Function at 0x140001030
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2b8
mov r12, r9
mov r13, r8
mov rbp, rdx
mov r14, rcx
lea rax, [rcx + 0x3c]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
movsxd rdx, dword [rax]
mov rax, rdx
add rax, rcx
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov esi, dword [rax]
mov ecx, 0x4550
call fcn.140002bc0
mov qword [rsp + 0x48], 0
cmp esi, eax
jne 0x1400025cc
mov rax, qword [rsp + 0xf0]
add rax, 4
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
movzx esi, word [rax]
mov ecx, 0x14c
mov edx, 0xeb
call fcn.140002bc0
mov qword [rsp + 0x48], 0
cmp si, ax
je 0x1400025cc
mov qword [rsp + 0x290], rbp
mov r15, qword [0x1400071d0]
mov rax, qword [rsp + 0xf0]
add rax, 0x18
mov qword [rsp + 0x118], rax
mov rax, qword [rsp + 0x118]
add rax, 0x38
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov ebp, dword [rax]
mov rax, qword [rsp + 0x118]
add rax, 0x18
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov rsi, qword [rax]
mov r8d, 0x8f
mov rcx, rbp
mov edx, ebp
call fcn.140002bc0
mov rbx, rax
mov ecx, 0x3000
mov edx, ebp
mov r8d, ebp
call fcn.140002bc0
mov rdi, rax
mov ecx, 0x40
mov edx, ebp
mov r8d, ebp
call fcn.140002bc0
mov rcx, rsi
mov rdx, rbx
mov r8d, edi
mov r9d, eax
call r15
mov r15, r12
mov r12, r13
mov r13, qword [rsp + 0x290]
mov qword [rsp + 0x1e0], rax
test rax, rax
jne 0x140001206
mov rbp, qword [0x1400071d0]
mov rax, qword [rsp + 0x1f8]
mov esi, dword [rax]
mov rcx, rsi
mov edx, esi
call fcn.140002bc0
mov rdi, rax
mov ecx, 0x3000
mov edx, esi
mov r8d, esi
call fcn.140002bc0
mov rbx, rax
mov ecx, 0x40
mov edx, 0x52
mov r9d, 0x14c38e
mov r8d, esi
call fcn.140002bc0
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, eax
call rbp
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x48], 0
test rax, rax
je 0x1400025cc
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rbp, rax
mov qword [rsp + 0x28], 0x330b8e9d
mov qword [rsp + 0x20], 0xa6
mov edx, 0x3490a069
mov r8d, 4
mov r9d, 3
xor ecx, ecx
call fcn.140002bc0
mov rsi, rax
mov qword [rsp + 0x20], 0x30dc466d
mov ecx, 0x50
mov edx, 0xe4
mov r8d, 0x33bdd6c9
mov r9d, 0xe8
call fcn.140002bc0
mov rcx, rbp
mov edx, esi
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400016d7
mov rdi, qword [rsp + 0x320]
mov rax, qword [rsp + 0x38]
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x38]
add rax, 0x10
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x38]
add rax, 0x1c
mov qword [rsp + 0x298], rax
mov rax, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x208]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movzx ebp, word [rax + 0x12]
mov ecx, 0xd
call fcn.140002bc0
mov esi, ebp
mov ecx, eax
shr esi, cl
mov ecx, 1
mov edx, 0xbc2902
mov r8d, 0x3f
mov r9d, 0x4874e1
call fcn.140002bc0
and eax, esi
mov rcx, qword [rsp + 0x38]
add rcx, 0x20
mov qword [rsp + 0x210], rcx
mov rcx, qword [rsp + 0x210]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38]
add rax, 0x28
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x218]
mov qword [rax], r13
mov rax, qword [rsp + 0x38]
add rax, 0x30
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x128]
mov qword [rax], r12
mov r12, rdi
mov rax, qword [rsp + 0x38]
add rax, 0x38
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rax], r15
mov rax, qword [rsp + 0x38]
add rax, 0x40
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rax], rdi
mov r15, qword [0x1400071d0]
mov rbx, qword [rsp + 0x118]
mov ecx, dword [rbx + 0x3c]
mov word [rsp + 0x20], bp
mov edx, 0x79
mov r9d, 0x30b0b9
mov r8d, ebp
call fcn.140002bc0
