Function at 0x140071f30
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e8]
sub rsp, 0x3e8
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov qword [rbp - 0x40], r9
mov r13d, r8d
mov qword [rbp - 0x38], rdx
mov r15, rcx
mov qword [rbp + 0x160], rcx
mov r14, qword [rbp + 0x350]
mov qword [rbp - 0x30], r14
xor esi, esi
mov r12d, esi
mov dword [rbp - 0x50], esi
lea rax, [0x1400fba40]
mov qword [rbp + 0x30], rax
lea rcx, [0x1400fba90]
call fcn.140035fdc
test eax, eax
jne 0x1400735e3
movzx ebx, byte [0x1400fba40]
test bl, bl
sete byte [rbp + 0x38]
test bl, bl
jne 0x140071fbb
inc dword [0x1400fbae0]
lea rcx, [0x1400fba90]
call fcn.140036000
nop
mov dword [rbp - 0x50], 0x203e2d20
mov byte [rbp - 0x4c], 0
movdqa xmm0, xmmword [0x1400d1dd0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x485f7972
mov dword [rbp - 0x6c], 0x6b6f6f
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x230], 0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14005ed10
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140061370
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.140061bb0
mov dword [rbp - 0x50], 0x202d3c20
mov byte [rbp - 0x4c], 0
movdqa xmm0, xmmword [0x1400d1dd0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x485f7972
mov dword [rbp - 0x6c], 0x6b6f6f
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x230], 0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x48]
call fcn.14005ed10
lea r8, [rbp - 0x50]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140061370
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140061bb0
mov rdi, qword [0x1400fbc38]
mov qword [rbp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rsi
mov rax, qword [rdi]
cmp dword [rax], 0
je 0x140072129
mov qword [rbp + 0x1d0], rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x1d0]
mov qword [rbp + 0x40], rax
lea rcx, [0x1400e01eb]
mov qword [rsp + 0x28], rcx
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
mov r8, rcx
xor edx, edx
mov rcx, rdi
call fcn.14007cc00
nop
test bl, bl
je 0x14007213d
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140073573
lea rcx, [rbp + 0x1a0]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140072272
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov rdx, rax
lea r8, str.GenericLoadLibrary_Hook_called_with:
xor ecx, ecx
call fcn.14007cd90
lea rcx, [rbp + 0x1a0]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400723aa
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov r9, r15
lea r8, str.Filename:__s
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
lea rcx, [rbp + 0x1a0]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400724e3
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov rdx, rax
mov r9, qword [rbp - 0x38]
lea r8, str.hFile:__x
xor ecx, ecx
call fcn.14007cd90
lea rcx, [rbp + 0x1a0]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007261b
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov rdx, rax
mov r9d, r13d
lea r8, str.Flags:_0x_x
xor ecx, ecx
call fcn.14007cd90
lea rcx, [rbp + 0x70]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x1c0], xmm1
mov edi, 5
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007284b
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x80], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0x220], xmm0
mov qword [rbp - 0x80], 0xc
lea rax, [rbp + 0x220]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x50], xmm0
lea rax, str.FuncName:_
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0xc
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x170]
call fcn.140095680
nop
mov r12d, edi
mov dword [rbp - 0x50], edi
lea rbx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0x10
cmovae rbx, qword [rbp + 0x170]
movdqa xmm0, xmmword [0x1400d1dd0]
movdqu xmmword [rbp + 0x1a0], xmm0
mov dword [rbp + 0x1b0], 0x485f7972
mov dword [rbp + 0x1b4], 0x6b6f6f
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x70], 0
lea r8, [rbp + 0x1a0]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14005ed10
mov rdx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140068060
mov rdx, rax
movzx ecx, byte [rax]
mov byte [rbp - 0x80], cl
movzx ecx, byte [rax + 1]
mov byte [rbp - 0x7f], cl
movzx ecx, byte [rax + 2]
mov byte [rbp - 0x7e], cl
movzx ecx, byte [rax + 3]
mov byte [rbp - 0x7d], cl
movzx ecx, byte [rax + 4]
mov byte [rbp - 0x7c], cl
movzx ecx, byte [rax + 5]
mov byte [rbp - 0x7b], cl
movzx ecx, byte [rax + 6]
mov byte [rbp - 0x7a], cl
movzx eax, byte [rax + 7]
mov byte [rbp - 0x79], al
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x78], al
movzx eax, byte [rdx + 9]
mov byte [rbp - 0x77], al
movzx eax, byte [rdx + 0xa]
mov byte [rbp - 0x76], al
movzx eax, byte [rdx + 0xb]
mov byte [rbp - 0x75], al
movzx eax, byte [rdx + 0xc]
mov byte [rbp - 0x74], al
movzx eax, byte [rdx + 0xd]
mov byte [rbp - 0x73], al
movzx eax, byte [rdx + 0xe]
mov byte [rbp - 0x72], al
movzx eax, byte [rdx + 0xf]
mov byte [rbp - 0x71], al
movzx eax, byte [rdx + 0x10]
mov byte [rbp - 0x70], al
movzx eax, byte [rdx + 0x11]
mov byte [rbp - 0x6f], al
movzx eax, byte [rdx + 0x12]
mov byte [rbp - 0x6e], al
movzx eax, byte [rdx + 0x13]
mov byte [rbp - 0x6d], al
movzx eax, byte [rdx + 0x14]
mov byte [rbp - 0x6c], al
movzx eax, byte [rdx + 0x15]
mov byte [rbp - 0x6b], al
movzx eax, byte [rdx + 0x16]
mov byte [rbp - 0x6a], al
movzx eax, byte [rdx + 0x17]
mov byte [rbp - 0x69], al
movzx eax, byte [rdx + 0x18]
mov byte [rbp - 0x68], al
movzx eax, byte [rdx + 0x19]
mov byte [rbp - 0x67], al
movzx eax, byte [rdx + 0x1a]
mov byte [rbp - 0x66], al
movzx eax, byte [rdx + 0x1b]
mov byte [rbp - 0x65], al
movzx eax, byte [rdx + 0x1c]
mov byte [rbp - 0x64], al
movzx eax, byte [rdx + 0x1d]
mov byte [rbp - 0x63], al
movzx eax, byte [rdx + 0x1e]
mov byte [rbp - 0x62], al
movzx eax, byte [rdx + 0x1f]
mov byte [rbp - 0x61], al
movzx eax, byte [rdx + 0x20]
mov byte [rbp - 0x60], al
movzx eax, byte [rdx + 0x21]
mov byte [rbp - 0x5f], al
movzx eax, byte [rdx + 0x22]
mov byte [rbp - 0x5e], al
movzx eax, byte [rdx + 0x23]
mov byte [rbp - 0x5d], al
movzx eax, byte [rdx + 0x24]
mov byte [rbp - 0x5c], al
movzx eax, byte [rdx + 0x25]
mov byte [rbp - 0x5b], al
movzx eax, byte [rdx + 0x26]
mov byte [rbp - 0x5a], al
mov dword [rbp - 0x59], 0x2d202928
mov word [rbp - 0x55], 0x20
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x80]
xor ecx, ecx
call fcn.14007ca70
nop
test r12b, 1
je 0x140072896
and r12d, 0xfffffffe
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x140072896
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072891
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400735eb
call fcn.14005c5c0
lea rcx, [rbp + 0x70]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400729cb
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
mov dword [rbp + 0x170], 0x650047
mov dword [rbp + 0x174], 0x65006e
mov dword [rbp + 0x178], 0x690072
mov dword [rbp + 0x17c], 0x4c0063
mov dword [rbp + 0x180], 0x61006f
mov dword [rbp + 0x184], 0x4c0064
mov dword [rbp + 0x188], 0x620069
mov dword [rbp + 0x18c], 0x610072
mov dword [rbp + 0x190], 0x790072
mov dword [rbp + 0x194], 0x48005f
mov dword [rbp + 0x198], 0x6f006f
mov dword [rbp + 0x19c], 0x6b
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
lea r8, [rbp + 0x170]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov rdx, rax
mov r9, r14
lea r8, str.CallerAddr:_0x_x
xor ecx, ecx
call fcn.14007cd90
lea rcx, [rbp + 0x70]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140072ca2
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], si
mov r8d, 7
lea rdx, [0x1400d1638]
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
nop
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
mov r8d, 7
lea rdx, [0x1400d1638]
lea rcx, [rbp + 0x170]
call fcn.1400043e0
nop
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call fcn.14007b170
lea rcx, [rbp + 0x70]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140072b5f
lea rbx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rbx, qword [rbp + 0x170]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp + 0x220]
call fcn.140067ba0
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov r9, rbx
lea r8, str.CallerOffset:__s
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
lea rcx, [rbp + 0x70]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rsp + 0x68], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140072c43
lea rbx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rbx, qword [rbp + 0x1a0]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp + 0x220]
call fcn.140067ba0
mov dword [rsp + 0x48], 0x44005b
mov dword [rsp + 0x4c], 0x4c004c
mov dword [rsp + 0x50], 0x520050
mov dword [rsp + 0x54], 0x54004f
mov dword [rsp + 0x58], 0x430045
mov dword [rsp + 0x5c], 0x5d0054
mov dword [rsp + 0x60], 0x3a0020
mov dword [rsp + 0x64], 0x20003a
mov word [rsp + 0x68], si
mov r8, rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.1400614f0
mov r9, rbx
lea r8, str.CallerName:__s
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
nop
mov r8, qword [rbp + 0x188]
cmp r8, 8
jb 0x140072c66
inc r8
mov rdx, qword [rbp + 0x170]
lea rcx, [rbp + 0x170]
call fcn.140004640
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
mov r8, qword [rbp + 0x1b8]
cmp r8, 8
jb 0x140072ca2
inc r8
mov rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x1a0]
call fcn.140004640
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140072ccb
mov rax, qword [0x1400fbae8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
mov rcx, r15
call rax
mov rsi, rax
jmp 0x140073573
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x208], rsi
mov qword [rbp + 0x210], 7
mov word [rbp + 0x1f8], si
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp word [r15 + r8*2], 0
jne 0x140072cf5
mov rdx, r15
lea rcx, [rbp + 0x1f8]
call fcn.1400043e0
nop
call fcn.14007feb0
mov rbx, rax
mov qword [rbp + 0x1d0], rax
lea rdx, [rbp + 0x1f8]
cmp qword [rbp + 0x210], 8
cmovae rdx, qword [rbp + 0x1f8]
movabs r9, 0xcbf29ce484222325
mov rcx, qword [rbp + 0x208]
lea r8, [rcx + rcx]
mov rcx, rsi
test r8, r8
je 0x140072d73
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140072d60
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.1400638a0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140072e82
cmp rcx, qword [rbx + 8]
je 0x140072e82
lea rax, [rbp + 0x170]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 0xf
xor r8d, r8d
lea rdx, [0x1400e01eb]
lea rcx, [rbp + 0x170]
call fcn.140004810
nop
lea rax, [rbp - 0x20]
mov qword [rbp + 0x1d0], rax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14006b2c0
mov rbx, rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 7
inc r14
cmp word [r15 + r14*2], 0
jne 0x140072e11
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
mov r8d, r13d
lea rdx, [rbp + 0x1a0]
mov rcx, r15
call fcn.140078a60
mov rax, qword [0x1400fbae8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
mov rcx, r15
call rax
mov rsi, rax
jmp 0x140073566
lea r8, [rbp + 0x1f8]
lea rdx, [rbp + 0x220]
mov rcx, rbx
call fcn.140064f50
mov qword [rbp + 0x170], rbx
lea rax, [rbp + 0x1f8]
mov qword [rbp + 0x178], rax
mov byte [rbp + 0x180], 1
cmp byte [0x1400fbd13], 0
je 0x140072fb8
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x1a0]
call fcn.140019400
mov rcx, rax
call fcn.1400814a0
test al, al
je 0x140072fb8
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 0xf
xor r8d, r8d
lea rdx, [0x1400e01eb]
lea rcx, [rbp + 0x1a0]
call fcn.140004810
nop
lea rax, [rbp - 0x20]
mov qword [rbp + 0x1d0], rax
lea rcx, [rbp - 0x20]
call fcn.14006b360
mov r12, rax
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], 7
inc r14
cmp word [r15 + r14*2], 0
jne 0x140072f55
mov r8, r14
mov rdx, r15
lea rcx, [rbp + 0x220]
call fcn.1400043e0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r12
mov r9, qword [rbp - 0x40]
mov r8d, r13d
lea rdx, [rbp + 0x220]
mov rcx, r15
call fcn.140078a60
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140073556
mov dword [rbp - 0x50], esi
cmp byte [0x1400fbd1a], 0
jne 0x140073031
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140072fd0
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 7
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
or r12d, 0x1a
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1a0]
call fcn.140081fd0
test al, al
je 0x140073031
cmp dword [rbp - 0x50], 0
je 0x14007302a
cmp byte [0x1400fbd1b], 0
jne 0x140073031
mov byte [rsp + 0x40], 1
jmp 0x140073036
mov byte [rsp + 0x40], 0
test r12b, 2
je 0x140073048
lea rcx, [rbp + 0x1a0]
call fcn.140003e50
cmp byte [rsp + 0x40], 0
je 0x14007306a
mov rax, qword [0x1400fbae8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
mov rcx, r15
call rax
mov rsi, rax
jmp 0x140073556
mov qword [rbp + 0x1d8], rsi
movdqa xmm0, xmmword [0x1400e3130]
movdqu xmmword [rbp + 0x1e8], xmm0
mov word [rbp + 0x1d8], si
mov qword [rbp + 0x250], rsi
movdqa xmm0, xmmword [0x1400e3140]
movdqu xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
lea rax, [rbp + 0x168]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x250]
lea r8, [rbp + 0x1d8]
mov edx, r13d
mov rcx, r15
call fcn.140076d50
mov r12d, eax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x220], rax
mov byte [rbp + 0x228], 1
cmp r12d, 0xa
jne 0x14007318f
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], 0xf
xor r8d, r8d
lea rdx, [0x1400e01eb]
lea rcx, [rbp + 0x1a0]
call fcn.140004810
nop
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x20]
call fcn.14006b360
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp - 0x80]
call fcn.1400138b0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
mov r8d, r13d
mov rdx, rax
mov rcx, r15
call fcn.140078a60
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140073522
test r12d, r12d
je 0x1400732f2
test byte [0x1400fbd14], 0x10
je 0x1400731e3
lea rax, [rbp + 0x1a0]
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1a0]
call fcn.140004230
mov rdi, rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x20]
call fcn.14006b360
mov rbx, rax
lea rcx, [rsp + 0x48]
jmp 0x140073281
test byte [0x1400fbd14], 0x20
je 0x1400732f2
cmp byte [0x1400fbd18], 0
je 0x1400732c4
lea rax, [rsp + 0x48]
lea rdx, [rbp + 0x250]
lea rcx, [rsp + 0x48]
mov qword [rbp - 0x80], rax
call fcn.140004230
mov rdi, rax
cmp r12d, 5
jne 0x140073263
lea rax, [rbp - 0x20]
mov qword [rbp + 0x160], rax
lea rcx, [rbp - 0x20]
call fcn.14006b360
mov rbx, rax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x1a0]
call fcn.1400138b0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xa
jmp 0x1400732a1
lea rax, [rbp - 0x20]
mov qword [rbp + 0x160], rax
lea rcx, [rbp - 0x20]
call fcn.14006b360
mov rbx, rax
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp + 0x1d8]
call fcn.1400138b0
nop
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp - 0x40]
mov r8d, r13d
mov rdx, rax
mov rcx, r15
call fcn.140078a60
mov rbx, qword [rbp + 0x1d0]
mov edi, 5
test byte [0x1400fbd14], 0x20
je 0x1400732f2
cmp r12d, 5
je 0x1400732d9
cmp r12d, 2
jne 0x1400732f2
mov eax, 0x7e
cmp r12d, 2
cmove edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140073522
lea rdx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rdx, qword [rbp + 0x1d8]
mov qword [rbp + 0x1a0], rsi
movdqa xmm0, xmmword [0x1400e3130]
movdqu xmmword [rbp + 0x1b0], xmm0
mov word [rbp + 0x1a0], si
nop word [rax + rax]
inc r14
cmp word [rdx + r14*2], 0
jne 0x140073330
mov r8, r14
lea rcx, [rbp + 0x1a0]
call fcn.1400043e0
nop
lea r8, [rbp + 0x1a0]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140065330
nop
lea rcx, [rbp + 0x1a0]
call fcn.140003e50
mov qword [rbp + 0x1a0], rbx
lea rax, [rbp + 0x1d8]
mov qword [rbp + 0x1a8], rax
mov byte [rbp + 0x1b0], 1
lea rcx, [rbp + 0x70]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140073435
lea rdi, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rdi, qword [rbp + 0x1d8]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp - 0x20]
call fcn.140067ba0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rsp + 0x48]
call fcn.140067a60
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400614f0
mov r9, rdi
lea r8, str.calling_TrueLoadLibraryExW_with__s
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov rax, qword [0x1400fbae8]
lea rcx, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rcx, qword [rbp + 0x1d8]
mov r8d, r13d
mov rdx, qword [rbp - 0x38]
call rax
mov r14, rax
lea rcx, [rbp - 0x20]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x60], xmm1
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x140073512
lea rdi, [rbp + 0x1d8]
cmp qword [rbp + 0x1f0], 8
cmovae rdi, qword [rbp + 0x1d8]
mov dword [rbp - 0x80], 0x290028
mov dword [rbp - 0x7c], 0x2d0020
mov dword [rbp - 0x78], 0x20
lea rdx, str.GenericLoadLibrary_Hook
lea rcx, [rbp + 0x70]
call fcn.140067ba0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rsp + 0x48]
call fcn.140067a60
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.14005ee40
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400614f0
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, str.calling_TrueLoadLibraryExW_with__s___dll_p
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov rsi, r14
lea rcx, [rbp + 0x1a0]
call fcn.14006c830
nop
mov rcx, qword [rbp + 0x168]
cmp rcx, 0xffffffffffffffff
je 0x140073536
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x250]
call fcn.140004190
nop
lea rcx, [rbp + 0x1d8]
call fcn.140003e50
mov rbx, qword [rbp + 0x1d0]
lea rdx, [rbp + 0x1f8]
mov rcx, rbx
call fcn.14007ea40
nop
lea rcx, [rbp + 0x1f8]
call fcn.140003e50
nop
lea rcx, [rbp + 0x40]
call fcn.14006d200
nop
cmp byte [rbp + 0x38], 0
je 0x1400735b5
lea rcx, [0x1400fba90]
call fcn.140035fdc
test eax, eax
jne 0x1400735db
sub dword [0x1400fbae0], 1
jne 0x1400735a8
lea rcx, [0x1400fba48]
call fcn.1400c623c
lea rcx, [0x1400fba90]
call fcn.140036000
nop
mov rax, rsi
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x3e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.140035b50
nop
mov ecx, eax
call fcn.140035b50
nop
call fcn.1400a87d8
int3