Function at 0x140098df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x498
mov rax, qword [0x1401cf518]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rdx, [0x140149270]
lea rcx, [rsp + 0x328]
call fcn.140003570
nop
lea rdx, [rsp + 0x328]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x328]
call fcn.140003860
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x140098e6c
lea rcx, str._nSalidaModulosExtendidaTexto
call fcn.14000ad70
lea rdx, [0x1401492d4]
lea rcx, [rsp + 0x348]
call fcn.140003570
nop
lea rdx, [rsp + 0x348]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x49], al
lea rcx, [rsp + 0x348]
call fcn.140003860
movzx eax, byte [rsp + 0x49]
test eax, eax
je 0x140098ec2
mov edx, 4
lea rcx, [0x1401492e0]
call fcn.14004d7e0
jmp 0x140098ece
lea rcx, [0x140149360]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nMODULE_NAME:
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x28
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149378]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a8]
mov r8d, dword [rax + 0x58]
mov rax, qword [rsp + 0x4a8]
mov edx, dword [rax + 0x58]
lea rcx, [0x140149380]
call fcn.14000ad70
lea rdx, [0x1401493a4]
lea rcx, [rsp + 0x3a0]
call fcn.140005fd0
nop
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax]
test eax, eax
je 0x140098f67
lea rdx, [0x1401493a8]
lea rcx, [rsp + 0x3a0]
call fcn.1400097c0
mov byte [rsp + 0x40], 1
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0xd]
test eax, eax
je 0x140098f90
lea rdx, [0x1401493d0]
lea rcx, [rsp + 0x3a0]
call fcn.1400436a0
mov byte [rsp + 0x40], 1
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0x10]
test eax, eax
je 0x140098fb9
lea rdx, [0x1401493f8]
lea rcx, [rsp + 0x3a0]
call fcn.1400436a0
mov byte [rsp + 0x40], 1
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0xf]
test eax, eax
je 0x140098fce
mov byte [rsp + 0x40], 1
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x140099555
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x440]
call fcn.140005f30
nop
mov eax, 1
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
movzx eax, byte [rcx + rax + 0x578]
test eax, eax
je 0x140099022
lea rdx, [0x140149490]
lea rcx, [rsp + 0x440]
call fcn.1400436a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [0x1401d2a00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [0x1401d2a08]
mov word [0x1401d2a18], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dx, ntohs
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x440]
call fcn.140004b60
mov qword [rsp + 0xe8], rax
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0xf0], rax
mov r8, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0xf0]
lea rcx, [0x1401494c0]
call fcn.14000ad70
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x230]
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401494d8]
call fcn.14000ad70
mov eax, 8
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
movsd xmm1, qword [rcx + rax + 0x370]
movq rdx, xmm1
lea rcx, str._nEntropy__VAD_:__lf
call fcn.14000ad70
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x398]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149508]
call fcn.14000ad70
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x438]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149588]
call fcn.14000ad70
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x4d8]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x1401495d8]
call fcn.14000ad70
mov edx, 8
lea rcx, [0x140149600]
call fcn.14004d7e0
mov dword [rsp + 0x44], 0
jmp 0x1400991cd
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 4
jge 0x140099510
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4a8]
movzx eax, byte [rcx + rax + 0x368]
test eax, eax
jne 0x14009920e
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4a0]
movzx eax, byte [rcx + rax + 0x578]
test eax, eax
je 0x14009950b
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x420]
call fcn.140005f30
nop
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4a0]
movzx eax, byte [rcx + rax + 0x578]
test eax, eax
je 0x140099251
lea rdx, [0x1401496c8]
lea rcx, [rsp + 0x420]
call fcn.1400436a0
lea rcx, [rsp + 0x420]
call fcn.140004b60
mov qword [rsp + 0xf8], rax
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x100], rax
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x108], rax