mov rsi, rax
mov ecx, 0x1000
mov edx, 0x90
call fcn.140002bc0
mov rdi, rax
mov word [rsp + 0x20], bp
mov ecx, 4
mov edx, ebp
mov r8d, ebp
mov r9d, ebp
call fcn.140002bc0
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
mov r8d, edi
mov r9d, eax
call r15
mov rsi, rax
mov r8d, dword [rbx + 0x3c]
mov rcx, rax
mov rdx, r14
call fcn.140002b90
mov rax, qword [rsp + 0x1e8]
movsxd rax, dword [rax]
lea rcx, [rsi + rax]
mov rdx, qword [rsp + 0x38]
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsi + rax + 0x30], rcx
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
movzx esi, word [rax + 6]
xor ecx, ecx
call fcn.140002bc0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x1d0], rcx
cmp si, ax
je 0x14000175d
mov rsi, qword [rsp + 0xf8]
mov ecx, 0x18
mov edx, 0xe39179
mov r8, rsi
mov r9, rsi
call fcn.140002bc0
add rax, rsi
mov rcx, qword [rsp + 0xf8]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0xf0]
add rax, 0x38
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x1d8], rcx
mov dword [rsp + 0xb4], 0
jmp 0x1400015d6
mov r15, qword [0x1400071d0]
mov edi, dword [rsp + 0xb8]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov esi, dword [rcx + 0xc]
add rsi, qword [rax]
mov qword [rsp + 0x20], rdi
mov rcx, rdi
mov rdx, rdi
mov r8, rdi
mov r9, rdi
call fcn.140002bc0
mov rbp, rax
mov ecx, 0x1000
mov edx, 0xe48991
mov r8, rdi
call fcn.140002bc0
mov rbx, rax
mov ecx, 0x40
mov rdx, rdi
mov r8, rdi
call fcn.140002bc0
mov rcx, rsi
mov rdx, rbp
mov r8d, ebx
mov r9d, eax
call r15
mov rsi, rax
mov rax, qword [rsp + 0x60]
mov edx, dword [rax + 0x14]
add rdx, r14
mov rax, qword [rsp + 0x228]
mov r8d, dword [rax]
mov rcx, rsi
call fcn.140002b90
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], esi
mov ecx, 1
mov edx, 1
call fcn.140002bc0
add eax, dword [rsp + 0xd8]
mov rcx, qword [rsp + 0x60]
add rcx, 0x28
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
mov qword [rsp + 0x130], rdx
mov rdx, qword [rsp + 0x130]
movzx edx, word [rdx + 6]
mov qword [rsp + 0x1d8], rcx
mov dword [rsp + 0xb4], eax
cmp eax, edx
jae 0x140001729
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0xd8], eax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
add rax, 0x10
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x228]
mov eax, dword [rax]
mov dword [rsp + 0xb8], eax
mov edx, dword [rsp + 0xd8]
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
xor ecx, ecx
mov r8d, edx
mov r9d, edx
call fcn.140002bc0
mov ecx, dword [rsp + 0xb8]
cmp ecx, eax
jne 0x1400014f0
mov rax, qword [rsp + 0x2a0]
mov eax, dword [rax]
mov dword [rsp + 0xbc], eax
mov edx, 0x52
xor ecx, ecx
call fcn.140002bc0
mov ecx, dword [rsp + 0xbc]
cmp ecx, eax
jle 0x140001584
mov rbx, qword [0x1400071d0]
mov esi, dword [rsp + 0xbc]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov edi, dword [rcx + 0xc]
add rdi, qword [rax]
mov edx, 0xbe
mov rcx, rsi
mov r8, rsi
mov r9, rsi
call fcn.140002bc0
mov rbp, rax
mov ecx, 0x1000
call fcn.140002bc0
mov rcx, rdi
mov rdx, rbp
mov r8d, eax
mov r9d, 0x40
call rbx
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 8], eax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.1400028c0
jmp 0x140001584
mov edx, 0x261f085f
xor ecx, ecx
call fcn.140002bc0
mov rsi, rax
mov qword [rsp + 0x28], 0xf29d86
mov qword [rsp + 0x20], 0xe7
mov ecx, 0x8000
mov edx, 0x30fc03da
mov r8d, 0xd2
mov r9d, 4
call fcn.140002bc0
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000259e
cmp qword [rsp + 0x50], 0
mov rax, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x44], 1
mov qword [rsp + 0xe8], rcx
je 0x140001ada
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x200]
mov rsi, qword [rax]
mov r8d, 0x7e
xor ecx, ecx
mov rdx, rsi
mov r9, rsi
call fcn.140002bc0
sub rax, rsi
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x100]
mov edi, dword [rax + 0xb4]
xor ecx, ecx
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0xe8], rcx
cmp edi, eax
je 0x140001ada
mov rax, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rax + 0xb0]
add rax, qword [rcx]
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
mov eax, dword [rax]
mov dword [rsp + 0xc0], eax
xor ecx, ecx
call fcn.140002bc0
mov ecx, dword [rsp + 0xc0]
mov dword [rsp + 0x44], 1
mov rdx, qword [rsp + 0x100]
mov qword [rsp + 0xe8], rdx
cmp ecx, eax
je 0x140001ada
movabs r14, 0x1fffffff8
mov rax, qword [rsp + 0x230]
mov dword [rsp + 0x148], eax
mov rax, qword [rsp + 0x238]
mov ecx, dword [rsp + 0xc0]
mov dword [rsp + 0xb0], ecx
mov qword [rsp + 0x1c8], rax
jmp 0x1400018b6
mov eax, dword [rsp + 0xc8]
mov qword [rsp + 0x1c0], rax
mov rdx, qword [rsp + 0x1c0]
mov rdi, qword [rsp + 0x140]
mov ebx, dword [rdi + rdx]
add rdi, rdx
xor ecx, ecx
mov r8, rdx
call fcn.140002bc0
mov dword [rsp + 0xb0], ebx
mov qword [rsp + 0x1c8], rdi
cmp ebx, eax
je 0x140001ac2
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x140], rax
mov edi, dword [rsp + 0xb0]
mov rax, qword [rsp + 0x58]
mov rcx, rdi
add rcx, qword [rax]
mov qword [rsp + 0x240], rcx
mov rax, qword [rsp + 0x140]
add rax, 4
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x248]
mov ebp, dword [rax]
mov rcx, r14
mov edx, edi
mov r8d, edi
call fcn.140002bc0
mov rbx, rax
add rbx, rbp
mov ecx, 1
mov r8d, 0x96
mov edx, edi
call fcn.140002bc0
mov ecx, eax
shr rbx, cl
mov edx, 0xae
mov r9d, 0xfa
xor ecx, ecx
mov r8d, edi
call fcn.140002bc0
mov qword [rsp + 0x1c0], rbp
cmp ebx, eax
jle 0x14000187f
mov rax, qword [rsp + 0x140]
add rax, 8
mov dword [rsp + 0xac], 0
mov qword [rsp + 0x1b8], rax
jmp 0x140001a26
mov eax, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x240]
mov rdx, qword [rcx + rax]
add rdx, qword [rsp + 0x230]
mov qword [rcx + rax], rdx
mov ecx, 1
mov edx, 0xfa
call fcn.140002bc0
mov rdi, rax
add edi, dword [rsp + 0x6c]
mov rbp, qword [rsp + 0x270]
add rbp, 2
mov rax, qword [rsp + 0x248]
mov eax, dword [rax]
mov dword [rsp + 0xc8], eax
mov esi, dword [rsp + 0xc8]
mov rcx, r14
mov edx, edi
call fcn.140002bc0
mov rbx, rax
add rbx, rsi
mov qword [rsp + 0x20], 0xd9
mov ecx, 1
mov edx, 0x4f
mov r8d, 0xb5b01d
mov r9d, edi
call fcn.140002bc0
mov ecx, eax
shr rbx, cl
mov dword [rsp + 0xac], edi
mov qword [rsp + 0x1b8], rbp
cmp edi, ebx
jge 0x140001870
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x270], rax
mov eax, dword [rsp + 0xac]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x270]
movzx ebx, word [rax]
mov edx, dword [rsp + 0x6c]
mov ecx, 0xc
mov r8d, edx
mov r9d, edx
call fcn.140002bc0
mov edi, ebx
mov ecx, eax
shr edi, cl
mov edx, dword [rsp + 0x6c]
mov qword [rsp + 0x20], 0xb8
mov ecx, 0xfff
mov r9d, 0x53
mov r8d, edx
call fcn.140002bc0
and eax, ebx
mov dword [rsp + 0xc4], eax
cmp edi, 0xa
je 0x140001980
cmp edi, 3
jne 0x14000199f
mov eax, dword [rsp + 0xc4]
mov rcx, qword [rsp + 0x240]
mov edx, dword [rcx + rax]
add edx, dword [rsp + 0x148]
mov dword [rcx + rax], edx
jmp 0x14000199f
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov dword [rsp + 0x44], 1
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x278], rax
mov edx, dword [rsp + 0x44]
mov rax, qword [rsp + 0x38]
mov dword [rax + 0x24], edx
mov rax, qword [rsp + 0x278]
