Function at 0x14000bf60
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x150], xmm6
mov qword [rbp + 0x148], 0xfffffffffffffffe
mov qword [rbp + 0xf0], rcx
xorps xmm6, xmm6
lea r15, [rbp + 0x70]
mov r13d, 0x4b35f358
mov r14d, 0xa5b66e03
mov dword [rbp + 0xc0], eax
mov dword [rbp + 0xc4], eax
mov dword [rbp + 0xd0], eax
mov dword [rbp + 0xc8], eax
mov dword [rbp + 0xcc], eax
mov dword [rbp + 0xd4], eax
mov dword [rbp + 0xe4], eax
mov qword [rbp + 0x68], rax
mov eax, 0x5cf9bfe0
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xede0641f
mov ecx, 0x552ca758
nop word cs:[rax + rax]
nop
cmove eax, ecx
cmp dword [0x140144998], 0xa
cmovl eax, ecx
cmp eax, 0xf3892dd4
jg 0x14000c080
cmp eax, 0xb5fe8b91
jg 0x14000c130
cmp eax, 0x9ef8a0f3
jg 0x14000c233
cmp eax, 0x88621da9
jg 0x14000c3e7
cmp eax, 0x84bef179
jle 0x14000c69c
cmp eax, 0x8684b94a
jle 0x14000cb53
cmp eax, 0x8684b94b
je 0x14000d2af
cmp eax, 0x8702cfa0
je 0x14000d2d9
cmp eax, 0x87f6dc92
jne 0x14000c00d
cmp byte [rbp + 0x113], 0
mov eax, 0x15358a24
mov ecx, 0x49123763
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0x3d6fa98d
jle 0x14000c1a0
cmp eax, 0x58834847
jg 0x14000c29e
cmp eax, 0x4ee4052c
jg 0x14000c455
cmp eax, 0x48e6ef19
jle 0x14000c6f6
cmp eax, 0x49123762
jle 0x14000cb73
cmp eax, 0x49123763
je 0x14000d2ef
cmp eax, 0x4b41ce58
je 0x14000d30e
cmp eax, 0x4b6ea151
jne 0x14000c00d
lea rax, [rbp - 0x80]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
lea rcx, [rcx + rcx*4]
mov rdx, qword [rax + rcx*8 + 0x10]
mov qword [rbp - 0x40], rdx
mov rdx, qword [rax + rcx*8 + 0x18]
mov qword [rbp - 0x48], rdx
mov rdx, qword [rax + rcx*8 + 0x20]
mov qword [rbp - 0x50], rdx
lea rax, [rax + rcx*8]
add rax, 0x28
mov qword [rbp - 0x58], rax
mov eax, 0x9b95a715
jmp 0x14000c00d
cmp eax, 0xda73ab49
jg 0x14000c2f9
cmp eax, 0xcb6636bd
jg 0x14000c496
cmp eax, 0xc02c23b0
jle 0x14000c73d
cmp eax, 0xc9c4f88f
jle 0x14000cbbd
cmp eax, 0xc9c4f890
je 0x14000d32c
cmp eax, 0xca663563
je 0x14000d35a
cmp eax, 0xcb58158d
jne 0x14000c00d
mov eax, dword [rbp + 0xa0]
cmp eax, 6
mov eax, 0xa69f5b3d
mov ecx, 0x22e9e9f3
cmovl eax, ecx
jmp 0x14000c00d
cmp eax, 0xf30c0c8
jg 0x14000c38c
cmp eax, 0x5c35518
jg 0x14000c502
cmp eax, 0xfbdc8b3f
jle 0x14000c772
cmp eax, 0xfd274ae5
jle 0x14000cbf1
cmp eax, 0xfd274ae6
je 0x14000d386
cmp eax, 0xb486c9
je 0x14000d39c
cmp eax, 0x3e8521e
jne 0x14000c00d
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, dword [rbp + 0x12c]
mov eax, 0x8684b94b
jmp 0x14000c00d
cmp eax, 0xa85044ca
jg 0x14000c552
cmp eax, 0xa35b02e2
jle 0x14000c7ac
cmp eax, 0xa69f5b3c
jle 0x14000cc3a
cmp eax, 0xa69f5b3d
je 0x14000d3ec
cmp eax, 0xa7125398
je 0x14000d40a
cmp eax, 0xa7d585fd
jne 0x14000c00d
cmp qword [rbp + 0xa8], 0
mov eax, 0xd5a61c58
mov ecx, 0x3e7dc76e
cmovne eax, ecx
cmp byte [rbp + 0x10f], 0
mov ecx, 0xd5a61c58
cmove eax, ecx
jmp 0x14000c00d
cmp eax, 0x65e226c7
jg 0x14000c5a7
cmp eax, 0x5c7ae739
jle 0x14000c7d7
cmp eax, 0x5dd285ed
jle 0x14000cca9
cmp eax, 0x5dd285ee
je 0x14000d41b
cmp eax, 0x62989d44
je 0x14000d439
cmp eax, 0x648c8b66
jne 0x14000c00d
cmp byte [rbp + 0x117], 0
mov eax, 0x4f955101
mov ecx, 0x2b93f6c3
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0xe2e1b997
jg 0x14000c5f2
cmp eax, 0xdee171ce
jle 0x14000c80a
cmp eax, 0xdfec11ad
jle 0x14000ccf6
cmp eax, 0xdfec11ae
je 0x14000d457
cmp eax, 0xe24d3076
je 0x14000d461
cmp eax, 0xe2d4be9b
jne 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.___MmUnloadedDrivers_Cleaned:
call fcn.140004ca0
add rsp, 0x20
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
mov rcx, rax
call fcn.140004ca0
add rsp, 0x20
mov qword [rbp - 0x70], rax
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa1f21b01
mov ecx, 0xbe6f5fb3
jmp 0x14000c000
cmp eax, 0x23b61d34
jg 0x14000c657
cmp eax, 0x18e1ba8d
jle 0x14000c835
cmp eax, 0x1fdca2d4
jle 0x14000cd16
cmp eax, 0x1fdca2d5
je 0x14000d473
cmp eax, 0x20e858ee
je 0x14000d495
cmp eax, 0x22e9e9f3
jne 0x14000c00d
cmp dword [rbp + 0xa0], 0
mov eax, 0xdee171cf
mov ecx, 0xa69f5b3d
cmove eax, ecx
jmp 0x14000c00d
cmp eax, 0x91da5f26
jle 0x14000c86a
cmp eax, 0x93cf58cd
jle 0x14000cd5c
cmp eax, 0x93cf58ce
je 0x14000d4ab
cmp eax, 0x98e94a92
je 0x14000d51b