mov r9, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
lea rcx, [0x140149750]
call fcn.14000ad70
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x230]
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x110], rax
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x118], rax
mov r8, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
lea rcx, [0x140149768]
call fcn.14000ad70
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x4a0]
movsd xmm0, qword [rcx + rax*8 + 0x370]
movsd qword [rsp + 0x120], xmm0
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x128], rax
movsd xmm2, qword [rsp + 0x120]
movq r8, xmm2
mov rdx, qword [rsp + 0x128]
lea rcx, str._nEntropy___S_:__lf
call fcn.14000ad70
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x398]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x130], rax
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x138], rax
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
lea rcx, [0x140149790]
call fcn.14000ad70
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x438]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x140], rax
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x148], rax
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
lea rcx, [0x1401497b0]
call fcn.14000ad70
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x4d8]
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x150], rax
movsxd rax, dword [rsp + 0x44]
imul rax, rax, 0x20
lea rcx, [0x1401d7ac0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x158], rax
mov r8, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x158]
lea rcx, [0x1401497d8]
call fcn.14000ad70
mov edx, 8
lea rcx, [0x140149890]
call fcn.14004d7e0
nop
lea rcx, [rsp + 0x420]
call fcn.140003890
jmp 0x1400991c3
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x6e], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x160], rax
movzx edx, word [rsp + 0x6e]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rsp + 0x440]
call fcn.140003890
jmp 0x1400996e7
mov edx, 0xa
lea rcx, [0x140149910]
call fcn.14004d7e0
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x2d0]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149918]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140149920]
call fcn.14004d7e0
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x230]
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014993c]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nEntropy:
call fcn.14004d7e0
mov eax, 8
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
movsd xmm1, qword [rcx + rax + 0x370]
movq rdx, xmm1
lea rcx, [0x14014994c]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140149950]
call fcn.14004d7e0
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x398]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149964]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140149968]
call fcn.14004d7e0
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x438]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149980]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140149988]
call fcn.14004d7e0
mov eax, 0x20
imul rax, rax, 4
mov rcx, qword [rsp + 0x4a0]
lea rax, [rcx + rax + 0x4d8]
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x1401499a0]
call fcn.14000ad70
mov edx, 8
lea rcx, [0x1401499b0]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x58
mov rdx, rax
lea rcx, [rsp + 0x460]
call fcn.140005fd0
nop
lea rdx, [0x1401440c7]
lea rcx, [rsp + 0x380]
call fcn.140003570
nop
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 7]
test eax, eax
je 0x14009973d
lea rdx, [0x140149a30]
lea rcx, [rsp + 0x380]
call fcn.140043640
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 8]
test eax, eax
je 0x140099761
lea rdx, [0x140149a50]
lea rcx, [rsp + 0x380]
call fcn.140043640
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 9]
test eax, eax
je 0x140099785
lea rdx, [0x140149a68]
lea rcx, [rsp + 0x380]
call fcn.140043640
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0xa]
test eax, eax
je 0x1400997a9
lea rdx, [0x140149a80]
lea rcx, [rsp + 0x380]
call fcn.140043640
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0xb]
test eax, eax
je 0x1400997cd
lea rdx, [0x140149a90]
lea rcx, [rsp + 0x380]
call fcn.140043640
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0xe]
test eax, eax
je 0x1400997f1
lea rdx, [0x140149aa0]
lea rcx, [rsp + 0x380]
call fcn.140043640
lea rdx, [0x1401440d2]
lea rcx, [rsp + 0x380]
call fcn.14000ff50
movzx eax, al
test eax, eax
je 0x140099894
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x380]
call fcn.1400b3ed0
mov qword [rsp + 0x168], rax
lea rcx, [rsp + 0x460]
call fcn.140004b60
mov qword [rsp + 0x170], rax
mov r8, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x170]
lea rcx, str._nLMIHV:__S__s
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x4a], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x178], rax
movzx edx, word [rsp + 0x4a]
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x1400998c1
mov edx, 0xa
lea rcx, [0x140149ac0]
call fcn.14004d7e0
lea rcx, [rsp + 0x460]
call fcn.140004b60
mov rdx, rax
lea rcx, [0x140149acc]
call fcn.14000ad70
mov r9d, dword [rsp + 0x4b8]
mov r8, qword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x4a0]
call fcn.1400519c0
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x140099974
mov rax, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x4a8]
mov ecx, dword [rcx + 0x24]
cmp dword [rax + 0x48], ecx
je 0x140099974
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x64]
test eax, eax
jne 0x140099974
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
mov edx, dword [rax + 0x48]
lea rcx, str._nEntry_Point__memory_:_0x_08x__Entry_Point_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x4c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x180], rax
movzx edx, word [rsp + 0x4c]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009999c
mov edx, 0xa
lea rcx, str._nEntry_Point__memory_:
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
mov edx, dword [rax + 0x48]
lea rcx, [0x140149b18]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x140149b20]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
mov edx, dword [rax + 0x24]
lea rcx, [0x140149b38]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
je 0x140099a3a
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
mov r8d, dword [rax + 0x764]
mov rax, qword [rsp + 0x4a0]
mov rdx, qword [rax + 0x68]
lea rcx, str._nModule_Base_Address:__:_0x_016llx__Image_Headers_offset:_0x_08x__Moat_Detected_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x4e], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x188], rax
movzx edx, word [rsp + 0x4e]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x140099a63
mov edx, 0xa
lea rcx, str._nModule_Base_Address:
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
mov rdx, qword [rax + 0x68]
lea rcx, [0x140149bb0]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
add rax, 8
lea rdx, [0x140149bc0]
mov rcx, rax
call fcn.14000fe70
movzx eax, al
test eax, eax
jne 0x140099ab1
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x5a8]
cmp eax, 1
je 0x140099ab1
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x5a9]
cmp eax, 1
jne 0x140099ed3
lea rdx, [0x1401440d3]
lea rcx, [rsp + 0x3e0]
call fcn.140003570
nop
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x5a8]
test eax, eax
je 0x140099aed
lea rdx, [0x140149be0]
lea rcx, [rsp + 0x3e0]
call fcn.140003940
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x5a9]
test eax, eax
je 0x140099b14
lea rdx, [0x140149bf0]
lea rcx, [rsp + 0x3e0]
call fcn.140043640
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x3e0]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140149c10]
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x50], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x190], rax
movzx edx, word [rsp + 0x50]
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edx, 0xa
lea rcx, [0x140149c30]
call fcn.14004d7e0
mov edx, 8
lea rcx, [rsp + 0x370]
call fcn.1400079b0
mov rax, qword [rsp + 0x4a8]
add rax, 0x140
mov qword [rsp + 0x198], rax
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x198]
call fcn.1400b5ef0
mov rax, qword [rsp + 0x4a8]
add rax, 0x140
mov qword [rsp + 0x1a0], rax
lea rdx, [rsp + 0x2f8]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140099d18
lea rcx, [rsp + 0x370]
call fcn.140042060
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x88], eax
lea rcx, [rsp + 0x370]
call fcn.140042060
mov eax, dword [rax + 0x30]
mov dword [rsp + 0x8c], eax
lea rcx, [rsp + 0x370]
call fcn.140042060
mov eax, dword [rax + 0x34]
mov dword [rsp + 0x90], eax
lea rcx, [rsp + 0x370]
call fcn.140042060
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x94], eax
lea rcx, [rsp + 0x370]
call fcn.140042060
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x370]
call fcn.140042060
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x9c], eax
lea rcx, [rsp + 0x370]
call fcn.140042060
add rax, 8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1a8], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x98]
mov r8d, dword [rsp + 0x9c]
mov rdx, qword [rsp + 0x1a8]
lea rcx, str._n_s_t0x_08x_t0x_08x_t0x_08x_t_t0x_08x______0x_08x_t0x_08x
call fcn.14000ad70
xor r8d, r8d
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x370]
call fcn.1400421d0
jmp 0x140099bba
mov edx, 0xa
lea rcx, [0x140149ce0]
call fcn.14004d7e0
mov edx, 8
lea rcx, [rsp + 0x378]
call fcn.1400079b0
mov rax, qword [rsp + 0x4a0]
add rax, 0x5b0
mov qword [rsp + 0x1b0], rax
lea rdx, [rsp + 0x378]
mov rcx, qword [rsp + 0x1b0]
call fcn.1400b5ef0
mov rax, qword [rsp + 0x4a0]
add rax, 0x5b0
mov qword [rsp + 0x1b8], rax
lea rdx, [rsp + 0x308]
mov rcx, qword [rsp + 0x1b8]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x378]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x140099ec4
lea rcx, [rsp + 0x378]
call fcn.140042060
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0xa0], eax
lea rcx, [rsp + 0x378]
call fcn.140042060
mov eax, dword [rax + 0x30]
mov dword [rsp + 0xa4], eax
lea rcx, [rsp + 0x378]
call fcn.140042060
mov eax, dword [rax + 0x34]
mov dword [rsp + 0xa8], eax
lea rcx, [rsp + 0x378]
call fcn.140042060
mov eax, dword [rax + 0x38]
mov dword [rsp + 0xac], eax
lea rcx, [rsp + 0x378]
call fcn.140042060
mov eax, dword [rax + 0x28]
mov dword [rsp + 0xb0], eax
lea rcx, [rsp + 0x378]
call fcn.140042060
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0xb4], eax
lea rcx, [rsp + 0x378]
call fcn.140042060
add rax, 8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1c0], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0xb0]
mov r8d, dword [rsp + 0xb4]
mov rdx, qword [rsp + 0x1c0]
lea rcx, str._n_s_t0x_08x_t0x_08x_t0x_08x_t_t0x_08x_t____0x_08x_t0x_08x
call fcn.14000ad70
xor r8d, r8d
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x378]
call fcn.1400421d0
jmp 0x140099d66
lea rcx, [rsp + 0x3e0]
call fcn.140003860
jmp 0x140099f09
mov edx, 0xa
lea rcx, [0x140149d88]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x588
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140149d98]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x5d0]
cmp eax, 1
jne 0x14009a266
mov edx, 8
lea rcx, [rsp + 0x368]
call fcn.1400079b0
mov rax, qword [rsp + 0x4a0]
add rax, 0x5c0
mov qword [rsp + 0x1c8], rax
lea rdx, [rsp + 0x368]
mov rcx, qword [rsp + 0x1c8]
call fcn.1400b5ef0
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
add rax, 0x5c0
mov qword [rsp + 0x1d0], rax
lea rdx, [rsp + 0x318]
mov rcx, qword [rsp + 0x1d0]
call fcn.1400bb510
mov rdx, rax
lea rcx, [rsp + 0x368]
call fcn.1400415b0
movzx eax, al
test eax, eax
je 0x14009a234
lea rcx, [rsp + 0x368]
call fcn.140042060
movzx eax, byte [rax + 0x58]
test eax, eax
je 0x14009a217
lea rcx, [0x140149da0]
call fcn.14000ad70
lea rcx, [rsp + 0x368]
call fcn.140042060
mov rdx, qword [rax + 0x10]
lea rcx, [0x140149dc0]
call fcn.14000ad70
lea rcx, [rsp + 0x368]
call fcn.140042060
mov rdx, qword [rax + 8]
lea rcx, str._n__Size:_0x_llx_bytes
call fcn.14000ad70
lea rcx, [rsp + 0x368]
call fcn.140042060
add rax, 0xa0
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x140149df8]
call fcn.14000ad70
lea rdx, [0x1401440d4]
lea rcx, [rsp + 0x3c0]
call fcn.140003570
nop
lea rcx, [rsp + 0x368]
call fcn.140042060
movzx eax, byte [rax + 0x59]
test eax, eax
je 0x14009a075
lea rdx, [0x140149e08]
lea rcx, [rsp + 0x3c0]
call fcn.140003940
lea rcx, [rsp + 0x368]
call fcn.140042060
movzx eax, byte [rax + 0x5c]
test eax, eax
je 0x14009a145
mov rax, qword [rsp + 0x4a0]
add rax, 0x28
lea rdx, [0x140149e38]
mov rcx, rax
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14009a145
lea rdx, [0x140149e70]
lea rcx, [rsp + 0x3c0]
call fcn.140043640
lea rcx, [rsp + 0x3c0]
call fcn.1400b3ed0
mov qword [rsp + 0x1d8], rax
lea rcx, [rsp + 0x368]
call fcn.140042060
add rax, 0x38
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1e0], rax
lea rcx, [rsp + 0x368]
call fcn.140042060
add rax, 0x18
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1e8], rax
mov r9, qword [rsp + 0x1d8]
mov r8, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x1e8]
lea rcx, [0x140149ea8]
call fcn.14000ad70
jmp 0x14009a197
lea rcx, [rsp + 0x3c0]
call fcn.1400b3ed0
mov qword [rsp + 0x1f0], rax
lea rcx, [rsp + 0x368]
call fcn.140042060
add rax, 0x18
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x1f8], rax
mov r8, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1f8]
lea rcx, [0x140149ed8]
call fcn.14000ad70
lea rcx, [rsp + 0x368]
call fcn.140042060
movzx eax, byte [rax + 0x5b]
test eax, eax
je 0x14009a1e8
mov rax, qword [rsp + 0x4a0]
add rax, 0x28
lea rdx, [0x140149f18]
mov rcx, rax
call fcn.14000fe70
movzx eax, al
test eax, eax
je 0x14009a1dc
lea rcx, str._n___Module_NTDLL_Private_Memory_Region_
call fcn.14000ad70
jmp 0x14009a1e8
lea rcx, str._n___Module_Private_Memory_Region_
call fcn.14000ad70
lea rcx, [rsp + 0x368]
call fcn.140042060
movzx eax, byte [rax + 0x5a]
test eax, eax
je 0x14009a20a
lea rcx, str._n___Unknown_Executable_Memory_Region_
call fcn.14000ad70
nop
lea rcx, [rsp + 0x3c0]
call fcn.140003860
xor r8d, r8d
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x368]
call fcn.1400421d0
jmp 0x140099f68
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x52], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x200], rax
movzx edx, word [rsp + 0x52]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 1]
test eax, eax
je 0x14009a2ce
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
mov edx, dword [rax + 0x148]
lea rcx, str._nSizeOfInitializedData:__d__Module_SizeOfInitializedData_is_0_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x54], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x208], rax
movzx edx, word [rsp + 0x54]
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a2f9
mov edx, 0xa
lea rcx, [0x14014a060]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
mov edx, dword [rax + 0x148]
lea rcx, [0x14014a07c]
call fcn.14000ad70
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14009a3cf
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
movzx eax, word [rax + 0x2dc]
mov rcx, qword [rsp + 0x4a0]
movzx ecx, word [rcx + 0x14c]
mov r8d, eax
mov edx, ecx
lea rcx, str._nDLLCharacteristics__memory__file_:_0x_x____0x_x__Module_PE_Anomalies_
call fcn.14000ad70
mov rax, qword [rsp + 0x4a8]
movzx eax, word [rax + 0x2de]
mov rcx, qword [rsp + 0x4a0]
movzx ecx, word [rcx + 0x14e]
mov r8d, eax
mov edx, ecx
lea rcx, str._nMajorImageVersion__memory__file_:__d_____d__Module_PE_Anomalies_
call fcn.14000ad70
mov rax, qword [rsp + 0x4a8]
mov r8d, dword [rax + 0x2c]
mov rax, qword [rsp + 0x4a8]
mov edx, dword [rax + 0x28]
lea rcx, str._nCheckSum_original__computed:_0x_x____0x_x__Module_PE_Anomalies_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x56], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x210], rax
movzx edx, word [rsp + 0x56]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a607
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 3]
test eax, eax
je 0x14009a4a3
mov edx, 0xa
lea rcx, [0x14014a198]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x14c]
mov edx, eax
lea rcx, [0x14014a1b0]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014a1b8]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x14e]
mov edx, eax
lea rcx, [0x14014a1d0]
call fcn.14000ad70
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
mov r8d, dword [rax + 0x2c]
mov rax, qword [rsp + 0x4a8]
mov edx, dword [rax + 0x28]
lea rcx, str._nCheckSum_original____computed:_0x_x____0x_x__Module_CheckSum_is_0_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x58], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x218], rax
movzx edx, word [rsp + 0x58]
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a607
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 4]
test eax, eax
je 0x14009a577
mov edx, 0xa
lea rcx, [0x14014a228]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x14c]
mov edx, eax
lea rcx, [0x14014a240]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014a248]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x14e]
mov edx, eax
lea rcx, [0x14014a260]
call fcn.14000ad70
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
mov r8d, dword [rax + 0x2c]
mov rax, qword [rsp + 0x4a8]
mov edx, dword [rax + 0x28]
lea rcx, str._nCheckSum_original____computed:_0x_x____0x_x__Module_CheckSum_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x5a], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x220], rax
movzx edx, word [rsp + 0x5a]
mov rcx, qword [rsp + 0x220]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a607
mov edx, 0xa
lea rcx, [0x14014a2c0]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x14c]
mov edx, eax
lea rcx, [0x14014a2d8]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014a2e0]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x14e]
mov edx, eax
lea rcx, [0x14014a2f8]
call fcn.14000ad70
mov edx, 0xa
lea rcx, str._nCheckSum_original____computed:
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
mov r8d, dword [rax + 0x2c]
mov rax, qword [rsp + 0x4a8]
mov edx, dword [rax + 0x28]
lea rcx, str.0x_x____0x_x
call fcn.14000ad70
lea rdx, [0x14014a338]
lea rcx, [rsp + 0x400]
call fcn.140005fd0
nop
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009a654
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x120]
test eax, eax
je 0x14009a654
lea rdx, [0x14014a340]
lea rcx, [rsp + 0x400]
call fcn.1400097c0
lea rdx, [0x14014a368]
lea rcx, [rsp + 0x400]
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14009a700
mov ecx, ntohs
call fcn.14007a320
lea rcx, [rsp + 0x400]
call fcn.140004b60
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x128
mov rcx, rax
call fcn.140004b60
mov qword [rsp + 0x230], rax
mov r8, qword [rsp + 0x228]
mov rdx, qword [rsp + 0x230]
lea rcx, str._nPE_format:__S__S
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x5c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x238], rax
movzx edx, word [rsp + 0x5c]
mov rcx, qword [rsp + 0x238]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a736
mov edx, 0xa
lea rcx, [0x14014a388]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x128
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014a398]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x5d2]
cmp eax, 0x8664
jne 0x14009a76b
mov edx, 0xa
lea rcx, [0x14014a3a0]
call fcn.14004d7e0
lea rcx, [0x14014a3b8]
call fcn.14000ad70
jmp 0x14009a79e
mov rax, qword [rsp + 0x4a0]
movzx eax, word [rax + 0x5d2]
cmp eax, 0x14c
jne 0x14009a79e
mov edx, 0xa
lea rcx, [0x14014a3d8]
call fcn.14004d7e0
lea rcx, [0x14014a3f0]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014a408]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x860
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014a418]
call fcn.14000ad70
mov rax, qword [rsp + 0x4b0]
movzx eax, byte [rax + 0x11]
test eax, eax
je 0x14009a847
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
add rax, 0x880
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, str._nLoad_delay:__S__Module_Delayed_LoadTime_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x5e], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x240], rax
movzx edx, word [rsp + 0x5e]
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a87d
mov edx, 0xa
lea rcx, [0x14014a450]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x880
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014a460]
call fcn.14000ad70
mov edx, 8
lea rcx, [0x14014a470]
call fcn.14004d7e0
mov edx, 0xa
lea rcx, [0x14014a4f0]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
add rax, 0x1b0
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014a500]
call fcn.14000ad70
mov edx, 0xa
lea rcx, [0x14014a508]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
add rax, 0x1d0
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014a51c]
call fcn.14000ad70
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rsp + 0x4a0]
call fcn.14007af70
mov edx, 0xa
lea rcx, [0x14014a520]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009a9b8
mov rax, qword [rsp + 0x4a0]
add rax, 8
lea rdx, [0x14014a530]
mov rcx, rax
call fcn.1400100d0
movzx eax, al
test eax, eax
je 0x14009a9b8
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
add rax, 8
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, str._S__Module_NOT_Signed_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x60], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x248], rax
movzx edx, word [rsp + 0x60]
mov rcx, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009a9db
mov rax, qword [rsp + 0x4a0]
add rax, 8
mov rcx, rax
call fcn.140004b60
mov rdx, rax
lea rcx, [0x14014a558]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009aab2
mov rax, qword [rsp + 0x4a8]
add rax, 0x78
mov rcx, qword [rsp + 0x4a0]
add rcx, 0x178
mov rdx, rax
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x14009aab2
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
add rax, 0x78
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x178
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x258], rax
mov r8, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x258]
lea rcx, str._nPDB_file__memory____file_:__s_____s__Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x62], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x260], rax
movzx edx, word [rsp + 0x62]
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009aae8
mov edx, 0xa
lea rcx, [0x14014a5a8]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x178
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014a5b4]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009ac65
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x7d1]
test eax, eax
jne 0x14009ab40
mov rax, qword [rsp + 0x4a8]
add rax, 0x98
mov rcx, qword [rsp + 0x4a0]
add rcx, 0x198
mov rdx, rax
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x14009ac65
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
movzx eax, byte [rax + 0x7d1]
test eax, eax
je 0x14009abc8
mov edx, 0xa
lea rcx, [0x14014a5b8]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
add rax, 0x98
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x198
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x270], rax
mov r8, qword [rsp + 0x268]
mov rdx, qword [rsp + 0x270]
lea rcx, str._s_____s__UTC___Delphi_4
call fcn.14000ad70
jmp 0x14009ac31
mov edx, 0xa
lea rcx, [0x14014a628]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
add rax, 0x98
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x278], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x198
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x280], rax
mov r8, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x280]
lea rcx, str._s_____s__UTC___Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x64], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x288], rax
movzx edx, word [rsp + 0x64]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009ac9b
mov edx, 0xa
lea rcx, [0x14014a698]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x198
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014a6c8]
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009aeaf
mov rax, qword [rsp + 0x4a8]
add rax, 0x60
mov rcx, qword [rsp + 0x4a0]
add rcx, 0x160
mov rdx, rax
call fcn.140010010
movzx eax, al
test eax, eax
je 0x14009aeaf
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a0]
add rax, 0x160
mov rcx, rax
call fcn.1400c32e0
test rax, rax
jbe 0x14009ada1
mov rax, qword [rsp + 0x4a0]
add rax, 0x160
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call fcn.140008ce0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0xb8]
call fcn.14001c8b0
mov qword [rsp + 0x290], rax
jmp 0x14009ad54
mov rax, qword [rsp + 0x70]
add rax, 0x20
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x290]
cmp qword [rsp + 0x70], rax
je 0x14009ad9f
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x298], rax
mov edx, 0xa
lea rcx, [0x14014a6d8]
call fcn.14004d7e0
mov rcx, qword [rsp + 0x298]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014a710]
call fcn.14000ad70
jmp 0x14009ad46
jmp 0x14009adb2
mov edx, 0xa
lea rcx, [0x14014a738]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a8]
add rax, 0x60
mov rcx, rax
call fcn.1400c32e0
test rax, rax
jbe 0x14009ae67
mov rax, qword [rsp + 0x4a8]
add rax, 0x60
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0xc0]
call fcn.140008ce0
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0xc0]
call fcn.14001c8b0
mov qword [rsp + 0x2a0], rax
jmp 0x14009ae1a
mov rax, qword [rsp + 0x78]
add rax, 0x20
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x2a0]
cmp qword [rsp + 0x78], rax
je 0x14009ae65
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x2a8], rax
mov edx, 0xa
lea rcx, [0x14014a770]
call fcn.14004d7e0
mov rcx, qword [rsp + 0x2a8]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._s__UTC___Memory_File_Values_Mismatch_
call fcn.14000ad70
jmp 0x14009ae0c
jmp 0x14009ae78
mov edx, 0xa
lea rcx, [0x14014a7d0]
call fcn.14004d7e0
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x66], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x2b0], rax
movzx edx, word [rsp + 0x66]
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009af88
mov rax, qword [rsp + 0x4a0]
add rax, 0x160
mov rcx, rax
call fcn.1400c32e0
test rax, rax
jbe 0x14009af77
mov rax, qword [rsp + 0x4a0]
add rax, 0x160
mov qword [rsp + 0xc8], rax
mov rcx, qword [rsp + 0xc8]
call fcn.140008ce0
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0xc8]
call fcn.14001c8b0
mov qword [rsp + 0x2b8], rax
jmp 0x14009af24
mov rax, qword [rsp + 0x80]
add rax, 0x20
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x2b8]
cmp qword [rsp + 0x80], rax
je 0x14009af75
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x2c0], rax
mov edx, 0xa
lea rcx, [0x14014a808]
call fcn.14004d7e0
mov rcx, qword [rsp + 0x2c0]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014a838]
call fcn.14000ad70
jmp 0x14009af10
jmp 0x14009af88
mov edx, 0xa
lea rcx, [0x14014a848]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009b063
mov rax, qword [rsp + 0x4a8]
add rax, 0xb8
mov rcx, qword [rsp + 0x4a0]
add rcx, 0x1b8
mov rdx, rax
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x14009b063
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
add rax, 0xb8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x1b8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x2d0], rax
mov r8, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2d0]
lea rcx, str._nIMAGE_EXPORT_DIRECTORY_TimeDateStamp__memory____file_:__s_____s__UTC___Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x68], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x2d8], rax
movzx edx, word [rsp + 0x68]
mov rcx, qword [rsp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009b099
mov edx, 0xa
lea rcx, [0x14014a8e8]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x1b8
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._s__UTC_
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009b174
mov rax, qword [rsp + 0x4a8]
add rax, 0xd8
mov rcx, qword [rsp + 0x4a0]
add rcx, 0x1d8
mov rdx, rax
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x14009b174
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
add rax, 0xd8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x1d8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0x2e8], rax
mov r8, qword [rsp + 0x2e0]
mov rdx, qword [rsp + 0x2e8]
lea rcx, str._nIMAGE_RESOURCE_DIRECTORY_TimeDateStamp__memory____file_:__s_____s__Compiler_Local_Time___Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x6a], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x2f0], rax
movzx edx, word [rsp + 0x6a]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009b1aa
mov edx, 0xa
lea rcx, [0x14014a9b0]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x1d8
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, str._s__Compiler_Local_Time_
call fcn.14000ad70
mov rax, qword [rsp + 0x4a0]
cmp dword [rax + 0x764], 0
jne 0x14009b285
mov rax, qword [rsp + 0x4a8]
add rax, 0xf8
mov rcx, qword [rsp + 0x4a0]
add rcx, 0x1f8
mov rdx, rax
call fcn.14000ff10
movzx eax, al
test eax, eax
je 0x14009b285
mov ecx, ntohs
call fcn.14007a320
mov rax, qword [rsp + 0x4a8]
add rax, 0xf8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x4a0]
add rax, 0x1f8
mov rcx, rax
call fcn.1400b3ed0
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
lea rcx, str._nCLR__memory____file_:__s_____s__Memory_File_Values_Mismatch_
call fcn.14000ad70
movzx eax, word [0x1401d2a18]
mov word [rsp + 0x6c], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xe0], rax
movzx edx, word [rsp + 0x6c]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x14009b2bc
mov edx, 0xa
lea rcx, [0x14014aa40]
call fcn.14004d7e0
mov rax, qword [rsp + 0x4a0]
add rax, 0x1f8
mov rcx, rax
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x14014aa48]
call fcn.14000ad70
nop
lea rcx, [rsp + 0x400]
call fcn.140003890
nop
lea rcx, [rsp + 0x380]
call fcn.140003860
nop
lea rcx, [rsp + 0x460]
call fcn.140003890
nop
lea rcx, [rsp + 0x3a0]
call fcn.140003890
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140101e00
add rsp, 0x498
ret