mov esi, dword [rax + 0x94]
mov r9d, 0x6f
xor ecx, ecx
mov r8d, edx
call fcn.140002bc0
cmp esi, eax
je 0x140001f56
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
mov esi, dword [rax + 0x90]
mov rdi, rsi
add rdi, qword [rsp + 0x70]
mov ecx, 0x14
mov edx, esi
call fcn.140002bc0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov ebx, eax
mov r8d, 0xad54e4
xor ecx, ecx
mov edx, esi
call fcn.140002bc0
mov qword [rsp + 0x1b0], rdi
cmp ebx, eax
jne 0x140001f56
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
jmp 0x140001bd0
mov rsi, qword [rsp + 0x98]
add rsi, 0x14
mov ecx, 0x14
mov edx, 0x90
mov r8d, 0x96
call fcn.140002bc0
mov rcx, rsi
mov rdx, rax
call r14
mov edi, eax
mov edx, 0x36
xor ecx, ecx
call fcn.140002bc0
mov qword [rsp + 0x1b0], rsi
cmp edi, eax
jne 0x140001f56
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0xcc], eax
xor ecx, ecx
call fcn.140002bc0
mov ecx, dword [rsp + 0xcc]
cmp ecx, eax
je 0x140001f56
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov ecx, dword [rsp + 0xcc]
add rcx, qword [rsp + 0x70]
call qword [rax]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x140002594
mov rax, qword [rsp + 0x120]
mov esi, dword [rax]
mov ecx, 1
mov edx, 0x41fdd5
call fcn.140002bc0
add eax, esi
movsxd rdi, eax
mov ecx, 3
call fcn.140002bc0
mov ecx, eax
shl rdi, cl
mov dword [rsp + 0x20], esi
mov rcx, rdi
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002bc0
mov rdi, rax
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov ecx, 0x1000
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002bc0
mov rbx, rax
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], 0xf0
mov qword [rsp + 0x20], 0xa03947
mov ecx, 4
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002bc0
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, eax
call rbp
mov qword [rsp + 0x138], rax
cmp qword [rsp + 0x138], 0
je 0x140002534
mov rax, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x138]
mov qword [rax], rcx
mov rax, qword [rsp + 0x120]
movsxd rsi, dword [rax]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
mov ecx, 1
mov r9d, 0xa
mov edx, esi
mov r8d, esi
call fcn.140002bc0
add eax, esi
mov rcx, qword [rsp + 0x120]
mov dword [rcx], eax
mov rax, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x90]
mov qword [rax + rsi*8], rcx
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0x20], esi
mov edx, 0xd8
mov r9d, 0xfc
xor ecx, ecx
mov r8d, esi
call fcn.140002bc0
mov ecx, dword [rsp + 0xd0]
cmp ecx, eax
jne 0x140001d9f
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x10]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], rax
jmp 0x140001dcb
mov eax, dword [rsp + 0xd0]
add rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x98]
mov ecx, dword [rcx + 0x10]
add rcx, qword [rsp + 0x70]
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1a0], rcx
mov rdi, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x1a8]
mov rsi, qword [rbx]
xor ecx, ecx
mov rdx, rsi
mov r8, rsi
call fcn.140002bc0
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x188], rbx
cmp rsi, rax
je 0x140001b88
nop dword [rax]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x2a8], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x108], rax
mov r8, qword [rsp + 0x108]
mov edx, 0x3cb1e7
mov rcx, 0xffffffffffffffff
call fcn.140002bc0
mov rcx, qword [rsp + 0x108]
cmp rcx, rax
jle 0x140001ea0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x88]
mov r8, qword [rdx]
lea rdx, [rax + rcx]
add rdx, 2
mov rcx, qword [rsp + 0x90]
call qword [rbx]
jmp 0x140001ee9
mov rax, qword [rsp + 0x128]
mov rdi, qword [rax]
mov rax, qword [rsp + 0x88]
mov rsi, qword [rax]
mov ecx, 0xffff
mov edx, 0x4f
mov r8d, 0x82
mov r9d, 0x28
call fcn.140002bc0
and rax, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x90]
mov rdx, rax
mov r8, rsi
call rdi
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x280]
mov qword [rcx], rax
test rax, rax
je 0x140002534
mov rsi, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x280]
add rdi, 8
mov rbx, qword [rsi + 8]
add rsi, 8
xor ecx, ecx
call fcn.140002bc0
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x190], rdi
mov qword [rsp + 0x188], rsi
cmp rbx, rax
jne 0x140001e10
jmp 0x140001b88
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rsi, qword [rax + 0x30]
movabs rcx, 0xffffffff00000000
mov edx, 0x34
mov r8, rsi
mov r9, rsi
call fcn.140002bc0
and rax, rsi
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x78]
movzx edi, word [rax + 6]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0xfcd03c
mov r8d, 0x710866
mov r9d, 0x31f52a
xor ecx, ecx
mov rdx, rsi
call fcn.140002bc0
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x160], rcx
cmp di, ax
jne 0x14000216f
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x110]
mov eax, dword [rax + 0xd0]
mov dword [rsp + 0xd4], eax
mov qword [rsp + 0x28], 0x78c0c6
mov qword [rsp + 0x20], 0x4f
mov edx, 0xe3
mov r8d, 9
mov r9d, 0xb
xor ecx, ecx
call fcn.140002bc0
mov ecx, dword [rsp + 0xd4]
mov rdx, qword [rsp + 0x110]
mov qword [rsp + 0xe0], rdx
cmp ecx, eax
je 0x14000212b
mov edx, dword [rsp + 0xd4]
mov rax, qword [rsp + 0x258]
mov rax, qword [rax + rdx + 0x18]
mov qword [rsp + 0x260], rax
xor ecx, ecx
mov r8, rdx
call fcn.140002bc0
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x110]
mov qword [rsp + 0xe0], rdx
cmp rcx, rax
je 0x14000212b
mov rax, qword [rsp + 0x260]
mov rcx, qword [rax]
mov qword [rsp + 0x158], rcx
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xe0], rax
test rcx, rcx
je 0x14000212b
nop dword [rax]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
mov ecx, 1
mov edx, 0xce831d
call fcn.140002bc0
mov rcx, qword [rsp + 0x258]
mov edx, eax
xor r8d, r8d
call rdi
mov rax, qword [rsi + 8]
add rsi, 8
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x150], rsi
test rax, rax
jne 0x1400020d0
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov eax, dword [rax + 0x28]
mov dword [rsp + 0x68], eax
mov r9d, dword [rsp + 0x68]
mov edx, 0xbd
mov r8d, 0x63
xor ecx, ecx
call fcn.140002bc0
mov ecx, dword [rsp + 0x68]
cmp ecx, eax
jne 0x1400024f0
mov rax, qword [rsp + 0x38]
mov qword [rax + 0x48], 0
jmp 0x1400025c2
mov rsi, qword [rsp + 0x78]
mov qword [rsp + 0x20], 0x3f9d45
mov ecx, 0x18
mov edx, 0x6838d7
mov r8, rsi
mov r9, rsi
call fcn.140002bc0
add rax, rsi
mov rcx, qword [rsp + 0x78]
movzx ecx, word [rcx + 0x14]
add rcx, rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x170], rcx
mov dword [rsp + 0xa8], 0
lea r15, section..rdata
lea r14, [rsp + 0x2b4]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140002298
mov rax, qword [rsp + 0x80]
mov esi, dword [rax + 0x10]
mov rax, qword [rsp + 0x80]
mov ebx, dword [rax + 8]
or rbx, qword [rsp + 0x250]
mov r8d, 0x3e0250
mov rcx, rsi
mov edx, esi
mov r9d, esi
call fcn.140002bc0
mov rbp, rax
mov ecx, 0xc000
mov r8d, 0x6f
mov r9d, 0xbcb1df
mov edx, esi
call fcn.140002bc0
mov rcx, rbx
mov rdx, rbp
mov r8d, eax
call rdi
mov ecx, 1
mov edx, 0xbb
mov r8d, 0x1719fc96
mov r9d, 0xae
call fcn.140002bc0
add eax, dword [rsp + 0xdc]
mov rcx, qword [rsp + 0x80]
add rcx, 0x28
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
movzx ebp, word [rdx + 6]
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x170], rcx
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x160], rdx
cmp eax, ebp
jae 0x140001fd4
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0xdc], eax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x288], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x40], eax
mov ecx, 0x2000000
mov edx, 0xb
mov r8d, 0x218aa2
mov r9d, 0x22
call fcn.140002bc0
mov rsi, rax
and esi, dword [rsp + 0x40]
mov edx, dword [rsp + 0xdc]
mov r8d, 0x94
mov r9d, 0xbc
xor ecx, ecx
call fcn.140002bc0
cmp esi, eax
jne 0x1400021e0
mov ecx, 0x1f
mov edx, 0x92
mov r8d, 0xd6
call fcn.140002bc0
mov esi, dword [rsp + 0x40]
mov ecx, eax
shr rsi, cl
mov ecx, 0x1e
mov r8d, 0x81
mov edx, esi
mov r9d, esi
call fcn.140002bc0
mov ebx, dword [rsp + 0x40]
mov ecx, eax
shr rbx, cl
mov ecx, 1
call fcn.140002bc0
and ebx, eax
mov ecx, 0x1d
mov edx, 0xca
mov r8d, 0xc6
mov r9d, 0xa0
call fcn.140002bc0
mov ebp, dword [rsp + 0x40]
mov ecx, eax
shr rbp, cl
mov qword [rsp + 0x20], 0xb3
mov ecx, 1
mov edx, 0x60
mov r8d, 0x1f
mov r9d, esi
call fcn.140002bc0
and ebp, eax
shl rbp, 4
add rbp, r15
lea rbx, [rbx*8]
add rbx, rbp
mov ecx, 0x11
mov edx, 0x13
call fcn.140002bc0
mov ebp, dword [rsp + 0x40]
mov ecx, eax
shr ebp, cl
mov ecx, 0x200
mov r9d, 0xce
mov edx, esi
mov r8d, esi
call fcn.140002bc0
and eax, ebp
or eax, dword [rbx + rsi*4]
mov dword [rsp + 0x14c], eax
mov rax, qword [rsp + 0x80]
mov esi, dword [rax + 0x10]
xor ecx, ecx
call fcn.140002bc0
mov dword [rsp + 0xa4], esi
cmp esi, eax
jne 0x1400024aa
mov ecx, 0x40
mov edx, 0x34422a86
call fcn.140002bc0
mov rsi, rax
and esi, dword [rsp + 0x40]
xor ecx, ecx
mov edx, esi
mov r8d, esi
call fcn.140002bc0
cmp esi, eax
jne 0x14000246e
mov ecx, 0x80
mov edx, 0xee
call fcn.140002bc0
mov rsi, rax
and esi, dword [rsp + 0x40]
xor ecx, ecx
mov edx, esi
call fcn.140002bc0
cmp esi, eax
je 0x140002237
mov rax, qword [rsp + 0x288]
add rax, 0x24
jmp 0x14000247a
mov rax, qword [rsp + 0x288]
add rax, 0x20
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov esi, dword [rax]
mov edx, 0xe76dab
xor ecx, ecx
mov r8d, esi
call fcn.140002bc0
mov dword [rsp + 0xa4], esi
cmp esi, eax
je 0x140002237
mov ecx, dword [rsp + 0xa4]
mov rbx, qword [0x1400071d8]
mov rax, qword [rsp + 0x80]
mov esi, dword [rax + 8]
or rsi, qword [rsp + 0x250]
mov edx, ecx
mov r8d, ecx
mov r9d, ecx
call fcn.140002bc0
mov r8d, dword [rsp + 0x14c]
mov rcx, rsi
mov rdx, rax
mov r9, r14
call rbx
jmp 0x140002237
mov rax, qword [rsp + 0x210]
mov esi, dword [rax]
xor ecx, ecx
mov edx, esi
mov r8d, esi
mov r9d, esi
call fcn.140002bc0
mov ecx, dword [rsp + 0x68]
add rcx, qword [rsp + 0x50]
mov qword [rsp + 0x268], rcx
cmp esi, eax
jne 0x140002553
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x268]
mov qword [rax + 0x48], rcx
jmp 0x1400025c2
mov rax, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x90]
call qword [rax]
jmp 0x140002594
mov ecx, 1
mov edx, 0x5c
mov r8d, 0x1afd0ddc
mov r9d, 0x1e
call fcn.140002bc0
mov rbp, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x50]
mov edx, eax
mov r8, r12
call rbp
mov esi, eax
mov edx, 0x3a
xor ecx, ecx
call fcn.140002bc0
cmp esi, eax
jne 0x1400025a9
mov rcx, qword [rsp + 0x38]
call fcn.140002620
mov qword [rsp + 0x48], 0
jmp 0x1400025cc
mov ecx, 1
mov edx, 0xe5
call fcn.140002bc0
mov rcx, qword [rsp + 0x298]
mov dword [rcx], eax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
add rsp, 0x2b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret