Function at 0x140028ca0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
lea rcx, [0x14011f8c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
call fcn.14000b930
mov rsi, rax
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r12b
lea r8d, [r12 + 0x18]
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140028d9c
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140028d9c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028d96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a24c
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140028de1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028ddc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a252
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x28
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140028e9f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140028e9f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028e99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a258
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140028ee4
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028edf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a25e
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140028fa2
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140028fa2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a264
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140028fe7
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028fe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a26a
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400290a5
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400290a5
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002909f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a270
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400290ea
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400290e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a276
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlHashUnicodeString
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400291a8
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400291a8
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400291a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a27c
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400291ed
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400291e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a282
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlUpcaseUnicodeChar
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400292ab
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400292ab
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400292a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a288
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400292f0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400292eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a28e
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400293ae
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400293ae
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400293a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a294
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400293f3
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400293ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a29a
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x17
lea rdx, str.NtSetInformationProcess
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400294b1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400294b1
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400294ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2a0
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400294f6
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400294f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2a6
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400295b4
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400295b4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400295ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2ac
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400295f9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400295f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2b2
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x11
lea rdx, str.NtDuplicateObject
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400296b7
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400296b7
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400296b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2b8
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400296fc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400296f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2be
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtQueryObject
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400297ba
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400297ba
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400297b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2c4
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400297ff
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400297fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2ca
call fcn.14009aa1c
call fcn.14000b930
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtQuerySection
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400298bd
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009740
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a310
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400298bd
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400298b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2d0
call fcn.14009aa1c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029902
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400298fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2d6
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.RtlCreateActivationContext
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002997c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029977
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2dc
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400299f6
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400299f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2e2
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029a70
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029a6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2e8
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x13
lea rdx, str.NtLockVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029aea
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2ee
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtSuspendProcess
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029b64
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2f4
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xf
lea rdx, str.NtResumeProcess
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029bde
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029bd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a2fa
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.RtlImageNtHeader
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029c58
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029c53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a300
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xc
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029cd2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029ccd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a306
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029d4c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029d47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a246
call fcn.14009aa1c
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1c
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029da5
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xb
lea rdx, str.NtOpenEvent
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029dfe
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtCreateEvent
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029e57
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtQueueApcThread
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029eb0
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlEncodeSystemPointer
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029f09
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029f62
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x20
lea rdx, str.NtWow64QueryInformationProcess64
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x140029fbb
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a014
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1b
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a06d
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x15
lea rdx, str.Wow64GetThreadContext
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a0c6
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x15
lea rdx, str.Wow64SetThreadContext
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a11f
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x12
lea rdx, str.Wow64SuspendThread
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a178
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x13
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a1d1
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
call fcn.14000b930
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400286f0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a22a
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009af0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3