + 0x134]
inc eax
mov dword [rsp + 0x134], eax
movsxd rax, dword [rsp + 0x134]
mov qword [rsp + 0xcf8], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov rcx, rax
call fcn.1400c32e0
mov rcx, qword [rsp + 0xcf8]
cmp rcx, rax
jae 0x1400672c1
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov qword [rsp + 0xd00], rax
movsxd rax, dword [rsp + 0x134]
mov rdx, rax
mov rcx, qword [rsp + 0xd00]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014ed4c]
call fcn.14000ad70
jmp 0x140067228
mov edx, 0xa
lea rcx, str._nEXE_Path:
call fcn.14004d7e0
lea rdx, [rsp + 0x6580]
lea rcx, [0x14014ed64]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, [0x14014ed70]
call fcn.14004d7e0
lea rdx, [rsp + 0x5a30]
lea rcx, [0x14014ed80]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, [0x14014ed88]
call fcn.14004d7e0
cmp dword [rsp + 0x13c], 0
je 0x140067332
lea rcx, [0x14014ed98]
call fcn.14000ad70
lea rdx, [rsp + 0x5d40]
lea rcx, [0x14014ed9c]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, str._nHASH_SHA1:
call fcn.14004d7e0
lea rcx, [rsp + 0x5160]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014edc0]
call fcn.14000ad70
lea rdx, [0x14014eddc]
lea rcx, [rsp + 0x2ba8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2ba8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xd3], al
lea rcx, [rsp + 0x2ba8]
call fcn.140003860
movzx eax, byte [rsp + 0xd3]
test eax, eax
je 0x140067db5
movsxd rax, dword [0x1401d6a24]
imul rax, rax, 0x20
lea rcx, [0x1401d7220]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd08], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x20
mov rdx, qword [rsp + 0xd08]
mov rcx, rax
call fcn.14003e6e0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
lea rdx, [rsp + 0x5720]
mov rcx, rax
call fcn.1400097c0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov ecx, dword [rsp + 0xac]
mov dword [rax + 0x40], ecx
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov byte [rax + 0x44], 0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov byte [rax + 0x45], 0
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
lea rdx, [rsp + 0x5720]
lea rcx, [0x1401d2a20]
call fcn.140112e20
cmp dword [rsp + 0xac], 0xffffffff
jne 0x14006759e
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x2ac], eax
lea rcx, [0x1401d7470]
call fcn.1400b3ed0
mov qword [rsp + 0xd10], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x2b0], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0xd18], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd20], rax
lea rax, [0x14014ede0]
mov qword [rsp + 0x40], rax
lea rax, [0x14014edf8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x2ac]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x5720]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd10]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x2b0]
lea r8, str._n_div_class_main__id_d__div_class_processName___sPROCESS_NAME:__S__PID:__d____font___a_href__s__PPID:__s__a____div__br__n_table_class_process_table__
mov rdx, qword [rsp + 0xd18]
mov rcx, qword [rsp + 0xd20]
call fcn.1400c8230
mov dword [rsp + 0x2b4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2b8], eax
mov eax, dword [rsp + 0x2b4]
mov ecx, dword [rsp + 0x2b8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140067689
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x2bc], eax
lea rcx, [0x1401d7470]
call fcn.1400b3ed0
mov qword [rsp + 0xd28], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x2c0], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0xd30], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd38], rax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x2bc]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x5720]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xd28]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x2c0]
lea r8, str._n_div_class_main__id_d__div_class_processName___sPROCESS_NAME:__S__PID:__d____font___a_href__d__PPID:__d__a____div__br__n_table_class_process_table__
mov rdx, qword [rsp + 0xd30]
mov rcx, qword [rsp + 0xd38]
call fcn.1400c8230
mov dword [rsp + 0x2c4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2c8], eax
mov eax, dword [rsp + 0x2c4]
mov ecx, dword [rsp + 0x2c8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, [0x14014ef60]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2cc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2d0], eax
mov eax, dword [rsp + 0x2cc]
mov ecx, dword [rsp + 0x2d0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov dword [rsp + 0x138], 0
jmp 0x140067713
mov eax, dword [rsp + 0x138]
inc eax
mov dword [rsp + 0x138], eax
movsxd rax, dword [rsp + 0x138]
mov qword [rsp + 0xd40], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov rcx, rax
call fcn.1400c32e0
mov rcx, qword [rsp + 0xd40]
cmp rcx, rax
jae 0x140067819
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov qword [rsp + 0xd48], rax
movsxd rax, dword [rsp + 0x138]
mov rdx, rax
mov rcx, qword [rsp + 0xd48]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0xd50], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0xd58], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd60], rax
mov r9, qword [rsp + 0xd50]
lea r8, str._n_t_s_br_
mov rdx, qword [rsp + 0xd58]
mov rcx, qword [rsp + 0xd60]
call fcn.1400c8230
mov dword [rsp + 0x2d4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2d8], eax
mov eax, dword [rsp + 0x2d4]
mov ecx, dword [rsp + 0x2d8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140067703
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x14014ef90]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2dc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2e0], eax
mov eax, dword [rsp + 0x2dc]
mov ecx, dword [rsp + 0x2e0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x6580]
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sEXE_Path:_s__S__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2e4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2e8], eax
mov eax, dword [rsp + 0x2e4]
mov ecx, dword [rsp + 0x2e8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x5a30]
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, [0x14014efc0]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2ec], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2f0], eax
mov eax, dword [rsp + 0x2ec]
mov ecx, dword [rsp + 0x2f0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, [0x14014efe0]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2f4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x2f8], eax
mov eax, dword [rsp + 0x2f4]
mov ecx, dword [rsp + 0x2f8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
cmp dword [rsp + 0x13c], 0
je 0x140067a38
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x14014eff4]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x2fc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x300], eax
mov eax, dword [rsp + 0x2fc]
mov ecx, dword [rsp + 0x300]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x5d40]
lea r8, [0x14014eff8]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x304], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x308], eax
mov eax, dword [rsp + 0x304]
mov ecx, dword [rsp + 0x308]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5160]
call fcn.1400b3ed0
mov qword [rsp + 0xd68], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0xd70], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd78], rax
mov rax, qword [rsp + 0xd68]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSHA1:_s__s__td___tr___table___div_
mov rdx, qword [rsp + 0xd70]
mov rcx, qword [rsp + 0xd78]
call fcn.1400c8230
mov dword [rsp + 0x30c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x310], eax
mov eax, dword [rsp + 0x30c]
mov ecx, dword [rsp + 0x310]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [0x1401d7940]
call fcn.14000f800
mov dword [0x1401d19fc], 0
cmp dword [rsp + 0xac], 0xffffffff
jne 0x140067c0a
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x5a30]
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x6580]
mov qword [rsp + 0x30], rdx
lea rdx, [0x14014f030]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0x41e0]
mov dword [rsp + 0x20], edx
lea r9, [rsp + 0x5720]
lea r8, str._n_S_t_t_d_t_s_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_S_t_t_t_S_t
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x314], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x318], eax
mov eax, dword [rsp + 0x314]
mov ecx, dword [rsp + 0x318]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140067c9c
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x5a30]
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x6580]
mov qword [rsp + 0x30], rdx
mov edx, dword [rsp + 0xac]
mov dword [rsp + 0x28], edx
mov edx, dword [rsp + 0x41e0]
mov dword [rsp + 0x20], edx
lea r9, [rsp + 0x5720]
lea r8, str._n_S_t_t_d_t_d_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_t_S_t_t_t_S_t
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x31c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x320], eax
mov eax, dword [rsp + 0x31c]
mov ecx, dword [rsp + 0x320]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
cmp dword [rsp + 0x13c], 0
je 0x140067d00
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
lea r8, [0x14014f0a4]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x324], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x328], eax
mov eax, dword [rsp + 0x324]
mov ecx, dword [rsp + 0x328]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5160]
call fcn.1400b3ed0
mov qword [rsp + 0xd80], rax
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0xd88], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d1a00]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xd90], rax
mov rax, qword [rsp + 0xd80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5d40]
lea r8, str._S_t_t_t_t_t_s_t_t_t_t_t_t_t_t
mov rdx, qword [rsp + 0xd88]
mov rcx, qword [rsp + 0xd90]
call fcn.1400c8230
mov dword [rsp + 0x32c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x330], eax
mov eax, dword [rsp + 0x32c]
mov ecx, dword [rsp + 0x330]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d77d0]
call fcn.14000f800
mov rcx, qword [rsp + 0x930]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x5160]
call fcn.140003860
nop
lea rcx, [rsp + 0x4f00]
call fcn.140003860
jmp 0x14007956d
lea rax, [rsp + 0x43a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x2e8
rep stosb byte [rdi], al
mov qword [rsp + 0x8d8], 0
mov rcx, qword [rsp + 0x41e8]
call fcn.140065530
mov qword [rsp + 0x8d8], rax
cmp qword [rsp + 0x8d8], 0
jne 0x140067e44
lea rcx, [rsp + 0x4f00]
call fcn.140003860
jmp 0x14007956d
mov qword [rsp + 0x20], 0
mov r9d, 0x2e8
lea r8, [rsp + 0x43a0]
mov rdx, qword [rsp + 0x8d8]
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140067e87
lea rcx, [rsp + 0x4f00]
call fcn.140003860
jmp 0x14007956d
mov rax, qword [rsp + 0x43b0]
mov qword [rsp + 0x4b18], rax
lea r9, [rsp + 0x4fe8]
mov r8d, 8
lea rdx, [rsp + 0x4240]
mov rcx, qword [rsp + 0x41e8]
call sub.KERNEL32.dll_K32EnumProcessModules
mov byte [rsp + 0x80], 0
mov byte [rsp + 0x79], 0
mov rax, qword [rsp + 0x4240]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x4ab0], rax
mov rax, qword [rsp + 0x158]
cmp qword [rsp + 0x4b18], rax
je 0x140067f37
movabs rax, 0xcccccccccccccccc
cmp qword [rsp + 0x158], rax
je 0x140067f18
cmp qword [rsp + 0x158], 0
jne 0x140067f2f
mov rax, qword [rsp + 0x4b18]
mov qword [rsp + 0x4ab0], rax
mov byte [rsp + 0x79], 1
jmp 0x140067f37
mov byte [rsp + 0x80], 1
lea rcx, [0x1401d7050]
call fcn.1400b6920
lea rcx, [rsp + 0x3340]
call fcn.140005e80
lea rcx, [rsp + 0x2a90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x2a90]
lea rcx, [0x1401d7050]
call fcn.14003e8e0
lea rcx, [0x1401d7310]
call fcn.1400b69c0
lea rcx, [rsp + 0x3350]
call fcn.140005e80
lea rcx, [rsp + 0x2a40]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x2a40]
lea rcx, [0x1401d7310]
call fcn.14003e930
mov dword [0x1401d19f0], 0
lea rdx, [0x1401d19f0]
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov dword [rsp + 0x110], 0
mov qword [rsp + 0x1b0], 0
mov qword [rsp + 0x4bf0], 0
mov qword [rsp + 0x1e8], 0
lea rax, [rsp + 0x4248]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov edx, 0x18
lea rcx, [rsp + 0x4c88]
call fcn.1400079b0
lea rcx, [rsp + 0x4c88]
call fcn.140034230
nop
movabs rax, 0x7fffffffffff
cmp qword [rsp + 0x1b0], rax
ja 0x14006829f
cmp dword [rsp + 0x110], 0
jne 0x14006829f
lea rax, [rsp + 0x3450]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x4248]
lea rcx, [rsp + 0x3450]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x1401d6f80]
mov qword [rsp + 0xda0], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x4248]
xor r8d, r8d
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x41e8]
call qword [rsp + 0xda0]
mov dword [rsp + 0x110], eax
mov rax, qword [rsp + 0x4250]
mov qword [rsp + 0x4bf0], rax
cmp dword [rsp + 0x4268], 0x10000
je 0x140068201
lea rdx, [rsp + 0x4bf0]
lea rcx, [rsp + 0x4c88]
call fcn.1400c1a80
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x4250]
cmp qword [rsp + 0x4bf0], rax
jne 0x1400681ef
mov rax, qword [rsp + 0x4260]
mov rcx, qword [rsp + 0x1e8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1e8], rax
lea rax, [rsp + 0x3420]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x4248]
lea rcx, [rsp + 0x3420]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x1401d6f80]
mov qword [rsp + 0xda8], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x4248]
xor r8d, r8d
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x41e8]
call qword [rsp + 0xda8]
mov dword [rsp + 0x110], eax
cmp dword [rsp + 0x110], 0
jne 0x1400681e8
cmp qword [rsp + 0x4bf0], 0
jne 0x1400681ea
jmp 0x1400681ef
jmp 0x140068124
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x1b0], rax
jmp 0x14006821f
mov rax, qword [rsp + 0x4260]
mov rcx, qword [rsp + 0x1b0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x3498]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x4248]
lea rcx, [rsp + 0x3498]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x1401d6f80]
mov qword [rsp + 0xdb0], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x4248]
xor r8d, r8d
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x41e8]
call qword [rsp + 0xdb0]
mov dword [rsp + 0x110], eax
jmp 0x14006803d
cmp dword [rsp + 0xc8], 4
jle 0x140068783
mov qword [rsp + 0x2ac0], 0
lea rcx, [rsp + 0x4c88]
call fcn.1400c3350
movsxd rcx, dword [rsp + 0xc8]
xor edx, edx
div rcx
mov dword [rsp + 0x214], eax
mov edx, 0x18
lea rcx, [rsp + 0x4fa0]
call fcn.1400079b0
lea rcx, [rsp + 0x1a0]
call fcn.140003030
movsxd rcx, dword [rsp + 0xc8]
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x4fa0]
call fcn.140034600
nop
mov edx, 0x18
lea rcx, [rsp + 0x4c40]
call fcn.1400079b0
lea rcx, [rsp + 0x194]
call fcn.140003030
movsxd rcx, dword [rsp + 0xc8]
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x4c40]
call fcn.140034600
mov dword [rsp + 0xa8], 0
jmp 0x14006836c
mov eax, dword [rsp + 0xa8]
inc eax
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0xa8], eax
jge 0x14006859c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0xdb8], rax
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rcx, qword [rsp + 0xdb8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0xdc0], rax
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdc0]
mov qword [rax], rcx
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x334], eax
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rax, qword [rax]
mov ecx, dword [rsp + 0x334]
mov dword [rax + 8], ecx
mov eax, dword [rsp + 0x214]
imul eax, dword [rsp + 0xa8]
cdqe
mov rdx, rax
lea rcx, [rsp + 0x4c88]
call fcn.140041ce0
mov rax, qword [rax]
mov qword [rsp + 0xdc8], rax
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdc8]
mov qword [rax + 0x10], rcx
mov eax, dword [rsp + 0xa8]
inc eax
cmp eax, dword [rsp + 0xc8]
jge 0x1400684ee
mov eax, dword [rsp + 0xa8]
inc eax
mov ecx, dword [rsp + 0x214]
imul ecx, eax
mov eax, ecx
cdqe
mov rdx, rax
lea rcx, [rsp + 0x4c88]
call fcn.140041ce0
mov rax, qword [rax]
mov qword [rsp + 0xdd0], rax
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rax, qword [rax]
mov rcx, qword [rsp + 0xdd0]
mov qword [rax + 0x18], rcx
jmp 0x140068517
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rax, qword [rax]
movabs rcx, 0x7fffffffffff
mov qword [rax + 0x18], rcx
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rdx, rax
lea rcx, [rsp + 0x2ac8]
call fcn.14002e060
mov rcx, rax
call fcn.140008ce0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rax]
lea r8, [0x14009b310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xdd8], rax
movsxd rax, dword [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x4fa0]
call fcn.140041ce0
mov rcx, qword [rsp + 0xdd8]
mov qword [rax], rcx
jmp 0x14006835c
mov dword [rsp + 0x4b28], 0
lea rdx, [rsp + 0x4b28]
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x4b28], 0x103
je 0x1400685f9
xor edx, edx
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x338], eax
cmp dword [rsp + 0x338], 0x102
jne 0x1400685f9
mov dword [rsp + 0x4b28], 0x103
cmp dword [rsp + 0x4b28], 0x103
jne 0x14006865b
mov dword [rsp + 0x140], 0
jmp 0x140068623
mov eax, dword [rsp + 0x140]
inc eax
mov dword [rsp + 0x140], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x140], eax
jge 0x14006865b
movsxd rax, dword [rsp + 0x140]
mov rdx, rax
lea rcx, [rsp + 0x4fa0]
call fcn.140041ce0
mov edx, 0x1d4c0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140068613
mov dword [rsp + 0x114], 0
jmp 0x140068678
mov eax, dword [rsp + 0x114]
inc eax
mov dword [rsp + 0x114], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x114], eax
jge 0x1400686c9
movsxd rax, dword [rsp + 0x114]
mov rdx, rax
lea rcx, [rsp + 0x4fa0]
call fcn.140041ce0
cmp qword [rax], 0
je 0x1400686c7
movsxd rax, dword [rsp + 0x114]
mov rdx, rax
lea rcx, [rsp + 0x4fa0]
call fcn.140041ce0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140068668
mov dword [rsp + 0x118], 0
jmp 0x1400686e6
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x118], eax
jge 0x140068763
movsxd rax, dword [rsp + 0x118]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov rax, qword [rax]
mov qword [rsp + 0xde0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xde8], rax
mov r8, qword [rsp + 0xde0]
xor edx, edx
mov rcx, qword [rsp + 0xde8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movsxd rax, dword [rsp + 0x118]
mov rdx, rax
lea rcx, [rsp + 0x4c40]
call fcn.140041ce0
mov qword [rax], 0
jmp 0x1400686d6
lea rcx, [rsp + 0x4c40]
call fcn.14003d090
nop
lea rcx, [rsp + 0x4fa0]
call fcn.14003d090
jmp 0x140068cf5
lea rcx, [rsp + 0x4c88]
call fcn.1400c3350
xor edx, edx
mov ecx, 4
div rcx
mov qword [rsp + 0x8e0], rax
mov rdx, qword [rsp + 0x8e0]
lea rcx, [rsp + 0x4c88]
call fcn.140041ce0
mov rax, qword [rax]
mov qword [rsp + 0x938], rax
mov rax, qword [rsp + 0x8e0]
shl rax, 1
mov rdx, rax
lea rcx, [rsp + 0x4c88]
call fcn.140041ce0
mov rax, qword [rax]
mov qword [rsp + 0x940], rax
imul rax, qword [rsp + 0x8e0], 3
mov rdx, rax
lea rcx, [rsp + 0x4c88]
call fcn.140041ce0
mov rax, qword [rax]
mov qword [rsp + 0x948], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x4218], rax
mov rax, qword [rsp + 0x4218]
mov rcx, qword [rsp + 0x41e8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x4218]
mov ecx, dword [rsp + 0x41e0]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x4218]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x4218]
mov rcx, qword [rsp + 0x938]
mov qword [rax + 0x18], rcx
lea rdx, [rsp + 0x4218]
lea rcx, [rsp + 0x2ad0]
call fcn.14002e060
mov rcx, rax
call fcn.140008ce0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rax]
lea r8, [0x14009b310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 0
mov qword [rsp + rcx + 0x5690], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x4210], rax
mov rax, qword [rsp + 0x4210]
mov rcx, qword [rsp + 0x41e8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x4210]
mov ecx, dword [rsp + 0x41e0]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x4210]
mov rcx, qword [rsp + 0x938]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x4210]
mov rcx, qword [rsp + 0x940]
mov qword [rax + 0x18], rcx
lea rdx, [rsp + 0x4210]
lea rcx, [rsp + 0x2ad8]
call fcn.14002e060
mov rcx, rax
call fcn.140008ce0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rax]
lea r8, [0x14009b310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 1
mov qword [rsp + rcx + 0x5690], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x4208], rax
mov rax, qword [rsp + 0x4208]
mov rcx, qword [rsp + 0x41e8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x4208]
mov ecx, dword [rsp + 0x41e0]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x4208]
mov rcx, qword [rsp + 0x940]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x4208]
mov rcx, qword [rsp + 0x948]
mov qword [rax + 0x18], rcx
lea rdx, [rsp + 0x4208]
lea rcx, [rsp + 0x2ae0]
call fcn.14002e060
mov rcx, rax
call fcn.140008ce0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rax]
lea r8, [0x14009b310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 2
mov qword [rsp + rcx + 0x5690], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x20
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x4200], rax
mov rax, qword [rsp + 0x4200]
mov rcx, qword [rsp + 0x41e8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x4200]
mov ecx, dword [rsp + 0x41e0]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x4200]
mov rcx, qword [rsp + 0x948]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x4200]
movabs rcx, 0x7fffffffffff
mov qword [rax + 0x18], rcx
lea rdx, [rsp + 0x4200]
lea rcx, [rsp + 0x2848]
call fcn.14002e060
mov rcx, rax
call fcn.140008ce0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rax]
lea r8, [0x14009b310]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 8
imul rcx, rcx, 3
mov qword [rsp + rcx + 0x5690], rax
mov dword [rsp + 0x4b24], 0
lea rdx, [rsp + 0x4b24]
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rsp + 0x4b24], 0x103
je 0x140068b6f
xor edx, edx
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x33c], eax
cmp dword [rsp + 0x33c], 0x102
jne 0x140068b6f
mov dword [rsp + 0x4b24], 0x103
cmp dword [rsp + 0x4b24], 0x103
jne 0x140068b9b
mov r9d, 0x1d4c0
mov r8d, 1
lea rdx, [rsp + 0x5690]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rsp + 0x11c], 0
jmp 0x140068bb8
mov eax, dword [rsp + 0x11c]
inc eax
mov dword [rsp + 0x11c], eax
cmp dword [rsp + 0x11c], 4
jge 0x140068bed
movsxd rax, dword [rsp + 0x11c]
cmp qword [rsp + rax*8 + 0x5690], 0
je 0x140068beb
movsxd rax, dword [rsp + 0x11c]
mov rcx, qword [rsp + rax*8 + 0x5690]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140068ba8
mov rax, qword [rsp + 0x4218]
mov qword [rsp + 0xdf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xdf8], rax
mov r8, qword [rsp + 0xdf0]
xor edx, edx
mov rcx, qword [rsp + 0xdf8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x4218], 0
mov rax, qword [rsp + 0x4210]
mov qword [rsp + 0xe00], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xe08], rax
mov r8, qword [rsp + 0xe00]
xor edx, edx
mov rcx, qword [rsp + 0xe08]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x4210], 0
mov rax, qword [rsp + 0x4208]
mov qword [rsp + 0xe10], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xe18], rax
mov r8, qword [rsp + 0xe10]
xor edx, edx
mov rcx, qword [rsp + 0xe18]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x4208], 0
mov rax, qword [rsp + 0x4200]
mov qword [rsp + 0xe20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xe28], rax
mov r8, qword [rsp + 0xe20]
xor edx, edx
mov rcx, qword [rsp + 0xe28]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x4200], 0
mov r8d, dword [rsp + 0x41e0]
mov rdx, qword [rsp + 0x41e8]
lea rcx, [rsp + 0x43a0]
call fcn.14005a220
mov r8d, dword [rsp + 0x41e0]
mov rdx, qword [rsp + 0x41e8]
lea rcx, [rsp + 0x43a0]
call fcn.140057590
cmp dword [0x1401d19f0], 0
je 0x140068df8
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov byte [rax + 0x45], 1
mov qword [rsp + 0x4c58], 0
lea rcx, [0x14014f110]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x14014f0f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xe30], rax
mov rax, qword [rsp + 0xe30]
mov qword [rsp + 0xe38], rax
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x4c58]
mov edx, 0x1a
mov rcx, qword [rsp + 0x41e8]
call qword [rsp + 0xe38]
mov r8d, dword [rsp + 0x41e0]
mov rdx, qword [rsp + 0x41e8]
mov ecx, dword [rsp + 0x4c58]
call fcn.140055e10
mov r8d, dword [rsp + 0x41e0]
mov rdx, qword [rsp + 0x41e8]
mov ecx, dword [rsp + 0x4c58]
call fcn.140052e90
mov rax, qword [rsp + 0x4ab0]
mov qword [rsp + 0xe40], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov rcx, qword [rsp + 0xe40]
mov qword [rax + 0x70], rcx
mov edx, 8
lea rcx, [rsp + 0x4aa0]
call fcn.1400079b0
lea r8, [rsp + 0x4ab0]
lea rdx, [rsp + 0x4aa0]
lea rcx, [0x1401d7050]
call fcn.1400bc620
mov edx, 8
lea rcx, [rsp + 0x4ab8]
call fcn.1400079b0
lea r8, [rsp + 0x4ab0]
lea rdx, [rsp + 0x28d0]
lea rcx, [0x1401d7310]
call fcn.1400bc620
mov rax, qword [rax]
mov qword [rsp + 0x4ab8], rax
lea rdx, [rsp + 0x28d8]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400413f0
movzx eax, al
test eax, eax
je 0x140068f87
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x140068f87
lea r8, [rsp + 0x4b18]
lea rdx, [rsp + 0x28e0]
lea rcx, [0x1401d7050]
call fcn.1400bc620
mov rax, qword [rax]
mov qword [rsp + 0x4aa0], rax
lea r8, [rsp + 0x4b18]
lea rdx, [rsp + 0x28e8]
lea rcx, [0x1401d7310]
call fcn.1400bc620
mov rax, qword [rax]
mov qword [rsp + 0x4ab8], rax
lea rdx, [rsp + 0x28f0]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140068f87
mov rax, qword [rsp + 0x4b18]
mov qword [rsp + 0x4ab0], rax
mov rax, qword [rsp + 0x4ab0]
mov qword [rsp + 0xe48], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov rcx, qword [rsp + 0xe48]
mov qword [rax + 0x70], rcx
mov byte [rsp + 0x82], 0
lea rdx, [rsp + 0x28f8]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006908e
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x6c]
test eax, eax
jne 0x14006908e
mov edx, 8
lea rcx, [rsp + 0x4b98]
call fcn.1400079b0
lea rdx, [rsp + 0x4b98]
lea rcx, [0x1401d7050]
call fcn.1400b5ef0
jmp 0x140069017
xor r8d, r8d
lea rdx, [rsp + 0x2900]
lea rcx, [rsp + 0x4b98]
call fcn.1400421d0
lea rdx, [rsp + 0x2908]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b98]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006908e
lea rcx, [rsp + 0x4b98]
call fcn.140042060
add rax, 0x30
lea rdx, [0x14014f11c]
mov rcx, rax
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x140069089
movzx eax, byte [rsp + 0x82]
test eax, eax
jne 0x140069089
lea rcx, [rsp + 0x4b98]
call fcn.14005c2c0
mov byte [rsp + 0x82], al
jmp 0x140068fff
mov dword [rsp + 0xa20], 0
mov qword [rsp + 0x8f0], 0
lea rdx, [0x14014f120]
lea rcx, [rsp + 0x4bf8]
call fcn.140005fd0
nop
lea rdx, [0x14014f124]
lea rcx, [rsp + 0x5010]
call fcn.140005fd0
nop
mov byte [rsp + 0x91], 0
mov rax, qword [rsp + 0x43c0]
mov qword [rsp + 0x8f0], rax
mov rax, qword [rsp + 0x8f0]
add rax, 0x70
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [0x1401d6a30]
mov rdx, rax
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400692f2
mov edx, 0x18
lea rcx, [rsp + 0x4f88]
call fcn.1400079b0
lea rcx, [rsp + 0x193]
call fcn.140003030
mov qword [rsp + 0xe50], rax
mov byte [rsp + 0xd4], 0
movzx eax, word [0x1401d6a30]
mov qword [rsp + 0xe58], rax
mov r9, qword [rsp + 0xe50]
lea r8, [rsp + 0xd4]
mov rdx, qword [rsp + 0xe58]
lea rcx, [rsp + 0x4f88]
call fcn.140034380
nop
movzx eax, word [0x1401d6a30]
mov qword [rsp + 0xe60], rax
xor edx, edx
lea rcx, [rsp + 0x4f88]
call fcn.140041c50
mov qword [rsp + 0xe68], rax
mov rax, qword [0x1401d6a38]
mov qword [rsp + 0xe70], rax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0xe78], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xe60]
mov r8, qword [rsp + 0xe68]
mov rdx, qword [rsp + 0xe70]
mov rcx, qword [rsp + 0xe78]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, word [0x1401d6a30]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x218], eax
movsxd rax, dword [rsp + 0x218]
mov qword [rsp + 0xe80], rax
xor edx, edx
lea rcx, [rsp + 0x4f88]
call fcn.140041c50
mov rcx, qword [rsp + 0xe80]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x5550]
call fcn.140006030
nop
lea rdx, [rsp + 0x5550]
lea rcx, [rsp + 0x5010]
call fcn.140006550
xor edx, edx
lea rcx, [rsp + 0x4f88]
call fcn.140041c50
mov qword [rsp + 0x4238], rax
mov edx, dword [rsp + 0x218]
lea rcx, [rsp + 0x4238]
call fcn.14004dea0
mov byte [rsp + 0x91], al
lea rcx, [rsp + 0x2ee0]
call fcn.140034230
mov qword [rsp + 0xe90], rax
mov rax, qword [rsp + 0xe90]
mov qword [rsp + 0xe98], rax
lea rdx, [rsp + 0x4f88]
mov rcx, qword [rsp + 0xe98]
call fcn.1400c3850
lea rcx, [rsp + 0x2ee0]
call fcn.14003d030
nop
lea rcx, [rsp + 0x5550]
call fcn.140003890
nop
lea rcx, [rsp + 0x4f88]
call fcn.14003d030
mov rax, qword [rsp + 0x8f0]
add rax, 0x38
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [0x1401d6a40]
mov rdx, rax
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400694c8
mov edx, 0x18
lea rcx, [rsp + 0x5128]
call fcn.1400079b0
lea rcx, [rsp + 0x192]
call fcn.140003030
mov qword [rsp + 0xea0], rax
mov byte [rsp + 0xd5], 0
movzx eax, word [0x1401d6a40]
mov qword [rsp + 0xea8], rax
mov r9, qword [rsp + 0xea0]
lea r8, [rsp + 0xd5]
mov rdx, qword [rsp + 0xea8]
lea rcx, [rsp + 0x5128]
call fcn.140034380
nop
movzx eax, word [0x1401d6a40]
mov qword [rsp + 0xeb0], rax
xor edx, edx
lea rcx, [rsp + 0x5128]
call fcn.140041c50
mov qword [rsp + 0xeb8], rax
mov rax, qword [0x1401d6a48]
mov qword [rsp + 0xec0], rax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0xec8], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xeb0]
mov r8, qword [rsp + 0xeb8]
mov rdx, qword [rsp + 0xec0]
mov rcx, qword [rsp + 0xec8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, word [0x1401d6a40]
cdq
sub eax, edx
sar eax, 1
cdqe
mov qword [rsp + 0xed0], rax
xor edx, edx
lea rcx, [rsp + 0x5128]
call fcn.140041c50
mov qword [rsp + 0xed8], rax
mov r8, qword [rsp + 0xed0]
mov rdx, qword [rsp + 0xed8]
lea rcx, [rsp + 0x5530]
call fcn.140006030
nop
lea rdx, [rsp + 0x5530]
lea rcx, [rsp + 0x4bf8]
call fcn.140006550
lea rcx, [rsp + 0x2ec8]
call fcn.140034230
mov qword [rsp + 0xee0], rax
mov rax, qword [rsp + 0xee0]
mov qword [rsp + 0xee8], rax
lea rdx, [rsp + 0x5128]
mov rcx, qword [rsp + 0xee8]
call fcn.1400c3850
lea rcx, [rsp + 0x2ec8]
call fcn.14003d030
nop
lea rcx, [rsp + 0x5530]
call fcn.140003890
nop
lea rcx, [rsp + 0x5128]
call fcn.14003d030
mov edx, 0x18
lea rcx, [rsp + 0x4dd8]
call fcn.1400079b0
lea rcx, [rsp + 0x4dd8]
call fcn.140034230
nop
mov r8d, 5
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x268], rax
mov dword [rsp + 0x4b4c], 0
mov dword [rsp + 0x4b50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x4b50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4b4c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 3
mov r8d, 0x30
xor edx, edx
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
mov edx, 0x18
lea rcx, [rsp + 0x5148]
call fcn.1400079b0
lea rcx, [rsp + 0x191]
call fcn.140003030
mov qword [rsp + 0xef0], rax
mov eax, dword [rsp + 0x4b4c]
mov qword [rsp + 0xef8], rax
mov r8, qword [rsp + 0xef0]
mov rdx, qword [rsp + 0xef8]
lea rcx, [rsp + 0x5148]
call fcn.140034280
nop
lea rcx, [rsp + 0x5148]
call fcn.1400c3250
mov dword [rsp + 0x340], eax
lea rcx, [rsp + 0x5148]
call fcn.1400b3f80
mov qword [rsp + 0xf00], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x4b50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x4b4c]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xf00]
mov qword [rsp + 0x20], rax
mov r9d, 3
mov r8d, 0x30
xor edx, edx
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusExW]
lea rcx, [rsp + 0x5148]
call fcn.1400b3f80
mov qword [rsp + 0xf08], rax
mov dword [rsp + 0x144], 0
jmp 0x14006967e
mov eax, dword [rsp + 0x144]
inc eax
mov dword [rsp + 0x144], eax
mov eax, dword [rsp + 0x4b50]
cmp dword [rsp + 0x144], eax
jae 0x140069746
mov eax, dword [rsp + 0x144]
imul rax, rax, 0x38
lea rcx, [rsp + 0x4278]
mov rdx, qword [rsp + 0xf08]
mov rdi, rcx
lea rsi, [rdx + rax]
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x41e0]
cmp dword [rsp + 0x42a4], eax
jne 0x140069741
mov rdx, qword [rsp + 0x4278]
lea rcx, [rsp + 0x52c0]
call fcn.140005fd0
nop
lea rdx, [0x14014f128]
lea rcx, [rsp + 0x52c0]
call fcn.1400436a0
mov rdx, qword [rsp + 0x4280]
lea rcx, [rsp + 0x52c0]
call fcn.1400436a0
lea rdx, [0x14014f130]
lea rcx, [rsp + 0x52c0]
call fcn.1400436a0
lea rdx, [rsp + 0x52c0]
lea rcx, [rsp + 0x4dd8]
call fcn.1400c19f0
nop
lea rcx, [rsp + 0x52c0]
call fcn.140003890
jmp 0x14006966e
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [rsp + 0xbc], 0
mov edx, 0x18
lea rcx, [rsp + 0x4bc8]
call fcn.1400079b0
lea rcx, [rsp + 0x4bc8]
call fcn.140034230
nop
lea rcx, [rsp + 0x4cb8]
call fcn.1400035d0
nop
lea rcx, [rsp + 0x4ee0]
call fcn.1400035d0
nop
lea rcx, [rsp + 0x4ea0]
call fcn.1400035d0
nop
mov edx, 0x18
lea rcx, [rsp + 0x4ca0]
call fcn.1400079b0
lea rcx, [rsp + 0x4ca0]
call fcn.140034230
nop
lea rcx, [rsp + 0x4df0]
call fcn.1400035d0
nop
lea rcx, [rsp + 0x5030]
call fcn.1400035d0
nop
lea rcx, [rsp + 0x5050]
call fcn.1400035d0
nop
mov dword [rsp + 0x124], 0
xor eax, eax
mov word [rsp + 0x84], ax
xor eax, eax
mov word [rsp + 0x88], ax
mov dword [rsp + 0x344], 0
mov dword [rsp + 0xc4], 0
mov dword [rsp + 0xb0], 0
mov byte [rsp + 0x8c], 0
mov byte [rsp + 0x8d], 0
mov byte [rsp + 0x8e], 0
mov byte [rsp + 0x8f], 0
lea rdx, [0x14014f134]
lea rcx, [rsp + 0x4ff0]
call fcn.140005fd0
nop
movsd xmm0, qword [0x14015b178]
movsd qword [rsp + 0x2910], xmm0
lea rdx, [0x14014f138]
lea rcx, [rsp + 0x51e0]
call fcn.140005fd0
nop
lea rdx, [0x14014f13c]
lea rcx, [rsp + 0x5200]
call fcn.140005fd0
nop
lea rdx, [0x14014f140]
lea rcx, [rsp + 0x5180]
call fcn.140005fd0
nop
lea rdx, [0x14014419c]
lea rcx, [0x1401d77a8]
call fcn.140003940
lea rdx, [rsp + 0x2918]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140069ab3
mov byte [rsp + 0xbc], 1
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x168
mov rdx, rax
lea rcx, [rsp + 0x4bc8]
call fcn.14003ecf0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x1a0
mov rdx, rax
lea rcx, [rsp + 0x4cb8]
call fcn.14003e6e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x1c0
mov rdx, rax
lea rcx, [rsp + 0x4ee0]
call fcn.14003e6e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x1e0
mov rdx, rax
lea rcx, [rsp + 0x4ea0]
call fcn.14003e6e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov eax, dword [rax + 0x150]
mov dword [rsp + 0x124], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, word [rax + 0x154]
mov word [rsp + 0x84], ax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, word [rax + 0x156]
mov word [rsp + 0x88], ax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov eax, dword [rax + 0x15c]
mov dword [rsp + 0x344], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
mov rdx, rax
lea rcx, [rsp + 0x4ff0]
call fcn.140006550
lea rax, [rsp + 0x3708]
mov qword [rsp + 0xf10], rax
lea rdx, [rsp + 0x4ff0]
mov rcx, qword [rsp + 0xf10]
call fcn.140005f30
mov qword [rsp + 0xf18], rax
mov rdx, qword [rsp + 0xf18]
lea rcx, [rsp + 0x3100]
call fcn.140003b30
mov qword [rsp + 0xf20], rax
mov rdx, qword [rsp + 0xf20]
lea rcx, [rsp + 0x4f00]
call fcn.14003e660
lea rcx, [rsp + 0x3100]
call fcn.140003860
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x200
mov rdx, rax
lea rcx, [0x1401d77a8]
call fcn.14003e6e0
mov dword [rsp + 0xcc], 0xffffffff
lea rdx, [rsp + 0x2920]
lea rcx, [0x1401d7310]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ab8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140069c93
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x68
mov rdx, rax
lea rcx, [rsp + 0x4ca0]
call fcn.14003ecf0
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0xa0
mov rdx, rax
lea rcx, [rsp + 0x4df0]
call fcn.14003e6e0
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0xc0
mov rdx, rax
lea rcx, [rsp + 0x5030]
call fcn.14003e6e0
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0xe0
mov rdx, rax
lea rcx, [rsp + 0x5050]
call fcn.14003e6e0
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
mov eax, dword [rax + 0x30]
mov dword [rsp + 0xb0], eax
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
mov eax, dword [rax + 0x34]
mov dword [rsp + 0xc4], eax
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
mov eax, dword [rax + 0x60]
mov dword [rsp + 0xcc], eax
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x478
mov rdx, rax
lea rcx, [rsp + 0x51e0]
call fcn.140006550
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x498
mov rdx, rax
lea rcx, [rsp + 0x5200]
call fcn.140006550
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x4b8
mov rdx, rax
lea rcx, [rsp + 0x5180]
call fcn.140006550
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
cmp dword [rax + 0x60], 0
jne 0x140069c93
lea rcx, [rsp + 0x4ff0]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nGetProcessList__S
call fcn.14000ad70
lea rax, [rsp + 0x55b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x38
rep stosb byte [rdi], al
lea rcx, [rsp + 0x4ff0]
call fcn.140004b60
lea rdx, [rsp + 0x55b0]
mov rcx, rax
call fcn.1401194fc
mov eax, dword [rsp + 0x55c8]
mov dword [rsp + 0xcc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
cmp dword [rax + 0x150], 0
jne 0x140069cb1
mov byte [rsp + 0x8c], 1
movzx eax, word [rsp + 0x84]
test eax, eax
jne 0x140069cdb
movzx eax, word [rsp + 0x88]
test eax, eax
jne 0x140069cdb
cmp dword [rsp + 0xb0], 0
jne 0x140069cdb
mov byte [rsp + 0x8d], 1
cmp dword [rsp + 0xb0], 0
jne 0x140069cef
mov byte [rsp + 0x8f], 1
jmp 0x140069d07
mov eax, dword [rsp + 0xb0]
cmp dword [rsp + 0xc4], eax
je 0x140069d07
mov byte [rsp + 0x8e], 1
movzx eax, word [0x14014f174]
mov word [rsp + 0x5f50], ax
lea rax, [rsp + 0x5f52]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x14014f178]
mov word [rsp + 0x6160], ax
lea rax, [rsp + 0x6162]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x34c], 0
mov dword [rsp + 0x1d0], 0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d6f88]
call fcn.1400418a0
mov rax, qword [rax]
mov qword [rsp + 0x4ad0], rax
lea rdx, [rsp + 0x4c70]
lea rcx, [rsp + 0x4ad0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x140069f52
movzx eax, word [rsp + 0x4c7e]
movzx ecx, word [rsp + 0x4c7c]
movzx edx, word [rsp + 0x4c7a]
movzx edi, word [rsp + 0x4c78]
movzx esi, word [rsp + 0x4c76]
movzx r8d, word [rsp + 0x4c72]
movzx r9d, word [rsp + 0x4c70]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r8d
lea r8, [0x14014f180]
mov edx, 0x104
lea rcx, [rsp + 0x5f50]
call fcn.14009e3e0
mov dword [rsp + 0x348], eax
mov eax, dword [rsp + 0x4ad0]
mov dword [rsp + 0x958], eax
mov eax, dword [rsp + 0x4ad4]
mov dword [rsp + 0x95c], eax
lea rdx, str.System
lea rcx, [rsp + 0x5720]
call fcn.14010e378
test eax, eax
jne 0x140069e5c
mov rax, qword [rsp + 0x958]
mov qword [rsp + 0x4b70], rax
jmp 0x140069f52
mov eax, dword [rsp + 0x4ad4]
shl rax, 0x20
mov ecx, dword [rsp + 0x4ad0]
add rax, rcx
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x4b70]
mov rcx, qword [rsp + 0x1c8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c8], rax
cmp qword [rsp + 0x1c8], 0
jge 0x140069ebe
mov dword [rsp + 0x1d0], 1
imul rax, qword [rsp + 0x1c8], 0xffffffffffffffff
mov qword [rsp + 0x1c8], rax
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1c8]
and rcx, rax
mov rax, rcx
mov dword [rsp + 0x4ce0], eax
mov rax, qword [rsp + 0x1c8]
sar rax, 0x20
mov dword [rsp + 0x4ce4], eax
lea rdx, [rsp + 0x4e60]
lea rcx, [rsp + 0x4ce0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [rsp + 0x4e6e]
movzx ecx, word [rsp + 0x4e6c]
movzx edx, word [rsp + 0x4e6a]
movzx edi, word [rsp + 0x4e68]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0x34c]
lea r8, [0x14014f1d8]
mov edx, 0x104
lea rcx, [rsp + 0x6160]
call fcn.14009e3e0
mov qword [rsp + 0x4220], 0
mov dword [rsp + 0x4b7c], 1
mov dword [rsp + 0x4ba0], 1
lea rdx, [0x14014419d]
lea rcx, [rsp + 0x4e10]
call fcn.140003570
nop
lea rdx, [0x14014f20c]
lea rcx, [rsp + 0x4d78]
call fcn.140005fd0
nop
mov qword [rsp + 0x41f8], 0
mov qword [rsp + 0x4228], 0
lea rdx, [0x14014f210]
lea rcx, [rsp + 0x4c20]
call fcn.140005fd0
nop
lea rdx, [0x14014f214]
lea rcx, [rsp + 0x4d20]
call fcn.140005fd0
nop
lea r8, [rsp + 0x41f0]
mov edx, 8
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14006ae91
mov byte [rsp + 0x90], 1
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006a045
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14006a045
jmp 0x14006ae81
mov edx, 0x18
lea rcx, [rsp + 0x4f70]
call fcn.1400079b0
lea rcx, [rsp + 0x190]
call fcn.140003030
mov qword [rsp + 0xf28], rax
mov byte [rsp + 0xd6], 0
mov eax, dword [rsp + 0x4aa8]
mov qword [rsp + 0xf30], rax
mov r9, qword [rsp + 0xf28]
lea r8, [rsp + 0xd6]
mov rdx, qword [rsp + 0xf30]
lea rcx, [rsp + 0x4f70]
call fcn.140034380
nop
mov eax, dword [rsp + 0x4aa8]
mov dword [rsp + 0x350], eax
xor edx, edx
lea rcx, [rsp + 0x4f70]
call fcn.140041c50
mov qword [rsp + 0xf38], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0xf40], rax
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x350]
mov r8, qword [rsp + 0xf38]
mov edx, 1
mov rcx, qword [rsp + 0xf40]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006a1d7
xor edx, edx
lea rcx, [rsp + 0x4f70]
call fcn.140041c50
lea rdx, [rsp + 0x4220]
mov rcx, qword [rax]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
mov dword [rsp + 0x4b7c], 0x100
mov dword [rsp + 0x4ba0], 0x100
xor edx, edx
lea rcx, [rsp + 0x4f70]
call fcn.140041c50
lea rcx, [rsp + 0x4fd8]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x4ba0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x5c40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x4b7c]
lea r8, [rsp + 0x5930]
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
jne 0x14006a1d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
jne 0x14006a1c3
lea rdx, str.Account_owner_not_found_for_specified_SID.
lea rcx, [rsp + 0x5930]
call fcn.14010e840
jmp 0x14006a1d7
lea rdx, str.Error_in_LookupAccountSid.
lea rcx, [rsp + 0x5930]
call fcn.14010e840
lea rcx, [rsp + 0x2eb0]
call fcn.140034230
mov qword [rsp + 0xf48], rax
mov rax, qword [rsp + 0xf48]
mov qword [rsp + 0xf50], rax
lea rdx, [rsp + 0x4f70]
mov rcx, qword [rsp + 0xf50]
call fcn.1400c3850
lea rcx, [rsp + 0x2eb0]
call fcn.14003d030
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x11
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006a258
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14006a258
jmp 0x14006a392
mov edx, 0x18
lea rcx, [rsp + 0x5110]
call fcn.1400079b0
lea rcx, [rsp + 0x18f]
call fcn.140003030
mov qword [rsp + 0xf58], rax
mov byte [rsp + 0xd7], 0
mov eax, dword [rsp + 0x4aa8]
mov qword [rsp + 0xf60], rax
mov r9, qword [rsp + 0xf58]
lea r8, [rsp + 0xd7]
mov rdx, qword [rsp + 0xf60]
lea rcx, [rsp + 0x5110]
call fcn.140034380
mov eax, dword [rsp + 0x4aa8]
mov dword [rsp + 0x354], eax
xor edx, edx
lea rcx, [rsp + 0x5110]
call fcn.140041c50
mov qword [rsp + 0xf68], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0xf70], rax
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x354]
mov r8, qword [rsp + 0xf68]
mov edx, 0x11
mov rcx, qword [rsp + 0xf70]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006a33e
xor edx, edx
lea rcx, [rsp + 0x5110]
call fcn.140041c50
mov rax, qword [rax]
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x2e98]
call fcn.140034230
mov qword [rsp + 0xf78], rax
mov rax, qword [rsp + 0xf78]
mov qword [rsp + 0xf80], rax
lea rdx, [rsp + 0x5110]
mov rcx, qword [rsp + 0xf80]
call fcn.1400c3850
lea rcx, [rsp + 0x2e98]
call fcn.14003d030
lea rcx, [rsp + 0x5110]
call fcn.14003d030
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006a3cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14006a3cc
jmp 0x14006a5d8
mov edx, 0x18
lea rcx, [rsp + 0x50f8]
call fcn.1400079b0
lea rcx, [rsp + 0x18e]
call fcn.140003030
mov qword [rsp + 0xf88], rax
mov byte [rsp + 0xd8], 0
mov eax, dword [rsp + 0x4aa8]
mov qword [rsp + 0xf90], rax
mov r9, qword [rsp + 0xf88]
lea r8, [rsp + 0xd8]
mov rdx, qword [rsp + 0xf90]
lea rcx, [rsp + 0x50f8]
call fcn.140034380
nop
mov eax, dword [rsp + 0x4aa8]
mov dword [rsp + 0x358], eax
xor edx, edx
lea rcx, [rsp + 0x50f8]
call fcn.140041c50
mov qword [rsp + 0xf98], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0xfa0], rax
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x358]
mov r8, qword [rsp + 0xf98]
mov edx, 0xa
mov rcx, qword [rsp + 0xfa0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006a583
xor edx, edx
lea rcx, [rsp + 0x50f8]
call fcn.140041c50
mov rax, qword [rax + 8]
mov qword [rsp + 0x4af0], rax
lea rdx, [rsp + 0x4228]
lea rcx, [rsp + 0x4af0]
call sub.Secur32.dll_LsaGetLogonSessionData
mov dword [rsp + 0xa30], eax
mov rax, qword [rsp + 0x4228]
mov edx, dword [rax + 0x40]
lea rcx, [rsp + 0x30e0]
call fcn.14005fe20
mov qword [rsp + 0xfa8], rax
mov rdx, qword [rsp + 0xfa8]
lea rcx, [rsp + 0x4c20]
call fcn.140009740
lea rcx, [rsp + 0x30e0]
call fcn.140003890
mov rax, qword [rsp + 0x4228]
movzx eax, word [rax + 0x30]
test eax, eax
je 0x14006a583
lea rax, [rsp + 0x2a30]
mov rcx, qword [rsp + 0x4228]
mov rdi, rax
lea rsi, [rcx + 0x30]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x2a30]
lea rcx, [rsp + 0x30c0]
call fcn.14009ece0
mov qword [rsp + 0xfb0], rax
mov rdx, qword [rsp + 0xfb0]
lea rcx, [rsp + 0x4d20]
call fcn.140009740
lea rcx, [rsp + 0x30c0]
call fcn.140003890
lea rcx, [rsp + 0x2e80]
call fcn.140034230
mov qword [rsp + 0xfb8], rax
mov rax, qword [rsp + 0xfb8]
mov qword [rsp + 0xfc0], rax
lea rdx, [rsp + 0x50f8]
mov rcx, qword [rsp + 0xfc0]
call fcn.1400c3850
lea rcx, [rsp + 0x2e80]
call fcn.14003d030
nop
lea rcx, [rsp + 0x50f8]
call fcn.14003d030
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 8
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006a612
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14006a612
jmp 0x14006a7a2
mov edx, 0x18
lea rcx, [rsp + 0x5070]
call fcn.1400079b0
lea rcx, [rsp + 0x18d]
call fcn.140003030
mov qword [rsp + 0xfc8], rax
mov byte [rsp + 0xd9], 0
mov eax, dword [rsp + 0x4aa8]
mov qword [rsp + 0xfd0], rax
mov r9, qword [rsp + 0xfc8]
lea r8, [rsp + 0xd9]
mov rdx, qword [rsp + 0xfd0]
lea rcx, [rsp + 0x5070]
call fcn.140034380
nop
mov eax, dword [rsp + 0x4aa8]
mov dword [rsp + 0x35c], eax
xor edx, edx
lea rcx, [rsp + 0x5070]
call fcn.140041c50
mov qword [rsp + 0xfd8], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0xfe0], rax
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x35c]
mov r8, qword [rsp + 0xfd8]
mov edx, 8
mov rcx, qword [rsp + 0xfe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006a74d
xor edx, edx
lea rcx, [rsp + 0x5070]
call fcn.140041c50
mov eax, dword [rax]
mov dword [rsp + 0x228], eax
cmp dword [rsp + 0x228], 1
je 0x14006a70d
cmp dword [rsp + 0x228], 2
je 0x14006a723
jmp 0x14006a739
lea rdx, [0x14014f268]
lea rcx, [rsp + 0x4e10]
call fcn.140003940
jmp 0x14006a74d
lea rdx, str.Impersonation_Token
lea rcx, [rsp + 0x4e10]
call fcn.140003940
jmp 0x14006a74d
lea rdx, str.Unknown_type
lea rcx, [rsp + 0x4e10]
call fcn.140003940
lea rcx, [rsp + 0x2e68]
call fcn.140034230
mov qword [rsp + 0xfe8], rax
mov rax, qword [rsp + 0xfe8]
mov qword [rsp + 0xff0], rax
lea rdx, [rsp + 0x5070]
mov rcx, qword [rsp + 0xff0]
call fcn.1400c3850
lea rcx, [rsp + 0x2e68]
call fcn.14003d030
nop
lea rcx, [rsp + 0x5070]
call fcn.14003d030
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x19
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006a7dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14006a7dc
jmp 0x14006aab0
mov edx, 0x18
lea rcx, [rsp + 0x50e0]
call fcn.1400079b0
lea rcx, [rsp + 0x18c]
call fcn.140003030
mov qword [rsp + 0xff8], rax
mov byte [rsp + 0xda], 0
mov eax, dword [rsp + 0x4aa8]
mov qword [rsp + 0x1000], rax
mov r9, qword [rsp + 0xff8]
lea r8, [rsp + 0xda]
mov rdx, qword [rsp + 0x1000]
lea rcx, [rsp + 0x50e0]
call fcn.140034380
mov eax, dword [rsp + 0x4aa8]
mov dword [rsp + 0x360], eax
xor edx, edx
lea rcx, [rsp + 0x50e0]
call fcn.140041c50
mov qword [rsp + 0x1008], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0x1010], rax
lea rax, [rsp + 0x4aa8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x360]
mov r8, qword [rsp + 0x1008]
mov edx, 0x19
mov rcx, qword [rsp + 0x1010]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006aa5c
xor edx, edx
lea rcx, [rsp + 0x50e0]
call fcn.140041c50
lea rdx, [rsp + 0x41f8]
mov rcx, qword [rax]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
lea rax, [rsp + 0x56b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x64
rep stosb byte [rdi], al
mov r8d, 0x63
mov rdx, qword [rsp + 0x41f8]
lea rcx, [rsp + 0x56b0]
call fcn.140112e20
mov rax, qword [rsp + 0x41f8]
mov qword [rsp + 0x2928], rax
lea rdx, str.S_1_16_0
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006a936
lea rax, str.UNTRUSTED_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_4096
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006a962
lea rax, str.LOW_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_8192
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006a98e
lea rax, str.MEDIUM_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_8448
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006a9ba
lea rax, str.MEDIUM_PLUS_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_12288
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006a9e3
lea rax, str.HIGH_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_16384
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006aa0c
lea rax, str.SYSTEM_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_20480
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006aa35
lea rax, str.PROTECTED_PROCESS_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
jmp 0x14006aa5c
lea rdx, str.S_1_16_28672
lea rcx, [rsp + 0x56b0]
call fcn.14010e910
test eax, eax
jne 0x14006aa5c
lea rax, str.SECURE_PROCESS_MANDATORY_LEVEL
mov qword [rsp + 0x41f8], rax
lea rcx, [rsp + 0x2f58]
call fcn.140034230
mov qword [rsp + 0x1018], rax
mov rax, qword [rsp + 0x1018]
mov qword [rsp + 0x1020], rax
lea rdx, [rsp + 0x50e0]
mov rcx, qword [rsp + 0x1020]
call fcn.1400c3850
lea rcx, [rsp + 0x2f58]
call fcn.14003d030
lea rcx, [rsp + 0x50e0]
call fcn.14003d030
mov dword [rsp + 0x4b20], 0
mov dword [rsp + 0xa34], 0
mov qword [rsp + 0x2930], 0
mov qword [rsp + 0x2938], 0
mov dword [rsp + 0xa38], 0x400
mov dword [rsp + 0xa3c], 0x400
mov qword [rsp + 0x4230], 0
mov byte [rsp + 0x4b38], 0
mov byte [rsp + 0x4b39], 0
mov byte [rsp + 0x4b3a], 0
mov byte [rsp + 0x4b3b], 0
mov byte [rsp + 0x4b3c], 0
mov byte [rsp + 0x4b3d], 5
lea rax, [rsp + 0x4b20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14006ab6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14006ab6a
jmp 0x14006ae74
mov edx, 0x18
lea rcx, [rsp + 0x4d40]
call fcn.1400079b0
lea rcx, [rsp + 0x1a4]
call fcn.140003030
mov qword [rsp + 0x1028], rax
mov byte [rsp + 0xdb], 0
mov eax, dword [rsp + 0x4b20]
mov qword [rsp + 0x1030], rax
mov r9, qword [rsp + 0x1028]
lea r8, [rsp + 0xdb]
mov rdx, qword [rsp + 0x1030]
lea rcx, [rsp + 0x4d40]
call fcn.140034380
nop
mov eax, dword [rsp + 0x4b20]
mov dword [rsp + 0x364], eax
xor edx, edx
lea rcx, [rsp + 0x4d40]
call fcn.140041c50
mov qword [rsp + 0x1038], rax
mov rax, qword [rsp + 0x41f0]
mov qword [rsp + 0x1040], rax
lea rax, [rsp + 0x4b20]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x364]
mov r8, qword [rsp + 0x1038]
mov edx, 2
mov rcx, qword [rsp + 0x1040]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14006ae10
lea rax, [rsp + 0x4230]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rsp + 0x4b38]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14006acac
lea rdx, str.AllocateAndInitializeSid_Error
lea rcx, [rsp + 0x4d78]
call fcn.1400097c0
mov byte [rsp + 0x9e], 0
mov dword [rsp + 0x108], 0
jmp 0x14006acd1
mov eax, dword [rsp + 0x108]
inc eax
mov dword [rsp + 0x108], eax
movzx eax, byte [rsp + 0x9e]
test eax, eax
jne 0x14006ae10
xor edx, edx
lea rcx, [rsp + 0x4d40]
call fcn.140041c50
mov eax, dword [rax]
cmp dword [rsp + 0x108], eax
jae 0x14006ae10
xor edx, edx
lea rcx, [rsp + 0x4d40]
call fcn.140041c50
mov ecx, dword [rsp + 0x108]
imul rcx, rcx, 0x10
mov rax, qword [rax + rcx + 8]
mov qword [rsp + 0x1048], rax
mov rax, qword [rsp + 0x4230]
mov qword [rsp + 0x1050], rax
mov rdx, qword [rsp + 0x1048]
mov rcx, qword [rsp + 0x1050]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x14006ad5a
mov byte [rsp + 0xbb], 1
jmp 0x14006ad62
mov byte [rsp + 0xbb], 0
movzx eax, byte [rsp + 0xbb]
mov byte [rsp + 0x9e], al
movzx eax, byte [rsp + 0x9e]
test eax, eax
je 0x14006ae0b
xor edx, edx
lea rcx, [rsp + 0x4d40]
call fcn.140041c50
mov ecx, dword [rsp + 0x108]
imul rcx, rcx, 0x10
mov eax, dword [rax + rcx + 0x10]
and eax, 4
test eax, eax
je 0x14006adbc
lea rdx, str.BUILTINAdministrators_group._The_group_SID_is_enabled.
lea rcx, [rsp + 0x4d78]
call fcn.1400097c0
jmp 0x14006ae0b
xor edx, edx
lea rcx, [rsp + 0x4d40]
call fcn.140041c50
mov ecx, dword [rsp + 0x108]
imul rcx, rcx, 0x10
mov eax, dword [rax + rcx + 0x10]
and eax, 0x10
test eax, eax
je 0x14006adf7
lea rdx, str.BUILTINAdministrators_group._The_group_SID_is_a_deny_only_SID.
lea rcx, [rsp + 0x4d78]
call fcn.1400097c0
jmp 0x14006ae0b
lea rdx, str.BUILTINAdministrators_group._The_group_SID_is_not_enabled.
lea rcx, [rsp + 0x4d78]
call fcn.1400097c0
jmp 0x14006acc1
lea rcx, [rsp + 0x2f70]
call fcn.140034230
mov qword [rsp + 0x1058], rax
mov rax, qword [rsp + 0x1058]
mov qword [rsp + 0x1060], rax
lea rdx, [rsp + 0x4d40]
mov rcx, qword [rsp + 0x1060]
call fcn.1400c3850
lea rcx, [rsp + 0x2f70]
call fcn.14003d030
mov rcx, qword [rsp + 0x4230]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
nop
lea rcx, [rsp + 0x4d40]
call fcn.14003d030
nop
lea rcx, [rsp + 0x4f70]
call fcn.14003d030
mov rcx, qword [rsp + 0x41f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006aea8
mov byte [rsp + 0x90], 0
lea rax, str.Unknown
mov qword [rsp + 0x4220], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 8
mov rdx, rax
lea rcx, [rsp + 0x5358]
call fcn.140005f30
nop
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
movzx eax, byte [rax]
test eax, eax
je 0x14006af21
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
mov ecx, 0x20
imul rcx, rcx, 3
lea rax, [rax + rcx + 0x370]
mov rdx, rax
lea rcx, [rsp + 0x5358]
call fcn.140006550
lea rdx, [rsp + 0x5720]
lea rcx, [rsp + 0x5088]
call fcn.140005fd0
nop
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
add rax, 0x1b0
mov rdx, rax
lea rcx, [rsp + 0x4d58]
call fcn.140005f30
nop
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d78d8]
call fcn.140041870
add rax, 0x40
lea rdx, [rsp + 0x4d58]
mov rcx, rax
call fcn.140006550
lea rdx, [rsp + 0x5358]
lea rcx, [rsp + 0x51a0]
call fcn.140005f30
nop
mov dword [rsp + 0x4ac8], 0
mov byte [rsp + 0xc1], 0
mov byte [rsp + 0xa6], 0
mov byte [rsp + 0x9f], 0
mov byte [rsp + 0xa1], 0
mov byte [rsp + 0xa0], 0
mov byte [rsp + 0x92], 0
lea rdx, [0x14014f6d4]
lea rcx, [rsp + 0x51c0]
call fcn.140005fd0
nop
mov byte [rsp + 0xa2], 0
mov dword [rsp + 0xf8], 0
mov dword [rsp + 0x120], 0
mov byte [rsp + 0x70], 0
mov byte [rsp + 0x78], 0
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
movzx eax, byte [rax]
test eax, eax
je 0x14006b102
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x368], eax
lea rax, [rsp + 0x3788]
mov qword [rsp + 0x1068], rax
lea rdx, [0x1401441c4]
mov rcx, qword [rsp + 0x1068]
call fcn.140003570
mov qword [rsp + 0x1070], rax
mov rax, qword [rsp + 0x1070]
mov qword [rsp + 0x1078], rax
mov rax, qword [rsp + 0x1078]
mov qword [rsp + 0x1090], rax
lea rax, [rsp + 0x37a8]
mov qword [rsp + 0x1080], rax
lea rdx, [0x14014f6e8]
mov rcx, qword [rsp + 0x1080]
call fcn.140003570
mov qword [rsp + 0x1088], rax
mov rax, qword [rsp + 0x1088]
mov qword [rsp + 0x1098], rax
mov r9d, dword [rsp + 0x368]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1090]
mov rcx, qword [rsp + 0x1098]
call fcn.140052820
mov byte [rsp + 0x9f], 1
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x78], 1
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
movzx eax, byte [rax + 0x57d]
test eax, eax
je 0x14006b1ff
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x36c], eax
lea rax, [rsp + 0x37c8]
mov qword [rsp + 0x10a0], rax
lea rdx, [0x1401441c5]
mov rcx, qword [rsp + 0x10a0]
call fcn.140003570
mov qword [rsp + 0x10a8], rax
mov rax, qword [rsp + 0x10a8]
mov qword [rsp + 0x10b0], rax
mov rax, qword [rsp + 0x10b0]
mov qword [rsp + 0x10c8], rax
lea rax, [rsp + 0x37e8]
mov qword [rsp + 0x10b8], rax
lea rdx, [0x14014f700]
mov rcx, qword [rsp + 0x10b8]
call fcn.140003570
mov qword [rsp + 0x10c0], rax
mov rax, qword [rsp + 0x10c0]
mov qword [rsp + 0x10d0], rax
mov r9d, dword [rsp + 0x36c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x10c8]
mov rcx, qword [rsp + 0x10d0]
call fcn.140052820
mov byte [rsp + 0xa0], 1
mov byte [rsp + 0x70], 1
lea rdx, [0x14014f718]
lea rcx, [rsp + 0x51c0]
call fcn.1400097c0
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
movzx eax, byte [rax + 0x57e]
test eax, eax
je 0x14006b2ed
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x370], eax
lea rax, [rsp + 0x3808]
mov qword [rsp + 0x10d8], rax
lea rdx, [0x1401441c6]
mov rcx, qword [rsp + 0x10d8]
call fcn.140003570
mov qword [rsp + 0x10e0], rax
mov rax, qword [rsp + 0x10e0]
mov qword [rsp + 0x10e8], rax
mov rax, qword [rsp + 0x10e8]
mov qword [rsp + 0x1100], rax
lea rax, [rsp + 0x3848]
mov qword [rsp + 0x10f0], rax
lea rdx, [0x14014f740]
mov rcx, qword [rsp + 0x10f0]
call fcn.140003570
mov qword [rsp + 0x10f8], rax
mov rax, qword [rsp + 0x10f8]
mov qword [rsp + 0x1108], rax
mov r9d, dword [rsp + 0x370]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1100]
mov rcx, qword [rsp + 0x1108]
call fcn.140052820
mov byte [rsp + 0x92], 1
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x78], 1
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x60
mov rdx, rax
lea rcx, [rsp + 0x4d00]
call fcn.140005fd0
nop
lea rdx, str.LM_H_
lea rcx, [rsp + 0x4d00]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006b3fe
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x374], eax
lea rax, [rsp + 0x3888]
mov qword [rsp + 0x1110], rax
lea rdx, [0x1401441ec]
mov rcx, qword [rsp + 0x1110]
call fcn.140003570
mov qword [rsp + 0x1118], rax
mov rax, qword [rsp + 0x1118]
mov qword [rsp + 0x1120], rax
mov rax, qword [rsp + 0x1120]
mov qword [rsp + 0x1138], rax
lea rax, [rsp + 0x38a8]
mov qword [rsp + 0x1128], rax
lea rdx, [0x14014f778]
mov rcx, qword [rsp + 0x1128]
call fcn.140003570
mov qword [rsp + 0x1130], rax
mov rax, qword [rsp + 0x1130]
mov qword [rsp + 0x1140], rax
mov r9d, dword [rsp + 0x374]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1138]
mov rcx, qword [rsp + 0x1140]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0xa1], 1
mov byte [rsp + 0x78], 1
jmp 0x14006b586
lea rdx, [0x14014f790]
lea rcx, [rsp + 0x4d00]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006b423
mov byte [rsp + 0x79], 1
jmp 0x14006b586
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 2
imul rcx, rcx, 0
movzx eax, word [rax + rcx + 0x60]
mov ecx, 2
imul rcx, rcx, 0
lea rdx, [0x14014f79c]
movzx ecx, word [rdx + rcx]
cmp eax, ecx
je 0x14006b4c0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 2
imul rcx, rcx, 1
movzx eax, word [rax + rcx + 0x60]
mov ecx, 2
imul rcx, rcx, 0
lea rdx, [0x14014f7a0]
movzx ecx, word [rdx + rcx]
cmp eax, ecx
je 0x14006b4c0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 2
imul rcx, rcx, 3
movzx eax, word [rax + rcx + 0x60]
mov ecx, 2
imul rcx, rcx, 0
lea rdx, [0x14014f7a4]
movzx ecx, word [rdx + rcx]
cmp eax, ecx
jne 0x14006b586
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x378], eax
lea rax, [rsp + 0x36c8]
mov qword [rsp + 0x1148], rax
lea rdx, [0x1401441ed]
mov rcx, qword [rsp + 0x1148]
call fcn.140003570
mov qword [rsp + 0x1150], rax
mov rax, qword [rsp + 0x1150]
mov qword [rsp + 0x1158], rax
mov rax, qword [rsp + 0x1158]
mov qword [rsp + 0x1170], rax
lea rax, [rsp + 0x38e8]
mov qword [rsp + 0x1160], rax
lea rdx, [0x14014f7a8]
mov rcx, qword [rsp + 0x1160]
call fcn.140003570
mov qword [rsp + 0x1168], rax
mov rax, qword [rsp + 0x1168]
mov qword [rsp + 0x1178], rax
mov r9d, dword [rsp + 0x378]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1170]
mov rcx, qword [rsp + 0x1178]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0xa2], 1
movzx eax, byte [rsp + 0x91]
test eax, eax
je 0x14006b64f
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x37c], eax
lea rax, [rsp + 0x3988]
mov qword [rsp + 0x1180], rax
lea rdx, [0x1401441ee]
mov rcx, qword [rsp + 0x1180]
call fcn.140003570
mov qword [rsp + 0x1188], rax
mov rax, qword [rsp + 0x1188]
mov qword [rsp + 0x1190], rax
mov rax, qword [rsp + 0x1190]
mov qword [rsp + 0x11a8], rax
lea rax, [rsp + 0x39a8]
mov qword [rsp + 0x1198], rax
lea rdx, [0x14014f7c0]
mov rcx, qword [rsp + 0x1198]
call fcn.140003570
mov qword [rsp + 0x11a0], rax
mov rax, qword [rsp + 0x11a0]
mov qword [rsp + 0x11b0], rax
mov r9d, dword [rsp + 0x37c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x11a8]
mov rcx, qword [rsp + 0x11b0]
call fcn.140052820
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x7d9]
test eax, eax
je 0x14006b729
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x380], eax
lea rax, [rsp + 0x34c8]
mov qword [rsp + 0x11b8], rax
lea rdx, [0x1401441ef]
mov rcx, qword [rsp + 0x11b8]
call fcn.140003570
mov qword [rsp + 0x11c0], rax
mov rax, qword [rsp + 0x11c0]
mov qword [rsp + 0x11c8], rax
mov rax, qword [rsp + 0x11c8]
mov qword [rsp + 0x11e0], rax
lea rax, [rsp + 0x39c8]
mov qword [rsp + 0x11d0], rax
lea rdx, [0x14014f7e0]
mov rcx, qword [rsp + 0x11d0]
call fcn.140003570
mov qword [rsp + 0x11d8], rax
mov rax, qword [rsp + 0x11d8]
mov qword [rsp + 0x11e8], rax
mov r9d, dword [rsp + 0x380]
mov r8d, 0xa
mov rdx, qword [rsp + 0x11e0]
mov rcx, qword [rsp + 0x11e8]
call fcn.140052820
mov byte [rsp + 0x70], 1
lea rdx, [0x14014f800]
lea rcx, [rsp + 0x51a0]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006b80e
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x384], eax
lea rax, [rsp + 0x39e8]
mov qword [rsp + 0x11f0], rax
lea rdx, [0x140144214]
mov rcx, qword [rsp + 0x11f0]
call fcn.140003570
mov qword [rsp + 0x11f8], rax
mov rax, qword [rsp + 0x11f8]
mov qword [rsp + 0x1200], rax
mov rax, qword [rsp + 0x1200]
mov qword [rsp + 0x1218], rax
lea rax, [rsp + 0x3a08]
mov qword [rsp + 0x1208], rax
lea rdx, [0x14014f810]
mov rcx, qword [rsp + 0x1208]
call fcn.140003570
mov qword [rsp + 0x1210], rax
mov rax, qword [rsp + 0x1210]
mov qword [rsp + 0x1220], rax
mov r9d, dword [rsp + 0x384]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1218]
mov rcx, qword [rsp + 0x1220]
call fcn.140052820
mov byte [rsp + 0xa6], 1
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b0]
test eax, eax
je 0x14006b8ed
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x388], eax
lea rax, [rsp + 0x3a28]
mov qword [rsp + 0x1228], rax
lea rdx, [0x140144215]
mov rcx, qword [rsp + 0x1228]
call fcn.140003570
mov qword [rsp + 0x1230], rax
mov rax, qword [rsp + 0x1230]
mov qword [rsp + 0x1238], rax
mov rax, qword [rsp + 0x1238]
mov qword [rsp + 0x1250], rax
lea rax, [rsp + 0x3a48]
mov qword [rsp + 0x1240], rax
lea rdx, [0x14014f828]
mov rcx, qword [rsp + 0x1240]
call fcn.140003570
mov qword [rsp + 0x1248], rax
mov rax, qword [rsp + 0x1248]
mov qword [rsp + 0x1258], rax
mov r9d, dword [rsp + 0x388]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1250]
mov rcx, qword [rsp + 0x1258]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x78], 1
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b1]
test eax, eax
je 0x14006b9cc
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x38c], eax
lea rax, [rsp + 0x3a68]
mov qword [rsp + 0x1260], rax
lea rdx, [0x140144216]
mov rcx, qword [rsp + 0x1260]
call fcn.140003570
mov qword [rsp + 0x1268], rax
mov rax, qword [rsp + 0x1268]
mov qword [rsp + 0x1270], rax
mov rax, qword [rsp + 0x1270]
mov qword [rsp + 0x1288], rax
lea rax, [rsp + 0x3aa8]
mov qword [rsp + 0x1278], rax
lea rdx, [0x14014f838]
mov rcx, qword [rsp + 0x1278]
call fcn.140003570
mov qword [rsp + 0x1280], rax
mov rax, qword [rsp + 0x1280]
mov qword [rsp + 0x1290], rax
mov r9d, dword [rsp + 0x38c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1288]
mov rcx, qword [rsp + 0x1290]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x78], 1
lea rdx, [rsp + 0x2940]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006bb32
lea rdx, [rsp + 0x2948]
lea rcx, [0x1401d7310]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ab8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006bb32
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xf8], eax
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x120], eax
mov eax, dword [rsp + 0x120]
cmp dword [rsp + 0xf8], eax
je 0x14006bb32
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x390], eax
lea rax, [rsp + 0x3ac8]
mov qword [rsp + 0x1298], rax
lea rdx, [0x140144217]
mov rcx, qword [rsp + 0x1298]
call fcn.140003570
mov qword [rsp + 0x12a0], rax
mov rax, qword [rsp + 0x12a0]
mov qword [rsp + 0x12a8], rax
mov rax, qword [rsp + 0x12a8]
mov qword [rsp + 0x12c0], rax
lea rax, [rsp + 0x3b70]
mov qword [rsp + 0x12b0], rax
lea rdx, [0x14014f858]
mov rcx, qword [rsp + 0x12b0]
call fcn.140003570
mov qword [rsp + 0x12b8], rax
mov rax, qword [rsp + 0x12b8]
mov qword [rsp + 0x12c8], rax
mov r9d, dword [rsp + 0x390]
mov r8d, 0xa
mov rdx, qword [rsp + 0x12c0]
mov rcx, qword [rsp + 0x12c8]
call fcn.140052820
mov byte [rsp + 0xc1], 1
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x90]
test eax, eax
je 0x14006bc40
mov eax, dword [rsp + 0x4af0]
mov ecx, dword [rsp + 0x4af4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ac8], eax
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov eax, dword [rax + 0x88]
cmp dword [rsp + 0x10c], eax
je 0x14006bc40
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x394], eax
lea rax, [rsp + 0x36a8]
mov qword [rsp + 0x12d0], rax
lea rdx, [0x14014423e]
mov rcx, qword [rsp + 0x12d0]
call fcn.140003570
mov qword [rsp + 0x12d8], rax
mov rax, qword [rsp + 0x12d8]
mov qword [rsp + 0x12e0], rax
mov rax, qword [rsp + 0x12e0]
mov qword [rsp + 0x12f8], rax
lea rax, [rsp + 0x3688]
mov qword [rsp + 0x12e8], rax
lea rdx, [0x14014f868]
mov rcx, qword [rsp + 0x12e8]
call fcn.140003570
mov qword [rsp + 0x12f0], rax
mov rax, qword [rsp + 0x12f0]
mov qword [rsp + 0x1300], rax
mov r9d, dword [rsp + 0x394]
mov r8d, 0xa
mov rdx, qword [rsp + 0x12f8]
mov rcx, qword [rsp + 0x1300]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0xa5], 0
mov byte [rsp + 0x81], 0
lea rdx, [0x14014f884]
lea rcx, [rsp + 0x4c20]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006bea5
lea rdx, [0x14014f888]
lea rcx, [rsp + 0x4c20]
call fcn.14000fe70
movzx eax, al
test eax, eax
jne 0x14006bcfa
lea rdx, [0x14014f8a8]
lea rcx, [rsp + 0x4c20]
call fcn.14000fe70
movzx eax, al
test eax, eax
jne 0x14006bcfa
lea rdx, [0x14014f8b8]
lea rcx, [rsp + 0x4c20]
call fcn.14000fe70
movzx eax, al
test eax, eax
jne 0x14006bcfa
lea rdx, [0x14014f8e0]
lea rcx, [rsp + 0x4c20]
call fcn.14000fe70
movzx eax, al
test eax, eax
jne 0x14006bcfa
lea rdx, str.CachedRemoteInteractive
lea rcx, [rsp + 0x4c20]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006bea5
lea rdx, [0x14014f938]
lea rcx, [rsp + 0x4c20]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006bddf
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x398], eax
lea rax, [rsp + 0x3668]
mov qword [rsp + 0x1308], rax
lea rdx, [0x14014423f]
mov rcx, qword [rsp + 0x1308]
call fcn.140003570
mov qword [rsp + 0x1310], rax
mov rax, qword [rsp + 0x1310]
mov qword [rsp + 0x1318], rax
mov rax, qword [rsp + 0x1318]
mov qword [rsp + 0x1330], rax
lea rax, [rsp + 0x3648]
mov qword [rsp + 0x1320], rax
lea rdx, [0x14014f958]
mov rcx, qword [rsp + 0x1320]
call fcn.140003570
mov qword [rsp + 0x1328], rax
mov rax, qword [rsp + 0x1328]
mov qword [rsp + 0x1338], rax
mov r9d, dword [rsp + 0x398]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1330]
mov rcx, qword [rsp + 0x1338]
call fcn.140052820
mov byte [rsp + 0x81], 1
jmp 0x14006bea0
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x39c], eax
lea rax, [rsp + 0x3628]
mov qword [rsp + 0x1340], rax
lea rdx, [0x140144242]
mov rcx, qword [rsp + 0x1340]
call fcn.140003570
mov qword [rsp + 0x1348], rax
mov rax, qword [rsp + 0x1348]
mov qword [rsp + 0x1350], rax
mov rax, qword [rsp + 0x1350]
mov qword [rsp + 0x1368], rax
lea rax, [rsp + 0x3608]
mov qword [rsp + 0x1358], rax
lea rdx, [0x14014f980]
mov rcx, qword [rsp + 0x1358]
call fcn.140003570
mov qword [rsp + 0x1360], rax
mov rax, qword [rsp + 0x1360]
mov qword [rsp + 0x1370], rax
mov r9d, dword [rsp + 0x39c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1368]
mov rcx, qword [rsp + 0x1370]
call fcn.140052820
mov byte [rsp + 0xa5], 1
mov byte [rsp + 0x70], 1
mov byte [rsp + 0xbd], 0
mov byte [rsp + 0xbe], 0
mov byte [rsp + 0xbf], 0
mov byte [rsp + 0xc0], 0
mov byte [rsp + 0x1a3], 0
movzx eax, byte [rsp + 0xbc]
test eax, eax
je 0x14006c38b
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5d8]
cmp eax, 1
jne 0x14006c38b
mov edx, 0x10
lea rcx, [rsp + 0x4e50]
call fcn.1400079b0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5c8
mov rdx, rax
lea rcx, [rsp + 0x4e50]
call fcn.140033c10
nop
mov edx, 8
lea rcx, [rsp + 0x4b40]
call fcn.1400079b0
lea rdx, [rsp + 0x4b40]
lea rcx, [rsp + 0x4e50]
call fcn.1400b5ef0
lea rdx, [rsp + 0x2950]
lea rcx, [rsp + 0x4e50]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b40]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006c37e
lea rcx, [rsp + 0x4b40]
call fcn.140042060
movzx eax, byte [rax + 0x58]
test eax, eax
je 0x14006c361
lea rcx, [rsp + 0x4b40]
call fcn.140042060
movzx eax, byte [rax + 0x59]
test eax, eax
je 0x14006c08a
movzx eax, byte [rsp + 0xbd]
test eax, eax
jne 0x14006c08a
mov byte [rsp + 0xbd], 1
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3a0], eax
lea rax, [rsp + 0x35e8]
mov qword [rsp + 0x1378], rax
lea rdx, [0x140144243]
mov rcx, qword [rsp + 0x1378]
call fcn.140003570
mov qword [rsp + 0x1380], rax
mov rax, qword [rsp + 0x1380]
mov qword [rsp + 0x1388], rax
mov rax, qword [rsp + 0x1388]
mov qword [rsp + 0x13a0], rax
lea rax, [rsp + 0x35c8]
mov qword [rsp + 0x1390], rax
lea rdx, [0x14014f990]
mov rcx, qword [rsp + 0x1390]
call fcn.140003570
mov qword [rsp + 0x1398], rax
mov rax, qword [rsp + 0x1398]
mov qword [rsp + 0x13a8], rax
mov r9d, dword [rsp + 0x3a0]
mov r8d, 0xa
mov rdx, qword [rsp + 0x13a0]
mov rcx, qword [rsp + 0x13a8]
call fcn.140052820
lea rcx, [rsp + 0x4b40]
call fcn.140042060
movzx eax, byte [rax + 0x5c]
test eax, eax
je 0x14006c174
movzx eax, byte [rsp + 0xbe]
test eax, eax
jne 0x14006c174
mov byte [rsp + 0xbe], 1
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3a4], eax
lea rax, [rsp + 0x35a8]
mov qword [rsp + 0x13b0], rax
lea rdx, [0x140144246]
mov rcx, qword [rsp + 0x13b0]
call fcn.140003570
mov qword [rsp + 0x13b8], rax
mov rax, qword [rsp + 0x13b8]
mov qword [rsp + 0x13c0], rax
mov rax, qword [rsp + 0x13c0]
mov qword [rsp + 0x13d8], rax
lea rax, [rsp + 0x3588]
mov qword [rsp + 0x13c8], rax
lea rdx, [0x14014f9b0]
mov rcx, qword [rsp + 0x13c8]
call fcn.140003570
mov qword [rsp + 0x13d0], rax
mov rax, qword [rsp + 0x13d0]
mov qword [rsp + 0x13e0], rax
mov r9d, dword [rsp + 0x3a4]
mov r8d, 0xa
mov rdx, qword [rsp + 0x13d8]
mov rcx, qword [rsp + 0x13e0]
call fcn.140052820
lea rcx, [rsp + 0x4b40]
call fcn.140042060
movzx eax, byte [rax + 0x5b]
test eax, eax
je 0x14006c25e
movzx eax, byte [rsp + 0xbf]
test eax, eax
jne 0x14006c25e
mov byte [rsp + 0xbf], 1
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3a8], eax
lea rax, [rsp + 0x3568]
mov qword [rsp + 0x13e8], rax
lea rdx, [0x140144247]
mov rcx, qword [rsp + 0x13e8]
call fcn.140003570
mov qword [rsp + 0x13f0], rax
mov rax, qword [rsp + 0x13f0]
mov qword [rsp + 0x13f8], rax
mov rax, qword [rsp + 0x13f8]
mov qword [rsp + 0x1410], rax
lea rax, [rsp + 0x3548]
mov qword [rsp + 0x1400], rax
lea rdx, [0x14014f9e8]
mov rcx, qword [rsp + 0x1400]
call fcn.140003570
mov qword [rsp + 0x1408], rax
mov rax, qword [rsp + 0x1408]
mov qword [rsp + 0x1418], rax
mov r9d, dword [rsp + 0x3a8]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1410]
mov rcx, qword [rsp + 0x1418]
call fcn.140052820
lea rcx, [rsp + 0x4b40]
call fcn.140042060
movzx eax, byte [rax + 0x5a]
test eax, eax
je 0x14006c348
movzx eax, byte [rsp + 0xc0]
test eax, eax
jne 0x14006c348
mov byte [rsp + 0xc0], 1
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3ac], eax
lea rax, [rsp + 0x3528]
mov qword [rsp + 0x1420], rax
lea rdx, [0x14014424e]
mov rcx, qword [rsp + 0x1420]
call fcn.140003570
mov qword [rsp + 0x1428], rax
mov rax, qword [rsp + 0x1428]
mov qword [rsp + 0x1430], rax
mov rax, qword [rsp + 0x1430]
mov qword [rsp + 0x1448], rax
lea rax, [rsp + 0x3b90]
mov qword [rsp + 0x1438], rax
lea rdx, [0x14014fa08]
mov rcx, qword [rsp + 0x1438]
call fcn.140003570
mov qword [rsp + 0x1440], rax
mov rax, qword [rsp + 0x1440]
mov qword [rsp + 0x1450], rax
mov r9d, dword [rsp + 0x3ac]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1448]
mov rcx, qword [rsp + 0x1450]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov eax, dword [0x1401d19f4]
add eax, 0xa
mov dword [0x1401d19f4], eax
mov byte [rsp + 0x78], 1
xor r8d, r8d
lea rdx, [rsp + 0x2960]
lea rcx, [rsp + 0x4b40]
call fcn.1400421d0
jmp 0x14006bf57
lea rcx, [rsp + 0x4e50]
call fcn.14003cc30
mov byte [rsp + 0xa3], 0
mov byte [rsp + 0xa4], 0
lea rdx, [0x14014fa34]
lea rcx, [rsp + 0x50a8]
call fcn.140005fd0
nop
mov qword [rsp + 0x20], 0
mov r9d, 0x408
lea r8, [rsp + 0x4690]
mov rdx, qword [rsp + 0x43c0]
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, word [rsp + 0x4750]
test eax, eax
je 0x14006c97c
mov edx, 0x18
lea rcx, [rsp + 0x4f40]
call fcn.1400079b0
lea rcx, [rsp + 0x4f40]
call fcn.140034230
nop
movzx eax, word [rsp + 0x4750]
mov edx, eax
lea rcx, [rsp + 0x4f40]
call fcn.1400c2130
xor edx, edx
lea rcx, [rsp + 0x4f40]
call fcn.140041c50
mov qword [rsp + 0x1458], rax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x1460], rax
movzx eax, word [rsp + 0x4750]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rsp + 0x1458]
mov rdx, qword [rsp + 0x4758]
mov rcx, qword [rsp + 0x1460]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, word [rsp + 0x4750]
cdq
sub eax, edx
sar eax, 1
cdqe
mov qword [rsp + 0x1468], rax
xor edx, edx
lea rcx, [rsp + 0x4f40]
call fcn.140041c50
mov rcx, qword [rsp + 0x1468]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x4fb8]
call fcn.140006030
nop
lea rdx, [rsp + 0x4fb8]
lea rcx, [rsp + 0x50a8]
call fcn.140006550
lea rdx, [rsp + 0x2968]
lea rcx, [rsp + 0x4fb8]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0x1470], rax
mov rax, qword [rsp + 0x1470]
mov qword [rsp + 0x1488], rax
lea rdx, [rsp + 0x2970]
lea rcx, [rsp + 0x4fb8]
call fcn.1400bb630
mov rax, qword [rax]
mov qword [rsp + 0x1478], rax
mov rax, qword [rsp + 0x1478]
mov qword [rsp + 0x1490], rax
lea rdx, [rsp + 0x2978]
lea rcx, [rsp + 0x4fb8]
call fcn.1400b6020
mov rax, qword [rax]
mov qword [rsp + 0x1480], rax
mov rax, qword [rsp + 0x1480]
mov qword [rsp + 0x1498], rax
lea rax, [fcn.14010ddbc]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1488]
mov r8, qword [rsp + 0x1490]
mov rdx, qword [rsp + 0x1498]
lea rcx, [rsp + 0x2980]
call fcn.14002ec30
xor r8d, r8d
lea rdx, [0x14014fa38]
lea rcx, [rsp + 0x50a8]
call fcn.1400bc850
mov qword [rsp + 0x8b0], rax
cmp qword [rsp + 0x8b0], 0xffffffffffffffff
je 0x14006c800
mov r9, qword [rsp + 0x8b0]
xor r8d, r8d
lea rdx, [rsp + 0x30a0]
lea rcx, [rsp + 0x4fb8]
call fcn.14000ac90
mov qword [rsp + 0x14a0], rax
mov rax, qword [rsp + 0x14a0]
mov qword [rsp + 0x14a8], rax
mov rax, qword [rsp + 0x14a8]
mov qword [rsp + 0x14b0], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x820
mov rdx, qword [rsp + 0x14b0]
mov rcx, rax
call fcn.140009740
nop
lea rcx, [rsp + 0x30a0]
call fcn.140003890
mov rax, qword [rsp + 0x8b0]
inc rax
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rsp + 0x3080]
lea rcx, [rsp + 0x4fb8]
call fcn.14000ac90
mov qword [rsp + 0x14b8], rax
mov rax, qword [rsp + 0x14b8]
mov qword [rsp + 0x14c0], rax
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x14c8], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x840
mov rdx, qword [rsp + 0x14c8]
mov rcx, rax
call fcn.140009740
nop
lea rcx, [rsp + 0x3080]
call fcn.140003890
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x820
lea rdx, str.winsta0
mov rcx, rax
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006c7fb
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x840
lea rdx, str.default
mov rcx, rax
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006c7fb
mov byte [rsp + 0xa3], 1
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3b0], eax
lea rax, [rsp + 0x3bb0]
mov qword [rsp + 0x14d0], rax
lea rdx, [0x14014424f]
mov rcx, qword [rsp + 0x14d0]
call fcn.140003570
mov qword [rsp + 0x14d8], rax
mov rax, qword [rsp + 0x14d8]
mov qword [rsp + 0x14e0], rax
mov rax, qword [rsp + 0x14e0]
mov qword [rsp + 0x14f8], rax
lea rax, [rsp + 0x3bd0]
mov qword [rsp + 0x14e8], rax
lea rdx, [0x14014fa60]
mov rcx, qword [rsp + 0x14e8]
call fcn.140003570
mov qword [rsp + 0x14f0], rax
mov rax, qword [rsp + 0x14f0]
mov qword [rsp + 0x1500], rax
mov r9d, dword [rsp + 0x3b0]
mov r8d, 0xa
mov rdx, qword [rsp + 0x14f8]
mov rcx, qword [rsp + 0x1500]
call fcn.140052820
mov byte [rsp + 0x70], 1
jmp 0x14006c919
mov byte [rsp + 0xa4], 1
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3b4], eax
lea rax, [rsp + 0x3bf0]
mov qword [rsp + 0x1508], rax
lea rdx, [0x140144262]
mov rcx, qword [rsp + 0x1508]
call fcn.140003570
mov qword [rsp + 0x1510], rax
mov rax, qword [rsp + 0x1510]
mov qword [rsp + 0x1518], rax
mov rax, qword [rsp + 0x1518]
mov qword [rsp + 0x1530], rax
lea rax, [rsp + 0x3c10]
mov qword [rsp + 0x1520], rax
lea rdx, [0x14014fa80]
mov rcx, qword [rsp + 0x1520]
call fcn.140003570
mov qword [rsp + 0x1528], rax
mov rax, qword [rsp + 0x1528]
mov qword [rsp + 0x1538], rax
mov r9d, dword [rsp + 0x3b4]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1530]
mov rcx, qword [rsp + 0x1538]
call fcn.140052820
mov byte [rsp + 0x70], 1
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x820
lea rdx, [0x14014faac]
mov rcx, rax
call fcn.1400097c0
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x840
lea rdx, [rsp + 0x4fb8]
mov rcx, rax
call fcn.140006550
lea rcx, [rsp + 0x2f40]
call fcn.140034230
mov qword [rsp + 0x1540], rax
mov rax, qword [rsp + 0x1540]
mov qword [rsp + 0x1548], rax
lea rdx, [rsp + 0x4f40]
mov rcx, qword [rsp + 0x1548]
call fcn.1400c3850
lea rcx, [rsp + 0x2f40]
call fcn.14003d030
nop
lea rcx, [rsp + 0x4fb8]
call fcn.140003890
nop
lea rcx, [rsp + 0x4f40]
call fcn.14003d030
lea rdx, [0x14014fab0]
lea rcx, [rsp + 0x4d20]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006ca87
movzx eax, byte [0x1401d2a16]
test eax, eax
je 0x14006ca87
lea rdx, [0x14014fab8]
lea rcx, [rsp + 0x4d20]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006ca87
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3b8], eax
lea rax, [rsp + 0x3c30]
mov qword [rsp + 0x1550], rax
lea rdx, [0x140144263]
mov rcx, qword [rsp + 0x1550]
call fcn.140003570
mov qword [rsp + 0x1558], rax
mov rax, qword [rsp + 0x1558]
mov qword [rsp + 0x1560], rax
mov rax, qword [rsp + 0x1560]
mov qword [rsp + 0x1578], rax
lea rax, [rsp + 0x3c50]
mov qword [rsp + 0x1568], rax
lea rdx, [0x14014fac8]
mov rcx, qword [rsp + 0x1568]
call fcn.140003570
mov qword [rsp + 0x1570], rax
mov rax, qword [rsp + 0x1570]
mov qword [rsp + 0x1580], rax
mov r9d, dword [rsp + 0x3b8]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1578]
mov rcx, qword [rsp + 0x1580]
call fcn.140052820
mov byte [rsp + 0x70], 1
lea rdx, [0x14014fae0]
lea rcx, [rsp + 0x4d78]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006cb64
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3bc], eax
lea rax, [rsp + 0x3c70]
mov qword [rsp + 0x1588], rax
lea rdx, [0x140144264]
mov rcx, qword [rsp + 0x1588]
call fcn.140003570
mov qword [rsp + 0x1590], rax
mov rax, qword [rsp + 0x1590]
mov qword [rsp + 0x1598], rax
mov rax, qword [rsp + 0x1598]
mov qword [rsp + 0x15b0], rax
lea rax, [rsp + 0x3c90]
mov qword [rsp + 0x15a0], rax
lea rdx, [0x14014fae8]
mov rcx, qword [rsp + 0x15a0]
call fcn.140003570
mov qword [rsp + 0x15a8], rax
mov rax, qword [rsp + 0x15a8]
mov qword [rsp + 0x15b8], rax
mov r9d, dword [rsp + 0x3bc]
mov r8d, 0xa
mov rdx, qword [rsp + 0x15b0]
mov rcx, qword [rsp + 0x15b8]
call fcn.140052820
mov byte [rsp + 0x70], 1
xor r8d, r8d
lea rdx, [0x14014faf8]
lea rcx, [rsp + 0x4d58]
call fcn.1400bc850
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3040]
lea rcx, [rsp + 0x4d58]
call fcn.14000ac90
mov qword [rsp + 0x15c0], rax
mov rax, qword [rsp + 0x15c0]
mov qword [rsp + 0x15c8], rax
mov rax, qword [rsp + 0x15c8]
mov qword [rsp + 0x15e0], rax
xor r8d, r8d
lea rdx, [0x14014fafc]
lea rcx, [rsp + 0x5088]
call fcn.1400bc850
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3060]
lea rcx, [rsp + 0x5088]
call fcn.14000ac90
mov qword [rsp + 0x15d0], rax
mov rax, qword [rsp + 0x15d0]
mov qword [rsp + 0x15d8], rax
mov rax, qword [rsp + 0x15d8]
mov qword [rsp + 0x15e8], rax
mov rdx, qword [rsp + 0x15e0]
mov rcx, qword [rsp + 0x15e8]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x14006cc41
mov dword [rsp + 0x22c], 1
jmp 0x14006cc4c
mov dword [rsp + 0x22c], 0
movzx eax, byte [rsp + 0x22c]
mov byte [rsp + 0xdc], al
lea rcx, [rsp + 0x3060]
call fcn.140003890
nop
lea rcx, [rsp + 0x3040]
call fcn.140003890
movzx eax, byte [rsp + 0xdc]
test eax, eax
je 0x14006cd44
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3c0], eax
lea rax, [rsp + 0x3cb0]
mov qword [rsp + 0x15f0], rax
lea rdx, [0x140144265]
mov rcx, qword [rsp + 0x15f0]
call fcn.140003570
mov qword [rsp + 0x15f8], rax
mov rax, qword [rsp + 0x15f8]
mov qword [rsp + 0x1600], rax
mov rax, qword [rsp + 0x1600]
mov qword [rsp + 0x1618], rax
lea rax, [rsp + 0x3cd0]
mov qword [rsp + 0x1608], rax
lea rdx, [0x14014fb00]
mov rcx, qword [rsp + 0x1608]
call fcn.140003570
mov qword [rsp + 0x1610], rax
mov rax, qword [rsp + 0x1610]
mov qword [rsp + 0x1620], rax
mov r9d, dword [rsp + 0x3c0]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1618]
mov rcx, qword [rsp + 0x1620]
call fcn.140052820
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x14006ce17
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3c4], eax
lea rax, [rsp + 0x3cf0]
mov qword [rsp + 0x1628], rax
lea rdx, [0x140144266]
mov rcx, qword [rsp + 0x1628]
call fcn.140003570
mov qword [rsp + 0x1630], rax
mov rax, qword [rsp + 0x1630]
mov qword [rsp + 0x1638], rax
mov rax, qword [rsp + 0x1638]
mov qword [rsp + 0x1650], rax
lea rax, [rsp + 0x3d10]
mov qword [rsp + 0x1640], rax
lea rdx, str._PEB
mov rcx, qword [rsp + 0x1640]
call fcn.140003570
mov qword [rsp + 0x1648], rax
mov rax, qword [rsp + 0x1648]
mov qword [rsp + 0x1658], rax
mov r9d, dword [rsp + 0x3c4]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1650]
mov rcx, qword [rsp + 0x1658]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x78], 1
movzx eax, byte [rsp + 0x79]
test eax, eax
je 0x14006cee2
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3c8], eax
lea rax, [rsp + 0x3d30]
mov qword [rsp + 0x1660], rax
lea rdx, [0x140144267]
mov rcx, qword [rsp + 0x1660]
call fcn.140003570
mov qword [rsp + 0x1668], rax
mov rax, qword [rsp + 0x1668]
mov qword [rsp + 0x1670], rax
mov rax, qword [rsp + 0x1670]
mov qword [rsp + 0x1688], rax
lea rax, [rsp + 0x3d50]
mov qword [rsp + 0x1678], rax
lea rdx, [0x14014fb40]
mov rcx, qword [rsp + 0x1678]
call fcn.140003570
mov qword [rsp + 0x1680], rax
mov rax, qword [rsp + 0x1680]
mov qword [rsp + 0x1690], rax
mov r9d, dword [rsp + 0x3c8]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1688]
mov rcx, qword [rsp + 0x1690]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov r8, 0xffffffffffffffff
lea rdx, [0x14014fb5c]
lea rcx, [rsp + 0x4bf8]
call fcn.1400c2430
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3000]
lea rcx, [rsp + 0x4bf8]
call fcn.14000ac90
mov qword [rsp + 0x1698], rax
mov rax, qword [rsp + 0x1698]
mov qword [rsp + 0x16a0], rax
mov eax, dword [rsp + 0x74]
or eax, 1
mov dword [rsp + 0x74], eax
lea rdx, [0x1401d7b80]
mov rcx, qword [rsp + 0x16a0]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x14006cfdb
mov r8, 0xffffffffffffffff
lea rdx, [0x14014fb60]
lea rcx, [rsp + 0x4bf8]
call fcn.1400c2430
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3020]
lea rcx, [rsp + 0x4bf8]
call fcn.14000ac90
mov qword [rsp + 0x16a8], rax
mov rax, qword [rsp + 0x16a8]
mov qword [rsp + 0x16b0], rax
mov eax, dword [rsp + 0x74]
or eax, 2
mov dword [rsp + 0x74], eax
lea rdx, [0x1401d7548]
mov rcx, qword [rsp + 0x16b0]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x14006cfdb
mov dword [rsp + 0x230], 1
jmp 0x14006cfe6
mov dword [rsp + 0x230], 0
movzx eax, byte [rsp + 0x230]
mov byte [rsp + 0xdd], al
mov eax, dword [rsp + 0x74]
and eax, 2
test eax, eax
je 0x14006d013
and dword [rsp + 0x74], 0xfffffffd
lea rcx, [rsp + 0x3020]
call fcn.140003890
nop
mov eax, dword [rsp + 0x74]
and eax, 1
test eax, eax
je 0x14006d030
and dword [rsp + 0x74], 0xfffffffe
lea rcx, [rsp + 0x3000]
call fcn.140003890
movzx eax, byte [rsp + 0xdd]
test eax, eax
je 0x14006d0fe
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3cc], eax
lea rax, [rsp + 0x3d70]
mov qword [rsp + 0x16b8], rax
lea rdx, [0x14014428f]
mov rcx, qword [rsp + 0x16b8]
call fcn.140003570
mov qword [rsp + 0x16c0], rax
mov rax, qword [rsp + 0x16c0]
mov qword [rsp + 0x16c8], rax
mov rax, qword [rsp + 0x16c8]
mov qword [rsp + 0x16e0], rax
lea rax, [rsp + 0x3d90]
mov qword [rsp + 0x16d0], rax
lea rdx, [0x14014fb68]
mov rcx, qword [rsp + 0x16d0]
call fcn.140003570
mov qword [rsp + 0x16d8], rax
mov rax, qword [rsp + 0x16d8]
mov qword [rsp + 0x16e8], rax
mov r9d, dword [rsp + 0x3cc]
mov r8d, 0xa
mov rdx, qword [rsp + 0x16e0]
mov rcx, qword [rsp + 0x16e8]
call fcn.140052820
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x8c]
test eax, eax
je 0x14006d1cc
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3d0], eax
lea rax, [rsp + 0x3db0]
mov qword [rsp + 0x16f0], rax
lea rdx, [0x14014429a]
mov rcx, qword [rsp + 0x16f0]
call fcn.140003570
mov qword [rsp + 0x16f8], rax
mov rax, qword [rsp + 0x16f8]
mov qword [rsp + 0x1700], rax
mov rax, qword [rsp + 0x1700]
mov qword [rsp + 0x1718], rax
lea rax, [rsp + 0x3dd0]
mov qword [rsp + 0x1708], rax
lea rdx, [0x14014fb78]
mov rcx, qword [rsp + 0x1708]
call fcn.140003570
mov qword [rsp + 0x1710], rax
mov rax, qword [rsp + 0x1710]
mov qword [rsp + 0x1720], rax
mov r9d, dword [rsp + 0x3d0]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1718]
mov rcx, qword [rsp + 0x1720]
call fcn.140052820
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x8d]
test eax, eax
je 0x14006d29a
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3d4], eax
lea rax, [rsp + 0x3df0]
mov qword [rsp + 0x1728], rax
lea rdx, [0x14014429b]
mov rcx, qword [rsp + 0x1728]
call fcn.140003570
mov qword [rsp + 0x1730], rax
mov rax, qword [rsp + 0x1730]
mov qword [rsp + 0x1738], rax
mov rax, qword [rsp + 0x1738]
mov qword [rsp + 0x1750], rax
lea rax, [rsp + 0x3e10]
mov qword [rsp + 0x1740], rax
lea rdx, [0x14014fb98]
mov rcx, qword [rsp + 0x1740]
call fcn.140003570
mov qword [rsp + 0x1748], rax
mov rax, qword [rsp + 0x1748]
mov qword [rsp + 0x1758], rax
mov r9d, dword [rsp + 0x3d4]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1750]
mov rcx, qword [rsp + 0x1758]
call fcn.140052820
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x8e]
test eax, eax
je 0x14006d368
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3d8], eax
lea rax, [rsp + 0x3e30]
mov qword [rsp + 0x1760], rax
lea rdx, [0x14014429c]
mov rcx, qword [rsp + 0x1760]
call fcn.140003570
mov qword [rsp + 0x1768], rax
mov rax, qword [rsp + 0x1768]
mov qword [rsp + 0x1770], rax
mov rax, qword [rsp + 0x1770]
mov qword [rsp + 0x1788], rax
lea rax, [rsp + 0x3e50]
mov qword [rsp + 0x1778], rax
lea rdx, [0x14014fbb0]
mov rcx, qword [rsp + 0x1778]
call fcn.140003570
mov qword [rsp + 0x1780], rax
mov rax, qword [rsp + 0x1780]
mov qword [rsp + 0x1790], rax
mov r9d, dword [rsp + 0x3d8]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1788]
mov rcx, qword [rsp + 0x1790]
call fcn.140052820
mov byte [rsp + 0x70], 1
movzx eax, byte [rsp + 0x8f]
test eax, eax
je 0x14006d436
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3dc], eax
lea rax, [rsp + 0x3e70]
mov qword [rsp + 0x1798], rax
lea rdx, [0x14014429d]
mov rcx, qword [rsp + 0x1798]
call fcn.140003570
mov qword [rsp + 0x17a0], rax
mov rax, qword [rsp + 0x17a0]
mov qword [rsp + 0x17a8], rax
mov rax, qword [rsp + 0x17a8]
mov qword [rsp + 0x17c0], rax
lea rax, [rsp + 0x3e90]
mov qword [rsp + 0x17b0], rax
lea rdx, [0x14014fbd0]
mov rcx, qword [rsp + 0x17b0]
call fcn.140003570
mov qword [rsp + 0x17b8], rax
mov rax, qword [rsp + 0x17b8]
mov qword [rsp + 0x17c8], rax
mov r9d, dword [rsp + 0x3dc]
mov r8d, 0xa
mov rdx, qword [rsp + 0x17c0]
mov rcx, qword [rsp + 0x17c8]
call fcn.140052820
mov byte [rsp + 0x70], 1
lea rdx, [rsp + 0x2988]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006d813
lea rdx, [rsp + 0x2990]
lea rcx, [0x1401d7310]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ab8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006d813
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov qword [rsp + 0x17d0], rax
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
mov eax, dword [rax + 0x448]
mov rcx, qword [rsp + 0x17d0]
cmp dword [rcx + 0x790], eax
jne 0x14006d750
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x428
mov qword [rsp + 0x17d8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x770
mov qword [rsp + 0x17e0], rax
mov rdx, qword [rsp + 0x17d8]
mov rcx, qword [rsp + 0x17e0]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x128
mov qword [rsp + 0x17e8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x590
mov qword [rsp + 0x17f0], rax
mov rdx, qword [rsp + 0x17e8]
mov rcx, qword [rsp + 0x17f0]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x80
mov qword [rsp + 0x17f8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov qword [rsp + 0x1800], rax
mov rdx, qword [rsp + 0x17f8]
mov rcx, qword [rsp + 0x1800]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rdx, [rsp + 0x4df0]
lea rcx, [rsp + 0x4cb8]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rdx, [rsp + 0x4ca0]
lea rcx, [rsp + 0x4bc8]
call fcn.140010010
movzx eax, al
test eax, eax
jne 0x14006d750
lea rdx, [rsp + 0x5030]
lea rcx, [rsp + 0x4ee0]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rdx, [rsp + 0x5050]
lea rcx, [rsp + 0x4ea0]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x100
mov qword [rsp + 0x1808], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x200
mov qword [rsp + 0x1810], rax
mov rdx, qword [rsp + 0x1808]
mov rcx, qword [rsp + 0x1810]
call fcn.14000ff10
movzx eax, al
test eax, eax
jne 0x14006d750
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x3f8
mov qword [rsp + 0x1818], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x7f8
mov qword [rsp + 0x1820], rax
mov rdx, qword [rsp + 0x1818]
mov rcx, qword [rsp + 0x1820]
call fcn.140010050
movzx eax, al
test eax, eax
jne 0x14006d750
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x410
mov qword [rsp + 0x1828], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x810
mov qword [rsp + 0x1830], rax
mov rdx, qword [rsp + 0x1828]
mov rcx, qword [rsp + 0x1830]
call fcn.14000ff90
movzx eax, al
test eax, eax
je 0x14006d813
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3e0], eax
lea rax, [rsp + 0x3eb0]
mov qword [rsp + 0x1838], rax
lea rdx, [0x14014429e]
mov rcx, qword [rsp + 0x1838]
call fcn.140003570
mov qword [rsp + 0x1840], rax
mov rax, qword [rsp + 0x1840]
mov qword [rsp + 0x1848], rax
mov rax, qword [rsp + 0x1848]
mov qword [rsp + 0x1860], rax
lea rax, [rsp + 0x3ed0]
mov qword [rsp + 0x1850], rax
lea rdx, [0x14014fbe8]
mov rcx, qword [rsp + 0x1850]
call fcn.140003570
mov qword [rsp + 0x1858], rax
mov rax, qword [rsp + 0x1858]
mov qword [rsp + 0x1868], rax
mov r9d, dword [rsp + 0x3e0]
mov r8d, 0xa
mov rdx, qword [rsp + 0x1860]
mov rcx, qword [rsp + 0x1868]
call fcn.140052820
mov byte [rsp + 0x70], 1
mov byte [rsp + 0x78], 1
lea rdx, [0x14014fc08]
lea rcx, [rsp + 0x5240]
call fcn.140005fd0
nop
lea rdx, [rsp + 0x2998]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006d8a1
lea rdx, [rsp + 0x29a0]
lea rcx, [0x1401d7310]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ab8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006d8a1
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x130
mov rdx, rax
lea rcx, [rsp + 0x5240]
call fcn.140006550
lea rdx, [0x14014fc0c]
lea rcx, [rsp + 0x2bc8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2bc8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x14006d8de
mov dword [rsp + 0x234], 1
jmp 0x14006d8e9
mov dword [rsp + 0x234], 0
movzx eax, byte [rsp + 0x234]
mov byte [rsp + 0xde], al
lea rcx, [rsp + 0x2bc8]
call fcn.140003860
movzx eax, byte [rsp + 0xde]
test eax, eax
je 0x1400706f5
mov edx, 0xa
lea rcx, str._r________________________________________________________________________________________________________________________
call fcn.14004d7e0
movzx eax, byte [rsp + 0x9f]
test eax, eax
je 0x14006d98a
mov ecx, ntohs
call fcn.14007a320
lea rdx, [rsp + 0x5720]
lea rcx, str._nPROCESS_NAME:__s__Process_Ghosting_
call fcn.1400c83f0
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1a6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1870], rax
movzx edx, word [rsp + 0x1a6]
mov rcx, qword [rsp + 0x1870]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14006d9af
mov edx, 0xa
lea rcx, str._nPROCESS_NAME:
call fcn.14004d7e0
lea rdx, [rsp + 0x5720]
lea rcx, [0x14014fcf0]
call fcn.1400c83f0
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xcc]
lea rcx, str.__d__0x_x__bytes_
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._PID:
call fcn.14004d7e0
mov edx, dword [rsp + 0x41e0]
lea rcx, [0x14014fd14]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014fd18]
call fcn.14004d7e0
cmp dword [rsp + 0xac], 0xffffffff
jne 0x14006da28
mov edx, 0xa
lea rcx, [0x14014fd20]
call fcn.14004d7e0
lea rcx, [0x14014fd28]
call fcn.14000ad70
jmp 0x14006da4c
mov edx, 0xa
lea rcx, str._PPID:
call fcn.14004d7e0
mov edx, dword [rsp + 0xac]
lea rcx, [0x14014fd48]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014fd4c]
call fcn.14004d7e0
movzx eax, byte [rsp + 0xa0]
test eax, eax
jne 0x14006da79
movzx eax, byte [rsp + 0x92]
test eax, eax
je 0x14006df45
lea rdx, [rsp + 0x51c0]
lea rcx, [rsp + 0x5418]
call fcn.140005f30
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 1
imul rcx, rcx, 4
movzx eax, byte [rax + rcx + 0x580]
test eax, eax
je 0x14006dac5
lea rdx, [0x14014fd50]
lea rcx, [rsp + 0x5418]
call fcn.1400436a0
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x5418]
call fcn.140004b60
mov qword [rsp + 0x1878], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1880], rax
mov r8, qword [rsp + 0x1878]
mov rdx, qword [rsp + 0x1880]
lea rcx, str._nPath__VAD_:__S__S
call fcn.14000ad70
lea rcx, [rsp + 0x4f00]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._nSHA1__VAD_:__s
call fcn.14000ad70
lea rcx, [rsp + 0x51e0]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nFileCreationTime__VAD_:__S
call fcn.14000ad70
lea rcx, [rsp + 0x5200]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nFileLastAccessTime__VAD_:__S
call fcn.14000ad70
lea rcx, [rsp + 0x5180]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nFileLastWriteTime__VAD_:__S
call fcn.14000ad70
mov edx, 8
lea rcx, [0x14014fe10]
call fcn.14004d7e0
mov dword [rsp + 0x98], 0
jmp 0x14006dbcc
mov eax, dword [rsp + 0x98]
inc eax
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 4
jge 0x14006defa
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
movsxd rcx, dword [rsp + 0x98]
movzx eax, byte [rax + rcx + 0x370]
test eax, eax
jne 0x14006dc20
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
movzx eax, byte [rax + rcx + 0x580]
test eax, eax
je 0x14006def5
lea rdx, [rsp + 0x51c0]
lea rcx, [rsp + 0x5438]
call fcn.140005f30
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
movzx eax, byte [rax + rcx + 0x580]
test eax, eax
je 0x14006dc6b
lea rdx, [0x14014fe90]
lea rcx, [rsp + 0x5438]
call fcn.1400436a0
lea rcx, [rsp + 0x5438]
call fcn.140004b60
mov qword [rsp + 0x1888], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1890], rax
movsxd rax, dword [rsp + 0x98]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1898], rax
mov r9, qword [rsp + 0x1888]
mov r8, qword [rsp + 0x1890]
mov rdx, qword [rsp + 0x1898]
lea rcx, str._nPath___S_:__S__S
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x238]
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x18a0], rax
movsxd rax, dword [rsp + 0x98]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18a8], rax
mov r8, qword [rsp + 0x18a0]
mov rdx, qword [rsp + 0x18a8]
lea rcx, str._nSHA1___S_:__s
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x3a0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18b0], rax
movsxd rax, dword [rsp + 0x98]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18b8], rax
mov r8, qword [rsp + 0x18b0]
mov rdx, qword [rsp + 0x18b8]
lea rcx, str._nFileCreationTime___S_:__S
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x440]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18c0], rax
movsxd rax, dword [rsp + 0x98]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18c8], rax
mov r8, qword [rsp + 0x18c0]
mov rdx, qword [rsp + 0x18c8]
lea rcx, str._nFileLastAccessTime___S_:__S
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x98]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x4e0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18d0], rax
movsxd rax, dword [rsp + 0x98]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x18d8], rax
mov r8, qword [rsp + 0x18d0]
mov rdx, qword [rsp + 0x18d8]
lea rcx, str._nFileLastWriteTime___S_:__S
call fcn.14000ad70
mov edx, 8
lea rcx, [0x14014ff50]
call fcn.14004d7e0
nop
lea rcx, [rsp + 0x5438]
call fcn.140003890
jmp 0x14006dbbc
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1a8], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x18e0], rax
movzx edx, word [rsp + 0x1a8]
mov rcx, qword [rsp + 0x18e0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x5418]
call fcn.140003890
jmp 0x14006e050
mov edx, 0xa
lea rcx, str._nPath:
call fcn.14004d7e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014ffd8]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nSHA1:
call fcn.14004d7e0
lea rcx, [rsp + 0x4f00]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014ffe8]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nFileCreationTime:
call fcn.14004d7e0
lea rcx, [rsp + 0x51e0]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150004]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nFileLastAccessTime:
call fcn.14004d7e0
lea rcx, [rsp + 0x5200]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150020]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nFileLastWriteTime:
call fcn.14004d7e0
lea rcx, [rsp + 0x5180]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150040]
call fcn.14000ad70
mov edx, 8
lea rcx, [0x140150050]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, str._nNetwork:
call fcn.14004d7e0
mov dword [rsp + 0x148], 0
jmp 0x14006e07e
mov eax, dword [rsp + 0x148]
inc eax
mov dword [rsp + 0x148], eax
movsxd rax, dword [rsp + 0x148]
mov qword [rsp + 0x18e8], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov rcx, rax
call fcn.1400c32e0
mov rcx, qword [rsp + 0x18e8]
cmp rcx, rax
jae 0x14006e107
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov qword [rsp + 0x18f0], rax
movsxd rax, dword [rsp + 0x148]
mov rdx, rax
mov rcx, qword [rsp + 0x18f0]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._n_t_s
call fcn.14000ad70
jmp 0x14006e06e
movzx eax, byte [rsp + 0xa1]
test eax, eax
je 0x14006e176
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nLMIHV:__S__Process_Hollowing_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1aa], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x18f8], rax
movzx edx, word [rsp + 0x1aa]
mov rcx, qword [rsp + 0x18f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14006e27b
movzx eax, byte [rsp + 0x79]
test eax, eax
je 0x14006e1e2
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nLMIHV:__S__Process_Not_Initialized_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1ac], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1900], rax
movzx edx, word [rsp + 0x1ac]
mov rcx, qword [rsp + 0x1900]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14006e27b
movzx eax, byte [rsp + 0xa2]
test eax, eax
je 0x14006e24e
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nLMIHV:__S__Process_Hiding_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1b8], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1908], rax
movzx edx, word [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1908]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14006e27b
mov edx, 0xa
lea rcx, str._nLMIHV:
call fcn.14004d7e0
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14015015c]
call fcn.14000ad70
lea rax, [rsp + 0x5478]
mov rdi, rax
xor eax, eax
mov ecx, 0x12
rep stosb byte [rdi], al
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x3e4], eax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
mov qword [rsp + 0x1910], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov qword [rsp + 0x1918], rax
mov r9d, dword [rsp + 0x3e4]
lea r8, [rsp + 0x5478]
mov rdx, qword [rsp + 0x1910]
mov rcx, qword [rsp + 0x1918]
call fcn.1400519c0
movzx eax, byte [rsp + 0xc1]
test eax, eax
je 0x14006e35d
mov ecx, ntohs
call fcn.14007a320
mov edx, dword [rsp + 0xf8]
lea rcx, str._nEntry_Point__process_:_0x_08x__Entry_Point_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1ba], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1920], rax
movzx edx, word [rsp + 0x1ba]
mov rcx, qword [rsp + 0x1920]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14006e381
mov edx, 0xa
lea rcx, str._nEntry_Point__process_:
call fcn.14004d7e0
mov edx, dword [rsp + 0xf8]
lea rcx, [0x1401501ac]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nEntry_Point__file_:
call fcn.14004d7e0
mov edx, dword [rsp + 0x120]
lea rcx, str.0x_08x
call fcn.14000ad70
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x14006e425
mov ecx, ntohs
call fcn.14007a320
mov rdx, qword [rsp + 0x4b18]
lea rcx, str._nImageBaseAddress__PEB_:_0x_016llx__PEB_ImageBaseAddress_Forgery_
call fcn.14000ad70
mov rdx, qword [rsp + 0x158]
lea rcx, str._nImageBaseAddress__Ldr_:_0x_016llx
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1bc], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1928], rax
movzx edx, word [rsp + 0x1bc]
mov rcx, qword [rsp + 0x1928]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006e4c4
movzx eax, byte [rsp + 0x79]
test eax, eax
je 0x14006e49f
mov ecx, ntohs
call fcn.14007a320
mov rdx, qword [rsp + 0x4b18]
lea rcx, str._nImageBaseAddress__PEB_:_0x_016llx
call fcn.14000ad70
mov rdx, qword [rsp + 0x158]
lea rcx, str._nImageBaseAddress__Ldr_:_0x_016llx__Process_Not_Initialized_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1be], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1930], rax
movzx edx, word [rsp + 0x1be]
mov rcx, qword [rsp + 0x1930]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006e4c4
mov edx, 0xa
lea rcx, str._nProcess_Base_Address:
call fcn.14004d7e0
mov rdx, qword [rsp + 0x4ab0]
lea rcx, [0x1401502d8]
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b0]
test eax, eax
jne 0x14006e4f8
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b1]
test eax, eax
je 0x14006e943
lea rdx, [0x14014429f]
lea rcx, [rsp + 0x5318]
call fcn.140003570
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b0]
test eax, eax
je 0x14006e539
lea rdx, [0x1401502e8]
lea rcx, [rsp + 0x5318]
call fcn.140003940
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b1]
test eax, eax
je 0x14006e565
lea rdx, [0x1401502f8]
lea rcx, [rsp + 0x5318]
call fcn.140043640
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x5318]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._nPE_Sections:__s
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x1c0], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1938], rax
movzx edx, word [rsp + 0x1c0]
mov rcx, qword [rsp + 0x1938]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, str._nFrom_file:_nName_tCharacteristics_tPhysicalAddress_tPointerToRawData_tSizeofRawData_tVirtualAddress_tVirtualSize
call fcn.14004d7e0
mov edx, 8
lea rcx, [rsp + 0x4af8]
call fcn.1400079b0
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x148
mov qword [rsp + 0x1940], rax
lea rdx, [rsp + 0x4af8]
mov rcx, qword [rsp + 0x1940]
call fcn.1400b5f40
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x148
mov qword [rsp + 0x1948], rax
lea rdx, [rsp + 0x2840]
mov rcx, qword [rsp + 0x1948]
call fcn.1400bb550
mov rdx, rax
lea rcx, [rsp + 0x4af8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006e779
lea rcx, [rsp + 0x4af8]
call fcn.140042040
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x3e8], eax
lea rcx, [rsp + 0x4af8]
call fcn.140042040
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x3ec], eax
lea rcx, [rsp + 0x4af8]
call fcn.140042040
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x3f0], eax
lea rcx, [rsp + 0x4af8]
call fcn.140042040
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x3f4], eax
lea rcx, [rsp + 0x4af8]
call fcn.140042040
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x3f8], eax
lea rcx, [rsp + 0x4af8]
call fcn.140042040
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x3fc], eax
lea rcx, [rsp + 0x4af8]
call fcn.140042040
add rax, 8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1950], rax
mov eax, dword [rsp + 0x3e8]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3ec]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3f0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3f4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x3f8]
mov r8d, dword [rsp + 0x3fc]
mov rdx, qword [rsp + 0x1950]
lea rcx, [0x1401503a0]
call fcn.14000ad70
xor r8d, r8d
lea rdx, [rsp + 0x29b0]
lea rcx, [rsp + 0x4af8]
call fcn.1400421d0
jmp 0x14006e616
mov edx, 0xa
lea rcx, str._nFrom_memory:_nName_tCharacteristics_tPhysicalAddress_tPointerToRawData_tSizeofRawData_tVirtualAddress_tVirtualSize
call fcn.14004d7e0
mov edx, 8
lea rcx, [rsp + 0x4b00]
call fcn.1400079b0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5b8
mov qword [rsp + 0x1958], rax
lea rdx, [rsp + 0x4b00]
mov rcx, qword [rsp + 0x1958]
call fcn.1400b5ef0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5b8
mov qword [rsp + 0x1960], rax
lea rdx, [rsp + 0x29b8]
mov rcx, qword [rsp + 0x1960]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b00]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006e92f
lea rcx, [rsp + 0x4b00]
call fcn.140042060
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x400], eax
lea rcx, [rsp + 0x4b00]
call fcn.140042060
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x404], eax
lea rcx, [rsp + 0x4b00]
call fcn.140042060
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x408], eax
lea rcx, [rsp + 0x4b00]
call fcn.140042060
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x40c], eax
lea rcx, [rsp + 0x4b00]
call fcn.140042060
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x410], eax
lea rcx, [rsp + 0x4b00]
call fcn.140042060
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x414], eax
lea rcx, [rsp + 0x4b00]
call fcn.140042060
add rax, 8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1968], rax
mov eax, dword [rsp + 0x400]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x404]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x408]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x40c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x410]
mov r8d, dword [rsp + 0x414]
mov rdx, qword [rsp + 0x1968]
lea rcx, str._n_s_t0x_08x_t0x_08x_t0x_08x_t_t_d_t_t0x_08x_t_d
call fcn.14000ad70
xor r8d, r8d
lea rdx, [rsp + 0x29c0]
lea rcx, [rsp + 0x4b00]
call fcn.1400421d0
jmp 0x14006e7cc
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x5318]
call fcn.140003860
jmp 0x14006e97e
mov edx, 0xa
lea rcx, str._nPE_Sections:
call fcn.14004d7e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x590
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140150478]
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5d8]
cmp eax, 1
jne 0x14006ec8f
mov ecx, ntohs
call fcn.14007a320
mov edx, 0x10
lea rcx, [rsp + 0x4e40]
call fcn.1400079b0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5c8
mov rdx, rax
lea rcx, [rsp + 0x4e40]
call fcn.140033c10
nop
mov edx, 8
lea rcx, [rsp + 0x4ae0]
call fcn.1400079b0
lea rdx, [rsp + 0x4ae0]
lea rcx, [rsp + 0x4e40]
call fcn.1400b5ef0
lea rdx, [rsp + 0x29c8]
lea rcx, [rsp + 0x4e40]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ae0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14006ec49
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
movzx eax, byte [rax + 0x58]
test eax, eax
je 0x14006ec2c
lea rcx, str._nAbnormal_memory_region:
call fcn.14000ad70
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
mov rdx, qword [rax + 0x10]
lea rcx, str._n__Region_address:_0x_016llx
call fcn.14000ad70
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
add rax, 0xa0
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._n__Section:__s
call fcn.14000ad70
lea rdx, [0x1401442b2]
lea rcx, [rsp + 0x5280]
call fcn.140003570
nop
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
movzx eax, byte [rax + 0x59]
test eax, eax
je 0x14006eadc
lea rdx, [0x1401504d0]
lea rcx, [rsp + 0x5280]
call fcn.140003940
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
movzx eax, byte [rax + 0x5c]
test eax, eax
je 0x14006eb86
lea rdx, [0x1401504f0]
lea rcx, [rsp + 0x5280]
call fcn.140043640
lea rcx, [rsp + 0x5280]
call fcn.1400b3ed0
mov qword [rsp + 0x1970], rax
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
add rax, 0x38
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1978], rax
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
add rax, 0x18
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1980], rax
mov r9, qword [rsp + 0x1970]
mov r8, qword [rsp + 0x1978]
mov rdx, qword [rsp + 0x1980]
lea rcx, str._n__Protection__current_declared_:__s__s__s
call fcn.14000ad70
jmp 0x14006ebd8
lea rcx, [rsp + 0x5280]
call fcn.1400b3ed0
mov qword [rsp + 0x1988], rax
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
add rax, 0x18
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1990], rax
mov r8, qword [rsp + 0x1988]
mov rdx, qword [rsp + 0x1990]
lea rcx, str._n__Protection:__s__s
call fcn.14000ad70
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
movzx eax, byte [rax + 0x5b]
test eax, eax
je 0x14006ebf9
lea rcx, str._n___Process_Private_Memory_Region_
call fcn.14000ad70
lea rcx, [rsp + 0x4ae0]
call fcn.140042060
movzx eax, byte [rax + 0x5a]
test eax, eax
je 0x14006ec1a
lea rcx, str._n___Process_Unknown_Executable_Memory_Region_
call fcn.14000ad70
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x5280]
call fcn.140003860
xor r8d, r8d
lea rdx, [rsp + 0x29d0]
lea rcx, [rsp + 0x4ae0]
call fcn.1400421d0
jmp 0x14006ea02
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x160], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1998], rax
movzx edx, word [rsp + 0x160]
mov rcx, qword [rsp + 0x1998]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x4e40]
call fcn.14003cc30
movzx eax, byte [rsp + 0x8c]
test eax, eax
je 0x14006ecf7
mov ecx, ntohs
call fcn.14007a320
mov edx, dword [rsp + 0x124]
lea rcx, str._nSizeOfInitializedData:__d__SizeOfInitializedData_is_0_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x162], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19a0], rax
movzx edx, word [rsp + 0x162]
mov rcx, qword [rsp + 0x19a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006ed1b
mov edx, 0xa
lea rcx, str._nSizeOfInitializedData:
call fcn.14004d7e0
mov edx, dword [rsp + 0x124]
lea rcx, [0x14015061c]
call fcn.14000ad70
movzx eax, byte [rsp + 0x8d]
test eax, eax
je 0x14006edbe
mov ecx, ntohs
call fcn.14007a320
movzx eax, word [rsp + 0x84]
mov edx, eax
lea rcx, str._nDLLCharacteristics:_0x_x__Process_PE_Anomalies_
call fcn.14000ad70
movzx eax, word [rsp + 0x88]
mov edx, eax
lea rcx, str._nMajorImageVersion:__d__Process_PE_Anomalies_
call fcn.14000ad70
mov r8d, dword [rsp + 0xc4]
mov edx, dword [rsp + 0xb0]
lea rcx, str._nCheckSum_original_computed:_0x_x_0x_x__Process_PE_Anomalies_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x164], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19a8], rax
movzx edx, word [rsp + 0x164]
mov rcx, qword [rsp + 0x19a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006efbf
movzx eax, byte [rsp + 0x8f]
test eax, eax
je 0x14006ee83
mov edx, 0xa
lea rcx, [0x1401506c8]
call fcn.14004d7e0
movzx eax, word [rsp + 0x84]
mov edx, eax
lea rcx, [0x1401506e0]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x1401506e8]
call fcn.14004d7e0
movzx eax, word [rsp + 0x88]
mov edx, eax
lea rcx, [0x140150700]
call fcn.14000ad70
mov ecx, ntohs
call fcn.14007a320
mov r8d, dword [rsp + 0xc4]
mov edx, dword [rsp + 0xb0]
lea rcx, str._nCheckSum_original_computed:_0x_x_0x_x__Process_CheckSum_is_0_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x166], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19b0], rax
movzx edx, word [rsp + 0x166]
mov rcx, qword [rsp + 0x19b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006efbf
movzx eax, byte [rsp + 0x8e]
test eax, eax
je 0x14006ef45
mov edx, 0xa
lea rcx, [0x140150748]
call fcn.14004d7e0
movzx eax, word [rsp + 0x84]
mov edx, eax
lea rcx, [0x140150760]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140150768]
call fcn.14004d7e0
movzx eax, word [rsp + 0x88]
mov edx, eax
lea rcx, [0x140150780]
call fcn.14000ad70
mov ecx, ntohs
call fcn.14007a320
mov r8d, dword [rsp + 0xc4]
mov edx, dword [rsp + 0xb0]
lea rcx, str._nCheckSum_original_computed:_0x_x_0x_x__Process_CheckSum_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x168], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19b8], rax
movzx edx, word [rsp + 0x168]
mov rcx, qword [rsp + 0x19b8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006efbf
mov edx, 0xa
lea rcx, str._nDLLCharacteristics:
call fcn.14004d7e0
movzx eax, word [rsp + 0x84]
mov edx, eax
lea rcx, str.0x_x
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nMajorImageVersion:
call fcn.14004d7e0
movzx eax, word [rsp + 0x88]
mov edx, eax
lea rcx, [0x140150810]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nCheckSum_original_computed:
call fcn.14004d7e0
mov r8d, dword [rsp + 0xc4]
mov edx, dword [rsp + 0xb0]
lea rcx, str.0x_x_0x_x
call fcn.14000ad70
lea rdx, [0x140150844]
lea rcx, [rsp + 0x52a0]
call fcn.140005fd0
nop
movzx eax, byte [rsp + 0xa3]
test eax, eax
je 0x14006eff4
lea rdx, [0x140150848]
lea rcx, [rsp + 0x52a0]
call fcn.1400097c0
movzx eax, byte [rsp + 0xa4]
test eax, eax
je 0x14006f014
lea rdx, [0x140150880]
lea rcx, [rsp + 0x52a0]
call fcn.1400436a0
lea rcx, [rsp + 0x52a0]
call fcn.1400bb3f0
movzx eax, al
test eax, eax
jne 0x14006f0b6
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x52a0]
call fcn.140004b60
mov qword [rsp + 0x19c0], rax
lea rcx, [rsp + 0x50a8]
call fcn.140004b60
mov qword [rsp + 0x19c8], rax
mov r8, qword [rsp + 0x19c0]
mov rdx, qword [rsp + 0x19c8]
lea rcx, str._nWindow_StationDesktop:__S__S
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x16a], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19d0], rax
movzx edx, word [rsp + 0x16a]
mov rcx, qword [rsp + 0x19d0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14006f0e3
mov edx, 0xa
lea rcx, str._nWindow_StationDesktop:
call fcn.14004d7e0
lea rcx, [rsp + 0x50a8]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150914]
call fcn.14000ad70
movzx eax, byte [rsp + 0x90]
test eax, eax
je 0x14006f61d
mov eax, dword [rsp + 0x4af0]
mov ecx, dword [rsp + 0x4af4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ac8], eax
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov eax, dword [rax + 0x88]
cmp dword [rsp + 0x10c], eax
jne 0x14006f168
mov edx, 0xa
lea rcx, [0x140150918]
call fcn.14004d7e0
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov edx, dword [rax + 0x88]
lea rcx, [0x14015092c]
call fcn.14000ad70
jmp 0x14006f1d5
mov ecx, ntohs
call fcn.14007a320
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov edx, dword [rax + 0x88]
lea rcx, str._nSession_ID__LSA_:__d__Alternative_Credentials_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x16c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19d8], rax
movzx edx, word [rsp + 0x16c]
mov rcx, qword [rsp + 0x19d8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
mov edx, 0xa
lea rcx, [0x140150960]
call fcn.14004d7e0
mov edx, dword [rsp + 0x10c]
lea rcx, [0x140150978]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140150980]
call fcn.14004d7e0
mov r8d, dword [rsp + 0x4af0]
mov edx, dword [rsp + 0x4af4]
lea rcx, [0x140150998]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x1401509a8]
call fcn.14004d7e0
mov r8d, dword [rsp + 0x250]
mov edx, dword [rsp + 0x254]
lea rcx, str.0x_x:0x_x
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x1401509d8]
call fcn.14004d7e0
mov rdx, qword [rsp + 0x41f8]
lea rcx, [0x1401509ec]
call fcn.1400c83f0
lea rdx, [0x1401509f8]
lea rcx, [rsp + 0x4e10]
call fcn.1400b6ea0
test eax, eax
jne 0x14006f2bd
mov edx, 0xa
lea rcx, [0x140150a08]
call fcn.14004d7e0
lea rcx, [rsp + 0x4e10]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140150a18]
call fcn.14000ad70
jmp 0x14006f331
mov ecx, ntohs
call fcn.14007a320
mov edx, 0xa
lea rcx, [0x140150a20]
call fcn.14004d7e0
lea rcx, [rsp + 0x4e10]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140150a30]
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x16e], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19e0], rax
movzx edx, word [rsp + 0x16e]
mov rcx, qword [rsp + 0x19e0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
lea rdx, [0x140150a34]
lea rcx, [rsp + 0x4c20]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006f42a
movzx eax, byte [rsp + 0xa5]
test eax, eax
jne 0x14006f36c
movzx eax, byte [rsp + 0x81]
test eax, eax
je 0x14006f3fb
mov ecx, ntohs
call fcn.14007a320
movzx eax, byte [rsp + 0x81]
test eax, eax
je 0x14006f3a0
lea rcx, [rsp + 0x4c20]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nLogon_Type:__S__Alternative_Network_Credentials_
call fcn.14000ad70
jmp 0x14006f3bc
lea rcx, [rsp + 0x4c20]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nLogon_Type:__S__LogonType_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x170], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19e8], rax
movzx edx, word [rsp + 0x170]
mov rcx, qword [rsp + 0x19e8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006f428
mov edx, 0xa
lea rcx, [0x140150a90]
call fcn.14004d7e0
lea rcx, [rsp + 0x4c20]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150aa0]
call fcn.14000ad70
jmp 0x14006f43b
mov edx, 0xa
lea rcx, [0x140150ab8]
call fcn.14004d7e0
lea rdx, [0x140150ae0]
lea rcx, [rsp + 0x4d20]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006f518
movzx eax, byte [0x1401d2a16]
test eax, eax
je 0x14006f4e9
lea rdx, str.NTLM
lea rcx, [rsp + 0x4d20]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14006f4e9
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4d20]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nAuthenticationPackage:__S
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x172], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19f0], rax
movzx edx, word [rsp + 0x172]
mov rcx, qword [rsp + 0x19f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006f516
mov edx, 0xa
lea rcx, [0x140150b68]
call fcn.14004d7e0
lea rcx, [rsp + 0x4d20]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150ba0]
call fcn.14000ad70
jmp 0x14006f529
mov edx, 0xa
lea rcx, [0x140150bc0]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, [0x140150be0]
call fcn.14004d7e0
lea r8, [rsp + 0x5930]
lea rdx, [rsp + 0x5c40]
lea rcx, [0x140150bfc]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140150c14]
call fcn.14004d7e0
mov rdx, qword [rsp + 0x4220]
lea rcx, [0x140150c24]
call fcn.1400c83f0
lea rdx, [0x140150c5c]
lea rcx, [rsp + 0x4d78]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14006f5fb
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4d78]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nMember_of:__S__Admin_Privs_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x174], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x19f8], rax
movzx edx, word [rsp + 0x174]
mov rcx, qword [rsp + 0x19f8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006f618
mov edx, 0xa
lea rcx, str._nNot_member_of:
call fcn.14004d7e0
lea rcx, str.BUILTINAdministrators_group.
call fcn.14000ad70
jmp 0x14006f6d7
mov ecx, 0xa
call fcn.14007a320
lea rcx, str._nSession_ID__Process_:
call fcn.14000ad70
lea rcx, str._nSession_ID__LSA_:
call fcn.14000ad70
lea rcx, str._nLogon_Session:
call fcn.14000ad70
lea rcx, str._nOriginating_Logon_Session:
call fcn.14000ad70
lea rcx, str._nToken_Integrity:
call fcn.14000ad70
lea rcx, str._nToken_Type:
call fcn.14000ad70
lea rcx, str._nLogon_Type:
call fcn.14000ad70
lea rcx, str._nAuthenticationPackage:
call fcn.14000ad70
lea rcx, str._nDomainUser:
call fcn.1400c83f0
lea rcx, str._nSID:
call fcn.1400c83f0
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x176], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1a00], rax
movzx edx, word [rsp + 0x176]
mov rcx, qword [rsp + 0x1a00]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, byte [rsp + 0x91]
test eax, eax
je 0x14006f831
mov ecx, ntohs
call fcn.14007a320
lea rcx, str._nCmdLine:__Suspicious_Commandline_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x178], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1a08], rax
movzx edx, word [rsp + 0x178]
mov rcx, qword [rsp + 0x1a08]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rax, [rsp + 0x3ef0]
mov qword [rsp + 0x1a10], rax
lea rdx, [0x140150ed8]
mov rcx, qword [rsp + 0x1a10]
call fcn.140003570
mov qword [rsp + 0x1a18], rax
mov rax, qword [rsp + 0x1a18]
mov qword [rsp + 0x1a20], rax
lea rcx, [rsp + 0x5010]
call fcn.140004b60
mov qword [rsp + 0x1a28], rax
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9, qword [rsp + 0x1a20]
mov r8d, 0x100
mov rdx, qword [rsp + 0x1a28]
xor ecx, ecx
call fcn.14007a6b0
lea rax, [rsp + 0x3f10]
mov qword [rsp + 0x1a30], rax
lea rdx, [0x140150ef0]
mov rcx, qword [rsp + 0x1a30]
call fcn.140003570
mov qword [rsp + 0x1a38], rax
mov rax, qword [rsp + 0x1a38]
mov qword [rsp + 0x1a40], rax
lea rcx, [rsp + 0x5010]
call fcn.140004b60
mov qword [rsp + 0x1a48], rax
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 0
mov r9, qword [rsp + 0x1a40]
mov r8d, 0x20
mov rdx, qword [rsp + 0x1a48]
xor ecx, ecx
call fcn.14009ee40
jmp 0x14006f85e
mov edx, 0xa
lea rcx, str._nCmdLine:
call fcn.14004d7e0
lea rcx, [rsp + 0x5010]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150f30]
call fcn.14000ad70
mov r8, 0xffffffffffffffff
lea rdx, [0x140150f70]
lea rcx, [rsp + 0x4bf8]
call fcn.1400c2430
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x2fc0]
lea rcx, [rsp + 0x4bf8]
call fcn.14000ac90
mov qword [rsp + 0x1a50], rax
mov rax, qword [rsp + 0x1a50]
mov qword [rsp + 0x1a58], rax
mov eax, dword [rsp + 0x74]
or eax, 4
mov dword [rsp + 0x74], eax
lea rdx, [0x1401d7b80]
mov rcx, qword [rsp + 0x1a58]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x14006f957
mov r8, 0xffffffffffffffff
lea rdx, [0x140150f88]
lea rcx, [rsp + 0x4bf8]
call fcn.1400c2430
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x2fe0]
lea rcx, [rsp + 0x4bf8]
call fcn.14000ac90
mov qword [rsp + 0x1a60], rax
mov rax, qword [rsp + 0x1a60]
mov qword [rsp + 0x1a68], rax
mov eax, dword [rsp + 0x74]
or eax, 8
mov dword [rsp + 0x74], eax
lea rdx, [0x1401d7548]
mov rcx, qword [rsp + 0x1a68]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x14006f957
mov dword [rsp + 0x238], 1
jmp 0x14006f962
mov dword [rsp + 0x238], 0
movzx eax, byte [rsp + 0x238]
mov byte [rsp + 0xdf], al
mov eax, dword [rsp + 0x74]
and eax, 8
test eax, eax
je 0x14006f98f
and dword [rsp + 0x74], 0xfffffff7
lea rcx, [rsp + 0x2fe0]
call fcn.140003890
nop
mov eax, dword [rsp + 0x74]
and eax, 4
test eax, eax
je 0x14006f9ac
and dword [rsp + 0x74], 0xfffffffb
lea rcx, [rsp + 0x2fc0]
call fcn.140003890
movzx eax, byte [rsp + 0xdf]
test eax, eax
je 0x14006fa1d
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4bf8]
call fcn.140004b60
mov rdx, rax
lea rcx, str._nCWD:__S__Unusual_CWD_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x17a], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1a70], rax
movzx edx, word [rsp + 0x17a]
mov rcx, qword [rsp + 0x1a70]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006fa4a
mov edx, 0xa
lea rcx, str._nCWD:
call fcn.14004d7e0
lea rcx, [rsp + 0x4bf8]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140150fe4]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nServices:
call fcn.14004d7e0
lea rcx, [rsp + 0x4dd8]
call fcn.1400c32e0
test rax, rax
jbe 0x14006fb01
lea rax, [rsp + 0x4dd8]
mov qword [rsp + 0x968], rax
mov rcx, qword [rsp + 0x968]
call fcn.140008ce0
mov qword [rsp + 0x248], rax
mov rcx, qword [rsp + 0x968]
call fcn.14001c8b0
mov qword [rsp + 0x1a78], rax
jmp 0x14006fac1
mov rax, qword [rsp + 0x248]
add rax, 0x20
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x1a78]
cmp qword [rsp + 0x248], rax
je 0x14006fb01
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x1a80], rax
mov rcx, qword [rsp + 0x1a80]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140151024]
call fcn.14000ad70
jmp 0x14006faad
mov edx, 0xa
lea rcx, str._nPE_format:
call fcn.14004d7e0
lea rcx, [rsp + 0x5240]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14015106c]
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, word [rax + 0x5da]
cmp eax, 0x8664
jne 0x14006fb68
mov edx, 0xa
lea rcx, [0x140151088]
call fcn.14004d7e0
lea rcx, str.IMAGE_FILE_MACHINE_AMD64
call fcn.14000ad70
jmp 0x14006fba0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, word [rax + 0x5da]
cmp eax, 0x14c
jne 0x14006fba0
mov edx, 0xa
lea rcx, str._nTarget_Machine:
call fcn.14004d7e0
lea rcx, str.IMAGE_FILE_MACHINE_I386
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nLoad_time:
call fcn.14004d7e0
lea rdx, [rsp + 0x5f50]
lea rcx, [0x140151100]
call fcn.1400c83f0
mov edx, 0xa
lea rcx, str._nLoad_delay:
call fcn.14004d7e0
cmp dword [rsp + 0x1d0], 0
je 0x14006fbec
lea rcx, [0x140151118]
call fcn.14000ad70
lea rdx, [rsp + 0x6160]
lea rcx, [0x14015111c]
call fcn.1400c83f0
xor r8d, r8d
lea rdx, [0x140151124]
lea rcx, [rsp + 0x4d58]
call fcn.1400bc850
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3400]
lea rcx, [rsp + 0x4d58]
call fcn.14000ac90
mov qword [rsp + 0x1a88], rax
mov rax, qword [rsp + 0x1a88]
mov qword [rsp + 0x1a90], rax
mov rax, qword [rsp + 0x1a90]
mov qword [rsp + 0x1aa8], rax
xor r8d, r8d
lea rdx, [0x140151128]
lea rcx, [rsp + 0x5088]
call fcn.1400bc850
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x2fa0]
lea rcx, [rsp + 0x5088]
call fcn.14000ac90
mov qword [rsp + 0x1a98], rax
mov rax, qword [rsp + 0x1a98]
mov qword [rsp + 0x1aa0], rax
mov rax, qword [rsp + 0x1aa0]
mov qword [rsp + 0x1ab0], rax
mov rdx, qword [rsp + 0x1aa8]
mov rcx, qword [rsp + 0x1ab0]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x14006fcdd
mov dword [rsp + 0x23c], 1
jmp 0x14006fce8
mov dword [rsp + 0x23c], 0
movzx eax, byte [rsp + 0x23c]
mov byte [rsp + 0xe0], al
lea rcx, [rsp + 0x2fa0]
call fcn.140003890
nop
lea rcx, [rsp + 0x3400]
call fcn.140003890
movzx eax, byte [rsp + 0xe0]
test eax, eax
je 0x14006fd98
mov ecx, ntohs
call fcn.14007a320
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
add rax, 0x1b0
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, str._nInternalName:__S__Process_Name___Internal_Name_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x17c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1ab8], rax
movzx edx, word [rsp + 0x17c]
mov rcx, qword [rsp + 0x1ab8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006fdda
mov edx, 0xa
lea rcx, str._nInternalName:
call fcn.14004d7e0
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
add rax, 0x1b0
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140151178]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nOriginalFileName:
call fcn.14004d7e0
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
add rax, 0x1d0
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140151194]
call fcn.14000ad70
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
mov qword [rsp + 0x1ac0], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov qword [rsp + 0x1ac8], rax
mov rdx, qword [rsp + 0x1ac0]
mov rcx, qword [rsp + 0x1ac8]
call fcn.14007af70
mov edx, 0xa
lea rcx, str._nSignature:
call fcn.14004d7e0
movzx eax, byte [rsp + 0xa6]
test eax, eax
je 0x14006feeb
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x51a0]
call fcn.140004b60
mov rdx, rax
lea rcx, str._S__Process_Not_Signed_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x17e], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1ad0], rax
movzx edx, word [rsp + 0x17e]
mov rcx, qword [rsp + 0x1ad0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14006ff07
lea rcx, [rsp + 0x51a0]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x1401511c0]
call fcn.14000ad70
lea rdx, [rsp + 0x29d8]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x1400700b4
lea rdx, [rsp + 0x29e0]
lea rcx, [0x1401d7310]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ab8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x1400700b4
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x80
mov qword [rsp + 0x1ad8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov qword [rsp + 0x1ae0], rax
mov rdx, qword [rsp + 0x1ad8]
mov rcx, qword [rsp + 0x1ae0]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x140070077
mov edx, 0xa
lea rcx, str._nPDB_file__memory____file_:
call fcn.14004d7e0
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x80
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1ae8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1af0], rax
mov r8, qword [rsp + 0x1ae8]
mov rdx, qword [rsp + 0x1af0]
lea rcx, [0x1401511e8]
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x180], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1af8], rax
movzx edx, word [rsp + 0x180]
mov rcx, qword [rsp + 0x1af8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x1400700b2
mov edx, 0xa
lea rcx, [0x140151210]
call fcn.14004d7e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14015121c]
call fcn.14000ad70
jmp 0x1400700ef
mov edx, 0xa
lea rcx, str._nPDB_file:
call fcn.14004d7e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14015122c]
call fcn.14000ad70
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x7d9]
test eax, eax
jne 0x140070127
lea rdx, [rsp + 0x4df0]
lea rcx, [rsp + 0x4cb8]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x140070238
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x7d9]
test eax, eax
je 0x1400701a2
mov edx, 0xa
lea rcx, [0x140151230]
call fcn.14004d7e0
lea rcx, [rsp + 0x4df0]
call fcn.1400b3ed0
mov qword [rsp + 0x1b00], rax
lea rcx, [rsp + 0x4cb8]
call fcn.1400b3ed0
mov qword [rsp + 0x1b08], rax
mov r8, qword [rsp + 0x1b00]
mov rdx, qword [rsp + 0x1b08]
lea rcx, str._s_____s__Delphi_4
call fcn.14000ad70
jmp 0x1400701f9
mov edx, 0xa
lea rcx, str._nIMAGE_FILE_HEADER_TimeDateStamp__memory____file_:
call fcn.14004d7e0
lea rcx, [rsp + 0x4df0]
call fcn.1400b3ed0
mov qword [rsp + 0x1b10], rax
lea rcx, [rsp + 0x4cb8]
call fcn.1400b3ed0
mov qword [rsp + 0x1b18], rax
mov r8, qword [rsp + 0x1b10]
mov rdx, qword [rsp + 0x1b18]
lea rcx, str._s_____s__Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x182], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1b20], rax
movzx edx, word [rsp + 0x182]
mov rcx, qword [rsp + 0x1b20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x140070265
mov edx, 0xa
lea rcx, str._nIMAGE_FILE_HEADER_TimeDateStamp:
call fcn.14004d7e0
lea rcx, [rsp + 0x4cb8]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14015132c]
call fcn.14000ad70
lea rdx, [rsp + 0x4ca0]
lea rcx, [rsp + 0x4bc8]
call fcn.140010010
movzx eax, al
test eax, eax
je 0x140070465
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x4bc8]
call fcn.1400c32e0
test rax, rax
jbe 0x140070348
lea rax, [rsp + 0x4bc8]
mov qword [rsp + 0x978], rax
mov rcx, qword [rsp + 0x978]
call fcn.140008ce0
mov qword [rsp + 0x260], rax
mov rcx, qword [rsp + 0x978]
call fcn.14001c8b0
mov qword [rsp + 0x1b28], rax
jmp 0x1400702f5
mov rax, qword [rsp + 0x260]
add rax, 0x20
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x1b28]
cmp qword [rsp + 0x260], rax
je 0x140070346
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x1b30], rax
mov edx, 0xa
lea rcx, [0x140151330]
call fcn.14004d7e0
mov rcx, qword [rsp + 0x1b30]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140151368]
call fcn.14000ad70
jmp 0x1400702e1
jmp 0x140070359
mov edx, 0xa
lea rcx, str._nIMAGE_DEBUG_DIRECTORY_TimeDateStamp__memory_:
call fcn.14004d7e0
lea rcx, [rsp + 0x4ca0]
call fcn.1400c32e0
test rax, rax
jbe 0x140070412
lea rax, [rsp + 0x4ca0]
mov qword [rsp + 0x8f8], rax
mov rcx, qword [rsp + 0x8f8]
call fcn.140008ce0
mov qword [rsp + 0x258], rax
mov rcx, qword [rsp + 0x8f8]
call fcn.14001c8b0
mov qword [rsp + 0x1b38], rax
jmp 0x1400703bf
mov rax, qword [rsp + 0x258]
add rax, 0x20
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x1b38]
cmp qword [rsp + 0x258], rax
je 0x140070410
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x1b40], rax
mov edx, 0xa
lea rcx, [0x1401513c8]
call fcn.14004d7e0
mov rcx, qword [rsp + 0x1b40]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._s__Memory_File_Values_Mismatch_
call fcn.14000ad70
jmp 0x1400703ab
jmp 0x140070423
mov edx, 0xa
lea rcx, str._nIMAGE_DEBUG_DIRECTORY_TimeDateStamp__file_:
call fcn.14004d7e0
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x184], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1b48], rax
movzx edx, word [rsp + 0x184]
mov rcx, qword [rsp + 0x1b48]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14007052f
lea rcx, [rsp + 0x4bc8]
call fcn.1400c32e0
test rax, rax
jbe 0x14007051e
lea rax, [rsp + 0x4bc8]
mov qword [rsp + 0x970], rax
mov rcx, qword [rsp + 0x970]
call fcn.140008ce0
mov qword [rsp + 0x270], rax
mov rcx, qword [rsp + 0x970]
call fcn.14001c8b0
mov qword [rsp + 0x1b50], rax
jmp 0x1400704cb
mov rax, qword [rsp + 0x270]
add rax, 0x20
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x1b50]
cmp qword [rsp + 0x270], rax
je 0x14007051c
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x1b58], rax
mov edx, 0xa
lea rcx, [0x140151460]
call fcn.14004d7e0
mov rcx, qword [rsp + 0x1b58]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14015148c]
call fcn.14000ad70
jmp 0x1400704b7
jmp 0x14007052f
mov edx, 0xa
lea rcx, str._nIMAGE_DEBUG_DIRECTORY_TimeDateStamp:
call fcn.14004d7e0
lea rdx, [rsp + 0x5030]
lea rcx, [rsp + 0x4ee0]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x1400705de
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x5030]
call fcn.1400b3ed0
mov qword [rsp + 0x1b60], rax
lea rcx, [rsp + 0x4ee0]
call fcn.1400b3ed0
mov qword [rsp + 0x1b68], rax
mov r8, qword [rsp + 0x1b60]
mov rdx, qword [rsp + 0x1b68]
lea rcx, str._nIMAGE_EXPORT_DIRECTORY_TimeDateStamp__memory____file_:__s_____s__Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x186], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1b70], rax
movzx edx, word [rsp + 0x186]
mov rcx, qword [rsp + 0x1b70]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x14007060b
mov edx, 0xa
lea rcx, str._nIMAGE_EXPORT_DIRECTORY_TimeDateStamp:
call fcn.14004d7e0
lea rcx, [rsp + 0x4ee0]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140151554]
call fcn.14000ad70
lea rdx, [rsp + 0x5050]
lea rcx, [rsp + 0x4ea0]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x1400706ba
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x5050]
call fcn.1400b3ed0
mov qword [rsp + 0x1b78], rax
lea rcx, [rsp + 0x4ea0]
call fcn.1400b3ed0
mov qword [rsp + 0x1b80], rax
mov r8, qword [rsp + 0x1b78]
mov rdx, qword [rsp + 0x1b80]
lea rcx, str._nIMAGE_RESOURCE_DIRECTORY_TimeDateStamp__memory____file_:__s_____s__Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x188], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x1b88], rax
movzx edx, word [rsp + 0x188]
mov rcx, qword [rsp + 0x1b88]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov byte [rsp + 0x70], 1
jmp 0x1400706e8
mov edx, 0xa
lea rcx, str._nIMAGE_RESOURCE_DIRECTORY_TimeDateStamp:
call fcn.14004d7e0
lea rcx, [rsp + 0x4ea0]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401515f4]
call fcn.14000ad70
nop
lea rcx, [rsp + 0x52a0]
call fcn.140003890
lea rcx, [rsp + 0x5590]
call fcn.140006080
nop
mov edx, 0x18
lea rcx, [rsp + 0x4ce8]
call fcn.1400079b0
lea rcx, [rsp + 0x4ce8]
call fcn.140034230
nop
lea rcx, [rsp + 0x4ba8]
call fcn.140006080
nop
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2c08]
call fcn.140003570
nop
lea rdx, [rsp + 0x2c08]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xe1], al
lea rcx, [rsp + 0x2c08]
call fcn.140003860
movzx eax, byte [rsp + 0xe1]
test eax, eax
je 0x140076c74
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
movzx eax, byte [rsp + 0x9f]
test eax, eax
je 0x1400708b4
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x418], eax
lea rcx, [0x1401d7470]
call fcn.1400b3ed0
mov qword [rsp + 0x1b90], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x41c], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1b98], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1ba0], rax
mov eax, dword [rsp + 0x418]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x40], eax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5720]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1b90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x41c]
lea r8, str._n_div_class_main__id_d__div_class_processName___sPROCESS_NAME:__S__s_Process_Ghosting__s___d__0x_x__bytes___PID:__d____font_
mov rdx, qword [rsp + 0x1b98]
mov rcx, qword [rsp + 0x1ba0]
call fcn.1400c8230
mov dword [rsp + 0x420], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x424], eax
mov eax, dword [rsp + 0x420]
mov ecx, dword [rsp + 0x424]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x14007099f
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x428], eax
lea rcx, [0x1401d7470]
call fcn.1400b3ed0
mov qword [rsp + 0x1ba8], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x42c], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1bb0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1bb8], rax
mov eax, dword [rsp + 0x428]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xcc]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x5720]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1ba8]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x42c]
lea r8, str._n_div_class_main__id_d__div_class_processName___sPROCESS_NAME:__S___d__0x_x__bytes___PID:__d____font_
mov rdx, qword [rsp + 0x1bb0]
mov rcx, qword [rsp + 0x1bb8]
call fcn.1400c8230
mov dword [rsp + 0x430], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x434], eax
mov eax, dword [rsp + 0x430]
mov ecx, dword [rsp + 0x434]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
cmp dword [rsp + 0xac], 0xffffffff
jne 0x140070a18
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, [0x140151700]
mov qword [rsp + 0x20], rdx
lea r9, str.Non_existent_process
lea r8, str.__a_href__s__PPID:__s__a____div_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x438], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x43c], eax
mov eax, dword [rsp + 0x438]
mov ecx, dword [rsp + 0x43c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140070a85
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x4b2c]
mov dword [rsp + 0x20], edx
mov r9d, dword [rsp + 0x4b2c]
lea r8, str.__a_href__d__PPID:__d__a____div_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x440], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x444], eax
mov eax, dword [rsp + 0x440]
mov ecx, dword [rsp + 0x444]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov r9d, dword [rsp + 0x41e0]
lea r8, str._n_button_type_button__class_collapsible__id_dgeneral_General_details__button__div_class_contento__
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x448], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x44c], eax
mov eax, dword [rsp + 0x448]
mov ecx, dword [rsp + 0x44c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, str._br__n_table_class_process_table__
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x450], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x454], eax
mov eax, dword [rsp + 0x450]
mov ecx, dword [rsp + 0x454]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0xa0]
test eax, eax
jne 0x140070b5d
movzx eax, byte [rsp + 0x92]
test eax, eax
je 0x140071652
lea rdx, [rsp + 0x51c0]
lea rcx, [rsp + 0x53d8]
call fcn.140005f30
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 1
imul rcx, rcx, 4
movzx eax, byte [rax + rcx + 0x580]
test eax, eax
je 0x140070ba9
lea rdx, [0x140151818]
lea rcx, [rsp + 0x53d8]
call fcn.1400436a0
lea rcx, [rsp + 0x53d8]
call fcn.140004b60
mov qword [rsp + 0x1bc8], rax
mov eax, 0x20
imul rax, rax, 4
mov qword [rsp + 0x1bc0], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov rcx, qword [rsp + 0x1bc0]
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1bd0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1bd8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1be0], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1bc8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1bd0]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sPath__VAD_:_s__s_S__S_s__td___tr_
mov rdx, qword [rsp + 0x1bd8]
mov rcx, qword [rsp + 0x1be0]
call fcn.1400c8230
mov dword [rsp + 0x458], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x45c], eax
mov eax, dword [rsp + 0x458]
mov ecx, dword [rsp + 0x45c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4f00]
call fcn.1400b3ed0
mov qword [rsp + 0x1be8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1bf0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1bf8], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1be8]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSHA1__VAD_:_s__s_s_s__td___tr_
mov rdx, qword [rsp + 0x1bf0]
mov rcx, qword [rsp + 0x1bf8]
call fcn.1400c8230
mov dword [rsp + 0x460], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x464], eax
mov eax, dword [rsp + 0x460]
mov ecx, dword [rsp + 0x464]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x51e0]
call fcn.140004b60
mov qword [rsp + 0x1c00], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1c08], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c10], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1c00]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileCreationTime__VAD_:_s__s_S_s__td___tr_
mov rdx, qword [rsp + 0x1c08]
mov rcx, qword [rsp + 0x1c10]
call fcn.1400c8230
mov dword [rsp + 0x468], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x46c], eax
mov eax, dword [rsp + 0x468]
mov ecx, dword [rsp + 0x46c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5200]
call fcn.140004b60
mov qword [rsp + 0x1c18], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1c20], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c28], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1c18]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileLastAccessTime__VAD_:_s__s_S_s__td___tr_
mov rdx, qword [rsp + 0x1c20]
mov rcx, qword [rsp + 0x1c28]
call fcn.1400c8230
mov dword [rsp + 0x470], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x474], eax
mov eax, dword [rsp + 0x470]
mov ecx, dword [rsp + 0x474]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5180]
call fcn.140004b60
mov qword [rsp + 0x1c30], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1c38], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c40], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1c30]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileLastWriteTime__VAD_:_s__s_S_s__td___tr_
mov rdx, qword [rsp + 0x1c38]
mov rcx, qword [rsp + 0x1c40]
call fcn.1400c8230
mov dword [rsp + 0x478], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x47c], eax
mov eax, dword [rsp + 0x478]
mov ecx, dword [rsp + 0x47c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov dword [rsp + 0x94], 0
jmp 0x140070fea
mov eax, dword [rsp + 0x94]
inc eax
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 4
jge 0x140071640
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
movsxd rcx, dword [rsp + 0x94]
movzx eax, byte [rax + rcx + 0x370]
test eax, eax
jne 0x14007103e
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x94]
movzx eax, byte [rax + rcx + 0x580]
test eax, eax
je 0x14007163b
lea rdx, [rsp + 0x51c0]
lea rcx, [rsp + 0x53b8]
call fcn.140005f30
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x94]
movzx eax, byte [rax + rcx + 0x580]
test eax, eax
je 0x140071089
lea rdx, str.__Non_existent_Path_
lea rcx, [rsp + 0x53b8]
call fcn.1400436a0
lea rcx, [rsp + 0x53b8]
call fcn.140004b60
mov qword [rsp + 0x1c50], rax
movsxd rax, dword [rsp + 0x94]
imul rax, rax, 0x20
mov qword [rsp + 0x1c48], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov rcx, qword [rsp + 0x1c48]
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1c58], rax
movsxd rax, dword [rsp + 0x94]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1c60], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1c68], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c70], rax
lea rax, str.__font_
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x1c50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1c58]
mov qword [rsp + 0x38], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x30], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1c60]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._sPath___S_:_s__s_S__S_s__td___tr_
mov rdx, qword [rsp + 0x1c68]
mov rcx, qword [rsp + 0x1c70]
call fcn.1400c8230
mov dword [rsp + 0x480], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x484], eax
mov eax, dword [rsp + 0x480]
mov ecx, dword [rsp + 0x484]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x94]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x238]
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1c78], rax
movsxd rax, dword [rsp + 0x94]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1c80], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1c88], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1c90], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1c78]
mov qword [rsp + 0x38], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x30], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1c80]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSHA1___S_:_s__s_s_s__td___tr_
mov rdx, qword [rsp + 0x1c88]
mov rcx, qword [rsp + 0x1c90]
call fcn.1400c8230
mov dword [rsp + 0x488], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x48c], eax
mov eax, dword [rsp + 0x488]
mov ecx, dword [rsp + 0x48c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x94]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x3a0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1c98], rax
movsxd rax, dword [rsp + 0x94]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1ca0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1ca8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1cb0], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1c98]
mov qword [rsp + 0x38], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x30], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1ca0]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileCreationTime___S_:_s__s_S_s__td___tr_
mov rdx, qword [rsp + 0x1ca8]
mov rcx, qword [rsp + 0x1cb0]
call fcn.1400c8230
mov dword [rsp + 0x490], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x494], eax
mov eax, dword [rsp + 0x490]
mov ecx, dword [rsp + 0x494]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x94]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x440]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1cb8], rax
movsxd rax, dword [rsp + 0x94]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1cc0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1cc8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1cd0], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1cb8]
mov qword [rsp + 0x38], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x30], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1cc0]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileLastAccessTime___S_:_s__s_S_s__td___tr_
mov rdx, qword [rsp + 0x1cc8]
mov rcx, qword [rsp + 0x1cd0]
call fcn.1400c8230
mov dword [rsp + 0x498], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x49c], eax
mov eax, dword [rsp + 0x498]
mov ecx, dword [rsp + 0x49c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movsxd rcx, dword [rsp + 0x94]
imul rcx, rcx, 0x20
lea rax, [rax + rcx + 0x4e0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1cd8], rax
movsxd rax, dword [rsp + 0x94]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1ce0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1ce8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1cf0], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1cd8]
mov qword [rsp + 0x38], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x30], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1ce0]
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileLastWriteTime___S_:_s__s_S_s__td___tr_
mov rdx, qword [rsp + 0x1ce8]
mov rcx, qword [rsp + 0x1cf0]
call fcn.1400c8230
mov dword [rsp + 0x4a0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4a4], eax
mov eax, dword [rsp + 0x4a0]
mov ecx, dword [rsp + 0x4a4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x53b8]
call fcn.140003890
jmp 0x140070fda
lea rcx, [rsp + 0x53d8]
call fcn.140003890
jmp 0x1400719cc
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x1cf8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1d00], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1d08], rax
mov rax, qword [rsp + 0x1cf8]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sPath:_s__S__td___tr_
mov rdx, qword [rsp + 0x1d00]
mov rcx, qword [rsp + 0x1d08]
call fcn.1400c8230
mov dword [rsp + 0x4a8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4ac], eax
mov eax, dword [rsp + 0x4a8]
mov ecx, dword [rsp + 0x4ac]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4f00]
call fcn.1400b3ed0
mov qword [rsp + 0x1d10], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1d18], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1d20], rax
mov rax, qword [rsp + 0x1d10]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSHA1:_s__s__td___tr_
mov rdx, qword [rsp + 0x1d18]
mov rcx, qword [rsp + 0x1d20]
call fcn.1400c8230
mov dword [rsp + 0x4b0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4b4], eax
mov eax, dword [rsp + 0x4b0]
mov ecx, dword [rsp + 0x4b4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x51e0]
call fcn.140004b60
mov qword [rsp + 0x1d28], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1d30], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1d38], rax
mov rax, qword [rsp + 0x1d28]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileCreationTime:_s__S__td___tr_
mov rdx, qword [rsp + 0x1d30]
mov rcx, qword [rsp + 0x1d38]
call fcn.1400c8230
mov dword [rsp + 0x4b8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4bc], eax
mov eax, dword [rsp + 0x4b8]
mov ecx, dword [rsp + 0x4bc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5200]
call fcn.140004b60
mov qword [rsp + 0x1d40], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1d48], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1d50], rax
mov rax, qword [rsp + 0x1d40]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileLastAccessTime:_s__S__td___tr_
mov rdx, qword [rsp + 0x1d48]
mov rcx, qword [rsp + 0x1d50]
call fcn.1400c8230
mov dword [rsp + 0x4c0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4c4], eax
mov eax, dword [rsp + 0x4c0]
mov ecx, dword [rsp + 0x4c4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5180]
call fcn.140004b60
mov qword [rsp + 0x1d58], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1d60], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1d68], rax
mov rax, qword [rsp + 0x1d58]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sFileLastWriteTime:_s__S__td___tr_
mov rdx, qword [rsp + 0x1d60]
mov rcx, qword [rsp + 0x1d68]
call fcn.1400c8230
mov dword [rsp + 0x4c8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4cc], eax
mov eax, dword [rsp + 0x4c8]
mov ecx, dword [rsp + 0x4cc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sNetwork:_s
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x4d0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4d4], eax
mov eax, dword [rsp + 0x4d0]
mov ecx, dword [rsp + 0x4d4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0x2c28]
call fcn.140003570
nop
lea rdx, [rsp + 0x2c28]
lea rcx, [rsp + 0x4ce8]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x2c28]
call fcn.140003860
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
mov dword [rsp + 0x14c], 0
jmp 0x140071aac
mov eax, dword [rsp + 0x14c]
inc eax
mov dword [rsp + 0x14c], eax
movsxd rax, dword [rsp + 0x14c]
mov qword [rsp + 0x1d70], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov rcx, rax
call fcn.1400c32e0
mov rcx, qword [rsp + 0x1d70]
cmp rcx, rax
jae 0x140071be1
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d74a0]
call fcn.140041ab0
mov qword [rsp + 0x1d78], rax
movsxd rax, dword [rsp + 0x14c]
mov rdx, rax
mov rcx, qword [rsp + 0x1d78]
call fcn.140041d40
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [rsp + 0x33c0]
call fcn.140003570
mov qword [rsp + 0x1d80], rax
mov rax, qword [rsp + 0x1d80]
mov qword [rsp + 0x1d88], rax
mov r8, qword [rsp + 0x1d88]
lea rdx, [0x140151af8]
lea rcx, [rsp + 0x33e0]
call fcn.1400102f0
mov qword [rsp + 0x1d90], rax
mov rax, qword [rsp + 0x1d90]
mov qword [rsp + 0x1d98], rax
lea r8, [0x140151af0]
mov rdx, qword [rsp + 0x1d98]
lea rcx, [rsp + 0x5510]
call fcn.1400101c0
nop
lea rcx, [rsp + 0x33e0]
call fcn.140003860
nop
lea rcx, [rsp + 0x33c0]
call fcn.140003860
lea rdx, [rsp + 0x5510]
lea rcx, [rsp + 0x4ce8]
call fcn.1400c1990
nop
lea rcx, [rsp + 0x5510]
call fcn.140003860
jmp 0x140071a9c
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x140151b00]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x4d8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4dc], eax
mov eax, dword [rsp + 0x4d8]
mov ecx, dword [rsp + 0x4dc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0xa1]
test eax, eax
je 0x140071d15
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov qword [rsp + 0x1da0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1da8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1db0], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1da0]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLMIHV:_s__s_S__Process_Hollowing__s__td___tr_
mov rdx, qword [rsp + 0x1da8]
mov rcx, qword [rsp + 0x1db0]
call fcn.1400c8230
mov dword [rsp + 0x4e0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4e4], eax
mov eax, dword [rsp + 0x4e0]
mov ecx, dword [rsp + 0x4e4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140071f73
movzx eax, byte [rsp + 0x79]
test eax, eax
je 0x140071dec
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov qword [rsp + 0x1db8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1dc0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1dc8], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1db8]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLMIHV:_s__s_S__Process_Not_Initialized__s__td___tr_
mov rdx, qword [rsp + 0x1dc0]
mov rcx, qword [rsp + 0x1dc8]
call fcn.1400c8230
mov dword [rsp + 0x4e8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4ec], eax
mov eax, dword [rsp + 0x4e8]
mov ecx, dword [rsp + 0x4ec]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140071f73
movzx eax, byte [rsp + 0xa2]
test eax, eax
je 0x140071ec6
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov qword [rsp + 0x1dd0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1dd8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1de0], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1dd0]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLMIHV:_s__s_S__Process_Hiding__s__td___tr_
mov rdx, qword [rsp + 0x1dd8]
mov rcx, qword [rsp + 0x1de0]
call fcn.1400c8230
mov dword [rsp + 0x4f0], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4f4], eax
mov eax, dword [rsp + 0x4f0]
mov ecx, dword [rsp + 0x4f4]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140071f73
lea rcx, [rsp + 0x4d00]
call fcn.140004b60
mov qword [rsp + 0x1de8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1df0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1df8], rax
mov rax, qword [rsp + 0x1de8]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sLMIHV:_s__S__td___tr_
mov rdx, qword [rsp + 0x1df0]
mov rcx, qword [rsp + 0x1df8]
call fcn.1400c8230
mov dword [rsp + 0x4f8], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x4fc], eax
mov eax, dword [rsp + 0x4f8]
mov ecx, dword [rsp + 0x4fc]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rax, [rsp + 0x5460]
mov rdi, rax
xor eax, eax
mov ecx, 0x12
rep stosb byte [rdi], al
lea rax, [rsp + 0x3f30]
mov qword [rsp + 0x1e00], rax
lea rdx, [rsp + 0x4ff0]
mov rcx, qword [rsp + 0x1e00]
call fcn.140005f30
mov qword [rsp + 0x1e08], rax
mov rax, qword [rsp + 0x1e08]
mov qword [rsp + 0x1e10], rax
mov rax, qword [rsp + 0x1e10]
mov qword [rsp + 0x1e18], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x500], eax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
mov qword [rsp + 0x1e20], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov qword [rsp + 0x1e28], rax
mov rax, qword [rsp + 0x1e18]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x500]
lea r8, [rsp + 0x5460]
mov rdx, qword [rsp + 0x1e20]
mov rcx, qword [rsp + 0x1e28]
call fcn.14004f1a0
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0x2c48]
call fcn.140003570
nop
lea rdx, [rsp + 0x2c48]
lea rcx, [rsp + 0x4ce8]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x2c48]
call fcn.140003860
mov dword [0x1401d19fc], 0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
mov eax, dword [rsp + 0xf8]
cmp dword [rsp + 0x120], eax
je 0x14007214d
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x38], rdx
mov edx, dword [rsp + 0xf8]
mov dword [rsp + 0x30], edx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sEntry_Point__process_:_s__s0x_08x__Entry_Point__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x504], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x508], eax
mov eax, dword [rsp + 0x504]
mov ecx, dword [rsp + 0x508]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x1400721c5
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0xf8]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sEntry_Point__process_:_s_0x_08x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x50c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x510], eax
mov eax, dword [rsp + 0x50c]
mov ecx, dword [rsp + 0x510]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x120]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sEntry_Point__file_:_s_0x_08x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x514], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x518], eax
mov eax, dword [rsp + 0x514]
mov ecx, dword [rsp + 0x518]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0x80]
test eax, eax
je 0x14007237b
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x4b18]
mov qword [rsp + 0x30], rdx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sImageBaseAddress__PEB_:_s__s0x_016llx__PEB_ImageBaseAddress_Forgery__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x51c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x520], eax
mov eax, dword [rsp + 0x51c]
mov ecx, dword [rsp + 0x520]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x158]
mov qword [rsp + 0x30], rdx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sImageBaseAddress__Ldr_:_s__s0x_016llx_s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x524], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x528], eax
mov eax, dword [rsp + 0x524]
mov ecx, dword [rsp + 0x528]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x14007252d
movzx eax, byte [rsp + 0x79]
test eax, eax
je 0x1400724b3
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x4b18]
mov qword [rsp + 0x30], rdx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sImageBaseAddress__PEB_:_s__s0x_016llx_s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x52c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x530], eax
mov eax, dword [rsp + 0x52c]
mov ecx, dword [rsp + 0x530]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x158]
mov qword [rsp + 0x30], rdx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sImageBaseAddress__Ldr_:_s__s0x_016llx__Process_Not_Initialized__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x534], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x538], eax
mov eax, dword [rsp + 0x534]
mov ecx, dword [rsp + 0x538]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x14007252d
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x4ab0]
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sImageBaseAddress:_s_0x_016llx__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x53c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x540], eax
mov eax, dword [rsp + 0x53c]
mov ecx, dword [rsp + 0x540]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b0]
test eax, eax
jne 0x140072561
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b1]
test eax, eax
je 0x140072be6
lea rdx, [0x1401442b3]
lea rcx, [rsp + 0x5338]
call fcn.140003570
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b0]
test eax, eax
je 0x1400725a2
lea rdx, [0x140152130]
lea rcx, [rsp + 0x5338]
call fcn.140003940
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5b1]
test eax, eax
je 0x1400725ce
lea rdx, [0x1401521d8]
lea rcx, [rsp + 0x5338]
call fcn.140043640
lea rcx, [rsp + 0x5338]
call fcn.1400b3ed0
mov qword [rsp + 0x1e30], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1e38], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1e40], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1e30]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sPE_Sections:_s___s__s_s__td___tr_
mov rdx, qword [rsp + 0x1e38]
mov rcx, qword [rsp + 0x1e40]
call fcn.1400c8230
mov dword [rsp + 0x544], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x548], eax
mov eax, dword [rsp + 0x544]
mov ecx, dword [rsp + 0x548]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, str._n_tr__td_colspan_2___table_style_border:1px_solid_black_margin_left:50px____tr__td_From_file:__td___tr__tr__td_Name__td__td_Characteristics__td__td_PhysicalAddress__td__td_PointerToRawData__td__td_SizeofRawData__td__td_VirtualAddress__td__td_VirtualSize__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x54c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x550], eax
mov eax, dword [rsp + 0x54c]
mov ecx, dword [rsp + 0x550]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov edx, 8
lea rcx, [rsp + 0x4b08]
call fcn.1400079b0
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x148
mov qword [rsp + 0x1e48], rax
lea rdx, [rsp + 0x4b08]
mov rcx, qword [rsp + 0x1e48]
call fcn.1400b5f40
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x148
mov qword [rsp + 0x1e50], rax
lea rdx, [rsp + 0x29e8]
mov rcx, qword [rsp + 0x1e50]
call fcn.1400bb550
mov rdx, rax
lea rcx, [rsp + 0x4b08]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140072909
lea rcx, [rsp + 0x4b08]
call fcn.140042040
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x554], eax
lea rcx, [rsp + 0x4b08]
call fcn.140042040
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x558], eax
lea rcx, [rsp + 0x4b08]
call fcn.140042040
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x55c], eax
lea rcx, [rsp + 0x4b08]
call fcn.140042040
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x560], eax
lea rcx, [rsp + 0x4b08]
call fcn.140042040
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x564], eax
lea rcx, [rsp + 0x4b08]
call fcn.140042040
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x568], eax
lea rcx, [rsp + 0x4b08]
call fcn.140042040
add rax, 8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1e58], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1e60], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1e68], rax
mov eax, dword [rsp + 0x554]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x558]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x55c]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x560]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x564]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x568]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x1e58]
lea r8, [0x140152440]
mov rdx, qword [rsp + 0x1e60]
mov rcx, qword [rsp + 0x1e68]
call fcn.1400c8230
mov dword [rsp + 0x56c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x570], eax
mov eax, dword [rsp + 0x56c]
mov ecx, dword [rsp + 0x570]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
xor r8d, r8d
lea rdx, [rsp + 0x29f0]
lea rcx, [rsp + 0x4b08]
call fcn.1400421d0
jmp 0x140072734
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, str._n_tr__td_From_memory:__td___tr__tr__td_Name__td__td_Characteristics__td__td_PhysicalAddress__td__td_PointerToRawData__td__td_SizeofRawData__td__td_VirtualAddress__td__td_VirtualSize__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x574], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x578], eax
mov eax, dword [rsp + 0x574]
mov ecx, dword [rsp + 0x578]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov edx, 8
lea rcx, [rsp + 0x4b10]
call fcn.1400079b0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5b8
mov qword [rsp + 0x1e70], rax
lea rdx, [rsp + 0x4b10]
mov rcx, qword [rsp + 0x1e70]
call fcn.1400b5ef0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5b8
mov qword [rsp + 0x1e78], rax
lea rdx, [rsp + 0x29f8]
mov rcx, qword [rsp + 0x1e78]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b10]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140072b7a
lea rcx, [rsp + 0x4b10]
call fcn.140042060
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x57c], eax
lea rcx, [rsp + 0x4b10]
call fcn.140042060
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x580], eax
lea rcx, [rsp + 0x4b10]
call fcn.140042060
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x584], eax
lea rcx, [rsp + 0x4b10]
call fcn.140042060
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x588], eax
lea rcx, [rsp + 0x4b10]
call fcn.140042060
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x58c], eax
lea rcx, [rsp + 0x4b10]
call fcn.140042060
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x590], eax
lea rcx, [rsp + 0x4b10]
call fcn.140042060
add rax, 8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1e80], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1e88], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1e90], rax
mov eax, dword [rsp + 0x57c]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x580]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x584]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x588]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x590]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x1e80]
lea r8, str._n_tr__td__s__td__td_0x_08x__td__td_0x_08x__td__td_0x_08x__td__td__d__td__td_0x_08x__td__td__d__td___tr_
mov rdx, qword [rsp + 0x1e88]
mov rcx, qword [rsp + 0x1e90]
call fcn.1400c8230
mov dword [rsp + 0x594], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x598], eax
mov eax, dword [rsp + 0x594]
mov ecx, dword [rsp + 0x598]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
xor r8d, r8d
lea rdx, [rsp + 0x2a00]
lea rcx, [rsp + 0x4b10]
call fcn.1400421d0
jmp 0x1400729a5
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, str._n__table___td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x59c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5a0], eax
mov eax, dword [rsp + 0x59c]
mov ecx, dword [rsp + 0x5a0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5338]
call fcn.140003860
jmp 0x140072ca1
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x590
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1e98], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1ea0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1ea8], rax
mov rax, qword [rsp + 0x1e98]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sPE_Sections:_s__s__td___tr_
mov rdx, qword [rsp + 0x1ea0]
mov rcx, qword [rsp + 0x1ea8]
call fcn.1400c8230
mov dword [rsp + 0x5a4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5a8], eax
mov eax, dword [rsp + 0x5a4]
mov ecx, dword [rsp + 0x5a8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5d8]
cmp eax, 1
jne 0x1400732da
mov edx, 0x10
lea rcx, [rsp + 0x4e30]
call fcn.1400079b0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5c8
mov rdx, rax
lea rcx, [rsp + 0x4e30]
call fcn.140033c10
nop
mov edx, 8
lea rcx, [rsp + 0x4ae8]
call fcn.1400079b0
lea rdx, [rsp + 0x4ae8]
lea rcx, [rsp + 0x4e30]
call fcn.1400b5ef0
lea rdx, [rsp + 0x2a08]
lea rcx, [rsp + 0x4e30]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ae8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x1400732cd
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
movzx eax, byte [rax + 0x58]
test eax, eax
je 0x1400732b0
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x30], rdx
lea rdx, str.__font_
mov qword [rsp + 0x28], rdx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_s_sExecutable_memory_region_detection:_s_s_pre_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x5ac], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5b0], eax
mov eax, dword [rsp + 0x5ac]
mov ecx, dword [rsp + 0x5b0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x1eb0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1eb8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1ec0], rax
mov r9, qword [rsp + 0x1eb0]
lea r8, str._nRegion_address:_0x_016llx
mov rdx, qword [rsp + 0x1eb8]
mov rcx, qword [rsp + 0x1ec0]
call fcn.1400c8230
mov dword [rsp + 0x5b4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5b8], eax
mov eax, dword [rsp + 0x5b4]
mov ecx, dword [rsp + 0x5b8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
add rax, 0xa0
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1ec8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1ed0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1ed8], rax
mov r9, qword [rsp + 0x1ec8]
lea r8, str._nSection:__s
mov rdx, qword [rsp + 0x1ed0]
mov rcx, qword [rsp + 0x1ed8]
call fcn.1400c8230
mov dword [rsp + 0x5bc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5c0], eax
mov eax, dword [rsp + 0x5bc]
mov ecx, dword [rsp + 0x5c0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401442b5]
lea rcx, [rsp + 0x4ec0]
call fcn.140003570
nop
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
movzx eax, byte [rax + 0x59]
test eax, eax
je 0x140072f68
lea rdx, [0x1401527d0]
lea rcx, [rsp + 0x4ec0]
call fcn.140003940
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
movzx eax, byte [rax + 0x5c]
test eax, eax
je 0x14007308b
lea rdx, [0x1401527f0]
lea rcx, [rsp + 0x4ec0]
call fcn.140043640
lea rcx, [rsp + 0x4ec0]
call fcn.1400b3ed0
mov qword [rsp + 0x1ee0], rax
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
add rax, 0x38
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1ee8], rax
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
add rax, 0x18
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1ef0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1ef8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1f00], rax
mov rax, qword [rsp + 0x1ee0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1ee8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1ef0]
lea r8, str._nProtection__current_declared_:__s__s__s
mov rdx, qword [rsp + 0x1ef8]
mov rcx, qword [rsp + 0x1f00]
call fcn.1400c8230
mov dword [rsp + 0x5c4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5c8], eax
mov eax, dword [rsp + 0x5c4]
mov ecx, dword [rsp + 0x5c8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x14007314e
lea rcx, [rsp + 0x4ec0]
call fcn.1400b3ed0
mov qword [rsp + 0x1f08], rax
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
add rax, 0x18
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1f10], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1f18], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1f20], rax
mov rax, qword [rsp + 0x1f08]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x1f10]
lea r8, str._nProtection:__s__s
mov rdx, qword [rsp + 0x1f18]
mov rcx, qword [rsp + 0x1f20]
call fcn.1400c8230
mov dword [rsp + 0x5cc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5d0], eax
mov eax, dword [rsp + 0x5cc]
mov ecx, dword [rsp + 0x5d0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401442b6]
lea rcx, [rsp + 0x4ec0]
call fcn.140003940
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
movzx eax, byte [rax + 0x5b]
test eax, eax
je 0x14007318b
lea rdx, str._n_Process_Private_Memory_Region_
lea rcx, [rsp + 0x4ec0]
call fcn.140003940
lea rcx, [rsp + 0x4ae8]
call fcn.140042060
movzx eax, byte [rax + 0x5a]
test eax, eax
je 0x1400731b4
lea rdx, str._n_Process_Unknown_Executable_Memory_Region_
lea rcx, [rsp + 0x4ec0]
call fcn.140043640
lea rcx, [rsp + 0x4ec0]
call fcn.1400b3ed0
mov qword [rsp + 0x1f28], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1f30], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1f38], rax
mov r9, qword [rsp + 0x1f28]
lea r8, [0x1401528e4]
mov rdx, qword [rsp + 0x1f30]
mov rcx, qword [rsp + 0x1f38]
call fcn.1400c8230
mov dword [rsp + 0x5d4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x5d4]
mov ecx, dword [rsp + 0x5d8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, str._n__pre___td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x5dc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x5dc]
mov ecx, dword [rsp + 0x5e0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4ec0]
call fcn.140003860
xor r8d, r8d
lea rdx, [rsp + 0x2850]
lea rcx, [rsp + 0x4ae8]
call fcn.1400421d0
jmp 0x140072d1b
lea rcx, [rsp + 0x4e30]
call fcn.14003cc30
movzx eax, byte [rsp + 0x8c]
test eax, eax
je 0x140073381
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x38], rdx
mov edx, dword [rsp + 0x124]
mov dword [rsp + 0x30], edx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSizeOfInitializedData:_s__s_d__SizeOfInitializedData_is_0__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x5e4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5e8], eax
mov eax, dword [rsp + 0x5e4]
mov ecx, dword [rsp + 0x5e8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x1400733f9
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x124]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSizeOfInitializedData:_s__d__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x5ec], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5f0], eax
mov eax, dword [rsp + 0x5ec]
mov ecx, dword [rsp + 0x5f0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0x8d]
test eax, eax
je 0x1400735f6
movzx eax, word [rsp + 0x84]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f40], rdx
lea rdi, str.__font_
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sDLLCharacteristics:_s__s0x_x__Process_PE_Anomalies__s__td___tr_
mov edx, ecx
mov rax, qword [rsp + 0x1f40]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x5f4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x5f8], eax
mov eax, dword [rsp + 0x5f4]
mov ecx, dword [rsp + 0x5f8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, word [rsp + 0x88]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f48], rdx
lea rdi, str.__font_
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sMajorImageVersion:_s__s0x_x__Process_PE_Anomalies__s__td___tr_
mov edx, ecx
mov rax, qword [rsp + 0x1f48]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x5fc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x600], eax
mov eax, dword [rsp + 0x5fc]
mov ecx, dword [rsp + 0x600]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0xc4]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0xb0]
mov dword [rsp + 0x30], edx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sCheckSum_original_computed:_s__s0x_x_0x_x__Process_PE_Anomalies__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x604], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x608], eax
mov eax, dword [rsp + 0x604]
mov ecx, dword [rsp + 0x608]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140073b2b
movzx eax, byte [rsp + 0x8e]
test eax, eax
je 0x1400737c3
movzx eax, word [rsp + 0x84]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f50], rdx
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, [0x140152b78]
mov edx, ecx
mov rax, qword [rsp + 0x1f50]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x60c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x610], eax
mov eax, dword [rsp + 0x60c]
mov ecx, dword [rsp + 0x610]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, word [rsp + 0x88]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f58], rdx
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, [0x140152ba8]
mov edx, ecx
mov rax, qword [rsp + 0x1f58]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x614], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x618], eax
mov eax, dword [rsp + 0x614]
mov ecx, dword [rsp + 0x618]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0xc4]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0xb0]
mov dword [rsp + 0x30], edx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sCheckSum_original_computed:_s__s0x_x_0x_x__Process_CheckSum_Mismatch__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x61c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x620], eax
mov eax, dword [rsp + 0x61c]
mov ecx, dword [rsp + 0x620]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140073b2b
movzx eax, byte [rsp + 0x8f]
test eax, eax
je 0x140073990
movzx eax, word [rsp + 0x84]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f60], rdx
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, [0x140152c48]
mov edx, ecx
mov rax, qword [rsp + 0x1f60]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x624], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x628], eax
mov eax, dword [rsp + 0x624]
mov ecx, dword [rsp + 0x628]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, word [rsp + 0x88]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f68], rdx
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, [0x140152c78]
mov edx, ecx
mov rax, qword [rsp + 0x1f68]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x62c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x630], eax
mov eax, dword [rsp + 0x62c]
mov ecx, dword [rsp + 0x630]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0xc4]
mov dword [rsp + 0x38], edx
mov edx, dword [rsp + 0xb0]
mov dword [rsp + 0x30], edx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sCheckSum_original_computed:_s__s0x_x_0x_x__Process_CheckSum_is_0__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x634], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x638], eax
mov eax, dword [rsp + 0x634]
mov ecx, dword [rsp + 0x638]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140073b2b
movzx eax, word [rsp + 0x84]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f70], rdx
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sDLLCharacteristics:_s_0x_x__td___tr_
mov edx, ecx
mov rax, qword [rsp + 0x1f70]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x63c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x640], eax
mov eax, dword [rsp + 0x63c]
mov ecx, dword [rsp + 0x640]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, word [rsp + 0x88]
mov ecx, 0x4000
sub ecx, dword [0x1401d19fc]
mov ecx, ecx
mov edx, dword [0x1401d19fc]
lea rdi, [0x1401d2a20]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x1f78], rdx
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sMajorImageVersion:_s_0x_x__td___tr_
mov edx, ecx
mov rax, qword [rsp + 0x1f78]
mov rcx, rax
call fcn.1400c8230
mov dword [rsp + 0x644], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x648], eax
mov eax, dword [rsp + 0x644]
mov ecx, dword [rsp + 0x648]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0xc4]
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0xb0]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sCheckSum_original_computed:_s_0x_x_0x_x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x64c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x650], eax
mov eax, dword [rsp + 0x64c]
mov ecx, dword [rsp + 0x650]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
xor r8d, r8d
lea rdx, [0x140152dd8]
lea rcx, [rsp + 0x4d58]
call fcn.1400bc850
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3380]
lea rcx, [rsp + 0x4d58]
call fcn.14000ac90
mov qword [rsp + 0x1f80], rax
mov rax, qword [rsp + 0x1f80]
mov qword [rsp + 0x1f88], rax
mov rax, qword [rsp + 0x1f88]
mov qword [rsp + 0x1fa0], rax
xor r8d, r8d
lea rdx, [0x140152df8]
lea rcx, [rsp + 0x5088]
call fcn.1400bc850
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x33a0]
lea rcx, [rsp + 0x5088]
call fcn.14000ac90
mov qword [rsp + 0x1f90], rax
mov rax, qword [rsp + 0x1f90]
mov qword [rsp + 0x1f98], rax
mov rax, qword [rsp + 0x1f98]
mov qword [rsp + 0x1fa8], rax
mov rdx, qword [rsp + 0x1fa0]
mov rcx, qword [rsp + 0x1fa8]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x140073c08
mov dword [rsp + 0x240], 1
jmp 0x140073c13
mov dword [rsp + 0x240], 0
movzx eax, byte [rsp + 0x240]
mov byte [rsp + 0xe2], al
lea rcx, [rsp + 0x33a0]
call fcn.140003890
nop
lea rcx, [rsp + 0x3380]
call fcn.140003890
movzx eax, byte [rsp + 0xe2]
test eax, eax
je 0x140073d1c
lea rcx, [rsp + 0x4d58]
call fcn.140004b60
mov qword [rsp + 0x1fb0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1fb8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1fc0], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x1fb0]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sInternalName:_s__s_S__Process_Name___Internal_Name__s__td___tr_
mov rdx, qword [rsp + 0x1fb8]
mov rcx, qword [rsp + 0x1fc0]
call fcn.1400c8230
mov dword [rsp + 0x654], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x658], eax
mov eax, dword [rsp + 0x654]
mov ecx, dword [rsp + 0x658]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140073dc9
lea rcx, [rsp + 0x4d58]
call fcn.140004b60
mov qword [rsp + 0x1fc8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1fd0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1fd8], rax
mov rax, qword [rsp + 0x1fc8]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sInternalName:_s__S__td___tr_
mov rdx, qword [rsp + 0x1fd0]
mov rcx, qword [rsp + 0x1fd8]
call fcn.1400c8230
mov dword [rsp + 0x65c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x660], eax
mov eax, dword [rsp + 0x65c]
mov ecx, dword [rsp + 0x660]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
add rax, 0x1d0
mov rdx, rax
lea rcx, [rsp + 0x4ba8]
call fcn.140006550
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x1fe0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x1fe8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x1ff0], rax
mov rax, qword [rsp + 0x1fe0]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sOriginalFileName:_s__S__td___tr_
mov rdx, qword [rsp + 0x1fe8]
mov rcx, qword [rsp + 0x1ff0]
call fcn.1400c8230
mov dword [rsp + 0x664], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x668], eax
mov eax, dword [rsp + 0x664]
mov ecx, dword [rsp + 0x668]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
mov qword [rsp + 0x1ff8], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov qword [rsp + 0x2000], rax
mov rdx, qword [rsp + 0x1ff8]
mov rcx, qword [rsp + 0x2000]
call fcn.14007b7c0
lea rdx, [0x140152ebc]
lea rcx, [rsp + 0x5220]
call fcn.140005fd0
nop
movzx eax, byte [rsp + 0xa3]
test eax, eax
je 0x140073f22
lea rdx, [0x140152ec8]
lea rcx, [rsp + 0x5220]
call fcn.1400097c0
movzx eax, byte [rsp + 0xa4]
test eax, eax
je 0x140073f42
lea rdx, str.__Process_Malformed_WindowStationDesktop_
lea rcx, [rsp + 0x5220]
call fcn.1400436a0
lea rcx, [rsp + 0x5220]
call fcn.1400bb3f0
movzx eax, al
test eax, eax
jne 0x140074046
lea rcx, [rsp + 0x5220]
call fcn.140004b60
mov qword [rsp + 0x2008], rax
lea rcx, [rsp + 0x50a8]
call fcn.140004b60
mov qword [rsp + 0x2010], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2018], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2020], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x2008]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2010]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sWindow_StationDesktop:_s__s_S__S_s__td___tr_
mov rdx, qword [rsp + 0x2018]
mov rcx, qword [rsp + 0x2020]
call fcn.1400c8230
mov dword [rsp + 0x66c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x670], eax
mov eax, dword [rsp + 0x66c]
mov ecx, dword [rsp + 0x670]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x1400740f3
lea rcx, [rsp + 0x50a8]
call fcn.140004b60
mov qword [rsp + 0x2028], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2030], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2038], rax
mov rax, qword [rsp + 0x2028]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sWindow_StationDesktop:_s__S__td___tr_
mov rdx, qword [rsp + 0x2030]
mov rcx, qword [rsp + 0x2038]
call fcn.1400c8230
mov dword [rsp + 0x674], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x678], eax
mov eax, dword [rsp + 0x674]
mov ecx, dword [rsp + 0x678]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0x90]
test eax, eax
je 0x140074ece
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov eax, dword [rax + 0x88]
cmp dword [rsp + 0x10c], eax
jne 0x1400741e6
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x67c], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2040], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2048], rax
mov eax, dword [rsp + 0x67c]
mov dword [rsp + 0x28], eax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sSession_ID__LSA_:_s__d__td___tr_
mov rdx, qword [rsp + 0x2040]
mov rcx, qword [rsp + 0x2048]
call fcn.1400c8230
mov dword [rsp + 0x680], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x684], eax
mov eax, dword [rsp + 0x680]
mov ecx, dword [rsp + 0x684]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x1400742ba
lea rdx, [rsp + 0x4ac8]
lea rcx, [0x1401d7528]
call fcn.140041800
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x688], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2050], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2058], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x688]
mov dword [rsp + 0x30], eax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sSession_ID__LSA_:_s__s_d__Alternative_Credentials__s__td___tr_
mov rdx, qword [rsp + 0x2050]
mov rcx, qword [rsp + 0x2058]
call fcn.1400c8230
mov dword [rsp + 0x68c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x690], eax
mov eax, dword [rsp + 0x68c]
mov ecx, dword [rsp + 0x690]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x10c]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSession_ID__Process_:_s__d__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x694], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x698], eax
mov eax, dword [rsp + 0x694]
mov ecx, dword [rsp + 0x698]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, dword [rsp + 0x4af0]
mov ecx, dword [rsp + 0x4af4]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x4ac8], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x4af0]
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0x4af4]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLogon_Session:_s_0x_x:0x_x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x69c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6a0], eax
mov eax, dword [rsp + 0x69c]
mov ecx, dword [rsp + 0x6a0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x250]
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0x254]
mov dword [rsp + 0x28], edx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sOriginating_Logon_Session:_s_0x_x:0x_x__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x6a4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6a8], eax
mov eax, dword [rsp + 0x6a4]
mov ecx, dword [rsp + 0x6a8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov rdx, qword [rsp + 0x41f8]
lea rcx, [rsp + 0x3360]
call fcn.140005fd0
mov qword [rsp + 0x2060], rax
mov rdx, qword [rsp + 0x2060]
lea rcx, [rsp + 0x4ba8]
call fcn.140009740
lea rcx, [rsp + 0x3360]
call fcn.140003890
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x2068], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2070], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2078], rax
mov rax, qword [rsp + 0x2068]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sToken_Integrity:_s__S__td___tr_
mov rdx, qword [rsp + 0x2070]
mov rcx, qword [rsp + 0x2078]
call fcn.1400c8230
mov dword [rsp + 0x6ac], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6b0], eax
mov eax, dword [rsp + 0x6ac]
mov ecx, dword [rsp + 0x6b0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, str.Primary_Token
lea rcx, [rsp + 0x4e10]
call fcn.1400b6ea0
test eax, eax
jne 0x1400745c7
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sToken_Type:_s_Primary_Token__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x6b4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6b8], eax
mov eax, dword [rsp + 0x6b4]
mov ecx, dword [rsp + 0x6b8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140074674
lea rcx, [rsp + 0x4e10]
call fcn.1400b3ed0
mov qword [rsp + 0x2080], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2088], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2090], rax
mov rax, qword [rsp + 0x2080]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sToken_Type:_s__s__td___tr_
mov rdx, qword [rsp + 0x2088]
mov rcx, qword [rsp + 0x2090]
call fcn.1400c8230
mov dword [rsp + 0x6bc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6c0], eax
mov eax, dword [rsp + 0x6bc]
mov ecx, dword [rsp + 0x6c0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLogon_Type:_s
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x6c4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6c8], eax
mov eax, dword [rsp + 0x6c4]
mov ecx, dword [rsp + 0x6c8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x14015348c]
lea rcx, [rsp + 0x4c20]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x140074944
lea rdx, [rsp + 0x4c20]
lea rcx, [rsp + 0x4ba8]
call fcn.140006550
movzx eax, byte [rsp + 0xa5]
test eax, eax
jne 0x140074731
movzx eax, byte [rsp + 0x81]
test eax, eax
je 0x1400748af
movzx eax, byte [rsp + 0x81]
test eax, eax
je 0x1400747f8
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x2098], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x20a0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20a8], rax
lea rax, str.__font_
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x2098]
mov qword [rsp + 0x20], rax
lea r9, str._font_color_ff6965___
lea r8, str._s_S__Alternative_Network_Credentials__s
mov rdx, qword [rsp + 0x20a0]
mov rcx, qword [rsp + 0x20a8]
call fcn.1400c8230
mov dword [rsp + 0x6cc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6d0], eax
mov eax, dword [rsp + 0x6cc]
mov ecx, dword [rsp + 0x6d0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x1400748aa
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x20b0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x20b8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20c0], rax
lea rax, str.__font_
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20b0]
mov qword [rsp + 0x20], rax
lea r9, str._font_color_ff6965___
lea r8, str._s_S__LogonType__s
mov rdx, qword [rsp + 0x20b8]
mov rcx, qword [rsp + 0x20c0]
call fcn.1400c8230
mov dword [rsp + 0x6d4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6d8], eax
mov eax, dword [rsp + 0x6d4]
mov ecx, dword [rsp + 0x6d8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140074944
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x20c8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x20d0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20d8], rax
mov r9, qword [rsp + 0x20c8]
lea r8, [0x1401534fc]
mov rdx, qword [rsp + 0x20d0]
mov rcx, qword [rsp + 0x20d8]
call fcn.1400c8230
mov dword [rsp + 0x6dc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6e0], eax
mov eax, dword [rsp + 0x6dc]
mov ecx, dword [rsp + 0x6e0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x140153508]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x6e4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6e8], eax
mov eax, dword [rsp + 0x6e4]
mov ecx, dword [rsp + 0x6e8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sAuthenticationPackage:_s
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x6ec], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6f0], eax
mov eax, dword [rsp + 0x6ec]
mov ecx, dword [rsp + 0x6f0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x14015353c]
lea rcx, [rsp + 0x4d20]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x140074bb9
lea rdx, [rsp + 0x4d20]
lea rcx, [rsp + 0x4ba8]
call fcn.140006550
movzx eax, byte [0x1401d2a16]
test eax, eax
je 0x140074b24
lea rdx, [0x140153548]
lea rcx, [rsp + 0x4d20]
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x140074b24
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x20e0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x20e8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20f0], rax
lea rax, str.__font_
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20e0]
mov qword [rsp + 0x20], rax
lea r9, str._font_color_ff6965___
lea r8, str._s_S__NTLM_Authentication__s
mov rdx, qword [rsp + 0x20e8]
mov rcx, qword [rsp + 0x20f0]
call fcn.1400c8230
mov dword [rsp + 0x6f4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x6f8], eax
mov eax, dword [rsp + 0x6f4]
mov ecx, dword [rsp + 0x6f8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140074bb9
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x20f8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2100], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2108], rax
mov r9, qword [rsp + 0x20f8]
lea r8, [0x140153578]
mov rdx, qword [rsp + 0x2100]
mov rcx, qword [rsp + 0x2108]
call fcn.1400c8230
mov dword [rsp + 0x6fc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x700], eax
mov eax, dword [rsp + 0x6fc]
mov ecx, dword [rsp + 0x700]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x140153580]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x704], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x708], eax
mov eax, dword [rsp + 0x704]
mov ecx, dword [rsp + 0x708]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, [rsp + 0x5930]
mov qword [rsp + 0x30], rdx
lea rdx, [rsp + 0x5c40]
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sDomainUser:_s__s_s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x70c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x710], eax
mov eax, dword [rsp + 0x70c]
mov ecx, dword [rsp + 0x710]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov rdx, qword [rsp + 0x4220]
lea rcx, [rsp + 0x4ba8]
call fcn.1400097c0
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x2110], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2118], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2120], rax
mov rax, qword [rsp + 0x2110]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSID:_s__S__td___tr_
mov rdx, qword [rsp + 0x2118]
mov rcx, qword [rsp + 0x2120]
call fcn.1400c8230
mov dword [rsp + 0x714], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x718], eax
mov eax, dword [rsp + 0x714]
mov ecx, dword [rsp + 0x718]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401535ec]
lea rcx, [rsp + 0x4d78]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x140074e5c
lea rdx, [rsp + 0x4d78]
lea rcx, [rsp + 0x4ba8]
call fcn.140006550
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x2128], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2130], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2138], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2128]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sMember_of:_s__s_S__Admin_Privs__s__td___tr_
mov rdx, qword [rsp + 0x2130]
mov rcx, qword [rsp + 0x2138]
call fcn.1400c8230
mov dword [rsp + 0x71c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x720], eax
mov eax, dword [rsp + 0x71c]
mov ecx, dword [rsp + 0x720]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140074ec9
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sNot_member_of:_s_BUILTINAdministrators_group.__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x724], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x728], eax
mov eax, dword [rsp + 0x724]
mov ecx, dword [rsp + 0x728]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140074f9b
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x60], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x58], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x50], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x48], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x40], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x38], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x30], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x28], rdx
lea rdx, str._tr__td_class___normal__
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSession_ID__Process_:__td___tr__n_sSession_ID__LSA_:__td___tr__n_sLogon_Session:__td___tr__n_sOriginating_Logon_Session:__td___tr__n_sToken_Integrity:__td___tr__n_sToken_Type:__td___tr__n_sLogon_Type:__td___tr__n_sAuthenticationPackage:__td___tr__n_sDomainUser:__td___tr__n_sSID:__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x72c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x730], eax
mov eax, dword [rsp + 0x72c]
mov ecx, dword [rsp + 0x730]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0x91]
test eax, eax
je 0x1400750e3
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__font_
mov qword [rsp + 0x30], rdx
lea rdx, str._font_color_ff6965___
mov qword [rsp + 0x28], rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sCmdLine:_s__s__Suspicious_Commandline__s__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x734], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x738], eax
mov eax, dword [rsp + 0x734]
mov ecx, dword [rsp + 0x738]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rax, [rsp + 0x3f50]
mov qword [rsp + 0x2140], rax
lea rdx, [0x1401537e8]
mov rcx, qword [rsp + 0x2140]
call fcn.140003570
mov qword [rsp + 0x2148], rax
mov rax, qword [rsp + 0x2148]
mov qword [rsp + 0x2150], rax
lea rcx, [rsp + 0x5010]
call fcn.140004b60
mov qword [rsp + 0x2158], rax
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 1
mov r9, qword [rsp + 0x2150]
mov r8d, 0x100
mov rdx, qword [rsp + 0x2158]
xor ecx, ecx
call fcn.14007a6b0
mov r8d, 0x4000
xor edx, edx
lea rcx, [0x1401d2a20]
call fcn.1401044f0
mov dword [0x1401d19fc], 0
jmp 0x140075190
lea rcx, [rsp + 0x5010]
call fcn.140004b60
mov qword [rsp + 0x2160], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2168], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2170], rax
mov rax, qword [rsp + 0x2160]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sCmdLine:_s__S__td___tr_
mov rdx, qword [rsp + 0x2168]
mov rcx, qword [rsp + 0x2170]
call fcn.1400c8230
mov dword [rsp + 0x73c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x740], eax
mov eax, dword [rsp + 0x73c]
mov ecx, dword [rsp + 0x740]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov r8, 0xffffffffffffffff
lea rdx, [0x14015380c]
lea rcx, [rsp + 0x4bf8]
call fcn.1400c2430
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3300]
lea rcx, [rsp + 0x4bf8]
call fcn.14000ac90
mov qword [rsp + 0x2178], rax
mov rax, qword [rsp + 0x2178]
mov qword [rsp + 0x2180], rax
mov eax, dword [rsp + 0x74]
or eax, 0x10
mov dword [rsp + 0x74], eax
lea rdx, [0x1401d7b80]
mov rcx, qword [rsp + 0x2180]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x140075289
mov r8, 0xffffffffffffffff
lea rdx, [0x140153810]
lea rcx, [rsp + 0x4bf8]
call fcn.1400c2430
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x3320]
lea rcx, [rsp + 0x4bf8]
call fcn.14000ac90
mov qword [rsp + 0x2188], rax
mov rax, qword [rsp + 0x2188]
mov qword [rsp + 0x2190], rax
mov eax, dword [rsp + 0x74]
or eax, 0x20
mov dword [rsp + 0x74], eax
lea rdx, [0x1401d7548]
mov rcx, qword [rsp + 0x2190]
call fcn.1400b63d0
movzx eax, al
test eax, eax
jne 0x140075289
mov dword [rsp + 0x244], 1
jmp 0x140075294
mov dword [rsp + 0x244], 0
movzx eax, byte [rsp + 0x244]
mov byte [rsp + 0xe3], al
mov eax, dword [rsp + 0x74]
and eax, 0x20
test eax, eax
je 0x1400752c1
and dword [rsp + 0x74], 0xffffffdf
lea rcx, [rsp + 0x3320]
call fcn.140003890
nop
mov eax, dword [rsp + 0x74]
and eax, 0x10
test eax, eax
je 0x1400752de
and dword [rsp + 0x74], 0xffffffef
lea rcx, [rsp + 0x3300]
call fcn.140003890
movzx eax, byte [rsp + 0xe3]
test eax, eax
je 0x1400753bd
lea rcx, [rsp + 0x4bf8]
call fcn.140004b60
mov qword [rsp + 0x2198], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x21a0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x21a8], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2198]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._sCWD:_s__s_S__Unusual_CWD__s__td___tr_
mov rdx, qword [rsp + 0x21a0]
mov rcx, qword [rsp + 0x21a8]
call fcn.1400c8230
mov dword [rsp + 0x744], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x748], eax
mov eax, dword [rsp + 0x744]
mov ecx, dword [rsp + 0x748]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x14007546a
lea rcx, [rsp + 0x4bf8]
call fcn.140004b60
mov qword [rsp + 0x21b0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x21b8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x21c0], rax
mov rax, qword [rsp + 0x21b0]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._sCWD:_s__S__td___tr_
mov rdx, qword [rsp + 0x21b8]
mov rcx, qword [rsp + 0x21c0]
call fcn.1400c8230
mov dword [rsp + 0x74c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x750], eax
mov eax, dword [rsp + 0x74c]
mov ecx, dword [rsp + 0x750]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_style_padding_right:_350px___
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___mm__
lea r8, str._n_sServices:_s
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x754], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x758], eax
mov eax, dword [rsp + 0x754]
mov ecx, dword [rsp + 0x758]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov dword [rsp + 0x150], 0
jmp 0x1400754f4
mov eax, dword [rsp + 0x150]
inc eax
mov dword [rsp + 0x150], eax
movsxd rax, dword [rsp + 0x150]
mov qword [rsp + 0x21c8], rax
lea rcx, [rsp + 0x4dd8]
call fcn.1400c32e0
mov rcx, qword [rsp + 0x21c8]
cmp rcx, rax
jae 0x1400755cf
movsxd rax, dword [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x4dd8]
call fcn.140041d40
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x21d0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x21d8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x21e0], rax
mov r9, qword [rsp + 0x21d0]
lea r8, str._n_t_S_br_
mov rdx, qword [rsp + 0x21d8]
mov rcx, qword [rsp + 0x21e0]
call fcn.1400c8230
mov dword [rsp + 0x75c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x760], eax
mov eax, dword [rsp + 0x75c]
mov ecx, dword [rsp + 0x760]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x1400754e4
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x140153878]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x764], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x768], eax
mov eax, dword [rsp + 0x764]
mov ecx, dword [rsp + 0x768]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x5240]
call fcn.140004b60
mov qword [rsp + 0x21e8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x21f0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x21f8], rax
mov rax, qword [rsp + 0x21e8]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr_style_border_top:_1px_solid_c0c0c0__td_class___normal__
lea r8, str._n_sPE_format:_s__S__td___tr_
mov rdx, qword [rsp + 0x21f0]
mov rcx, qword [rsp + 0x21f8]
call fcn.1400c8230
mov dword [rsp + 0x76c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x770], eax
mov eax, dword [rsp + 0x76c]
mov ecx, dword [rsp + 0x770]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, word [rax + 0x5da]
cmp eax, 0x8664
jne 0x140075763
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___mm__
lea r8, str._n_sTarget_Machine:_s_IMAGE_FILE_MACHINE_AMD64__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x774], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x778], eax
mov eax, dword [rsp + 0x774]
mov ecx, dword [rsp + 0x778]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x1400757eb
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, word [rax + 0x5da]
cmp eax, 0x14c
jne 0x1400757eb
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___mm__
lea r8, str._n_sTarget_Machine:_s_IMAGE_FILE_MACHINE_I386__td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x77c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x780], eax
mov eax, dword [rsp + 0x77c]
mov ecx, dword [rsp + 0x780]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x5f50]
lea rcx, [rsp + 0x4ba8]
call fcn.1400097c0
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x2200], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2208], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2210], rax
mov rax, qword [rsp + 0x2200]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLoad_time:_s__S__td___tr_
mov rdx, qword [rsp + 0x2208]
mov rcx, qword [rsp + 0x2210]
call fcn.1400c8230
mov dword [rsp + 0x784], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x788], eax
mov eax, dword [rsp + 0x784]
mov ecx, dword [rsp + 0x788]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___normal__
lea r8, str._n_sLoad_delay:_s
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x78c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x790], eax
mov eax, dword [rsp + 0x78c]
mov ecx, dword [rsp + 0x790]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
cmp dword [rsp + 0x1d0], 0
je 0x14007597e
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea r8, [0x14015394c]
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x794], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x798], eax
mov eax, dword [rsp + 0x794]
mov ecx, dword [rsp + 0x798]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x6160]
lea rcx, [rsp + 0x4ba8]
call fcn.1400097c0
lea rcx, [rsp + 0x4ba8]
call fcn.140004b60
mov qword [rsp + 0x2218], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2220], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2228], rax
mov r9, qword [rsp + 0x2218]
lea r8, str._S__td___tr_
mov rdx, qword [rsp + 0x2220]
mov rcx, qword [rsp + 0x2228]
call fcn.1400c8230
mov dword [rsp + 0x79c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7a0], eax
mov eax, dword [rsp + 0x79c]
mov ecx, dword [rsp + 0x7a0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
movzx eax, byte [rsp + 0xa6]
test eax, eax
je 0x140075b07
lea rcx, [rsp + 0x51a0]
call fcn.140004b60
mov qword [rsp + 0x2230], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2238], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2240], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2230]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSignature:_s__s_S__Process_Not_Signed__s__td___tr_
mov rdx, qword [rsp + 0x2238]
mov rcx, qword [rsp + 0x2240]
call fcn.1400c8230
mov dword [rsp + 0x7a4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7a8], eax
mov eax, dword [rsp + 0x7a4]
mov ecx, dword [rsp + 0x7a8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140075bb4
lea rcx, [rsp + 0x51a0]
call fcn.140004b60
mov qword [rsp + 0x2248], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2250], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2258], rax
mov rax, qword [rsp + 0x2248]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sSignature:_s__S__td___tr_
mov rdx, qword [rsp + 0x2250]
mov rcx, qword [rsp + 0x2258]
call fcn.1400c8230
mov dword [rsp + 0x7ac], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7b0], eax
mov eax, dword [rsp + 0x7ac]
mov ecx, dword [rsp + 0x7b0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x2858]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140075f2c
lea rdx, [rsp + 0x2860]
lea rcx, [0x1401d7310]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ab8]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140075f2c
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x80
mov qword [rsp + 0x2260], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov qword [rsp + 0x2268], rax
mov rdx, qword [rsp + 0x2260]
mov rcx, qword [rsp + 0x2268]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x140075e6c
lea rdx, [0x1401442da]
lea rcx, [rsp + 0x5398]
call fcn.140003570
nop
lea rdx, [0x1401442db]
lea rcx, [rsp + 0x5378]
call fcn.140003570
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rdx, rax
lea rcx, [rsp + 0x54d0]
call fcn.1400322d0
nop
lea rcx, [rsp + 0x54d0]
call fcn.1400c45d0
movzx eax, al
test eax, eax
jne 0x140075cf2
lea rdx, [0x1401d7410]
lea rcx, [rsp + 0x5398]
call fcn.14003e6e0
lea rdx, [0x1401d7430]
lea rcx, [rsp + 0x5378]
call fcn.14003e6e0
lea rcx, [rsp + 0x5378]
call fcn.1400b3ed0
mov qword [rsp + 0x2270], rax
lea rcx, [rsp + 0x4ab8]
call fcn.140042040
add rax, 0x80
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x2278], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x2280], rax
lea rcx, [rsp + 0x5398]
call fcn.1400b3ed0
mov qword [rsp + 0x2288], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2290], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2298], rax
lea rax, str.__font_
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x2270]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x2278]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x2280]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2288]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sPDB_file__memory____file_:_s___s_s_s_____s__Memory_File_Values_Mismatch__s_s__td___tr_
mov rdx, qword [rsp + 0x2290]
mov rcx, qword [rsp + 0x2298]
call fcn.1400c8230
mov dword [rsp + 0x7b4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7b8], eax
mov eax, dword [rsp + 0x7b4]
mov ecx, dword [rsp + 0x7b8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x54d0]
call fcn.140003860
nop
lea rcx, [rsp + 0x5378]
call fcn.140003860
nop
lea rcx, [rsp + 0x5398]
call fcn.140003860
jmp 0x140075f27
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x22a0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x22a8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x22b0], rax
mov rax, qword [rsp + 0x22a0]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, [0x140153a20]
mov rdx, qword [rsp + 0x22a8]
mov rcx, qword [rsp + 0x22b0]
call fcn.1400c8230
mov dword [rsp + 0x7bc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7c0], eax
mov eax, dword [rsp + 0x7bc]
mov ecx, dword [rsp + 0x7c0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140075fe7
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x180
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x22b8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x22c0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x22c8], rax
mov rax, qword [rsp + 0x22b8]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___normal__
lea r8, str._n_sPDB_file:_s__s__td___tr_
mov rdx, qword [rsp + 0x22c0]
mov rcx, qword [rsp + 0x22c8]
call fcn.1400c8230
mov dword [rsp + 0x7c4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7c8], eax
mov eax, dword [rsp + 0x7c4]
mov ecx, dword [rsp + 0x7c8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x7d9]
test eax, eax
jne 0x14007601f
lea rdx, [rsp + 0x4df0]
lea rcx, [rsp + 0x4cb8]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x140076218
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x7d9]
test eax, eax
je 0x140076127
lea rcx, [rsp + 0x4df0]
call fcn.1400b3ed0
mov qword [rsp + 0x22d0], rax
lea rcx, [rsp + 0x4cb8]
call fcn.1400b3ed0
mov qword [rsp + 0x22d8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x22e0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x22e8], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x22d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x22d8]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_FILE_HEADER_TimeDateStamp__memory____file_:_s__s_s_____s__Delphi_4
mov rdx, qword [rsp + 0x22e0]
mov rcx, qword [rsp + 0x22e8]
call fcn.1400c8230
mov dword [rsp + 0x7cc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7d0], eax
mov eax, dword [rsp + 0x7cc]
mov ecx, dword [rsp + 0x7d0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x14007620e
lea rcx, [rsp + 0x4df0]
call fcn.1400b3ed0
mov qword [rsp + 0x22f0], rax
lea rcx, [rsp + 0x4cb8]
call fcn.1400b3ed0
mov qword [rsp + 0x22f8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2300], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2308], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x22f0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x22f8]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_FILE_HEADER_TimeDateStamp__memory____file_:_s__s_s_____s__Memory_File_Values_Mismatch__s__td___tr_
mov rdx, qword [rsp + 0x2300]
mov rcx, qword [rsp + 0x2308]
call fcn.1400c8230
mov dword [rsp + 0x7d4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7d8], eax
mov eax, dword [rsp + 0x7d4]
mov ecx, dword [rsp + 0x7d8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x1400762c5
lea rcx, [rsp + 0x4cb8]
call fcn.1400b3ed0
mov qword [rsp + 0x2310], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2318], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2320], rax
mov rax, qword [rsp + 0x2310]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_FILE_HEADER_TimeDateStamp:_s__s__td___tr_
mov rdx, qword [rsp + 0x2318]
mov rcx, qword [rsp + 0x2320]
call fcn.1400c8230
mov dword [rsp + 0x7dc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7e0], eax
mov eax, dword [rsp + 0x7dc]
mov ecx, dword [rsp + 0x7e0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x4ca0]
lea rcx, [rsp + 0x4bc8]
call fcn.140010010
movzx eax, al
test eax, eax
je 0x14007667e
lea rcx, [rsp + 0x4bc8]
call fcn.1400c32e0
test rax, rax
jbe 0x140076442
lea rax, [rsp + 0x4bc8]
mov qword [rsp + 0x928], rax
mov rcx, qword [rsp + 0x928]
call fcn.140008ce0
mov qword [rsp + 0x2a0], rax
mov rcx, qword [rsp + 0x928]
call fcn.14001c8b0
mov qword [rsp + 0x2328], rax
jmp 0x14007634b
mov rax, qword [rsp + 0x2a0]
add rax, 0x20
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2328]
cmp qword [rsp + 0x2a0], rax
je 0x14007643b
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x2330], rax
mov rcx, qword [rsp + 0x2330]
call fcn.1400b3ed0
mov qword [rsp + 0x2338], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2340], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2348], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2338]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_DEBUG_DIRECTORY_TimeDateStamp__memory_:_s__s_s__Memory_File_Values_Mismatch__s__td___tr_
mov rdx, qword [rsp + 0x2340]
mov rcx, qword [rsp + 0x2348]
call fcn.1400c8230
mov dword [rsp + 0x7e4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7e8], eax
mov eax, dword [rsp + 0x7e4]
mov ecx, dword [rsp + 0x7e8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140076337
mov byte [rsp + 0x70], 1
jmp 0x1400764af
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_DEBUG_DIRECTORY_TimeDateStamp__memory_:_s___td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x7ec], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7f0], eax
mov eax, dword [rsp + 0x7ec]
mov ecx, dword [rsp + 0x7f0]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rcx, [rsp + 0x4ca0]
call fcn.1400c32e0
test rax, rax
jbe 0x14007660c
lea rax, [rsp + 0x4ca0]
mov qword [rsp + 0x920], rax
mov rcx, qword [rsp + 0x920]
call fcn.140008ce0
mov qword [rsp + 0x280], rax
mov rcx, qword [rsp + 0x920]
call fcn.14001c8b0
mov qword [rsp + 0x2350], rax
jmp 0x140076515
mov rax, qword [rsp + 0x2350]
cmp qword [rsp + 0x280], rax
je 0x140076605
mov rax, qword [rsp + 0x280]
mov qword [rsp + 0x2358], rax
mov rcx, qword [rsp + 0x2358]
call fcn.1400b3ed0
mov qword [rsp + 0x2360], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2368], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2370], rax
lea rax, str.__font_
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x2360]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_DEBUG_DIRECTORY_TimeDateStamp__file_:_s__s_s__Memory_File_Values_Mismatch__s__td___tr_
mov rdx, qword [rsp + 0x2368]
mov rcx, qword [rsp + 0x2370]
call fcn.1400c8230
mov dword [rsp + 0x7f4], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x7f8], eax
mov eax, dword [rsp + 0x7f4]
mov ecx, dword [rsp + 0x7f8]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x140076501
mov byte [rsp + 0x70], 1
jmp 0x140076679
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_DEBUG_DIRECTORY_TimeDateStamp__file_:_s___td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x7fc], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x800], eax
mov eax, dword [rsp + 0x7fc]
mov ecx, dword [rsp + 0x800]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x14007682b
lea rcx, [rsp + 0x4bc8]
call fcn.1400c32e0
test rax, rax
jbe 0x1400767be
lea rax, [rsp + 0x4bc8]
mov qword [rsp + 0x950], rax
mov rcx, qword [rsp + 0x950]
call fcn.140008ce0
mov qword [rsp + 0x288], rax
mov rcx, qword [rsp + 0x950]
call fcn.14001c8b0
mov qword [rsp + 0x2378], rax
jmp 0x1400766e4
mov rax, qword [rsp + 0x288]
add rax, 0x20
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x2378]
cmp qword [rsp + 0x288], rax
je 0x1400767bc
mov rax, qword [rsp + 0x288]
mov qword [rsp + 0x2380], rax
mov rcx, qword [rsp + 0x2380]
call fcn.1400b3ed0
mov qword [rsp + 0x2388], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2390], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2398], rax
mov rax, qword [rsp + 0x2388]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_DEBUG_DIRECTORY_TimeDateStamp:_s__s__td___tr_
mov rdx, qword [rsp + 0x2390]
mov rcx, qword [rsp + 0x2398]
call fcn.1400c8230
mov dword [rsp + 0x804], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x808], eax
mov eax, dword [rsp + 0x804]
mov ecx, dword [rsp + 0x808]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
jmp 0x1400766d0
jmp 0x14007682b
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d2a20]
add rdx, rcx
mov rcx, rdx
lea rdx, str.__td___td_
mov qword [rsp + 0x20], rdx
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_DEBUG_DIRECTORY_TimeDateStamp:_s___td___tr_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x80c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x810], eax
mov eax, dword [rsp + 0x80c]
mov ecx, dword [rsp + 0x810]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x5030]
lea rcx, [rsp + 0x4ee0]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x14007693c
lea rcx, [rsp + 0x5030]
call fcn.1400b3ed0
mov qword [rsp + 0x23a0], rax
lea rcx, [rsp + 0x4ee0]
call fcn.1400b3ed0
mov qword [rsp + 0x23a8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x23b0], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x23b8], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x23a0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x23a8]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_EXPORT_DIRECTORY_TimeDateStamp__memory____file_:_s__s_s_____s__Memory_File_Values_Mismatch__s__td___tr_
mov rdx, qword [rsp + 0x23b0]
mov rcx, qword [rsp + 0x23b8]
call fcn.1400c8230
mov dword [rsp + 0x814], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x818], eax
mov eax, dword [rsp + 0x814]
mov ecx, dword [rsp + 0x818]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x1400769e9
lea rcx, [rsp + 0x4ee0]
call fcn.1400b3ed0
mov qword [rsp + 0x23c0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x23c8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x23d0], rax
mov rax, qword [rsp + 0x23c0]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_EXPORT_DIRECTORY_TimeDateStamp:_s__s__td___tr_
mov rdx, qword [rsp + 0x23c8]
mov rcx, qword [rsp + 0x23d0]
call fcn.1400c8230
mov dword [rsp + 0x81c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x820], eax
mov eax, dword [rsp + 0x81c]
mov ecx, dword [rsp + 0x820]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [rsp + 0x5050]
lea rcx, [rsp + 0x4ea0]
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x140076afa
lea rcx, [rsp + 0x5050]
call fcn.1400b3ed0
mov qword [rsp + 0x23d8], rax
lea rcx, [rsp + 0x4ea0]
call fcn.1400b3ed0
mov qword [rsp + 0x23e0], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x23e8], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x23f0], rax
lea rax, str.__font_
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x23d8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x23e0]
mov qword [rsp + 0x30], rax
lea rax, str._font_color_ff6965___
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_RESOURCE_DIRECTORY_TimeDateStamp__memory____file_:_s__s_s_____s__Memory_File_Values_Mismatch__s__td___tr_
mov rdx, qword [rsp + 0x23e8]
mov rcx, qword [rsp + 0x23f0]
call fcn.1400c8230
mov dword [rsp + 0x824], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x828], eax
mov eax, dword [rsp + 0x824]
mov ecx, dword [rsp + 0x828]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
mov byte [rsp + 0x70], 1
jmp 0x140076ba7
lea rcx, [rsp + 0x4ea0]
call fcn.1400b3ed0
mov qword [rsp + 0x23f8], rax
mov eax, 0x4000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov qword [rsp + 0x2400], rax
mov eax, dword [0x1401d19fc]
lea rcx, [0x1401d2a20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2408], rax
mov rax, qword [rsp + 0x23f8]
mov qword [rsp + 0x28], rax
lea rax, str.__td___td_
mov qword [rsp + 0x20], rax
lea r9, str._tr__td_class___mm__
lea r8, str._n_sIMAGE_RESOURCE_DIRECTORY_TimeDateStamp:_s__s__td___tr_
mov rdx, qword [rsp + 0x2400]
mov rcx, qword [rsp + 0x2408]
call fcn.1400c8230
mov dword [rsp + 0x82c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x830], eax
mov eax, dword [rsp + 0x82c]
mov ecx, dword [rsp + 0x830]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d2a20]
lea rcx, [rsp + 0x2c68]
call fcn.140003570
nop
lea rdx, [rsp + 0x2c68]
lea rcx, [rsp + 0x4ce8]
call fcn.1400c1960
nop
lea rcx, [rsp + 0x2c68]
call fcn.140003860
lea rax, [rsp + 0x4ce8]
mov qword [rsp + 0x960], rax
mov rcx, qword [rsp + 0x960]
call fcn.140008ce0
mov qword [rsp + 0x290], rax
mov rcx, qword [rsp + 0x960]
call fcn.14001c8b0
mov qword [rsp + 0x2410], rax
jmp 0x140076c2f
mov rax, qword [rsp + 0x2410]
cmp qword [rsp + 0x290], rax
je 0x140076c67
lea rcx, [rsp + 0x2f28]
call fcn.140034230
mov qword [rsp + 0x2420], rax
mov rax, qword [rsp + 0x2420]
mov qword [rsp + 0x2428], rax
lea rdx, [rsp + 0x4ce8]
mov rcx, qword [rsp + 0x2428]
call fcn.1400c3850
lea rcx, [rsp + 0x2f28]
call fcn.14003d0d0
mov rcx, qword [rsp + 0x4228]
call sub.Secur32.dll_LsaFreeReturnBuffer
mov edx, 0x18
lea rcx, [rsp + 0x50c8]
call fcn.1400079b0
lea rcx, [rsp + 0x50c8]
call fcn.140034230
nop
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x140076e6e
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5d8]
cmp eax, 1
jne 0x140076df0
mov edx, 8
lea rcx, [rsp + 0x4b90]
call fcn.1400079b0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5c8
mov qword [rsp + 0x2430], rax
lea rdx, [rsp + 0x4b90]
mov rcx, qword [rsp + 0x2430]
call fcn.1400b5ef0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x5c8
mov qword [rsp + 0x2438], rax
lea rdx, [rsp + 0x2868]
mov rcx, qword [rsp + 0x2438]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b90]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140076dee
lea rcx, [rsp + 0x4b90]
call fcn.140042060
movzx eax, byte [rax + 0x58]
test eax, eax
je 0x140076dd1
lea rcx, [rsp + 0x4b90]
call fcn.140042060
add rax, 0x10
mov rdx, rax
lea rcx, [rsp + 0x50c8]
call fcn.1400c1a80
xor r8d, r8d
lea rdx, [rsp + 0x2870]
lea rcx, [rsp + 0x4b90]
call fcn.1400421d0
jmp 0x140076d54
jmp 0x140076e6e
mov rax, qword [rsp + 0x4ab0]
mov qword [rsp + 0x4c18], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
cmp dword [rax + 0x50], 0
je 0x140076e59
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov eax, dword [rax + 0x50]
mov qword [rsp + 0x2440], rax
mov rax, qword [rsp + 0x4c18]
mov qword [rsp + 0x2448], rax
mov rax, qword [rsp + 0x2440]
mov rcx, qword [rsp + 0x2448]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x4c18], rax
lea rdx, [rsp + 0x4c18]
lea rcx, [rsp + 0x50c8]
call fcn.1400c1a80
lea rax, [rsp + 0x3f70]
mov qword [rsp + 0x2450], rax
mov rdx, qword [rsp + 0x4220]
mov rcx, qword [rsp + 0x2450]
call fcn.140005fd0
mov qword [rsp + 0x2458], rax
mov rax, qword [rsp + 0x2458]
mov qword [rsp + 0x2460], rax
mov rax, qword [rsp + 0x2460]
mov qword [rsp + 0x24a8], rax
lea rax, [rsp + 0x3480]
mov qword [rsp + 0x2468], rax
lea rdx, [rsp + 0x50c8]
mov rcx, qword [rsp + 0x2468]
call fcn.140034b50
mov qword [rsp + 0x2470], rax
mov rax, qword [rsp + 0x2470]
mov qword [rsp + 0x2478], rax
mov rax, qword [rsp + 0x2478]
mov qword [rsp + 0x24b0], rax
lea rax, [rsp + 0x3748]
mov qword [rsp + 0x2480], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7310]
call fcn.140041c20
add rax, 0xf8
mov rdx, rax
mov rcx, qword [rsp + 0x2480]
call fcn.1400322d0
mov qword [rsp + 0x2488], rax
mov rax, qword [rsp + 0x2488]
mov qword [rsp + 0x2490], rax
mov rax, qword [rsp + 0x2490]
mov qword [rsp + 0x24b8], rax
lea rax, [rsp + 0x3f90]
mov qword [rsp + 0x2498], rax
lea rdx, [rsp + 0x4ab0]
lea rcx, [0x1401d7050]
call fcn.140041bf0
add rax, 0x1f8
mov rdx, rax
mov rcx, qword [rsp + 0x2498]
call fcn.1400322d0
mov qword [rsp + 0x24a0], rax
mov rax, qword [rsp + 0x24a0]
mov qword [rsp + 0x24c0], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x834], eax
mov rax, qword [rsp + 0x24a8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x24b0]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x28], al
mov rax, qword [rsp + 0x24b8]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x24c0]
movzx r8d, byte [rsp + 0x82]
mov edx, dword [rsp + 0x834]
lea rcx, [rsp + 0x41e8]
call fcn.140092e10
mov byte [rsp + 0xee], al
mov r8d, dword [rsp + 0x41e0]
lea rdx, [rsp + 0x43a0]
lea rcx, [rsp + 0x41e8]
call fcn.14004e0e0
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
cmp dword [rax + 0x220], 0
je 0x14007739c
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x5d9]
test eax, eax
je 0x14007739c
lea rdx, [0x140153ef4]
lea rcx, [rsp + 0x2c88]
call fcn.140003570
nop
lea rdx, [rsp + 0x2c88]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400770b6
mov dword [rsp + 0x1f0], 1
jmp 0x1400770c1
mov dword [rsp + 0x1f0], 0
movzx eax, byte [rsp + 0x1f0]
mov byte [rsp + 0xe4], al
lea rcx, [rsp + 0x2c88]
call fcn.140003860
movzx eax, byte [rsp + 0xe4]
test eax, eax
je 0x14007710b
mov edx, 4
lea rcx, [0x140153f00]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, str._n_n_HOOKS_
call fcn.14004d7e0
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2ca8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2ca8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xe5], al
lea rcx, [rsp + 0x2ca8]
call fcn.140003860
movzx eax, byte [rsp + 0xe5]
test eax, eax
je 0x1400771e4
mov dword [0x1401d19fc], 0
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov r9d, dword [rsp + 0x41e0]
lea r8, str._n_button_type_button__class_collapsible__id_dhooks_Process_Module_Hooks__button__div_class_contento__
mov edx, eax
call fcn.1400c8230
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rcx, [0x1401d7940]
call fcn.1400bc980
lea rdx, str._n_hr_class_categAlertas___p_class_categAlertasColor___HOOKS___p_
lea rcx, [0x1401d7940]
call fcn.14000f800
mov edx, 0x18
lea rcx, [rsp + 0x5300]
call fcn.1400079b0
lea rcx, [rsp + 0x5300]
call fcn.140034230
nop
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x838], eax
mov rax, qword [rsp + 0x4ab0]
mov qword [rsp + 0x24d0], rax
mov eax, 0x20
imul rax, rax, 4
mov qword [rsp + 0x24c8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov rcx, qword [rsp + 0x24c8]
lea rax, [rax + rcx + 0x2d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x24d8], rax
mov byte [rsp + 0x28], 1
lea rax, [rsp + 0x5300]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x838]
lea r8, [rsp + 0x41e8]
mov rdx, qword [rsp + 0x24d0]
mov rcx, qword [rsp + 0x24d8]
call fcn.14005ce60
lea rdx, [0x14015403c]
lea rcx, [rsp + 0x2cc8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2cc8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xe6], al
lea rcx, [rsp + 0x2cc8]
call fcn.140003860
movzx eax, byte [rsp + 0xe6]
test eax, eax
je 0x14007738f
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov dword [0x1401d19fc], 0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x41e0]
mov dword [rsp + 0x20], edx
mov r9d, dword [rsp + 0x41e0]
lea r8, str._n_h2_style_text_align:center____a_href__dhooks___span_stylefont_size:20px__128281___span___a__a_href__d___span_stylefont_size:20px__128285___span___a___h2___div_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x83c], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x840], eax
mov eax, dword [rsp + 0x83c]
mov ecx, dword [rsp + 0x840]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rcx, [0x1401d7940]
call fcn.1400bc980
nop
lea rcx, [rsp + 0x5300]
call fcn.14003d0d0
lea rax, [rsp + 0x3fb0]
mov qword [rsp + 0x24e0], rax
lea rdx, [rsp + 0x5240]
mov rcx, qword [rsp + 0x24e0]
call fcn.140005f30
mov qword [rsp + 0x24e8], rax
mov rax, qword [rsp + 0x24e8]
mov qword [rsp + 0x24f0], rax
mov rax, qword [rsp + 0x24f0]
mov qword [rsp + 0x2520], rax
lea rax, [rsp + 0x3fd0]
mov qword [rsp + 0x24f8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x848
mov rdx, rax
mov rcx, qword [rsp + 0x24f8]
call fcn.140005f30
mov qword [rsp + 0x2500], rax
mov rax, qword [rsp + 0x2500]
mov qword [rsp + 0x2508], rax
mov rax, qword [rsp + 0x2508]
mov qword [rsp + 0x2528], rax
lea rax, [rsp + 0x3ff0]
mov qword [rsp + 0x2510], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x828
mov rdx, rax
mov rcx, qword [rsp + 0x2510]
call fcn.140005f30
mov qword [rsp + 0x2518], rax
mov rax, qword [rsp + 0x2518]
mov qword [rsp + 0x2530], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x844], eax
mov rax, qword [rsp + 0x2520]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x2528]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2530]
mov r8d, dword [rsp + 0x844]
lea rdx, [rsp + 0x41e8]
mov rcx, qword [rsp + 0x128]
call fcn.1400856d0
mov byte [rsp + 0xef], al
mov qword [rsp + 0x220], 0
mov qword [rsp + 0x298], 0
lea rdx, [0x1401540f4]
lea rcx, [rsp + 0x53f8]
call fcn.140005fd0
nop
mov byte [rsp + 0xb5], 0
mov edx, 0x18
lea rcx, [rsp + 0x4f58]
call fcn.1400079b0
lea rcx, [rsp + 0x1d8]
call fcn.140003030
mov qword [rsp + 0x2538], rax
mov byte [rsp + 0xe7], 0
mov r9, qword [rsp + 0x2538]
lea r8, [rsp + 0xe7]
mov rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x4f58]
call fcn.140034380
nop
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x6c]
test eax, eax
jne 0x140077592
movzx eax, byte [rsp + 0x82]
test eax, eax
je 0x140077846
mov edx, 8
lea rcx, [rsp + 0x4b30]
call fcn.1400079b0
lea rdx, [rsp + 0x4b30]
lea rcx, [0x1401d7050]
call fcn.1400b5ef0
jmp 0x1400775d2
xor r8d, r8d
lea rdx, [rsp + 0x2878]
lea rcx, [rsp + 0x4b30]
call fcn.1400421d0
lea rdx, [rsp + 0x2880]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b30]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140077846
lea rcx, [rsp + 0x4b30]
call fcn.140042060
add rax, 0x30
lea rdx, str.clr.dll
mov rcx, rax
call fcn.14000fe70
movzx eax, al
test eax, eax
jne 0x140077653
lea rcx, [rsp + 0x4b30]
call fcn.140042060
add rax, 0x30
lea rdx, str.mscorwks.dll
mov rcx, rax
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x140077841
lea rcx, [rsp + 0x4b30]
call fcn.140042060
add rax, 0x30
mov rdx, rax
lea rcx, [rsp + 0x53f8]
call fcn.140006550
mov edx, 8
lea rcx, [rsp + 0x4b60]
call fcn.1400079b0
lea rcx, [rsp + 0x4b30]
call fcn.140042060
add rax, 0x5b8
mov qword [rsp + 0x2540], rax
lea rdx, [rsp + 0x4b60]
mov rcx, qword [rsp + 0x2540]
call fcn.1400b5ef0
jmp 0x1400776d0
xor r8d, r8d
lea rdx, [rsp + 0x2888]
lea rcx, [rsp + 0x4b60]
call fcn.1400421d0
lea rcx, [rsp + 0x4b30]
call fcn.140042060
add rax, 0x5b8
mov qword [rsp + 0x2548], rax
lea rdx, [rsp + 0x2890]
mov rcx, qword [rsp + 0x2548]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b60]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140077841
lea rcx, [rsp + 0x4b60]
call fcn.140042060
add rax, 8
lea rdx, [0x140154124]
mov rcx, rax
call fcn.14000fc30
movzx eax, al
test eax, eax
je 0x14007783c
lea rcx, [rsp + 0x4b60]
call fcn.140042060
mov eax, dword [rax + 0x2c]
mov qword [rsp + 0x220], rax
lea rcx, [rsp + 0x4b60]
call fcn.140042060
mov eax, dword [rax + 0x30]
mov qword [rsp + 0x2550], rax
lea rcx, [rsp + 0x4b30]
call fcn.140042060
mov rcx, qword [rsp + 0x2550]
add rcx, qword [rax + 0x70]
mov rax, rcx
mov qword [rsp + 0x298], rax
mov byte [rsp + 0xe8], 0
lea r8, [rsp + 0xe8]
mov rdx, qword [rsp + 0x220]
lea rcx, [rsp + 0x4f58]
call fcn.1400c2160
xor edx, edx
lea rcx, [rsp + 0x4f58]
call fcn.140041c50
mov qword [rsp + 0x2558], rax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x2560], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x220]
mov r8, qword [rsp + 0x2558]
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x2560]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140077823
mov byte [rsp + 0xb4], 1
jmp 0x14007782b
mov byte [rsp + 0xb4], 0
movzx eax, byte [rsp + 0xb4]
mov byte [rsp + 0xb5], al
jmp 0x140077841
jmp 0x1400776b8
jmp 0x1400775ba
mov byte [rsp + 0xb6], 0
mov byte [rsp + 0xb7], 0
mov byte [rsp + 0xb9], 0
mov byte [rsp + 0xb8], 0
mov byte [rsp + 0xba], 0
mov byte [rsp + 0xc2], 0
lea rdx, [rsp + 0x2898]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4aa0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140078d01
lea rdx, [0x14015412c]
lea rcx, [rsp + 0x2ce8]
call fcn.140003570
nop
lea rdx, [rsp + 0x2ce8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400778e2
mov dword [rsp + 0x1f4], 1
jmp 0x1400778ed
mov dword [rsp + 0x1f4], 0
movzx eax, byte [rsp + 0x1f4]
mov byte [rsp + 0xe9], al
lea rcx, [rsp + 0x2ce8]
call fcn.140003860
movzx eax, byte [rsp + 0xe9]
test eax, eax
je 0x140077937
mov edx, 4
lea rcx, [0x140154130]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, str._n_n_MEMORY_
call fcn.14004d7e0
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2d08]
call fcn.140003570
nop
lea rdx, [rsp + 0x2d08]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xea], al
lea rcx, [rsp + 0x2d08]
call fcn.140003860
movzx eax, byte [rsp + 0xea]
test eax, eax
je 0x140077a10
mov dword [0x1401d19fc], 0
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov r9d, dword [rsp + 0x41e0]
lea r8, str._n_button_type_button__class_collapsible__id_dmemory_Memory__button__div_class_contento__
mov edx, eax
call fcn.1400c8230
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rcx, [0x1401d7940]
call fcn.1400bc980
lea rdx, str._n_br__hr_class_categAlertas___p_class_categAlertasColor___MEMORY___p__n_table_class_process_table__
lea rcx, [0x1401d7940]
call fcn.14000f800
mov edx, 8
lea rcx, [rsp + 0x4ac0]
call fcn.1400079b0
lea rdx, [rsp + 0x28a0]
lea rcx, [0x1401d7050]
call fcn.1400b5ef0
mov rax, qword [rax]
mov qword [rsp + 0x4ac0], rax
jmp 0x140077a5b
xor r8d, r8d
lea rdx, [rsp + 0x28a8]
lea rcx, [rsp + 0x4ac0]
call fcn.1400421d0
lea rdx, [rsp + 0x28b0]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4ac0]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140078bb0
lea rdx, [0x14015427c]
lea rcx, [rsp + 0x4e70]
call fcn.140005fd0
nop
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
movzx eax, byte [rax + 0x22c]
test eax, eax
je 0x140077e51
mov dword [rsp + 0x1d4], 0xffffffff
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
movzx eax, byte [rax + 0x6c]
test eax, eax
jne 0x140077aeb
movzx eax, byte [rsp + 0x82]
test eax, eax
je 0x140077b9c
movzx eax, byte [rsp + 0xb5]
test eax, eax
je 0x140077b9c
lea rax, [rsp + 0x4010]
mov qword [rsp + 0x2568], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x130
mov rdx, rax
mov rcx, qword [rsp + 0x2568]
call fcn.140005f30
mov qword [rsp + 0x2570], rax
mov rax, qword [rsp + 0x2570]
mov qword [rsp + 0x2578], rax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x2580], rax
mov rax, qword [rsp + 0x2578]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x220]
lea r8, [rsp + 0x4ac0]
mov rdx, qword [rsp + 0x2580]
lea rcx, [rsp + 0x4f58]
call fcn.14005be10
mov dword [rsp + 0x1d4], eax
cmp dword [rsp + 0x1d4], 0xffffffff
je 0x140077cd2
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
movsxd rax, dword [rsp + 0x1d4]
mov rcx, qword [rsp + 0x298]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x2588], rax
lea rcx, [rsp + 0x53f8]
call fcn.140004b60
mov rcx, qword [rsp + 0x2588]
mov r9, rcx
mov r8, rax
lea rdx, [0x140154280]
lea rcx, [0x1401d1a00]
call fcn.14002e760
lea rdx, [0x1401d1a00]
lea rcx, [rsp + 0x54f0]
call fcn.140003570
nop
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov eax, dword [rax + 0x230]
mov dword [rsp + 0x848], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x25a0], rax
lea rax, [rsp + 0x4030]
mov qword [rsp + 0x2590], rax
lea rdx, [rsp + 0x54f0]
mov rcx, qword [rsp + 0x2590]
call fcn.1400322d0
mov qword [rsp + 0x2598], rax
mov rax, qword [rsp + 0x2598]
mov qword [rsp + 0x25a8], rax
mov r9d, dword [rsp + 0x848]
mov r8, qword [rsp + 0x25a0]
mov rdx, qword [rsp + 0x25a8]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
lea rdx, str._Executable_Memory_Region_NOT_MEM_IMAGE___Memory_region_referenced_in__S_at_0x_016llx_
lea rcx, [rsp + 0x4e70]
call fcn.1400097c0
nop
lea rcx, [rsp + 0x54f0]
call fcn.140003860
jmp 0x140077e51
mov eax, dword [0x1401d19f4]
add eax, 2
mov dword [0x1401d19f4], eax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov eax, dword [rax + 0x230]
mov dword [rsp + 0x84c], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x25c0], rax
lea rax, [rsp + 0x4050]
mov qword [rsp + 0x25b0], rax
lea rdx, [0x140154390]
mov rcx, qword [rsp + 0x25b0]
call fcn.140003570
mov qword [rsp + 0x25b8], rax
mov rax, qword [rsp + 0x25b8]
mov qword [rsp + 0x25c8], rax
mov r9d, dword [rsp + 0x84c]
mov r8, qword [rsp + 0x25c0]
mov rdx, qword [rsp + 0x25c8]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
movzx eax, byte [rsp + 0xb6]
test eax, eax
jne 0x140077e3d
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x850], eax
lea rax, [rsp + 0x4070]
mov qword [rsp + 0x25d0], rax
lea rdx, [0x1401442dc]
mov rcx, qword [rsp + 0x25d0]
call fcn.140003570
mov qword [rsp + 0x25d8], rax
mov rax, qword [rsp + 0x25d8]
mov qword [rsp + 0x25e0], rax
mov rax, qword [rsp + 0x25e0]
mov qword [rsp + 0x25f8], rax
lea rax, [rsp + 0x4090]
mov qword [rsp + 0x25e8], rax
lea rdx, [0x1401543c0]
mov rcx, qword [rsp + 0x25e8]
call fcn.140003570
mov qword [rsp + 0x25f0], rax
mov rax, qword [rsp + 0x25f0]
mov qword [rsp + 0x2600], rax
mov r9d, dword [rsp + 0x850]
mov r8d, 0xa
mov rdx, qword [rsp + 0x25f8]
mov rcx, qword [rsp + 0x2600]
call fcn.140052820
mov byte [rsp + 0xb6], 1
lea rdx, [0x1401543f0]
lea rcx, [rsp + 0x4e70]
call fcn.1400097c0
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
movzx eax, byte [rax + 0x587]
test eax, eax
je 0x140077fec
mov eax, dword [0x1401d19f4]
add eax, 5
mov dword [0x1401d19f4], eax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov eax, dword [rax + 0x588]
mov dword [rsp + 0x854], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x2618], rax
lea rax, [rsp + 0x40b0]
mov qword [rsp + 0x2608], rax
lea rdx, [0x140154448]
mov rcx, qword [rsp + 0x2608]
call fcn.140003570
mov qword [rsp + 0x2610], rax
mov rax, qword [rsp + 0x2610]
mov qword [rsp + 0x2620], rax
mov r9d, dword [rsp + 0x854]
mov r8, qword [rsp + 0x2618]
mov rdx, qword [rsp + 0x2620]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
movzx eax, byte [rsp + 0xb7]
test eax, eax
jne 0x140077fd8
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x858], eax
lea rax, [rsp + 0x40d0]
mov qword [rsp + 0x2628], rax
lea rdx, [0x1401442dd]
mov rcx, qword [rsp + 0x2628]
call fcn.140003570
mov qword [rsp + 0x2630], rax
mov rax, qword [rsp + 0x2630]
mov qword [rsp + 0x2638], rax
mov rax, qword [rsp + 0x2638]
mov qword [rsp + 0x2650], rax
lea rax, [rsp + 0x40f0]
mov qword [rsp + 0x2640], rax
lea rdx, [0x140154458]
mov rcx, qword [rsp + 0x2640]
call fcn.140003570
mov qword [rsp + 0x2648], rax
mov rax, qword [rsp + 0x2648]
mov qword [rsp + 0x2658], rax
mov r9d, dword [rsp + 0x858]
mov r8d, 0xa
mov rdx, qword [rsp + 0x2650]
mov rcx, qword [rsp + 0x2658]
call fcn.140052820
mov byte [rsp + 0xb7], 1
lea rdx, [0x140154468]
lea rcx, [rsp + 0x4e70]
call fcn.1400436a0
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
movzx eax, byte [rax + 0x7d8]
test eax, eax
je 0x14007830e
mov eax, dword [0x1401d19f4]
add eax, 5
mov dword [0x1401d19f4], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x2670], rax
lea rax, [rsp + 0x4110]
mov qword [rsp + 0x2660], rax
lea rdx, [0x140154480]
mov rcx, qword [rsp + 0x2660]
call fcn.140003570
mov qword [rsp + 0x2668], rax
mov rax, qword [rsp + 0x2668]
mov qword [rsp + 0x2678], rax
xor r9d, r9d
mov r8, qword [rsp + 0x2670]
mov rdx, qword [rsp + 0x2678]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
lea rdx, [0x140154494]
lea rcx, [rsp + 0x2d28]
call fcn.140003570
nop
lea rdx, [rsp + 0x2d28]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400780c0
mov dword [rsp + 0x1f8], 1
jmp 0x1400780cb
mov dword [rsp + 0x1f8], 0
movzx eax, byte [rsp + 0x1f8]
mov byte [rsp + 0xeb], al
lea rcx, [rsp + 0x2d28]
call fcn.140003860
movzx eax, byte [rsp + 0xeb]
test eax, eax
je 0x140078158
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
add rax, 0x70
mov rdx, rax
lea rcx, [0x1401d7310]
call fcn.140041c20
mov qword [rsp + 0x2680], rax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
add rax, 0x70
mov rdx, rax
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov qword [rsp + 0x2688], rax
mov rdx, qword [rsp + 0x2680]
mov rcx, qword [rsp + 0x2688]
call fcn.14007af70
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2d48]
call fcn.140003570
nop
lea rdx, [rsp + 0x2d48]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xec], al
lea rcx, [rsp + 0x2d48]
call fcn.140003860
movzx eax, byte [rsp + 0xec]
test eax, eax
je 0x140078229
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
add rax, 0x70
mov rdx, rax
lea rcx, [0x1401d7310]
call fcn.140041c20
mov qword [rsp + 0x2690], rax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
add rax, 0x70
mov rdx, rax
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov qword [rsp + 0x2698], rax
mov rdx, qword [rsp + 0x2690]
mov rcx, qword [rsp + 0x2698]
call fcn.14007b7c0
lea rdx, [0x1401d2a20]
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rcx, [0x1401d7940]
call fcn.1400bc980
movzx eax, byte [rsp + 0xb8]
test eax, eax
jne 0x1400782fa
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x85c], eax
lea rax, [rsp + 0x4130]
mov qword [rsp + 0x26a0], rax
lea rdx, [0x1401442de]
mov rcx, qword [rsp + 0x26a0]
call fcn.140003570
mov qword [rsp + 0x26a8], rax
mov rax, qword [rsp + 0x26a8]
mov qword [rsp + 0x26b0], rax
mov rax, qword [rsp + 0x26b0]
mov qword [rsp + 0x26c8], rax
lea rax, [rsp + 0x4150]
mov qword [rsp + 0x26b8], rax
lea rdx, [0x1401544a0]
mov rcx, qword [rsp + 0x26b8]
call fcn.140003570
mov qword [rsp + 0x26c0], rax
mov rax, qword [rsp + 0x26c0]
mov qword [rsp + 0x26d0], rax
mov r9d, dword [rsp + 0x85c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x26c8]
mov rcx, qword [rsp + 0x26d0]
call fcn.140052820
mov byte [rsp + 0xb8], 1
lea rdx, [0x1401544b8]
lea rcx, [rsp + 0x4e70]
call fcn.1400436a0
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
movzx eax, byte [rax + 0x224]
test eax, eax
je 0x1400784a9
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov eax, dword [rax + 0x228]
mov dword [rsp + 0x860], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x26e8], rax
lea rax, [rsp + 0x4170]
mov qword [rsp + 0x26d8], rax
lea rdx, [0x1401544e0]
mov rcx, qword [rsp + 0x26d8]
call fcn.140003570
mov qword [rsp + 0x26e0], rax
mov rax, qword [rsp + 0x26e0]
mov qword [rsp + 0x26f0], rax
mov r9d, dword [rsp + 0x860]
mov r8, qword [rsp + 0x26e8]
mov rdx, qword [rsp + 0x26f0]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
movzx eax, byte [rsp + 0xb9]
test eax, eax
jne 0x140078495
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x864], eax
lea rax, [rsp + 0x34e8]
mov qword [rsp + 0x26f8], rax
lea rdx, [0x1401442df]
mov rcx, qword [rsp + 0x26f8]
call fcn.140003570
mov qword [rsp + 0x2700], rax
mov rax, qword [rsp + 0x2700]
mov qword [rsp + 0x2708], rax
mov rax, qword [rsp + 0x2708]
mov qword [rsp + 0x2720], rax
lea rax, [rsp + 0x3508]
mov qword [rsp + 0x2710], rax
lea rdx, [0x140154500]
mov rcx, qword [rsp + 0x2710]
call fcn.140003570
mov qword [rsp + 0x2718], rax
mov rax, qword [rsp + 0x2718]
mov qword [rsp + 0x2728], rax
mov r9d, dword [rsp + 0x864]
mov r8d, 0xa
mov rdx, qword [rsp + 0x2720]
mov rcx, qword [rsp + 0x2728]
call fcn.140052820
mov eax, dword [0x1401d19f4]
add eax, 5
mov dword [0x1401d19f4], eax
mov byte [rsp + 0xb9], 1
lea rdx, [0x140154520]
lea rcx, [rsp + 0x4e70]
call fcn.1400436a0
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
lea rdx, [0x140154560]
mov rcx, rax
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14007866e
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
add rax, 0xd8
mov qword [rsp + 0x2730], rax
xor r8d, r8d
lea rdx, [0x140154564]
mov rcx, qword [rsp + 0x2730]
call fcn.1400bc850
cmp rax, 0xffffffffffffffff
je 0x14007866e
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x2748], rax
lea rax, [rsp + 0x3728]
mov qword [rsp + 0x2738], rax
lea rdx, [0x140154568]
mov rcx, qword [rsp + 0x2738]
call fcn.140003570
mov qword [rsp + 0x2740], rax
mov rax, qword [rsp + 0x2740]
mov qword [rsp + 0x2750], rax
xor r9d, r9d
mov r8, qword [rsp + 0x2748]
mov rdx, qword [rsp + 0x2750]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
movzx eax, byte [rsp + 0xba]
test eax, eax
jne 0x14007865a
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x868], eax
lea rax, [rsp + 0x3768]
mov qword [rsp + 0x2758], rax
lea rdx, [0x1401442ea]
mov rcx, qword [rsp + 0x2758]
call fcn.140003570
mov qword [rsp + 0x2760], rax
mov rax, qword [rsp + 0x2760]
mov qword [rsp + 0x2768], rax
mov rax, qword [rsp + 0x2768]
mov qword [rsp + 0x2780], rax
lea rax, [rsp + 0x3828]
mov qword [rsp + 0x2770], rax
lea rdx, [0x140154588]
mov rcx, qword [rsp + 0x2770]
call fcn.140003570
mov qword [rsp + 0x2778], rax
mov rax, qword [rsp + 0x2778]
mov qword [rsp + 0x2788], rax
mov r9d, dword [rsp + 0x868]
mov r8d, 0xa
mov rdx, qword [rsp + 0x2780]
mov rcx, qword [rsp + 0x2788]
call fcn.140052820
mov byte [rsp + 0xba], 1
lea rdx, [0x1401545a8]
lea rcx, [rsp + 0x4e70]
call fcn.1400436a0
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov ecx, 0x20
imul rcx, rcx, 4
lea rax, [rax + rcx + 0x2d8]
mov qword [rsp + 0x2790], rax
mov r8, 0xffffffffffffffff
lea rdx, [0x1401545e8]
mov rcx, qword [rsp + 0x2790]
call fcn.1400c2430
cmp rax, 0xffffffffffffffff
je 0x14007880a
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x27a8], rax
lea rax, [rsp + 0x3868]
mov qword [rsp + 0x2798], rax
lea rdx, [0x1401545f8]
mov rcx, qword [rsp + 0x2798]
call fcn.140003570
mov qword [rsp + 0x27a0], rax
mov rax, qword [rsp + 0x27a0]
mov qword [rsp + 0x27b0], rax
xor r9d, r9d
mov r8, qword [rsp + 0x27a8]
mov rdx, qword [rsp + 0x27b0]
lea rcx, [rsp + 0x4ac0]
call fcn.14008cad0
movzx eax, byte [rsp + 0xc2]
test eax, eax
jne 0x1400787f6
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x86c], eax
lea rax, [rsp + 0x38c8]
mov qword [rsp + 0x27b8], rax
lea rdx, [0x1401442eb]
mov rcx, qword [rsp + 0x27b8]
call fcn.140003570
mov qword [rsp + 0x27c0], rax
mov rax, qword [rsp + 0x27c0]
mov qword [rsp + 0x27c8], rax
mov rax, qword [rsp + 0x27c8]
mov qword [rsp + 0x27e0], rax
lea rax, [rsp + 0x3908]
mov qword [rsp + 0x27d0], rax
lea rdx, [0x140154610]
mov rcx, qword [rsp + 0x27d0]
call fcn.140003570
mov qword [rsp + 0x27d8], rax
mov rax, qword [rsp + 0x27d8]
mov qword [rsp + 0x27e8], rax
mov r9d, dword [rsp + 0x86c]
mov r8d, 0xa
mov rdx, qword [rsp + 0x27e0]
mov rcx, qword [rsp + 0x27e8]
call fcn.140052820
mov byte [rsp + 0xc2], 1
lea rdx, [0x140154628]
lea rcx, [rsp + 0x4e70]
call fcn.1400436a0
lea rdx, [0x140154668]
lea rcx, [rsp + 0x4e70]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x140078b90
lea rdx, [0x140154684]
lea rcx, [rsp + 0x2d68]
call fcn.140003570
nop
mov eax, dword [rsp + 0x74]
or eax, 0x40
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x2d68]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140078889
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
movzx eax, byte [rax + 0x586]
test eax, eax
jne 0x140078889
mov dword [rsp + 0x200], 0
jmp 0x140078894
mov dword [rsp + 0x200], 1
movzx eax, byte [rsp + 0x200]
mov byte [rsp + 0xed], al
mov eax, dword [rsp + 0x74]
and eax, 0x40
test eax, eax
je 0x1400788c0
and dword [rsp + 0x74], 0xffffffbf
lea rcx, [rsp + 0x2d68]
call fcn.140003860
movzx eax, byte [rsp + 0xed]
test eax, eax
je 0x140078b8e
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
movzx eax, byte [rax + 0x7d8]
test eax, eax
je 0x140078ace
mov qword [rsp + 0x8b8], 0
mov edx, 8
lea rcx, [rsp + 0x4b88]
call fcn.1400079b0
lea rdx, [rsp + 0x28b8]
lea rcx, [0x1401d7050]
call fcn.1400b5ef0
mov rax, qword [rax]
mov qword [rsp + 0x4b88], rax
jmp 0x140078943
xor r8d, r8d
lea rdx, [rsp + 0x28c0]
lea rcx, [rsp + 0x4b88]
call fcn.1400421d0
lea rdx, [rsp + 0x28c8]
lea rcx, [0x1401d7050]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b88]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x1400789d7
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov qword [rsp + 0x27f0], rax
lea rcx, [rsp + 0x4b88]
call fcn.140042040
mov rax, qword [rax + 0x80]
mov rcx, qword [rsp + 0x27f0]
cmp qword [rcx + 0x80], rax
jne 0x1400789d2
lea rcx, [rsp + 0x4b88]
call fcn.140042040
mov rax, qword [rax + 0x118]
mov rcx, qword [rsp + 0x8b8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x8b8], rax
jmp 0x14007892b
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
add rax, 0x70
mov rdx, rax
lea rcx, [0x1401d7050]
call fcn.140041bf0
mov rcx, qword [rsp + 0x8b8]
mov qword [rax + 0x118], rcx
lea rax, [rsp + 0x3928]
mov qword [rsp + 0x27f8], rax
lea rdx, str.MemoryRegion_HiddenPE
mov rcx, qword [rsp + 0x27f8]
call fcn.140005fd0
mov qword [rsp + 0x2800], rax
mov rax, qword [rsp + 0x2800]
mov qword [rsp + 0x2808], rax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov rax, qword [rax + 0x120]
mov qword [rsp + 0x2810], rax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov rax, qword [rax + 0x80]
mov qword [rsp + 0x2818], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x870], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x2820], rax
mov rax, qword [rsp + 0x2808]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x2810]
mov r8, qword [rsp + 0x2818]
mov edx, dword [rsp + 0x870]
mov rcx, qword [rsp + 0x2820]
call fcn.14005c8f0
jmp 0x140078b8e
lea rax, [rsp + 0x3948]
mov qword [rsp + 0x2828], rax
lea rdx, str.MemoryRegion
mov rcx, qword [rsp + 0x2828]
call fcn.140005fd0
mov qword [rsp + 0x2830], rax
mov rax, qword [rsp + 0x2830]
mov qword [rsp + 0x2838], rax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov rax, qword [rax + 0x118]
mov qword [rsp + 0x988], rax
lea rcx, [rsp + 0x4ac0]
call fcn.140042040
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x990], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x874], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x998], rax
mov rax, qword [rsp + 0x2838]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x988]
mov r8, qword [rsp + 0x990]
mov edx, dword [rsp + 0x874]
mov rcx, qword [rsp + 0x998]
call fcn.14005c8f0
jmp 0x140078b9e
lea rcx, [rsp + 0x4ac0]
call fcn.14008c0b0
nop
lea rcx, [rsp + 0x4e70]
call fcn.140003890
jmp 0x140077a43
lea rcx, [rsp + 0x2f10]
call fcn.140034230
mov qword [rsp + 0x9a0], rax
mov rax, qword [rsp + 0x9a0]
mov qword [rsp + 0x9a8], rax
lea rdx, [rsp + 0x4f58]
mov rcx, qword [rsp + 0x9a8]
call fcn.1400c3850
lea rcx, [rsp + 0x2f10]
call fcn.14003d030
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2d88]
call fcn.140003570
nop
lea rdx, [rsp + 0x2d88]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xfe], al
lea rcx, [rsp + 0x2d88]
call fcn.140003860
movzx eax, byte [rsp + 0xfe]
test eax, eax
je 0x140078d01
lea rdx, [0x140154730]
lea rcx, [0x1401d7940]
call fcn.14000f800
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov dword [0x1401d19fc], 0
mov eax, 0x1000
sub eax, dword [0x1401d19fc]
mov eax, eax
mov ecx, dword [0x1401d19fc]
lea rdx, [0x1401d1a00]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rsp + 0x41e0]
mov dword [rsp + 0x20], edx
mov r9d, dword [rsp + 0x41e0]
lea r8, str._n_h2_style_text_align:center____a_href__dmemory___span_stylefont_size:20px__128281___span___a__a_href__d___span_stylefont_size:20px__128285___span___a___h2___div_
mov edx, eax
call fcn.1400c8230
mov dword [rsp + 0x878], eax
mov eax, dword [0x1401d19fc]
mov dword [rsp + 0x87c], eax
mov eax, dword [rsp + 0x878]
mov ecx, dword [rsp + 0x87c]
add ecx, eax
mov eax, ecx
mov dword [0x1401d19fc], eax
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rcx, [0x1401d7940]
call fcn.1400bc980
lea rdx, [0x1401547f4]
lea rcx, [rsp + 0x2da8]
call fcn.140003570
nop
mov eax, dword [rsp + 0x74]
bts eax, 7
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x2da8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
je 0x140078d5e
movzx eax, byte [rsp + 0xee]
test eax, eax
jne 0x140078d77
movzx eax, byte [rsp + 0x70]
test eax, eax
jne 0x140078d77
movzx eax, byte [rsp + 0xef]
test eax, eax
jne 0x140078d77
movzx eax, byte [rsp + 0x92]
test eax, eax
jne 0x140078d77
mov dword [rsp + 0x208], 0
jmp 0x140078d82
mov dword [rsp + 0x208], 1
movzx eax, byte [rsp + 0x208]
mov byte [rsp + 0xf0], al
mov eax, dword [rsp + 0x74]
and eax, 0x80
test eax, eax
je 0x140078db3
and dword [rsp + 0x74], 0xffffff7f
lea rcx, [rsp + 0x2da8]
call fcn.140003860
movzx eax, byte [rsp + 0xf0]
test eax, eax
je 0x140078e90
lea rax, [rsp + 0x3968]
mov qword [rsp + 0x9b0], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
add rax, 0x30
mov rdx, rax
mov rcx, qword [rsp + 0x9b0]
call fcn.140005f30
mov qword [rsp + 0x9b8], rax
mov rax, qword [rsp + 0x9b8]
mov qword [rsp + 0x9c0], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov rax, qword [rax + 0x120]
mov qword [rsp + 0x9c8], rax
lea rcx, [rsp + 0x4aa0]
call fcn.140042060
mov rax, qword [rax + 0x70]
mov qword [rsp + 0x9d0], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x880], eax
mov rax, qword [rsp + 0x41e8]
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x9c8]
mov r8, qword [rsp + 0x9d0]
mov edx, dword [rsp + 0x880]
mov rcx, qword [rsp + 0x9d8]
call fcn.14005c8f0
lea rdx, [0x1401547f8]
lea rcx, [rsp + 0x2de8]
call fcn.140003570
nop
mov eax, dword [rsp + 0x74]
bts eax, 8
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x2de8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140078f15
lea rdx, [0x1401547fc]
lea rcx, [rsp + 0x2dc8]
call fcn.140003570
nop
mov eax, dword [rsp + 0x74]
bts eax, 9
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x2dc8]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x140078f15
mov dword [rsp + 0x20c], 0
jmp 0x140078f20
mov dword [rsp + 0x20c], 1
movzx eax, byte [rsp + 0x20c]
mov byte [rsp + 0xf1], al
mov eax, dword [rsp + 0x74]
and eax, 0x200
test eax, eax
je 0x140078f52
and dword [rsp + 0x74], 0xfffffdff
lea rcx, [rsp + 0x2dc8]
call fcn.140003860
nop
mov eax, dword [rsp + 0x74]
and eax, 0x100
test eax, eax
je 0x140078f74
and dword [rsp + 0x74], 0xfffffeff
lea rcx, [rsp + 0x2de8]
call fcn.140003860
movzx eax, byte [rsp + 0xf1]
test eax, eax
je 0x14007905d
mov rax, qword [rsp + 0x4ab0]
mov qword [rsp + 0xa18], rax
lea rax, [rsp + 0x3a88]
mov qword [rsp + 0x9e0], rax
lea rdx, [rsp + 0x5720]
mov rcx, qword [rsp + 0x9e0]
call fcn.140005fd0
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
mov rax, qword [rsp + 0x9f0]
mov qword [rsp + 0xa28], rax
lea rax, [rsp + 0x3ae8]
mov qword [rsp + 0x9f8], rax
lea rdx, [rsp + 0x4ff0]
mov rcx, qword [rsp + 0x9f8]
call fcn.140005f30
mov qword [rsp + 0xa00], rax
mov rax, qword [rsp + 0xa00]
mov qword [rsp + 0xa40], rax
mov eax, dword [rsp + 0x41e0]
mov dword [rsp + 0x884], eax
mov rax, qword [rsp + 0xa18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x41e8]
mov r8, qword [rsp + 0xa28]
mov rdx, qword [rsp + 0xa40]
mov ecx, dword [rsp + 0x884]
call fcn.14007db40
mov rcx, qword [rsp + 0x41e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2e48]
call fcn.140003570
nop
lea rdx, [rsp + 0x2e48]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xf2], al
lea rcx, [rsp + 0x2e48]
call fcn.140003860
movzx eax, byte [rsp + 0xf2]
test eax, eax
je 0x1400792cf
movsxd rax, dword [0x1401d6a24]
imul rax, rax, 0x20
lea rcx, [0x1401d7220]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa48], rax
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x20
mov rdx, qword [rsp + 0xa48]
mov rcx, rax
call fcn.14003e6e0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
lea rdx, [rsp + 0x5720]
mov rcx, rax
call fcn.1400097c0
lea rdx, [rsp + 0x41e0]
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov ecx, dword [rsp + 0xac]
mov dword [rax + 0x40], ecx
lea rdx, str.__table___div_
lea rcx, [0x1401d7aa0]
call fcn.140043640
lea rcx, [0x1401d7aa0]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401d7940]
call fcn.14000f800
mov dword [rsp + 0x1fc], 0
cmp dword [0x1401d6a20], 5
jle 0x140079197
mov eax, dword [0x1401d6a20]
sub eax, 5
imul eax, eax, 9
mov dword [rsp + 0x1fc], eax
mov edx, dword [rsp + 0x1fc]
lea rcx, [rsp + 0x32c0]
call fcn.1400c3a80
mov qword [rsp + 0xa50], rax
mov rax, qword [rsp + 0xa50]
mov qword [rsp + 0xa58], rax
mov r8, qword [rsp + 0xa58]
lea rdx, str._p_style_border_width:
lea rcx, [rsp + 0x32e0]
call fcn.1400102f0
mov qword [rsp + 0xa60], rax
mov rax, qword [rsp + 0xa60]
mov qword [rsp + 0xa68], rax
lea r8, str.px__border_color:_black__border_style:solid____
mov rdx, qword [rsp + 0xa68]
lea rcx, [rsp + 0x54b0]
call fcn.1400101c0
nop
lea rcx, [rsp + 0x32e0]
call fcn.140003860
nop
lea rcx, [rsp + 0x32c0]
call fcn.140003860
lea rdx, [rsp + 0x54b0]
lea rcx, [0x1401d7940]
call fcn.14000f400
lea rdx, [0x1401548a8]
lea rcx, [0x1401d7940]
call fcn.14000f800
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov eax, dword [0x1401d19f4]
mov dword [rsp + 0x888], eax
lea rcx, [0x1401d7788]
call fcn.1400b3ed0
mov qword [rsp + 0xa70], rax
mov r9d, dword [rsp + 0x888]
mov r8, qword [rsp + 0xa70]
lea rdx, str._t_s_t_d
lea rcx, [0x1401d1a00]
call fcn.14002e760
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d77d0]
call fcn.14000f800
nop
lea rcx, [rsp + 0x54b0]
call fcn.140003860
lea rdx, [0x1401548d8]
lea rcx, [rsp + 0x2e08]
call fcn.140003570
nop
lea rdx, [rsp + 0x2e08]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xf3], al
lea rcx, [rsp + 0x2e08]
call fcn.140003860
movzx eax, byte [rsp + 0xf3]
test eax, eax
je 0x140079376
mov ecx, ntohs
call fcn.14007a320
lea rcx, [0x1401d7320]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401548ec]
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x18a], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xa78], rax
movzx edx, word [rsp + 0x18a]
mov rcx, qword [rsp + 0xa78]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x4f58]
call fcn.14003d030
nop
lea rcx, [rsp + 0x53f8]
call fcn.140003890
nop
lea rcx, [rsp + 0x50c8]
call fcn.14003d090
nop
lea rcx, [rsp + 0x4ba8]
call fcn.140003890
nop
lea rcx, [rsp + 0x4ce8]
call fcn.14003d0d0
nop
lea rcx, [rsp + 0x5590]
call fcn.140003890
nop
lea rcx, [rsp + 0x5240]
call fcn.140003890
nop
lea rcx, [rsp + 0x50a8]
call fcn.140003890
nop
lea rcx, [rsp + 0x4d00]
call fcn.140003890
nop
lea rcx, [rsp + 0x51c0]
call fcn.140003890
nop
lea rcx, [rsp + 0x51a0]
call fcn.140003890
nop
lea rcx, [rsp + 0x4d58]
call fcn.140003890
nop
lea rcx, [rsp + 0x5088]
call fcn.140003890
nop
lea rcx, [rsp + 0x5358]
call fcn.140003890
nop
lea rcx, [rsp + 0x4d20]
call fcn.140003890
nop
lea rcx, [rsp + 0x4c20]
call fcn.140003890
nop
lea rcx, [rsp + 0x4d78]
call fcn.140003890
nop
lea rcx, [rsp + 0x4e10]
call fcn.140003860
nop
lea rcx, [rsp + 0x5180]
call fcn.140003890
nop
lea rcx, [rsp + 0x5200]
call fcn.140003890
nop
lea rcx, [rsp + 0x51e0]
call fcn.140003890
nop
lea rcx, [rsp + 0x4ff0]
call fcn.140003890
nop
lea rcx, [rsp + 0x5050]
call fcn.140003860
nop
lea rcx, [rsp + 0x5030]
call fcn.140003860
nop
lea rcx, [rsp + 0x4df0]
call fcn.140003860
nop
lea rcx, [rsp + 0x4ca0]
call fcn.14003d0d0
nop
lea rcx, [rsp + 0x4ea0]
call fcn.140003860
nop
lea rcx, [rsp + 0x4ee0]
call fcn.140003860
nop
lea rcx, [rsp + 0x4cb8]
call fcn.140003860
nop
lea rcx, [rsp + 0x4bc8]
call fcn.14003d0d0
nop
lea rcx, [rsp + 0x5148]
call fcn.14003d030
nop
lea rcx, [rsp + 0x4dd8]
call fcn.14003d0f0
nop
lea rcx, [rsp + 0x5010]
call fcn.140003890
nop
lea rcx, [rsp + 0x4bf8]
call fcn.140003890
nop
lea rcx, [rsp + 0x4c88]
call fcn.14003d090
nop
lea rcx, [rsp + 0x4f00]
call fcn.140003860
mov rax, qword [rsp + 0x128]
cmp dword [rax], 0
jne 0x1400664dc
lea rcx, [0x1401d77d0]
call fcn.1400b6d00
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0x2e28]
call fcn.140003570
nop
lea rdx, [rsp + 0x2e28]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0xf4], al
lea rcx, [rsp + 0x2e28]
call fcn.140003860
movzx eax, byte [rsp + 0xf4]
test eax, eax
je 0x14007a0c3
lea rdx, [0x140154924]
lea rcx, [0x1401d7940]
call fcn.14000f800
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
mov edx, 8
lea rcx, [rsp + 0x4b80]
call fcn.1400079b0
lea rdx, [rsp + 0x4b80]
lea rcx, [0x1401d7340]
call fcn.1400b5ef0
lea rdx, [rsp + 0x2a10]
lea rcx, [0x1401d7340]
call fcn.1400b5ef0
mov rax, qword [rax]
mov qword [rsp + 0x4b80], rax
jmp 0x140079652
lea rcx, [rsp + 0x4b80]
call fcn.140042240
lea rdx, [rsp + 0x2a18]
lea rcx, [0x1401d7340]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b80]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14007969b
lea rcx, [rsp + 0x4b80]
call fcn.140042060
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.1400c1930
jmp 0x140079645
lea rdx, [0x1401442ee]
lea rcx, [rsp + 0x4f20]
call fcn.140003570
nop
mov dword [rsp + 0x7c], 0
jmp 0x1400796c4
mov eax, dword [rsp + 0x7c]
inc eax
mov dword [rsp + 0x7c], eax
movsxd rax, dword [rsp + 0x7c]
mov qword [rsp + 0xa80], rax
lea rcx, [0x1401d7a88]
call fcn.1400c32b0
mov rcx, qword [rsp + 0xa80]
cmp rcx, rax
jae 0x140079d1f
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400b6fb0
test rax, rax
je 0x140079d1a
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x40
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400b6fb0
test rax, rax
je 0x140079772
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
cmp dword [rax], 0
jne 0x140079d1a
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
movzx eax, byte [rax + 0x46]
test eax, eax
je 0x1400797b1
lea rdx, [0x1401d7920]
lea rcx, [rsp + 0x4f20]
call fcn.14003e6e0
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
movzx eax, byte [rax + 0x47]
test eax, eax
je 0x1400797f0
lea rdx, [0x1401d7370]
lea rcx, [rsp + 0x4f20]
call fcn.140043610
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
movzx eax, byte [rax + 0x48]
test eax, eax
je 0x14007982f
lea rdx, [0x1401d73c8]
lea rcx, [rsp + 0x4f20]
call fcn.140043610
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
movzx eax, byte [rax + 0x49]
test eax, eax
je 0x14007986e
lea rdx, [0x1401d74b0]
lea rcx, [rsp + 0x4f20]
call fcn.140043610
lea rdx, [0x1401442ef]
lea rcx, [rsp + 0x5260]
call fcn.140003570
nop
mov r8d, 0x1000
xor edx, edx
lea rcx, [0x1401d1a00]
call fcn.1401044f0
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
movzx eax, byte [rax + 0x44]
cmp eax, 1
jne 0x1400799ed
lea rcx, [rsp + 0x4f20]
call fcn.1400b3ed0
mov qword [rsp + 0xa88], rax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x88c], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x890], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0xa90], rax
lea rcx, [rsp + 0x5260]
call fcn.1400b3ed0
mov qword [rsp + 0xa98], rax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x20
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0xaa0], rax
mov rax, qword [rsp + 0xa88]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x88c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x890]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xa98]
mov r8, qword [rsp + 0xaa0]
lea rdx, str._n_span_class__s___s_S___span__span_class_backgroundNET___a_href__d____d___a___span__s_br_
lea rcx, [0x1401d1a00]
call fcn.14002e760
jmp 0x140079c64
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
movzx eax, byte [rax + 0x45]
cmp eax, 1
jne 0x140079b43
lea rcx, [rsp + 0x4f20]
call fcn.1400b3ed0
mov qword [rsp + 0xaa8], rax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x894], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x898], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0xab0], rax
lea rcx, [rsp + 0x5260]
call fcn.1400b3ed0
mov qword [rsp + 0xab8], rax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x20
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0xac0], rax
mov rax, qword [rsp + 0xaa8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x894]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x898]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xab0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xab8]
mov r8, qword [rsp + 0xac0]
lea rdx, str._n_span_class__s___s_S___span__span_class_backgroundPE___a_href__d____d___a___span__s_br_
lea rcx, [0x1401d1a00]
call fcn.14002e760
jmp 0x140079c64
lea rcx, [rsp + 0x4f20]
call fcn.1400b3ed0
mov qword [rsp + 0xac8], rax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x89c], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x8a0], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0xad0], rax
lea rcx, [rsp + 0x5260]
call fcn.1400b3ed0
mov qword [rsp + 0xad8], rax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400419b0
add rax, 0x20
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0xae0], rax
mov rax, qword [rsp + 0xac8]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x89c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x8a0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xad0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xad8]
mov r8, qword [rsp + 0xae0]
lea rdx, str._n_span_class__s___s_S___span__a_href__d____d___a__s_br_
lea rcx, [0x1401d1a00]
call fcn.14002e760
lea rdx, [0x1401d1a00]
lea rcx, [0x1401d7b60]
call fcn.140043640
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov eax, dword [rax]
mov dword [rsp + 0x8a4], eax
movsxd rax, dword [rsp + 0x7c]
mov rdx, rax
lea rcx, [0x1401d7a88]
call fcn.140041cb0
mov rdx, rax
lea rcx, [0x1401d7340]
call fcn.1400bbad0
lea rax, [rsp + 0x3b08]
mov qword [rsp + 0xae8], rax
lea rdx, [rsp + 0x5260]
mov rcx, qword [rsp + 0xae8]
call fcn.1400322d0
mov qword [rsp + 0xaf0], rax
mov rdx, qword [rsp + 0xaf0]
mov ecx, dword [rsp + 0x8a4]
call fcn.140044b40
lea rdx, [0x140144314]
lea rcx, [rsp + 0x4f20]
call fcn.140003940
nop
lea rcx, [rsp + 0x5260]
call fcn.140003860
jmp 0x1400796ba
lea rdx, [0x1401d78e8]
lea rcx, [0x1401d7b60]
call fcn.140043610
mov edx, 8
lea rcx, [rsp + 0x4b68]
call fcn.1400079b0
lea rdx, [rsp + 0x4b68]
lea rcx, [0x1401d7538]
call fcn.1400b5ef0
jmp 0x140079d72
xor r8d, r8d
lea rdx, [rsp + 0x29a8]
lea rcx, [rsp + 0x4b68]
call fcn.1400421d0
lea rdx, [rsp + 0x2a70]
lea rcx, [0x1401d7538]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x4b68]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140079fa2
lea rcx, [rsp + 0x4b68]
call fcn.140042060
add rax, 0x40
mov qword [rsp + 0xb48], rax
lea rcx, [rsp + 0x4b68]
call fcn.140042060
mov qword [rsp + 0xb18], rax
lea rcx, [rsp + 0x4b68]
call fcn.140042060
add rax, 0x20
mov r8, rax
lea rdx, str._span_class_
lea rcx, [rsp + 0x3220]
call fcn.140010350
mov qword [rsp + 0xaf8], rax
mov rax, qword [rsp + 0xaf8]
mov qword [rsp + 0xb00], rax
lea r8, [0x140154b34]
mov rdx, qword [rsp + 0xb00]
lea rcx, [rsp + 0x3280]
call fcn.1400101c0
mov qword [rsp + 0xb08], rax
mov rax, qword [rsp + 0xb08]
mov qword [rsp + 0xb10], rax
mov rax, qword [rsp + 0xb10]
mov qword [rsp + 0xb20], rax
mov r8, qword [rsp + 0xb18]
mov rdx, qword [rsp + 0xb20]
lea rcx, [rsp + 0x3240]
call fcn.140010160
mov qword [rsp + 0xb28], rax
mov rax, qword [rsp + 0xb28]
mov qword [rsp + 0xb30], rax
lea r8, str.__span__br_
mov rdx, qword [rsp + 0xb30]
lea rcx, [rsp + 0x3260]
call fcn.1400101c0
mov qword [rsp + 0xb38], rax
mov rax, qword [rsp + 0xb38]
mov qword [rsp + 0xb40], rax
mov rax, qword [rsp + 0xb40]
mov qword [rsp + 0xb50], rax
mov r8, qword [rsp + 0xb48]
mov rdx, qword [rsp + 0xb50]
lea rcx, [rsp + 0x3160]
call fcn.140010160
mov qword [rsp + 0xb58], rax
mov rax, qword [rsp + 0xb58]
mov qword [rsp + 0xb60], rax
lea r8, str._br_
mov rdx, qword [rsp + 0xb60]
lea rcx, [rsp + 0x32a0]
call fcn.1400101c0
mov qword [rsp + 0xb68], rax
mov rax, qword [rsp + 0xb68]
mov qword [rsp + 0xb70], rax
mov rdx, qword [rsp + 0xb70]
lea rcx, [0x1401d7b60]
call fcn.140043610
nop
lea rcx, [rsp + 0x32a0]
call fcn.140003860
nop
lea rcx, [rsp + 0x3160]
call fcn.140003860
nop
lea rcx, [rsp + 0x3260]
call fcn.140003860
nop
lea rcx, [rsp + 0x3240]
call fcn.140003860
nop
lea rcx, [rsp + 0x3280]
call fcn.140003860
nop
lea rcx, [rsp + 0x3220]
call fcn.140003860
jmp 0x140079d5a
lea rdx, str.__pre___div_
lea rcx, [0x1401d7b60]
call fcn.140043640
lea r8, [0x1401d74f0]
lea rdx, str.__div_
lea rcx, [rsp + 0x31c0]
call fcn.140010350
mov qword [rsp + 0xb78], rax
mov rax, qword [rsp + 0xb78]
mov qword [rsp + 0xb80], rax
lea r8, [0x1401d7a48]
mov rdx, qword [rsp + 0xb80]
lea rcx, [rsp + 0x31e0]
call fcn.140010160
mov qword [rsp + 0xcd0], rax
mov rax, qword [rsp + 0xcd0]
mov qword [rsp + 0xcd8], rax
lea r8, str.__body___html_
mov rdx, qword [rsp + 0xcd8]
lea rcx, [rsp + 0x3200]
call fcn.1400101c0
mov qword [rsp + 0xd98], rax
mov rax, qword [rsp + 0xd98]
mov qword [rsp + 0xe88], rax
mov rdx, qword [rsp + 0xe88]
lea rcx, [0x1401d7b60]
call fcn.140043610
nop
lea rcx, [rsp + 0x3200]
call fcn.140003860
nop
lea rcx, [rsp + 0x31e0]
call fcn.140003860
nop
lea rcx, [rsp + 0x31c0]
call fcn.140003860
lea rcx, [0x1401d7b60]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401d7940]
call fcn.14000f800
lea rcx, [0x1401d7940]
call fcn.1400b6d00
nop
lea rcx, [rsp + 0x4f20]
call fcn.140003860
mov dword [rsp + 0x8a8], 1
lea rcx, [rsp + 0x5570]
call fcn.140003890
nop
lea rcx, [rsp + 0x4dc0]
call fcn.14003d030
mov eax, dword [rsp + 0x8a8]
mov rcx, qword [rsp + 0x16580]
xor rcx, rsp
call fcn.140101e00
add rsp, 0x16598
pop rdi
pop rsi
ret