cmp eax, 0x9b95a715
jne 0x14000c00d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rbp - 0x58]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov eax, eax
mov rcx, qword [rbp - 0x48]
cmp rcx, rax
mov eax, 0x5a7d3a1f
mov ecx, 0x8ad63f6f
cmove eax, ecx
jmp 0x14000c00d
cmp eax, 0x51fa2258
jle 0x14000c8a7
cmp eax, 0x54119f91
jle 0x14000cd8b
cmp eax, 0x54119f92
je 0x14000d552
cmp eax, 0x552ca758
je 0x14000d5af
cmp eax, 0x56215073
jne 0x14000c00d
mov eax, 0x62989d44
jmp 0x14000c00d
cmp eax, 0xd00da935
jle 0x14000c91b
cmp eax, 0xd5bab4ce
jle 0x14000cdbf
cmp eax, 0xd5bab4cf
je 0x14000d5cd
cmp eax, 0xd60e5d00
je 0x14000d5e6
cmp eax, 0xd65163e5
jne 0x14000c00d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe8], rax
mov eax, dword [rbp + 0xa4]
mov dword [rbp + 0xb8], eax
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xde886b61
mov ecx, 0x1e285368
jmp 0x14000c000
cmp eax, 0xbae9c27
jle 0x14000c9db
cmp eax, 0xc8ed187
jle 0x14000cdf3
cmp eax, 0xc8ed188
je 0x14000d5ff
cmp eax, 0xd85059d
je 0x14000d609
cmp eax, 0xf23948e
jne 0x14000c00d
cmp byte [rbp + 0x112], 0
mov eax, 0xe2e1b998
mov ecx, 0xa5f3dd18
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0xada4bfa9
jle 0x14000ca29
cmp eax, 0xae543391
jle 0x14000ce22
cmp eax, 0xae543392
je 0x14000d627
cmp eax, 0xb1d48fc5
je 0x14000d631
cmp eax, 0xb409f141
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfbdc8b40
mov ecx, 0x10f3d98d
jmp 0x14000c000
cmp eax, 0x729215a3
jle 0x14000ca5e
cmp eax, 0x7667a44d
jle 0x14000ce4a
cmp eax, 0x7667a44e
je 0x14000d65a
cmp eax, 0x7a0c6224
je 0x14000d678
cmp eax, 0x7f971940
jne 0x14000c00d
mov eax, 0x65e226c8
mov dword [rbp + 0xcc], 0
jmp 0x14000c00d
cmp eax, 0xed81fdee
jle 0x14000ca9d
cmp eax, 0xf068d225
jle 0x14000ce76
cmp eax, 0xf068d226
je 0x14000d6ae
cmp eax, 0xf19fa81f
je 0x14000d6b8
cmp eax, 0xf37e8018
jne 0x14000c00d
mov rdx, qword [rbp - 8]
mov r8d, dword [rbp + 0x2c]
sub rsp, 0x20
mov ecx, 0x40
lea r9, [rbp + 0x100]
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp + 0x28], eax
mov eax, 0x84bef17a
jmp 0x14000c00d
cmp eax, 0x35af618a
jle 0x14000cadc
cmp eax, 0x3b95e247
jle 0x14000ce96
cmp eax, 0x3b95e248
je 0x14000d6d6
cmp eax, 0x3c5b6068
jne 0x14000e9c5
cmp byte [rbp + 0x116], 0
mov eax, 0xda73ab4a
mov ecx, 0xd60e5d00
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0x832bcc04
jg 0x14000ceb6
cmp eax, 0x8100c15a
je 0x14000d6ec
cmp eax, 0x82509335
jne 0x14000c00d
mov rax, qword [rbp + 0x68]
mov dword [rbp + 0x12c], eax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x30], rax
mov eax, dword [rbp + 0x12c]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
cmp rcx, qword [rax]
mov eax, 0xae394ced
mov ecx, 0x4b6ea151
cmovb eax, ecx
jmp 0x14000c00d
cmp eax, 0x41294455
jg 0x14000cf09
cmp eax, 0x3d6fa98e
je 0x14000d29b
cmp eax, 0x3e7dc76e
jne 0x14000c00d
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xb0]
movups xmmword [rax], xmm6
mov eax, 0x6c8945a9
jmp 0x14000c00d
cmp eax, 0xbdf3c665
jg 0x14000cf45
cmp eax, 0xb5fe8b92
je 0x14000d713
cmp eax, 0xb666525c
jne 0x14000c00d
mov eax, 0x1fdca2d5
mov dword [rbp + 0xbc], 6
jmp 0x14000dc1c
cmp eax, 0xf6fa9330
jg 0x14000cf65
cmp eax, 0xf3892dd5
je 0x14000d76b
cmp eax, 0xf5dc7cf6
jne 0x14000c00d
mov eax, dword [rbp + 0x24]
mov qword [rbp + 0x68], rax
mov eax, 0x82509335
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 0x10], rcx
jmp 0x14000c00d
cmp eax, 0xa1b1b397
jg 0x14000cf99
cmp eax, 0x9ef8a0f4
je 0x14000d789
cmp eax, 0xa0db5614
jne 0x14000c00d
mov eax, 0xc02c23b1
jmp 0x14000c00d
cmp eax, 0x5a7d3a1e
jg 0x14000cfe8
cmp eax, 0x58834848
je 0x14000d7f1
cmp eax, 0x59f51c2d
jne 0x14000c00d
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x60], rax
mov eax, 0x91f7bf8
jmp 0x14000c00d
cmp eax, 0xdd2a4250
jg 0x14000d008
cmp eax, 0xda73ab4a
je 0x14000d80f
cmp eax, 0xdafd679a
jne 0x14000c00d
mov eax, 0xf3892dd5
jmp 0x14000c00d
cmp eax, 0x122f54e0
jg 0x14000d02e
cmp eax, 0xf30c0c9
je 0x14000d82d
cmp eax, 0x10f3d98d
jne 0x14000c00d
mov eax, 0xf6fa9331
mov dword [rbp + 0xc8], 0
jmp 0x14000c00d
cmp eax, 0x8b7c47fb
jg 0x14000d062
cmp eax, 0x88621daa
je 0x14000d84b
cmp eax, 0x8ad63f6f
jne 0x14000c00d
mov rax, qword [rbp - 0x50]
cmp rax, qword [rbp + 0xf0]
sete byte [rbp + 0x114]
mov eax, 0xc18baa3
jmp 0x14000c00d
cmp eax, 0x4f955100
jg 0x14000d096
cmp eax, 0x4ee4052d
je 0x14000d869
cmp eax, 0x4ee63379
jne 0x14000c00d
mov r12, qword [rbp - 0x68]
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop dword [rax]
cmp eax, 0xc0fc0ab9
je 0x14000d8b1
cmp eax, 0xe5460450
jne 0x14000c8f0
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000c8f0
cmp eax, 0xcd7dc139
jg 0x14000d0df
cmp eax, 0xcb6636be
je 0x14000d9c9
cmp eax, 0xccff84db
jne 0x14000c00d
mov al, byte [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
cmp byte [rbp + 0x10d], 0
mov rax, 0xffffffffffffffff
cmovne rcx, rax
sub rsp, 0x20
call fcn.1400a7060
add rsp, 0x20
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x80]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x88]
movzx r8d, word [rax]
add r8, 2
mov rcx, qword [rbp + 0x80]
sub rsp, 0x20
xor edx, edx
call fcn.1400b2950
add rsp, 0x20
mov rax, qword [rbp + 0x88]
movzx r9d, word [rax]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + 8]
mov rdx, qword [rbp + 0x80]
sub rsp, 0x20
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
test al, al
mov eax, 0x23b61d35
mov ecx, 0x4ee4052d
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0x85ab566
jg 0x14000d0ff
cmp eax, 0x5c35519
je 0x14000d9f2
cmp eax, 0x5cc9ea4
jne 0x14000c00d
movzx eax, word [rbp + 0xfe]
and eax, 0xfffffffe
add rax, 2
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x20], 0
mov rax, qword [rbp - 0x28]
mov al, byte [rbp - 0x20]
mov byte [rbp + 0x10d], al
mov eax, 0xccff84db
jmp 0x14000c00d
cmp eax, 0xab62cfb7
jg 0x14000d131
cmp eax, 0xa85044cb
je 0x14000da0b
cmp eax, 0xa9b69549
jne 0x14000c00d
mov eax, 0x2e917a6e
mov dword [rbp + 0xc0], 0
jmp 0x14000c00d
cmp eax, 0x6bcdbf51
jg 0x14000d1bb
cmp eax, 0x65e226c8
je 0x14000da15
cmp eax, 0x685e8964
jne 0x14000c00d
mov rcx, qword [rbp + 0x80]
sub rsp, 0x20
call fcn.1400a7080
add rsp, 0x20
mov eax, 0x860d5fbf
jmp 0x14000c00d
cmp eax, 0xe910ed59
jg 0x14000d1ef
cmp eax, 0xe2e1b998
je 0x14000da45
cmp eax, 0xe898c15e
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xae543392
mov ecx, 0x93770c3f
jmp 0x14000c000
cmp eax, 0x2e917a6d
jg 0x14000d21f
cmp eax, 0x23b61d35
je 0x14000daab
cmp eax, 0x2b93f6c3
jne 0x14000c00d
mov rcx, qword [rbp + 0xe8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
mov edx, dword [rbp + 0x100]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x100]
mov dword [rbp + 0x2c], eax
mov eax, 0xf37e8018
jmp 0x14000c00d
cmp eax, 0x84bef17a
je 0x14000db1b
cmp eax, 0x860d5fbf
jne 0x14000c00d
mov eax, 0xe24d3076
jmp 0x14000c00d
cmp eax, 0x48e6ef1a
je 0x14000db39
cmp eax, 0x48fae4b7
jne 0x14000c00d
sub rsp, 0x20
mov ecx, 0x40
xor edx, edx
xor r8d, r8d
lea r9, [rbp + 0x100]
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp + 0xa4], eax
mov eax, 0xd65163e5
xor ecx, ecx
mov qword [rbp + 0x18], rcx
jmp 0x14000c00d
cmp eax, 0xc02c23b1
je 0x14000db5e
cmp eax, 0xc95fa015
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3a0b3177
mov ecx, 0xd5bab4cf
jmp 0x14000c000
cmp eax, 0xfbdc8b40
je 0x14000db7c
cmp eax, 0xfbf62dc5
jne 0x14000c00d
mov eax, dword [rbp + 0xd0]
and al, 1
mov byte [rbp + 0x109], al
mov rax, qword [rbp + 0x90]
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdd2a4251
mov ecx, 0xd85059d
jmp 0x14000c000
cmp eax, 0xa35b02e3
je 0x14000db86
cmp eax, 0xa5f3dd18
jne 0x14000c00d
lea rax, [rbp + 0x58]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x58], 0
mov r8, qword [rbp + 0x98]
add r8, 8
mov rdx, qword [rbp + 0x40]
sub rsp, 0x20
mov r9d, 8
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
mov byte [rbp + 0x111], al
cmp qword [rbp + 0x58], 0
setne byte [rbp + 0x110]
mov eax, 0x122f54e1
jmp 0x14000c00d
cmp eax, 0x5c7ae73a
je 0x14000bfdc
cmp eax, 0x5cf9bfe0
jne 0x14000c00d
mov eax, 0x10
call fcn.1400a7470
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x100]
mov qword [rbp], rax
mov rax, qword [rbp]
mov dword [rbp + 0x100], 0
mov eax, 0x48fae4b7
jmp 0x14000c00d
cmp eax, 0xdee171cf
je 0x14000db90
cmp eax, 0xdf71c405
jne 0x14000c00d
mov eax, 0x7f971940
jmp 0x14000c00d
cmp eax, 0x18e1ba8e
je 0x14000dba2
cmp eax, 0x1e285368
jne 0x14000c00d
mov eax, dword [rbp + 0xb8]
cmp eax, 0xc0000004
sete byte [rbp + 0x117]
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xde886b61
mov ecx, 0x648c8b66
jmp 0x14000c000
cmp eax, 0x91da5f27
je 0x14000dbf2
cmp eax, 0x93770c3f
jne 0x14000c00d
cmp byte [rbp + 0x10c], 0
mov eax, 0x2f2d59c0
mov ecx, 0x35af618b
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0x51fa2259
je 0x14000dc0d
cmp eax, 0x535d723e
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xed81fdef
mov ecx, 0x91da5f27
jmp 0x14000c000
cmp eax, 0xd00da936
je 0x14000d29b
cmp eax, 0xd5a61c58
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xacc73577
mov ecx, 0xbae9c28
jmp 0x14000c000
cmp eax, 0xbae9c28
je 0x14000dc29
cmp eax, 0xc18baa3
jne 0x14000c00d
cmp byte [rbp + 0x114], 0
mov eax, 0x51fa2259
mov ecx, 0x59f51c2d
cmovne eax, ecx
jmp 0x14000c00d
cmp eax, 0xada4bfaa
je 0x14000dc9b
cmp eax, 0xae394ced
jne 0x14000c00d
mov eax, 0xcb6636be
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 8], rcx
jmp 0x14000c00d
cmp eax, 0x729215a4
je 0x14000dcb9
cmp eax, 0x75602c58
jne 0x14000c00d
mov eax, 0x82509335
xor ecx, ecx
mov qword [rbp + 0x68], rcx
xor ecx, ecx
mov qword [rbp + 0x10], rcx
jmp 0x14000c00d
cmp eax, 0xed81fdef
je 0x14000dd03
cmp eax, 0xede0641f
jne 0x14000c00d
mov eax, 0x552ca758
jmp 0x14000c00d
cmp eax, 0x35af618b
je 0x14000dd0d
cmp eax, 0x3a0b3177
jne 0x14000c00d
mov eax, 0xc95fa015
jmp 0x14000c00d
cmp eax, 0x832bcc05
je 0x14000dd2b
cmp eax, 0x849a9ead
jne 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_driver_name
call fcn.140004ca0
add rsp, 0x20
mov qword [rbp - 0x68], rax
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x48e6ef1a
mov ecx, 0x8b7c47fc
jmp 0x14000c000
cmp eax, 0x41294456
je 0x14000dd3f
cmp eax, 0x47e5bd6d
jne 0x14000c00d
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movzx eax, word [rax]
mov word [rbp + 0xfe], ax
mov eax, 0xe9a058af
jmp 0x14000c00d
cmp eax, 0xbdf3c666
je 0x14000dd5d
cmp eax, 0xbe6f5fb3
jne 0x14000c00d
mov eax, 0xb5fe8b92
jmp 0x14000c00d
cmp eax, 0xf6fa9331
je 0x14000dd67
cmp eax, 0xf77a9097
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa35b02e3
mov ecx, 0x3b95e248
jmp 0x14000c000
cmp eax, 0xa1b1b398
je 0x14000dd81
cmp eax, 0xa1f21b01
jne 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.___MmUnloadedDrivers_Cleaned:
call fcn.140004ca0
add rsp, 0x20
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
mov rcx, rax
call fcn.140004ca0
add rsp, 0x20
mov eax, 0xe2d4be9b
jmp 0x14000c00d
cmp eax, 0x5a7d3a1f
je 0x14000dd98
cmp eax, 0x5bdcbb82
jne 0x14000c00d
mov eax, 0xada4bfaa
jmp 0x14000c00d
cmp eax, 0xdd2a4251
je 0x14000ddb6
cmp eax, 0xde886b61
jne 0x14000c00d
mov eax, dword [rbp + 0xb8]
mov eax, 0x1e285368
jmp 0x14000c00d
cmp eax, 0x122f54e1
je 0x14000ddc0
cmp eax, 0x15358a24
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x56215073
mov ecx, 0x62989d44
jmp 0x14000c000
cmp eax, 0x8b7c47fc
je 0x14000dde9
cmp eax, 0x90c6d3f0
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdfec11ae
mov ecx, 0xbdf3c666
jmp 0x14000c000
cmp eax, 0x4f955101
je 0x14000ddf3
cmp eax, 0x4fa25ff3
jne 0x14000c00d
mov eax, dword [rbp + 0xd4]
and al, 1
mov byte [rbp + 0x10b], al
mov rax, qword [rbp + 0xb0]
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa35b02e3
mov ecx, 0xf77a9097
jmp 0x14000c000
cmp eax, 0xcd7dc13a
je 0x14000de0b
cmp eax, 0xcfbf5b4d
jne 0x14000c00d
mov eax, 0xf5dc7cf6
jmp 0x14000c00d
cmp eax, 0x85ab567
je 0x14000de21
cmp eax, 0x91f7bf8
jne 0x14000c00d
mov eax, 0x1fdca2d5
mov dword [rbp + 0xbc], 4
mov rcx, qword [rbp - 0x60]
mov qword [rbp + 0x60], rcx
jmp 0x14000c00d
cmp eax, 0xab62cfb8
je 0x14000de3f
cmp eax, 0xacc73577
jne 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_driver_section
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0xc0fc0ab9
je 0x14000de53
cmp eax, 0xe5460450
jne 0x14000d190
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000d190
cmp eax, 0x6bcdbf52
je 0x14000df69
cmp eax, 0x6c8945a9
jne 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a0c6224
mov ecx, 0xb486c9
jmp 0x14000c000
cmp eax, 0xe910ed5a
je 0x14000dfdb
cmp eax, 0xe9a058af
jne 0x14000c00d
cmp word [rbp + 0xfe], 0
mov eax, 0x5cc9ea4
mov ecx, 0x4b41ce58
cmove eax, ecx
jmp 0x14000c00d
cmp eax, 0x2e917a6e
je 0x14000dfe5
cmp eax, 0x2f2d59c0
jne 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_write_driver_name_length
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
cmp eax, 0xc0fc0ab9
je 0x14000e015
cmp eax, 0xe5460450
jne 0x14000d270
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000d270
mov eax, 0x20e858ee
mov dword [rbp + 0xe4], 0
jmp 0x14000c00d
mov eax, dword [rbp + 0x12c]
add eax, 1
mov dword [rbp + 0x24], eax
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e8521e
mov ecx, 0xcfbf5b4d
jmp 0x14000c000
mov al, byte [rbp + 0x108]
mov dword [rbp + 0xc0], eax
mov eax, 0x2e917a6e
jmp 0x14000c00d
lea rax, [rbp + 0x98]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov eax, 0x5dd285ee
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x48e6ef1a
mov ecx, 0x849a9ead
jmp 0x14000c000
mov rcx, qword [rbp + 0xe8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
mov rax, qword [rbp + 0xd8]
mov eax, 0x729215a4
jmp 0x14000c00d
mov eax, dword [rbp + 0xc4]
and al, 1
mov byte [rbp + 0x108], al
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe910ed5a
mov ecx, 0x85ab567
jmp 0x14000c000
mov al, byte [rbp + 0x109]
mov dword [rbp + 0xc4], eax
mov eax, 0xca663563
jmp 0x14000c00d
mov r8, qword [rbp + 0xa8]
add r8, 0x58
mov rdx, qword [rbp + 0xb0]
sub rsp, 0x20
mov r9d, 0x10
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
mov byte [rbp + 0x10e], al
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a0c6224
mov ecx, 0x5c35519
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e8521e
mov ecx, 0x8684b94b
jmp 0x14000c000
mov rax, qword [rbp + 0xe8]
mov eax, 0xb1d48fc5
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x54119f92
mov ecx, 0x9ef8a0f4
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x56215073
mov ecx, 0x832bcc05
jmp 0x14000c000
mov eax, 0x90c6d3f0
jmp 0x14000c00d
mov al, 1
mov dword [rbp + 0xe4], eax
mov eax, 0x20e858ee
jmp 0x14000c00d
mov eax, dword [rbp + 0xbc]
mov dword [rbp + 0xa0], eax
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x48]
mov eax, 0xcb58158d
jmp 0x14000c00d
mov eax, dword [rbp + 0xe4]
mov dword [rbp + 0xd4], eax
mov eax, 0x4fa25ff3
jmp 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_driver_object
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop word cs:[rax + rax]
cmp eax, 0xc0fc0ab9
je 0x14000e129
cmp eax, 0xe5460450
jne 0x14000d4f0
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000d4f0
cmp qword [rbp + 0xe8], 0
sete al
or al, byte [rbp + 0x12b]
and al, 1
mov byte [rbp + 0x116], al
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa1b1b398
mov ecx, 0xa85044cb
jmp 0x14000c000
mov qword [rbp + 0x98], 0
mov rax, qword [rbp + 0xd8]
mov rax, qword [rbp + 0xd8]
mov rax, qword [rbp + 0xd8]
mov rax, qword [rbp + 0xd8]
mov r8, qword [rbp + 0xd8]
add r8, 8
mov rdx, qword [rbp + 0x90]
sub rsp, 0x20
mov r9d, 8
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
mov eax, 0x9ef8a0f4
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xede0641f
mov ecx, 0xab62cfb8
jmp 0x14000c000
cmp byte [rbp + 0x115], 0
mov eax, 0xa9b69549
mov ecx, 0x8100c15a
cmovne eax, ecx
jmp 0x14000c00d
cmp qword [rbp + 0xe8], 0
setne byte [rbp + 0x115]
mov eax, 0x58834848
jmp 0x14000c00d
mov eax, 0x75602c58
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdd2a4251
mov ecx, 0xfd274ae6
jmp 0x14000c000
mov eax, 0xe898c15e
jmp 0x14000c00d
mov rax, qword [rbp + 0xe8]
mov qword [rbp - 0x10], rax
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa7125398
mov ecx, 0xc8ed188
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xfbdc8b40
mov ecx, 0xb409f141
jmp 0x14000c000
mov r8, qword [rbp + 0xa8]
add r8, 0x58
mov rdx, qword [rbp + 0xb0]
sub rsp, 0x20
mov r9d, 0x10
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
mov eax, 0xb486c9
jmp 0x14000c00d
mov eax, 0x7667a44e
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xae543392
mov ecx, 0xe898c15e
jmp 0x14000c000
mov al, byte [rbp + 0x10b]
mov dword [rbp + 0xcc], eax
mov eax, 0x65e226c8
jmp 0x14000c00d
mov rcx, qword [rbp + 0xe8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
mov eax, 0xf30c0c9
jmp 0x14000c00d
mov r12, qword [rbp - 0x70]
mov qword [rbp + 0x138], r12
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop word cs:[rax + rax]
nop
cmp eax, 0xc0fc0ab9
je 0x14000e239
cmp eax, 0xe5460450
jne 0x14000d740
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000d740
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdafd679a
mov ecx, 0xcd7dc13a
jmp 0x14000c000
mov qword [rbp + 0x98], 0
mov r8, qword [rbp + 0xd8]
add r8, 8
mov rdx, qword [rbp + 0x90]
sub rsp, 0x20
mov r9d, 8
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
cmp qword [rbp + 0x98], 0
setne cl
and cl, al
mov byte [rbp + 0x112], cl
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x54119f92
mov ecx, 0xf23948e
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3a0b3177
mov ecx, 0xc95fa015
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa7125398
mov ecx, 0xb1d48fc5
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdfec11ae
mov ecx, 0x90c6d3f0
jmp 0x14000c000
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa1b1b398
mov ecx, 0x98e94a92
jmp 0x14000c000
mov rax, qword [rbp + 0x88]
mov word [rax], 0
mov rdx, qword [rbp + 0xa8]
add rdx, 0x58
mov r8, qword [rbp + 0xb0]
sub rsp, 0x20
mov r9d, 0x10
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
mov byte [rbp + 0x10c], al
mov eax, 0xf19fa81f
jmp 0x14000c00d
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop word [rax + rax]
cmp edi, 0xcc7f689
jle 0x14000d930
cmp edi, 0xcc7f68a
je 0x14000d961
cmp edi, 0x4b35f358
je 0x14000d989
cmp edi, 0x61d31457
jne 0x14000d8f0
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000d8f0
cmp edi, 0xa5b66e03
je 0x14000e789
cmp edi, 0xbc232777
jne 0x14000d8f0
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000d8f0
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000d8f0
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000d8f0
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc9c4f890
mov ecx, 0x729215a4
jmp 0x14000c000
cmp byte [rbp + 0x10e], 0
mov eax, 0x4b41ce58
mov ecx, 0x47e5bd6d
cmovne eax, ecx
jmp 0x14000c00d
mov eax, 0x3c5b6068
jmp 0x14000c00d
mov eax, dword [rbp + 0xcc]
and al, 1
mov byte [rbp + 0x10a], al
mov rax, qword [rbp + 0x38]
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdafd679a
mov ecx, 0xf3892dd5
jmp 0x14000c000
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_device_object
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
cmp eax, 0xc0fc0ab9
je 0x14000e349
cmp eax, 0xe5460450
jne 0x14000da80
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000da80
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_read_driver_name
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop word cs:[rax + rax]
cmp eax, 0xc0fc0ab9
je 0x14000e459
cmp eax, 0xe5460450
jne 0x14000daf0
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000daf0
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xed81fdef
mov ecx, 0x535d723e
jmp 0x14000c000
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_driver_name
call fcn.140004ca0
add rsp, 0x20
mov eax, 0x849a9ead
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0db5614
mov ecx, 0x3c2fa054
jmp 0x14000c000
mov eax, 0xb409f141
jmp 0x14000c00d
mov eax, 0xf77a9097
jmp 0x14000c00d
mov eax, 0xcb6636be
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 8], rcx
jmp 0x14000c00d
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0xa8], 0
mov r8, qword [rbp + 0x58]
add r8, 0x28
mov rdx, qword [rbp + 0x38]
sub rsp, 0x20
mov r9d, 8
mov rcx, qword [rbp + 0xf0]
call fcn.14000fa90
add rsp, 0x20
mov byte [rbp + 0x10f], al
mov eax, 0xa7d585fd
jmp 0x14000c00d
mov rax, qword [rbp - 8]
mov qword [rbp + 0x18], rax
mov eax, 0xd65163e5
mov ecx, dword [rbp + 0x28]
mov dword [rbp + 0xa4], ecx
jmp 0x14000c00d
mov eax, 0x1fdca2d5
mov dword [rbp + 0xbc], 0
mov rcx, qword [rbp + 0x30]
mov qword [rbp + 0x60], rcx
jmp 0x14000c00d
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_driver_section
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop word cs:[rax + rax]
nop
cmp eax, 0xc0fc0ab9
je 0x14000e569
cmp eax, 0xe5460450
jne 0x14000dc70
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000dc70
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5bdcbb82
mov ecx, 0xb666525c
jmp 0x14000c000
mov rcx, qword [rbp + 0xe8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
cmp qword [rbp + 0xd8], 0
setne byte [rbp + 0x113]
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc9c4f890
mov ecx, 0x87f6dc92
jmp 0x14000c000
mov eax, 0x535d723e
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa1f21b01
mov ecx, 0xe2d4be9b
jmp 0x14000c000
mov eax, 0xca663563
mov dword [rbp + 0xc4], 0
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6bcdbf52
mov ecx, 0x93cf58ce
jmp 0x14000c000
mov eax, 0xa9b69549
jmp 0x14000c00d
mov rax, qword [rbp + 0x40]
mov eax, dword [rbp + 0xc8]
mov dword [rbp + 0xd0], eax
mov eax, 0xfbf62dc5
jmp 0x14000c00d
mov rax, qword [rbp + 0xe8]
mov al, byte [rbp + 0x12b]
mov eax, 0x98e94a92
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5bdcbb82
mov ecx, 0xada4bfaa
jmp 0x14000c000
mov eax, 0xd85059d
jmp 0x14000c00d
mov cl, byte [rbp + 0x111]
cmp byte [rbp + 0x110], 0
mov eax, 0x41294456
mov edx, 0x18e1ba8e
cmovne eax, edx
test cl, cl
mov ecx, 0x41294456
cmove eax, ecx
jmp 0x14000c00d
mov eax, 0x4ee63379
jmp 0x14000c00d
cmp dword [rbp + 0xb8], 0
sets byte [rbp + 0x12b]
mov eax, 0x88621daa
jmp 0x14000c00d
mov al, byte [rbp + 0x10a]
mov dword [rbp + 0xc8], eax
mov eax, 0xf6fa9331
jmp 0x14000c00d
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe910ed5a
mov ecx, 0x8702cfa0
jmp 0x14000c000
mov eax, 0xfbf62dc5
mov dword [rbp + 0xd0], 0
jmp 0x14000c00d
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop dword [rax]
cmp edi, 0xcc7f689
jle 0x14000ded0
cmp edi, 0xcc7f68a
je 0x14000df01
cmp edi, 0x4b35f358
je 0x14000df29
cmp edi, 0x61d31457
jne 0x14000de90
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000de90
cmp edi, 0xa5b66e03
je 0x14000e7cd
cmp edi, 0xbc232777
jne 0x14000de90
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000de90
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000de90
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000de90
sub rsp, 0x20
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_find_driver_object
call fcn.140004ca0
add rsp, 0x20
mov r12, rax
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x138]
mov rax, qword [rax]
mov qword [rbp + 0x120], rax
mov eax, 0xe5460450
nop word cs:[rax + rax]
nop
cmp eax, 0xc0fc0ab9
je 0x14000e679
cmp eax, 0xe5460450
jne 0x14000dfb0
mov rax, qword [rbp + 0x120]
movsxd rax, dword [rax + 4]
mov qword [rbp + 0x118], rax
mov eax, 0xc0fc0ab9
jmp 0x14000dfb0
mov eax, 0x85ab567
jmp 0x14000c00d
mov eax, dword [rbp + 0xc0]
and al, 1
mov byte [rbp + 0x107], al
mov rax, qword [rbp]
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0db5614
mov ecx, 0xc02c23b1
jmp 0x14000c000
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop dword [rax + rax]
cmp edi, 0xcc7f689
jle 0x14000e090
cmp edi, 0xcc7f68a
je 0x14000e0c1
cmp edi, 0x4b35f358
je 0x14000e0e9
cmp edi, 0x61d31457
jne 0x14000e050
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000e050
cmp edi, 0xa5b66e03
je 0x14000e807
cmp edi, 0xbc232777
jne 0x14000e050
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e050
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000e050
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000e050
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop
cmp edi, 0xcc7f689
jle 0x14000e1a0
cmp edi, 0xcc7f68a
je 0x14000e1d1
cmp edi, 0x4b35f358
je 0x14000e1f9
cmp edi, 0x61d31457
jne 0x14000e160
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000e160
cmp edi, 0xa5b66e03
je 0x14000e841
cmp edi, 0xbc232777
jne 0x14000e160
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e160
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000e160
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000e160
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop
cmp edi, 0xcc7f689
jle 0x14000e2b0
cmp edi, 0xcc7f68a
je 0x14000e2e1
cmp edi, 0x4b35f358
je 0x14000e309
cmp edi, 0x61d31457
jne 0x14000e270
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000e270
cmp edi, 0xa5b66e03
je 0x14000e88f
cmp edi, 0xbc232777
jne 0x14000e270
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e270
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000e270
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000e270
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rdi, rax
mov ebx, 0x61d31457
nop
cmp ebx, 0xcc7f689
jle 0x14000e3c0
cmp ebx, 0xcc7f68a
je 0x14000e3f1
cmp ebx, 0x4b35f358
je 0x14000e419
cmp ebx, 0x61d31457
jne 0x14000e380
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov ebx, 0xcc7f68a
jmp 0x14000e380
cmp ebx, 0xa5b66e03
je 0x14000e8c9
cmp ebx, 0xbc232777
jne 0x14000e380
mov ebx, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rdi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e380
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ebx, 0xbc232777
cmove ebx, r13d
cmp dword [0x140144950], 0xa
cmovl ebx, r13d
jmp 0x14000e380
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rdi
mov dl, 0xa
call rax
add rsp, 0x20
mov esi, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ebx, 0xbc232777
cmove ebx, r14d
cmp dword [0x140144950], 0xa
cmovl ebx, r14d
jmp 0x14000e380
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop
cmp edi, 0xcc7f689
jle 0x14000e4d0
cmp edi, 0xcc7f68a
je 0x14000e501
cmp edi, 0x4b35f358
je 0x14000e529
cmp edi, 0x61d31457
jne 0x14000e490
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000e490
cmp edi, 0xa5b66e03
je 0x14000e903
cmp edi, 0xbc232777
jne 0x14000e490
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e490
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000e490
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000e490
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop
cmp edi, 0xcc7f689
jle 0x14000e5e0
cmp edi, 0xcc7f68a
je 0x14000e611
cmp edi, 0x4b35f358
je 0x14000e639
cmp edi, 0x61d31457
jne 0x14000e5a0
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000e5a0
cmp edi, 0xa5b66e03
je 0x14000e93d
cmp edi, 0xbc232777
jne 0x14000e5a0
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e5a0
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000e5a0
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000e5a0
mov rcx, qword [rbp + 0x138]
add rcx, qword [rbp + 0x118]
sub rsp, 0x20
mov rdx, r15
call fcn.140049e10
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
call fcn.140049ce0
add rsp, 0x20
mov rsi, rax
mov edi, 0x61d31457
nop
cmp edi, 0xcc7f689
jle 0x14000e6f0
cmp edi, 0xcc7f68a
je 0x14000e721
cmp edi, 0x4b35f358
je 0x14000e749
cmp edi, 0x61d31457
jne 0x14000e6b0
mov rax, qword [rsi]
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x130], rax
mov edi, 0xcc7f68a
jmp 0x14000e6b0
cmp edi, 0xa5b66e03
je 0x14000e98b
cmp edi, 0xbc232777
jne 0x14000e6b0
mov edi, 0x4b35f358
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
jmp 0x14000e6b0
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r13d
cmp dword [0x140144950], 0xa
cmovl edi, r13d
jmp 0x14000e6b0
mov rax, qword [rbp + 0x130]
sub rsp, 0x20
mov rcx, rsi
mov dl, 0xa
call rax
add rsp, 0x20
mov ebx, eax
mov eax, dword [0x14014494c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov edi, 0xbc232777
cmove edi, r14d
cmp dword [0x140144950], 0xa
cmovl edi, r14d
jmp 0x14000e6b0
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0x4fa25ff3
mov dword [rbp + 0xd4], 0
jmp 0x14000c00d
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0xbae9c28
jmp 0x14000c00d
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0x3d6fa98e
jmp 0x14000c00d
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6bcdbf52
mov ecx, 0xf068d226
jmp 0x14000c000
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0x685e8964
jmp 0x14000c00d
mov word [rbp + 0x146], si
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0x5c7ae73a
jmp 0x14000c00d
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0xd00da936
jmp 0x14000c00d
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, dword [0x140144994]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xacc73577
mov ecx, 0xdf71c405
jmp 0x14000c000
mov word [rbp + 0x146], bx
movzx esi, word [rbp + 0x146]
sub rsp, 0x20
mov rcx, r15
call fcn.140028840
mov rcx, r12
mov edx, esi
call fcn.140049a30
mov rcx, r12
call fcn.140042df0
add rsp, 0x20
mov eax, 0x93cf58ce
jmp 0x14000c00d
cmp eax, 0x3c2fa054
jne 0x14000c00d
mov al, byte [rbp + 0x107]
movaps xmm6, xmmword [rbp + 0x150]
lea rsp, [rbp + 0x168]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret