Function at 0x1400873dc
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x58], rcx
imul eax, dword [0x14009cd84], 0x79ad3dff
imul ecx, dword [0x14009cd88], 0x88f735e4
mov edx, dword [0x14009dc4c]
add eax, ecx
add eax, 0x7d2aa434
xor eax, edx
imul eax, edx
imul ecx, dword [0x14009cd8c], 0x1b5ab7ca
imul edx, dword [0x14009cd90], 0x5ac94e1c
add ecx, edx
add ecx, 0xb5308215
imul edx, dword [0x14009cd94], 0x77f725f
imul r8d, dword [0x14009cd98], 0x788ef333
and ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x1fa0d996
imul edx, dword [0x14009cd9c], 0x158fc28b
imul r8d, dword [0x14009cda0], 0xa0dca101
imul r9d, dword [0x14009cda4], 0x9f08353a
imul r10d, dword [0x14009cda8], 0xae89289e
imul r11d, dword [0x14009cdac], 0x5ca88ecb
imul esi, dword [0x14009cdb0], 0x348512b5
cmp ecx, eax
mov eax, r8d
mov ecx, edx
mov edx, r10d
mov r8d, r9d
lea edx, [r8 + rdx - 0x34124042]
mov r8d, esi
mov r9d, r11d
lea r8d, [r9 + r8 + 0x23d3057d]
cmove r8d, edx
add eax, ecx
add eax, 0x12b4ff3e
cmp dword [0x14009dc50], eax
cmovl r8d, edx
mov dword [rbp - 0x50], r8d
xorps xmm6, xmm6
mov esi, 0x202dbbe9
mov r10d, esi
mov ebx, r11d
mov rsi, r9
mov r13, r8
mov r11, rdx
mov r14, rcx
cmp r10d, 0xf9e3c67d
jg 0x140087652
cmp r10d, 0xd5228ef2
jg 0x1400876eb
cmp r10d, 0xb3339db0
jle 0x140087894
cmp r10d, 0xc62ef51f
jg 0x140087c04
cmp r10d, 0xb3339db1
je 0x140088344
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r14
mov esi, r10d
cmp r10d, 0xc451e0be
jne 0x1400874e0
mov ebx, r12d
mov r14d, r15d
mov rcx, qword [r13]
mov al, byte [0x14009d06c]
mov dl, byte [0x14009d06d]
shr dl, 3
shl al, 5
or al, dl
mov edx, eax
xor dl, 0xad
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, dword [0x14009dc4c]
mov ecx, dword [0x14009d070]
mov edx, dword [0x14009d074]
shrd edx, ecx, 3
xor edx, eax
xor edx, 0x6251b496
imul edx, eax
mov eax, dword [0x14009d078]
mov ecx, dword [0x14009d07c]
shrd ecx, eax, 0x1c
xor ecx, 0x25510e82
and ecx, edx
imul eax, dword [0x14009d080], 0x89d8a6f2
imul edx, dword [0x14009d084], 0x425f076d
imul r8d, dword [0x14009d088], 0x6ca8da25
imul r9d, dword [0x14009d08c], 0x29aabefa
imul r10d, dword [0x14009d090], 0xdd91d8a2
imul r11d, dword [0x14009d094], 0x64b67130
imul esi, dword [0x14009d098], 0x5c8eaec6
imul r15d, dword [0x14009d09c], 0x8f5d2276
add eax, edx
add eax, 0x69f5bef7
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x1aa9315e]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x36a2a023]
mov edx, r15d
mov r8d, esi
lea esi, [r8 + rdx - 0x3b75ed16]
jmp 0x140087a0a
cmp r10d, 0x4a3985a1
jle 0x14008777b
cmp r10d, 0x5f7a8419
jle 0x140087a1b
cmp r10d, 0x658b0ae9
jg 0x140087dc8
cmp r10d, 0x5f7a841a
mov byte [rbp - 0x11], bl
je 0x14008854c
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x28], r14
mov r14, r11
mov r11d, ebx
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x62f16c20
jne 0x1400874e0
mov ebx, r12d
mov r13d, r15d
mov rcx, qword [r14]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov rcx, qword [rbp - 0x28]
mov rdx, r14
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov esi, 0xf5136b5d
jmp 0x1400874e0
cmp r10d, 0xf4461f30
jle 0x140087906
cmp r10d, 0xf5136b5c
jg 0x140087c8d
cmp r10d, 0xf4461f31
je 0x1400883f2
mov byte [rbp - 0x12], dil
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x38], r13
mov r13, rsi
mov esi, r10d
cmp r10d, 0xf494fa57
jne 0x1400874e0
mov ebx, r12d
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r13], eax
mov dil, byte [rbp - 0x12]
mov rcx, r14
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x38]
mov r9, r13
mov r11b, byte [rbp - 0x11]
mov esi, 0xf9b86c40
jmp 0x1400874e0
cmp r10d, 0x1818a9fe
jg 0x140087ad6
cmp r10d, 0x181beb8
jle 0x1400881a4
cmp r10d, 0x181beb9
je 0x1400889bf
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r14
mov esi, r10d
cmp r10d, 0x13a09185
jne 0x1400874e0
mov eax, edi
mov ebx, r12d
mov r14d, r15d
mov eax, dword [0x14009dc4c]
mov ecx, dword [0x14009cfdc]
mov edx, dword [0x14009cfe0]
shrd edx, ecx, 0x15
xor edx, eax
xor edx, 0x2d0c7a4e
imul ecx, dword [0x14009cfe4], 0x616718f4
imul r8d, dword [0x14009cfe8], 0x1da4df91
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x2809d9b0
and eax, edx
mov ecx, dword [0x14009cfec]
mov edx, dword [0x14009cff0]
shrd edx, ecx, 3
xor edx, 0x32c6d82c
mov ecx, dword [0x14009cff4]
mov r8d, dword [0x14009cff8]
shrd r8d, ecx, 9
imul ecx, dword [0x14009cffc], 0x7b303cf6
mov r9d, dword [0x14009d004]
mov esi, dword [0x14009d008]
shrd esi, r9d, 0x17
imul r9d, dword [0x14009d000], 0x956aab2a
xor r8d, 0xb9d264c
xor esi, 0xddb56861
cmp eax, edx
mov eax, r9d
lea eax, [rcx + rax - 0x37e65d1f]
cmove esi, eax
cmp dword [0x14009dc50], r8d
cmovl esi, eax
jmp 0x140087be6
cmp r10d, 0x95eef31c
je 0x1400888b0
cmp r10d, 0x96e233d7
je 0x140088258
mov r9, rsi
mov qword [rbp - 0x30], rsi
mov r8, r13
mov qword [rbp - 0x38], r13
mov rcx, r14
mov rdx, r11
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x12], r12b
mov esi, r10d
cmp r10d, 0xad6d5a57
jne 0x1400874e0
mov r13d, edi
mov rax, r14
mov r14d, r15d
mov rcx, rax
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
mov r11d, ebx
mov r12b, byte [rbp - 0x12]
mov esi, 0xda8431dc
jmp 0x1400874e0
cmp r10d, 0xd5228ef3
je 0x14008897d
cmp r10d, 0xda8431dc
je 0x140088271
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r14
mov esi, r10d
cmp r10d, 0xdd5d7ba5
jne 0x1400874e0
mov eax, edi
mov ebx, r12d
mov r14d, r15d
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009ce74], 0xccb0c292
imul edx, dword [0x14009ce78], 0xc717ba34
add ecx, edx
add ecx, 0xc8540e6d
xor ecx, eax
imul ecx, eax
mov eax, dword [str.r6M___]
mov edx, dword [0x14009ce80]
shrd edx, eax, 0xb
xor edx, 0xce47dded
and edx, ecx
imul eax, dword [0x14009ce84], 0x18f636e8
imul ecx, dword [0x14009ce88], 0x17a32793
imul r8d, dword [0x14009ce8c], 0x79641c38
imul r9d, dword [0x14009ce90], 0x7d70513c
add eax, ecx
add eax, 0xc7ece380
mov ecx, dword [0x14009ce9c]
mov esi, dword [0x14009cea0]
shrd esi, ecx, 0x1d
imul ecx, dword [0x14009ce94], 0xda13030
xor esi, 0xa072ba92
imul r11d, dword [0x14009ce98], 0x83e57b9d
cmp edx, eax
mov eax, r9d
mov edx, r8d
lea eax, [rdx + rax + 0x10e4a336]
mov edx, r11d
lea ecx, [rcx + rdx - 0xac49c97]
cmove esi, ecx
cmp dword [0x14009dc50], eax
cmovl esi, ecx
jmp 0x140087be6
cmp r10d, 0x4a3985a2
je 0x1400889d8
cmp r10d, 0x4bd935a5
je 0x140088533
mov byte [rbp - 0x12], dil
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x28], r14
mov r14, r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x50cce310
jne 0x1400874e0
mov ebx, r12d
mov rax, r13
mov r13d, r15d
mov rsi, rax
mov rax, qword [r14]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [r14]
imul edx, dword [0x14009d17c], 0x7c280630
imul r8d, dword [0x14009d180], 0x1a0a6f23
mov rcx, qword [rax + 0x28]
mov eax, r8d
add edx, eax
add edx, 0xb92075b4
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov dil, byte [rbp - 0x12]
mov rcx, qword [rbp - 0x28]
mov rdx, r14
mov r8, rsi
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov esi, 0x658b0aea
jmp 0x1400874e0
cmp r10d, 0x1818a9ff
mov qword [rbp - 0x20], r11
je 0x140088b63
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r14
mov esi, dword [rbp - 0x50]
cmp r10d, 0x202dbbe9
je 0x1400874e0
mov eax, edi
mov ebx, r12d
mov r14d, r15d
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
mov r8, r13
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov esi, r10d
cmp r10d, 0x3cc7d904
jne 0x1400874e0
mov edi, eax
mov eax, dword [0x14009dc4c]
mov ecx, dword [0x14009cf00]
mov edx, dword [0x14009cf04]
shrd edx, ecx, 0xa
xor edx, eax
xor edx, 0x1fa79e30
imul edx, eax
mov eax, dword [0x14009cf08]
mov ecx, dword [0x14009cf0c]
shrd ecx, eax, 0x12
xor ecx, 0xa75cb7c2
and ecx, edx
mov eax, dword [0x14009cf10]
mov edx, dword [0x14009cf14]
shrd edx, eax, 7
xor edx, 0xa2c3ab99
mov eax, dword [0x14009cf18]
mov r8d, dword [0x14009cf1c]
shrd r8d, eax, 3
mov eax, dword [0x14009cf20]
mov r9d, dword [0x14009cf24]
shrd r9d, eax, 0xd
xor r8d, 0xb34be10e
xor r9d, 0x98d88a67
mov eax, dword [0x14009cf28]
mov esi, dword [0x14009cf2c]
shrd esi, eax, 0xa
xor esi, 0xfc90d915
cmp ecx, edx
cmove esi, r9d
cmp dword [0x14009dc50], r8d
cmovl esi, r9d
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
mov r8, r13
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov r12d, ebx
mov r15d, r14d
jmp 0x1400874e0
cmp r10d, 0xc62ef520
je 0x140088429
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r14
mov esi, r10d
cmp r10d, 0xcd1e498e
jne 0x1400874e0
mov ebx, r12d
mov r14d, r15d
mov rcx, qword [r13]
movzx eax, byte [0x14009d184]
movzx edx, byte [0x14009d185]
imul eax, eax, 0xffffffac
imul edx, edx, 0xffffff84
add dl, al
add dl, 0xd4
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
mov r8, r13
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov esi, 0xc451e0be
jmp 0x1400874e0
cmp r10d, 0xf5136b5d
je 0x14008846b
mov byte [rbp - 0x12], dil
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov byte [rbp - 0x11], bl
mov rax, r13
mov r13, rsi
mov dword [rbp - 0x28], r15d
mov esi, r10d
cmp r10d, 0xf9b86c40
jne 0x1400874e0
mov ebx, r12d
sub rsp, 0x20
mov rcx, r14
mov r15, rax
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r13], eax
mov eax, dword [0x14009dc4c]
mov ecx, dword [0x14009cfac]
mov edx, dword [0x14009cfb0]
shrd edx, ecx, 0xd
xor edx, eax
xor edx, 0x8d90704b
imul edx, eax
mov eax, dword [0x14009cfb4]
mov ecx, dword [0x14009cfb8]
shrd ecx, eax, 0x16
xor ecx, 0x35390c83
and ecx, edx
mov eax, dword [0x14009cfbc]
mov edx, dword [0x14009cfc0]
shrd edx, eax, 0x1a
imul eax, dword [0x14009cfc4], 0xf975a948
imul r8d, dword [0x14009cfc8], 0x615e1177
imul r9d, dword [0x14009cfcc], 0x68d9444e
imul r10d, dword [0x14009cfd0], 0x5f14ceed
imul r11d, dword [0x14009cfd4], 0x90ba3372
imul esi, dword [0x14009cfd8], 0xcf0ba709
xor edx, 0x1a60e6a
cmp ecx, edx
mov ecx, r8d
lea eax, [rax + rcx - 0x5590d580]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx + 0x751efa35]
mov edx, esi
mov r8d, r11d
lea esi, [r8 + rdx + 0x7f904135]
cmove esi, ecx
cmp dword [0x14009dc50], eax
cmovl esi, ecx
mov dil, byte [rbp - 0x12]
mov rcx, r14
mov rdx, qword [rbp - 0x20]
mov r8, r15
mov r9, r13
mov r11b, byte [rbp - 0x11]
mov r15d, dword [rbp - 0x28]
jmp 0x1400874e0
cmp r10d, 0x658b0aea
je 0x14008877e
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov esi, r10d
cmp r10d, 0x6f9211ee
jne 0x1400874e0
mov r14d, r12d
mov dword [rbp - 0x28], r15d
mov eax, dword [0x14009cdb4]
mov ecx, dword [0x14009cdb8]
shrd ecx, eax, 0xa
xor ecx, 0xbfb7e633
mov eax, ecx
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov byte [rbp - 0x12], r12b
mov rdx, rsp
mov qword [rbp - 0x48], rdx
imul eax, dword [str.b4LSA], 0x57496b10
imul ecx, dword [0x14009cdc0], 0xa492f8c8
mov qword [rbp - 0x20], rdx
add eax, ecx
add eax, 0x8f33b119
lea rax, [rax*8 + 0xf]
movabs rcx, 0x7ffffffd0
and rax, rcx
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov qword [rbp - 0x30], rdi
imul eax, dword [0x14009cdc4], 0x2702b927
imul edx, dword [str._HXg], 0x9aaffe56
add eax, edx
add eax, 0xe3e9775
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
mov qword [rbp - 0x38], rdx
mov eax, dword [0x14009cdcc]
mov r8d, dword [0x14009cdd0]
shrd r8d, eax, 6
xor r8d, 0x5aed324b
mov eax, r8d
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x40], rsp
imul eax, dword [0x14009cdd4], 0x8d653809
imul r8d, dword [0x14009cdd8], 0x313ade2a
add eax, r8d
add eax, 0x7c7c7f5e
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor r9d, r9d
mov qword [rdx], r9
mov edx, dword [0x14009cddc]
mov r10d, dword [0x14009cde0]
shrd r10d, edx, 7
xor r10d, 0xa914d565
mov dword [r8], r10d
mov edx, dword [0x14009cde4]
mov r10d, dword [0x14009cde8]
shrd r10d, edx, 6
mov qword [r8 + 8], r9
xor r10d, 0x765ab1d8
mov dword [r8 + 0x18], r10d
imul edx, dword [0x14009cdec], 0x6c8d46f4
imul r10d, dword [0x14009cdf0], 0x63e958e0
imul r11d, dword [0x14009cdf4], 0x7e157d7a
lea esi, [rdx + r10]
add esi, 0x7912b2d4
imul r10d, dword [0x14009cdf8], 0x1938e18
mov r15d, r10d
mov r12d, dword [0x14009cdfc]
mov r10d, dword [0x14009ce00]
shrd r10d, r12d, 1
mov r13d, dword [0x14009ce04]
mov r12d, dword [0x14009ce08]
shrd r12d, r13d, 0x12
mov eax, dword [0x14009ce0c]
mov r13d, dword [0x14009ce10]
shrd r13d, eax, 0x16
imul ecx, dword [0x14009ce14], 0xe1741254
imul eax, dword [0x14009ce18], 0xd5aa3ee2
add r11d, r15d
add r11d, 0xb564887a
lea edx, [rcx + rax]
add edx, 0x84f8dfd2
imul ecx, dword [0x14009ce1c], 0xdb238672
imul r15d, dword [0x14009ce20], 0x4a9736f0
imul eax, dword [0x14009ce24], 0xcdc9861e
add ecx, r15d
add ecx, 0xc32d9310
imul r15d, dword [0x14009ce28], 0x2c37b5b7
add eax, r15d
add eax, 0x47dce1d2
mov r15, r8
mov qword [rdi], r9
mov r14d, ebx
mov rbx, qword [rbp - 0x58]
mov qword [r8 + 0x10], rbx
movups xmmword [r8 + 0x20], xmm6
xor r10d, 0x33c5800d
xor r12d, 0xa64dee34
xor r13d, 0x5c40ae64
sub rsp, 0x80
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov qword [rsp + 0x20], r9
mov rcx, rdi
mov edx, esi
mov r9, qword [rbp - 0x40]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov ecx, dword [0x14009ce2c]
mov edx, dword [0x14009ce30]
shrd edx, ecx, 0x13
mov rcx, qword [rbp - 0x48]
mov dword [rcx], eax
xor edx, 0x6ddd4e97
cmp eax, edx
setg dil
mov ecx, dword [0x14009dc4c]
imul edx, dword [0x14009ce34], 0x642bc0f6
imul r8d, dword [0x14009ce38], 0x5d07f1f3
add edx, r8d
add edx, 0xcdf7c115
xor edx, ecx
imul edx, ecx
mov ecx, dword [0x14009ce3c]
mov r8d, dword [0x14009ce40]
shrd r8d, ecx, 0x1f
xor r8d, 0x508cb4b3
and r8d, edx
imul ecx, dword [0x14009ce44], 0x5656289c
imul edx, dword [0x14009ce48], 0x2c35c5e3
add ecx, edx
add ecx, 0x8e1d93e6
mov edx, dword [0x14009ce4c]
mov r9d, dword [0x14009ce50]
shrd r9d, edx, 0xb
xor r9d, 0x3528bbf6
imul edx, dword [0x14009ce54], 0x6d00f139
imul r10d, dword [0x14009ce58], 0x4eb73b10
imul r11d, dword [0x14009ce5c], 0xb8f5f356
imul esi, dword [0x14009ce60], 0x664ffc2d
cmp r8d, ecx
mov ecx, r10d
lea ecx, [rdx + rcx - 0x1811f1d4]
mov edx, esi
mov r8d, r11d
lea esi, [r8 + rdx + 0x7f79b2ef]
cmove esi, ecx
cmp dword [0x14009dc50], r9d
cmovl esi, ecx
mov rcx, r15
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x20]
mov r11d, r14d
mov r12b, byte [rbp - 0x12]
mov r15d, dword [rbp - 0x28]
jmp 0x1400874e0
cmp r10d, 0xff98a368
jne 0x140088c44
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009cf7c], 0x6a403747
imul edx, dword [0x14009cf80], 0xe06e5831
add ecx, edx
add ecx, 0xdcc75417
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009cf84]
mov edx, dword [0x14009cf88]
shrd edx, eax, 0x13
xor edx, 0xb41f26c8
and edx, ecx
mov eax, dword [0x14009cf8c]
mov ecx, dword [0x14009cf90]
shrd ecx, eax, 0x13
xor ecx, 0x48cd0fb0
mov eax, dword [0x14009cf94]
mov r8d, dword [0x14009cf98]
shrd r8d, eax, 0x1e
mov eax, dword [0x14009cf9c]
mov r9d, dword [0x14009cfa0]
shrd r9d, eax, 0xa
xor r8d, 0x2194736a
xor r9d, 0xc0642dc8
mov eax, dword [0x14009cfa4]
mov r10d, dword [0x14009cfa8]
shrd r10d, eax, 0x13
xor r10d, 0x99f59ca9
cmp edx, ecx
jmp 0x140088957
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov esi, 0x13a09185
jmp 0x1400874e0
mov r15d, dword [rsi]
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009d0d0], 0x383375c6
imul edx, dword [0x14009d0d4], 0xe8a187ef
add ecx, edx
add ecx, 0x463ab617
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009d0d8]
mov edx, dword [0x14009d0dc]
shrd edx, eax, 0x1d
xor edx, 0xe201ca4c
and edx, ecx
mov eax, dword [0x14009d0e0]
mov ecx, dword [0x14009d0e4]
shrd ecx, eax, 0x13
xor ecx, 0x540ac65a
mov eax, dword [0x14009d0e8]
mov r8d, dword [0x14009d0ec]
shrd r8d, eax, 0x17
mov eax, dword [0x14009d0f0]
mov r9d, dword [0x14009d0f4]
shrd r9d, eax, 0x15
xor r8d, 0x3d931444
imul eax, dword [0x14009d0f8], 0xaff549fa
xor r9d, 0xb87a96b5
imul r10d, dword [0x14009d0fc], 0x87a9998b
cmp edx, ecx
mov ecx, r10d
lea eax, [rax + rcx - 0x32bb62f1]
cmove eax, r9d
cmp dword [0x14009dc50], r8d
mov r10, rsi
mov esi, eax
cmovl esi, r9d
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, r10
mov r11d, ebx
jmp 0x1400874e0
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rcx, qword [r13]
imul eax, dword [0x14009d168], 0x4800ce87
imul edx, dword [0x14009d16c], 0x376de2
add edx, eax
add edx, 0x9d7f02e8
mov al, byte [0x14009d170]
mov r9b, byte [0x14009d171]
shr r9b, 1
shl al, 7
or al, r9b
mov r9d, eax
xor r9b, 0x6e
mov eax, dword [0x14009d174]
mov r10d, dword [0x14009d178]
shrd r10d, eax, 6
xor r10d, 0xfae1e9bf
sub rsp, 0x40
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x30], 0
mov dword [rbp - 0x28], r15d
mov r15, r14
mov r14, rsi
mov rsi, r11
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [r14], eax
mov rcx, r15
mov rdx, rsi
mov r8, r13
mov r9, r14
mov r11d, ebx
mov r15d, dword [rbp - 0x28]
mov esi, 0x4a3985a2
jmp 0x1400874e0
imul eax, dword [0x14009ce64], 0x59f68ff5
mov ecx, dword [0x14009ce6c]
mov edx, dword [0x14009ce70]
shrd edx, ecx, 0x10
imul ecx, dword [0x14009ce68], 0x171f744e
add eax, ecx
add eax, 0xd03727d0
xor edx, 0x508e99f
test dil, 1
jmp 0x14008845e
imul eax, dword [0x14009cf6c], 0xf6e8a0bd
mov ecx, dword [0x14009cf74]
mov edx, dword [0x14009cf78]
shrd edx, ecx, 0xc
imul ecx, dword [0x14009cf70], 0xf81bc67a
add eax, ecx
add eax, 0x6a708aca
xor edx, 0x732fb301
test r12b, 1
mov r9, rsi
mov esi, edx
cmovne esi, eax
jmp 0x1400889b4
mov rcx, qword [r11]
sub rsp, 0x20
mov qword [rbp - 0x30], rsi
mov rsi, r11
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009d00c], 0xb508f88a
imul edx, dword [0x14009d010], 0xad7cb341
add ecx, edx
add ecx, 0x6bb97112
xor ecx, eax
imul edx, dword [0x14009d014], 0xab9e980b
imul r8d, dword [0x14009d018], 0xf85df5f6
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x5a59f717
and eax, ecx
mov ecx, dword [0x14009d01c]
mov edx, dword [0x14009d020]
shrd edx, ecx, 0x1a
xor edx, 0x9db0a542
mov ecx, dword [0x14009d024]
mov r8d, dword [0x14009d028]
shrd r8d, ecx, 0xc
mov ecx, dword [0x14009d02c]
mov r9d, dword [0x14009d030]
shrd r9d, ecx, 2
xor r8d, 0x877b2446
xor r9d, 0xbcd54641
mov ecx, dword [0x14009d034]
mov r10d, dword [0x14009d038]
shrd r10d, ecx, 0x1d
xor r10d, 0x9cf9f67a
cmp eax, edx
jmp 0x14008888f
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov esi, 0x95eef31c
jmp 0x1400874e0
mov eax, dword [0x14009d100]
mov ecx, dword [0x14009d104]
shrd ecx, eax, 6
xor ecx, 0x400e87df
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov qword [rbp - 0x40], r9
imul eax, dword [0x14009d108], 0x6bdebbd8
imul edx, dword [0x14009d10c], 0x6a49f431
add eax, edx
add eax, 0x1a1e3797
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x48], rsp
mov eax, dword [0x14009d110]
mov edx, dword [0x14009d114]
shrd edx, eax, 0x1c
xor edx, 0x93748953
mov eax, edx
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor ecx, ecx
mov qword [r9], rcx
mov eax, dword [0x14009d118]
mov edx, dword [0x14009d11c]
shrd edx, eax, 4
xor edx, 0x8a146cda
mov dword [r8], edx
mov qword [r8 + 8], rcx
mov eax, dword [0x14009d120]
mov edx, dword [0x14009d124]
shrd edx, eax, 3
xor edx, 0x62dec049
mov dword [r8 + 0x18], edx
mov rax, qword [rbp - 0x58]
mov qword [r8 + 0x10], rax
mov eax, dword [0x14009d128]
mov edx, dword [0x14009d12c]
shrd edx, eax, 0x1f
movups xmmword [r8 + 0x20], xmm6
xor edx, 0xae4f820c
mov eax, dword [0x14009d130]
mov r10d, dword [0x14009d134]
shrd r10d, eax, 0x1b
mov eax, r10d
xor eax, 0xfa6ce4b9
imul r10d, dword [0x14009d138], 0xdaa9bbe3
mov qword [rbp - 0x20], r11
imul r11d, dword [str.h__n], 0xdf9fc924
lea r9d, [r10 + r11]
add r9d, 0xad952ca2
mov dword [rbp - 0x4c], r9d
mov r11d, dword [0x14009d140]
mov r9, rsi
mov esi, dword [0x14009d144]
shrd esi, r11d, 0xf
mov r11d, esi
mov esi, dword [0x14009d148]
mov dword [rbp - 0x28], r15d
mov r15d, dword [0x14009d14c]
shrd r15d, esi, 0x1e
xor r11d, 0x177f873
xor r15d, 0x9a2f14a8
mov esi, dword [0x14009d150]
mov rbx, r9
mov byte [rbp - 0x12], r12b
mov r12d, dword [0x14009d154]
shrd r12d, esi, 0xc
xor r12d, 0x534f9b58
mov esi, dword [0x14009d158]
mov r10d, dword [0x14009d15c]
shrd r10d, esi, 0xf
xor r10d, 0xfd7b8ab8
mov esi, dword [0x14009d160]
mov r9d, dword [0x14009d164]
shrd r9d, esi, 7
xor r9d, 0xe9c67d9e
sub rsp, 0x80
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x68], r9d
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r11d
mov r9d, dword [rbp - 0x4c]
mov dword [rsp + 0x30], r9d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x40]
mov r9, qword [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov rcx, r14
mov rdx, qword [rbp - 0x20]
mov r8, r13
mov r9, rbx
mov r11b, byte [rbp - 0x11]
mov r12b, byte [rbp - 0x12]
mov r15d, dword [rbp - 0x28]
mov esi, 0x6f9211ee
jmp 0x1400874e0
mov rax, qword [r11]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [r11]
imul edx, dword [0x14009cf30], 0xffeb54d2
imul r8d, dword [0x14009cf34], 0x4f8d9c22
mov rcx, qword [rax + 0x28]
mov eax, r8d
add edx, eax
add edx, 0x4906ff90
sub rsp, 0x20
mov qword [rbp - 0x30], rsi
mov rsi, r11
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
movzx ecx, byte [0x14009cf38]
movzx edx, byte [0x14009cf39]
imul ecx, ecx, 0xffffff84
imul edx, edx, 0x62
add dl, cl
add dl, 0xf6
cmp al, dl
setne r12b
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009cf3c], 0x467bf1b9
imul edx, dword [0x14009cf40], 0x38345961
add ecx, edx
add ecx, 0xb4713156
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009cf44]
mov edx, dword [0x14009cf48]
shrd edx, eax, 0x17
xor edx, 0x3b8c0942
and edx, ecx
imul eax, dword [0x14009cf4c], 0xb2206811
imul ecx, dword [0x14009cf50], 0xe719c97
add eax, ecx
add eax, 0x37c59353
mov ecx, dword [0x14009cf54]
mov r8d, dword [0x14009cf58]
shrd r8d, ecx, 7
mov ecx, dword [0x14009cf5c]
mov r9d, dword [0x14009cf60]
shrd r9d, ecx, 2
xor r8d, 0x5c55088c
xor r9d, 0xb3ffad10
mov ecx, dword [0x14009cf64]
mov r10d, dword [0x14009cf68]
shrd r10d, ecx, 0x13
xor r10d, 0xccbc6e03
cmp edx, eax
cmove r10d, r9d
cmp dword [0x14009dc50], r8d
cmovl r10d, r9d
mov rcx, r14
mov rdx, rsi
mov r8, r13
mov r9, qword [rbp - 0x30]
jmp 0x140088972
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009d0a0], 0x1a555264
imul edx, dword [0x14009d0a4], 0x61d4ff81
add ecx, edx
add ecx, 0x7db062ff
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009d0a8]
mov edx, dword [0x14009d0ac]
shrd edx, eax, 0x12
xor edx, 0x97d52b52
and edx, ecx
imul eax, dword [0x14009d0b0], 0x8b8323ff
imul ecx, dword [0x14009d0b4], 0xb0b86360
add eax, ecx
add eax, 0x6b199251
mov ecx, dword [0x14009d0b8]
mov r8d, dword [str.:1_va]
shrd r8d, ecx, 9
mov ecx, dword [0x14009d0c0]
mov r9d, dword [0x14009d0c4]
shrd r9d, ecx, 0x1a
xor r8d, 0xc2303e92
xor r9d, 0x7a5c6c53
mov ecx, dword [0x14009d0c8]
mov r10d, dword [0x14009d0cc]
shrd r10d, ecx, 0xc
xor r10d, 0xbe0c36a0
cmp edx, eax
cmove r10d, r9d
cmp dword [0x14009dc50], r8d
cmovl r10d, r9d
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov esi, r10d
jmp 0x1400874e0
mov eax, dword [0x14009cef0]
mov ecx, dword [0x14009cef4]
shrd ecx, eax, 4
mov eax, dword [0x14009cef8]
mov edx, dword [0x14009cefc]
shrd edx, eax, 0x12
xor ecx, 0x88375c37
xor edx, 0x3defce61
test bl, 1
mov r9, rsi
mov esi, edx
cmovne esi, ecx
mov rcx, r14
mov rdx, r11
jmp 0x140088c39
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov esi, 0x1818a9ff
jmp 0x1400874e0
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov eax, dword [0x14009cea4]
mov edx, dword [0x14009cea8]
shrd edx, eax, 0xd
mov rcx, qword [r13]
xor edx, 0xd14c42ba
mov al, byte [0x14009ceac]
mov r9b, byte [0x14009cead]
shr r9b, 7
add al, al
or al, r9b
mov r9d, eax
imul eax, dword [0x14009ceb0], 0xfd1dcf87
imul r10d, dword [0x14009ceb4], 0x730955d3
xor r9b, 0xc4
add eax, r10d
add eax, 0x2f86f889
sub rsp, 0x40
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
mov qword [rbp - 0x20], r11
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [rsi], eax
imul ecx, dword [0x14009ceb8], 0x3725a5cb
imul edx, dword [0x14009cebc], 0xe501af4b
add ecx, edx
add ecx, 0x7681f7bb
cmp eax, ecx
setg bl
mov eax, dword [0x14009dc4c]
imul ecx, dword [0x14009cec0], 0x21802554
imul edx, dword [0x14009cec4], 0xc613db8a
add ecx, edx
add ecx, 0xcb601cdd
xor ecx, eax
imul edx, dword [0x14009cec8], 0xf68b5998
imul r8d, dword [0x14009cecc], 0x4dc50237
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0xa065050
and eax, ecx
imul ecx, dword [0x14009ced0], 0x82ba0dde
imul edx, dword [0x14009ced4], 0x3ff2d8e
add ecx, edx
add ecx, 0x1462119a
mov edx, dword [0x14009ced8]
mov r8d, dword [0x14009cedc]
shrd r8d, edx, 0x1c
xor r8d, 0x6de744f0
imul edx, dword [0x14009cee0], 0x243aeec
imul r9d, dword [0x14009cee4], 0x7542d2a7
imul r10d, dword [0x14009cee8], 0x8e3e0a3e
mov r11, rsi
imul esi, dword [0x14009ceec], 0x65eefdd1
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax + 0x7384d18d]
mov ecx, esi
mov edx, r10d
lea esi, [rdx + rcx + 0x349d5d2f]
cmove esi, eax
cmp dword [0x14009dc50], r8d
cmovl esi, eax
mov rcx, r14
mov rdx, qword [rbp - 0x20]
mov r8, r13
mov r9, r11
mov r11d, ebx
jmp 0x1400874e0
mov eax, dword [0x14009dc4c]
mov ecx, dword [0x14009d03c]
mov edx, dword [0x14009d040]
shrd edx, ecx, 0xb
xor edx, eax
xor edx, 0x420452e8
imul ecx, dword [0x14009d044], 0x1e305e32
imul r8d, dword [0x14009d048], 0xefa41ba6
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x2c94ab99
and eax, edx
imul ecx, dword [0x14009d04c], 0x952dc153
imul edx, dword [0x14009d050], 0x1a365d38
add ecx, edx
add ecx, 0x25fefd2a
mov edx, dword [0x14009d054]
mov r8d, dword [0x14009d058]
shrd r8d, edx, 0xb
xor r8d, 0x7f37457e
imul edx, dword [0x14009d05c], 0xfe96d1a8
imul r9d, dword [0x14009d060], 0x14022328
imul r10d, dword [0x14009d064], 0x7327b559
imul r11d, dword [0x14009d068], 0xa6767061
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax + 0x43f6012e]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x5b050b83]
cmove ecx, eax
cmp dword [0x14009dc50], r8d
mov r9, rsi
mov esi, ecx
cmovl esi, eax
mov rcx, r14
mov rdx, qword [rbp - 0x20]
mov r8, r13
mov r11d, ebx
jmp 0x1400874e0
mov rcx, r14
mov rdx, r11
mov r8, r13
mov r9, rsi
mov r11d, ebx
mov esi, r10d
cmp r10d, 0xf9e3c67e
jne 0x1400874e0
mov eax, r15d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret