Function at 0x140089f20
Capabilities:
Check if file exists
Delete file
Encode data using xor
Enumerate disk volumes
Generate random numbers using a mersenne twister
Move file
Query or enumerate registry value
Set uefi variable
Shutdown system

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
lea rbp, [rsp - 0x1c40]
mov eax, 0x1d40
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x1c30], rax
xor edi, edi
mov qword [rbp - 0x30], rcx
cmp qword [0x140328f28], rdi
xorps xmm0, xmm0
xorps xmm1, xmm1
mov qword [rbp + 0xa0], rdi
movdqu xmmword [rbp + 0x80], xmm0
movdqu xmmword [rbp + 0x90], xmm1
jne 0x140089f9a
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x140089f9a
mov qword [rax], rdi
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
call fcn.1401921e4
mov dword [rbp + 0x5c4], eax
mov edx, 1
mov r9d, 0x270
mov dword [rbp + 0x1944], 0xffffffff
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x5c4], eax
inc rdx
cmp rdx, r9
jb 0x140089fc0
mov dword [rbp + 0x5c0], r9d
lea r8, [rbp + 0x5c8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r8 + 0x62c]
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140089ff0
mov ecx, dword [rbp + 0x5c0]
mov edx, dword [rbp + rcx*4 + 0x5c4]
mov eax, edx
shr eax, 0xb
inc ecx
and eax, dword [rbp + 0x1944]
xor edx, eax
mov dword [rbp + 0x5c0], ecx
mov eax, edx
lea rcx, [rbp + 0x5c0]
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
movzx eax, ax
inc eax
imul eax, eax, 0xa51958c
mov dword [rbp + 0x78], eax
call fcn.1400b7000
shr eax, 0x10
lea rdx, [0x140322de0]
inc eax
lea rcx, [rbp - 0x80]
imul eax, eax, 0xcffd938
mov dword [rbp + 0x7c], eax
call fcn.140040c90
xorps xmm0, xmm0
lea rsi, [0x1403293e8]
xorps xmm1, xmm1
mov r13, 0xffffffffffffffff
movups xmmword [rsp + 0x60], xmm0
mov rbx, rax
mov r8, r13
movdqu xmmword [rsp + 0x70], xmm1
inc r8
cmp byte [rsi + r8], dil
jne 0x14008a0c7
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14003ce50
xorps xmm0, xmm0
lea rdx, str.Uni_ENTG
xorps xmm1, xmm1
lea rcx, [rbp + 0x230]
mov r8d, 8
movups xmmword [rbp + 0x230], xmm0
movdqu xmmword [rbp + 0x240], xmm1
call fcn.14003ce50
mov r9, rbx
mov byte [rsp + 0x20], dil
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x2a0]
call fcn.140052050
call fcn.140077520
lea rdx, [0x140322de0]
lea rcx, [rbp - 0x80]
test al, al
jne 0x14008a185
call fcn.140040c90
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x60], xmm0
mov rbx, rax
mov r8, r13
movdqu xmmword [rsp + 0x70], xmm1
nop dword [rax + rax]
inc r8
cmp byte [rsi + r8], dil
jne 0x14008a160
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14003ce50
mov r8d, 8
lea rdx, str.Uni_ENTG
jmp 0x14008a1c4
call fcn.140040c90
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x60], xmm0
mov rbx, rax
mov r8, r13
movdqu xmmword [rsp + 0x70], xmm1
inc r8
cmp byte [rsi + r8], dil
jne 0x14008a1a1
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14003ce50
mov r8d, 9
lea rdx, str.Uni_TENTG
xorps xmm0, xmm0
lea rcx, [rbp + 0x230]
xorps xmm1, xmm1
movups xmmword [rbp + 0x230], xmm0
movdqu xmmword [rbp + 0x240], xmm1
call fcn.14003ce50
mov r9, rbx
mov byte [rsp + 0x20], dil
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x2f0]
call fcn.140052050
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14008ccd0
lea rcx, [rbp + 0x2f0]
call fcn.140054370
cmp byte [rbp + 0x2a0], dil
jne 0x14008a290
xorps xmm0, xmm0
lea rdx, str.Bypass_Failure
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
mov r8d, send
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.14003ce50
xorps xmm0, xmm0
lea rdx, str.Code:_0x3_:_0x0
xorps xmm1, xmm1
lea rcx, [rbp + 0x230]
mov r8d, reloc.WS2_32.dll_ntohs
movups xmmword [rbp + 0x230], xmm0
movdqu xmmword [rbp + 0x240], xmm1
call fcn.14003ce50
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x230]
call fcn.14003cf90
mov qword [rsp + 0x1d70], r12
lea rcx, [0x1401fded8]
mov qword [rsp + 0x1d78], r14
mov qword [rsp + 0x1d80], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x48], rax
call fcn.140077510
lea rdx, [rbp + 0x2a8]
test al, al
jne 0x14008abf0
lea rcx, [rbp + 0x130]
call fcn.140040c90
mov rcx, rdi
mov r15d, edi
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x200], rcx
xorps xmm0, xmm0
mov qword [rbp + 0x208], rdi
mov r14, rax
movups xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1f0], cl
cmp qword [rax + 0x18], rdi
jbe 0x14008a317
mov rsi, qword [rax]
mov rdx, rsi
mov r8, rsi
jmp 0x14008a320
mov rsi, r14
mov rdx, r14
mov r8, r14
mov r12, qword [rax + 0x10]
add r12, rdx
cmp r8, r12
je 0x14008a3cc
movzx ebx, byte [rsp + 0x40]
movzx r9d, byte [rsi]
cmp r9b, 0x3a
jne 0x14008a36e
test r15d, r15d
je 0x14008a3cc
inc r15d
mov qword [rbp + 0x200], 0
cmp rdi, 0xf
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax], 0
jmp 0x14008a3b1
cmp rcx, rdi
jae 0x14008a39c
lea rax, [rcx + 1]
cmp rdi, 0xf
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008a3b1
movzx r8d, bl
lea rcx, [rbp + 0x1f0]
mov edx, 1
call fcn.1400fe5c0
mov rdi, qword [rbp + 0x208]
inc rsi
cmp rsi, r12
je 0x14008a3cc
mov rcx, qword [rbp + 0x200]
jmp 0x14008a335
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14008a406
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14008a401
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cc0c
mov rcx, r8
call fcn.140190a2c
mov rax, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x1f0]
mov qword [r14 + 0x10], 0
cmp rdi, 0xf
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 1
mov byte [r14], 0
cmova rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14005fa30
mov rdx, qword [rbp + 0x208]
mov rcx, rax
mov rax, qword [rbp + 0x78]
xor rcx, rax
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x80], rcx
cmp rdx, 0xf
jbe 0x14008a49b
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a496
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc0c
call fcn.140190a2c
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x150]
call fcn.140040c90
xor r10d, r10d
mov edi, reloc.WS2_32.dll_ntohs
mov ecx, r10d
mov qword [rbp + 0x208], rdi
xorps xmm0, xmm0
mov qword [rbp + 0x200], rcx
mov r14, rax
mov r15d, r10d
movups xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1f0], cl
cmp qword [rax + 0x18], rdi
jbe 0x14008a4ee
mov rsi, qword [rax]
mov rdx, rsi
mov r8, rsi
jmp 0x14008a4f7
mov rsi, r14
mov rdx, r14
mov r8, r14
mov r12, qword [rax + 0x10]
add r12, rdx
cmp r8, r12
je 0x14008a5a7
movzx ebx, byte [rsp + 0x40]
nop dword [rax]
movzx r9d, byte [rsi]
cmp r9b, 0x3a
jne 0x14008a546
cmp r15d, 1
je 0x14008a5a7
inc r15d
mov qword [rbp + 0x200], r10
cmp rdi, 0xf
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax], 0
jmp 0x14008a58c
cmp rcx, rdi
jae 0x14008a574
lea rax, [rcx + 1]
cmp rdi, 0xf
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008a58c
movzx r8d, bl
lea rcx, [rbp + 0x1f0]
mov edx, 1
call fcn.1400fe5c0
xor r10d, r10d
mov rdi, qword [rbp + 0x208]
inc rsi
cmp rsi, r12
je 0x14008a5a7
mov rcx, qword [rbp + 0x200]
jmp 0x14008a510
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14008a5e1
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14008a5dc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cc12
mov rcx, r8
call fcn.140190a2c
mov rax, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x1f0]
mov qword [r14 + 0x10], 0
cmp rdi, 0xf
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 1
mov byte [r14], 0
cmova rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14005fa30
xor rax, qword [rsp + 0x50]
mov rdx, qword [rbp + 0x208]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x88], rax
cmp rdx, 0xf
jbe 0x14008a66d
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a668
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc12
call fcn.140190a2c
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x170]
call fcn.140040c90
xor r10d, r10d
mov edi, reloc.WS2_32.dll_ntohs
mov ecx, r10d
mov qword [rbp + 0x208], rdi
xorps xmm0, xmm0
mov qword [rbp + 0x200], rcx
mov r14, rax
mov r15d, r10d
movups xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1f0], cl
cmp qword [rax + 0x18], rdi
jbe 0x14008a6c0
mov rsi, qword [rax]
mov rdx, rsi
mov r8, rsi
jmp 0x14008a6c9
mov rsi, r14
mov rdx, r14
mov r8, r14
mov r12, qword [rax + 0x10]
add r12, rdx
cmp r8, r12
je 0x14008a777
movzx ebx, byte [rsp + 0x40]
nop
movzx r9d, byte [rsi]
cmp r9b, 0x3a
jne 0x14008a716
cmp r15d, 2
je 0x14008a777
inc r15d
mov qword [rbp + 0x200], r10
cmp rdi, 0xf
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax], 0
jmp 0x14008a75c
cmp rcx, rdi
jae 0x14008a744
lea rax, [rcx + 1]
cmp rdi, 0xf
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008a75c
movzx r8d, bl
lea rcx, [rbp + 0x1f0]
mov edx, 1
call fcn.1400fe5c0
xor r10d, r10d
mov rdi, qword [rbp + 0x208]
inc rsi
cmp rsi, r12
je 0x14008a777
mov rcx, qword [rbp + 0x200]
jmp 0x14008a6e0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14008a7b1
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14008a7ac
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cc18
mov rcx, r8
call fcn.140190a2c
mov rax, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x1f0]
mov qword [r14 + 0x10], 0
cmp rdi, 0xf
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 1
mov byte [r14], 0
cmova rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14005fa30
xor rax, qword [rsp + 0x50]
mov rdx, qword [rbp + 0x208]
mov qword [rbp - 0x60], rax
mov qword [rbp + 0x90], rax
cmp rdx, 0xf
jbe 0x14008a83c
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008a837
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc18
call fcn.140190a2c
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x190]
call fcn.140040c90
xor r10d, r10d
mov edi, reloc.WS2_32.dll_ntohs
mov ecx, r10d
mov qword [rbp + 0x208], rdi
xorps xmm0, xmm0
mov qword [rbp + 0x200], rcx
mov r14, rax
mov r15d, r10d
movups xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1f0], cl
cmp qword [rax + 0x18], rdi
jbe 0x14008a88f
mov rsi, qword [rax]
mov rdx, rsi
mov r8, rsi
jmp 0x14008a898
mov rsi, r14
mov rdx, r14
mov r8, r14
mov r12, qword [rax + 0x10]
add r12, rdx
cmp r8, r12
je 0x14008a947
movzx ebx, byte [rsp + 0x40]
nop dword [rax]
movzx r9d, byte [rsi]
cmp r9b, 0x3a
jne 0x14008a8e6
cmp r15d, 3
je 0x14008a947
inc r15d
mov qword [rbp + 0x200], r10
cmp rdi, 0xf
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax], 0
jmp 0x14008a92c
cmp rcx, rdi
jae 0x14008a914
lea rax, [rcx + 1]
cmp rdi, 0xf
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008a92c
movzx r8d, bl
lea rcx, [rbp + 0x1f0]
mov edx, 1
call fcn.1400fe5c0
xor r10d, r10d
mov rdi, qword [rbp + 0x208]
inc rsi
cmp rsi, r12
je 0x14008a947
mov rcx, qword [rbp + 0x200]
jmp 0x14008a8b0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14008a981
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14008a97c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cc1e
mov rcx, r8
call fcn.140190a2c
mov rax, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x1f0]
mov qword [r14 + 0x10], 0
cmp rdi, 0xf
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 1
mov byte [r14], 0
cmova rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14005fa30
mov rbx, qword [rsp + 0x50]
mov rcx, rax
mov rdx, qword [rbp + 0x208]
xor rcx, rbx
mov qword [rsp + 0x48], rcx
mov qword [rbp + 0x98], rcx
cmp rdx, 0xf
jbe 0x14008aa18
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008aa0e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc1e
call fcn.140190a2c
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
mov rdi, qword [rbp - 0x60]
cmp qword [rbp + 0x2c0], 0xf
lea rax, [rbp + 0x2a8]
mov rsi, qword [rbp - 0x10]
cmova rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x2b8], 0
mov byte [rax], 0
cmp rsi, rbx
je 0x14008aa5e
cmp rdx, rbx
je 0x14008aa5e
cmp rdi, rbx
je 0x14008aa5e
cmp rcx, rbx
jne 0x14008aac5
xorps xmm0, xmm0
lea rdx, str.Bypass_Failure
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
mov r8d, send
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.14003ce50
xorps xmm0, xmm0
lea rdx, str.Code:_0x3_:_0x1
xorps xmm1, xmm1
lea rcx, [rbp + 0x230]
mov r8d, reloc.WS2_32.dll_ntohs
movups xmmword [rbp + 0x230], xmm0
movdqu xmmword [rbp + 0x240], xmm1
call fcn.14003ce50
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x230]
call fcn.14003cf90
lea rcx, [rbp + 0x5c0]
xor r15b, r15b
call fcn.1400b7000
imul ecx, eax, 0xffffffdf
cmp ecx, 0x20
ja 0x14008aaf4
nop dword [rax]
lea rcx, [rbp + 0x5c0]
call fcn.1400b7000
imul ecx, eax, 0xffffffdf
cmp ecx, 0x21
jb 0x14008aae0
mov rax, rsi
mov edx, 0x1000
xor rax, rbx
mov ecx, 0x200
call rax
mov qword [rbp + 0xa0], rax
test rax, 0xffffff
je 0x14008ab6a
mov r9d, 2
mov qword [rbp + 0x1f0], 0xaaaa
mov r10, rdi
mov qword [rsp + 0x20], rax
xor r10, rbx
lea rcx, [rbp + 0x1f0]
mov rdx, rax
lea r8d, [r9 + 6]
call r10
lea rcx, str.Internal_Data_Valid
call fcn.140041bd0
cmp qword [rbp + 0x1f0], 0xaaaa
je 0x14008ab6a
lea rcx, str.Internals_Successfully_Mapped
mov r15b, 1
call fcn.140041bd0
lea rcx, str.Mapping_Internal_Data
call fcn.140041bd0
mov r14, qword [0x140328f28]
xor ebx, ebx
mov edi, ebx
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r12, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14008b042
lea rbx, [r14 + 0x10]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp + 0x200], xmm0
test rax, rax
je 0x14008b02e
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14008b02e
movzx ecx, byte [rbp + 0x200]
test cl, cl
jne 0x14008afbf
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14008b02e
lea rcx, [rbp + 0x1b0]
call fcn.140040c90
mov rcx, rdi
mov r15d, edi
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x200], rcx
xorps xmm0, xmm0
mov qword [rbp + 0x208], rdi
mov r14, rax
movups xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1f0], cl
cmp qword [rax + 0x18], rdi
jbe 0x14008ac39
mov rsi, qword [rax]
mov rdx, rsi
mov r8, rsi
jmp 0x14008ac42
mov rsi, r14
mov rdx, r14
mov r8, r14
mov r12, qword [rax + 0x10]
add r12, rdx
cmp r8, r12
je 0x14008acf8
movzx ebx, byte [rsp + 0x40]
nop word [rax + rax]
movzx r9d, byte [rsi]
cmp r9b, 0x3a
jne 0x14008ac9a
cmp r15d, 3
je 0x14008acf8
inc r15d
mov qword [rbp + 0x200], 0
cmp rdi, 0xf
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax], 0
jmp 0x14008acdd
cmp rcx, rdi
jae 0x14008acc8
lea rax, [rcx + 1]
cmp rdi, 0xf
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008acdd
movzx r8d, bl
lea rcx, [rbp + 0x1f0]
mov edx, 1
call fcn.1400fe5c0
mov rdi, qword [rbp + 0x208]
inc rsi
cmp rsi, r12
je 0x14008acf8
mov rcx, qword [rbp + 0x200]
jmp 0x14008ac60
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14008ad32
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14008ad2d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cc24
mov rcx, r8
call fcn.140190a2c
mov rax, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x1f0]
mov qword [r14 + 0x10], 0
cmp rdi, 0xf
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 1
mov byte [r14], 0
cmova rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14005fa30
mov rdx, qword [rbp + 0x208]
mov rcx, rax
mov rax, qword [rbp + 0x78]
xor rcx, rax
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x80], rcx
cmp rdx, 0xf
jbe 0x14008adc7
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008adc2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc24
call fcn.140190a2c
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x1d0]
call fcn.140040c90
xor r10d, r10d
mov edi, reloc.WS2_32.dll_ntohs
mov ecx, r10d
mov qword [rbp + 0x208], rdi
xorps xmm0, xmm0
mov qword [rbp + 0x200], rcx
mov r14, rax
mov r15d, r10d
movups xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1f0], cl
cmp qword [rax + 0x18], rdi
jbe 0x14008ae1a
mov rsi, qword [rax]
mov rdx, rsi
mov r8, rsi
jmp 0x14008ae23
mov rsi, r14
mov rdx, r14
mov r8, r14
mov r12, qword [rax + 0x10]
add r12, rdx
cmp r8, r12
je 0x14008aed7
movzx ebx, byte [rsp + 0x40]
nop dword [rax + rax]
movzx r9d, byte [rsi]
cmp r9b, 0x3a
jne 0x14008ae76
cmp r15d, 2
je 0x14008aed7
inc r15d
mov qword [rbp + 0x200], r10
cmp rdi, 0xf
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax], 0
jmp 0x14008aebc
cmp rcx, rdi
jae 0x14008aea4
lea rax, [rcx + 1]
cmp rdi, 0xf
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x1f0]
cmova rax, qword [rbp + 0x1f0]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14008aebc
movzx r8d, bl
lea rcx, [rbp + 0x1f0]
mov edx, 1
call fcn.1400fe5c0
xor r10d, r10d
mov rdi, qword [rbp + 0x208]
inc rsi
cmp rsi, r12
je 0x14008aed7
mov rcx, qword [rbp + 0x200]
jmp 0x14008ae40
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14008af11
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14008af0c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cc2a
mov rcx, r8
call fcn.140190a2c
mov rax, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x1f0]
mov qword [r14 + 0x10], 0
cmp rdi, 0xf
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov r8d, 1
mov byte [r14], 0
cmova rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14005fa30
mov rbx, qword [rsp + 0x50]
mov rdi, rax
mov rdx, qword [rbp + 0x208]
xor rdi, rbx
mov qword [rbp - 0x60], rdi
mov qword [rbp + 0x90], rdi
cmp rdx, 0xf
jbe 0x14008afa2
mov rcx, qword [rbp + 0x1f0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008af9d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc2a
call fcn.140190a2c
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rbp + 0x88]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rdx
jmp 0x14008aa21
cmp cl, 1
jne 0x14008b02e
mov rdx, rax
lea rcx, [rbp + 0x258]
call fcn.140040c90
cmp qword [rbp + 0x270], 0xf
lea rax, [rbp + 0x258]
cmova rax, qword [rbp + 0x258]
mov byte [rax], 0
mov rdx, qword [rbp + 0x270]
cmp rdx, 0xf
jbe 0x14008b02e
mov rcx, qword [rbp + 0x258]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008b029
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc30
call fcn.140190a2c
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x14008aba1
xor ebx, ebx
mov r8, r12
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov qword [0x140328f28], rbx
test r15b, r15b
jne 0x14008cb6c
lea rax, [rbp + 0x1f0]
mov dword [rbp + 0x250], ebx
mov qword [rsp + 0x30], rax
lea r8, str.UEFISecureBootEnabled
lea rax, [rbp + 0x250]
mov dword [rbp + 0x1f0], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov r9d, 0xffff
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
cmp dword [rbp + 0x250], 1
jne 0x14008b125
xorps xmm0, xmm0
lea rdx, str.Bypass_Warning
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
mov r8d, send
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.14003ce50
xorps xmm0, xmm0
lea rdx, str.Product_Requires_System_Secure_Boot_State_to_be_Disabled__n_______________________Please_Disable_and_Re_Inject_
xorps xmm1, xmm1
lea rcx, [rbp + 0x210]
mov r8d, WSAGetLastError
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm1
call fcn.14003ce50
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x210]
call fcn.14003cf90
lea rcx, [rbp + 0x254]
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
test eax, eax
je 0x14008b1a6
cmp dword [rbp + 0x254], 1
jne 0x14008b1a6
xorps xmm0, xmm0
lea rdx, str.Bypass_Warning
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
mov r8d, send
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.14003ce50
xorps xmm0, xmm0
lea rdx, str.____Product_Requires_System_BIOS_Mode_Set_to_UEFI__n_________Please_Switch_and_Re_Attempt_Injection_
xorps xmm1, xmm1
lea rcx, [rbp + 0x210]
mov r8d, 0x63
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm1
call fcn.14003ce50
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x210]
call fcn.14003cf90
cmp qword [0x140328f28], 0
jne 0x14008b1d1
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x14008b1d1
mov qword [rax], rbx
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
xor edx, edx
lea rcx, [rbp + 0x4b0]
mov r8d, 0x110
call fcn.1401d1c40
lea rdx, str.C:WindowsSystem32_ntoskrnl.exe
lea rcx, [rbp + 0x4b0]
call fcn.1400b44b0
cmp qword [rbp + 0x540], 0
jne 0x14008b269
xorps xmm0, xmm0
lea rdx, str.Bypass_Failure
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
mov r8d, send
movups xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x70], xmm1
call fcn.14003ce50
xorps xmm0, xmm0
lea rdx, str.Code:_0x3_:_0x2
xorps xmm1, xmm1
lea rcx, [rbp + 0x210]
mov r8d, reloc.WS2_32.dll_ntohs
movups xmmword [rbp + 0x210], xmm0
movdqu xmmword [rbp + 0x220], xmm1
call fcn.14003ce50
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x210]
call fcn.14003cf90
mov rax, qword [rbp + 0x4b0]
lea r8, [rbp - 0x30]
mov qword [rbp - 0x30], rbx
lea rdx, [rbp + 0x1f0]
mov word [rbp - 0x28], 1
movaps xmm0, xmmword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
mov byte [rbp + 0x1f9], 0
movdqa xmmword [rbp - 0x30], xmm0
mov rax, qword [rbp + rcx + 0x4f8]
lea rcx, [rbp + 0x258]
mov qword [rbp + 0x1f0], rax
test rax, rax
sete byte [rbp + 0x1f8]
movaps xmm1, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp + 0x1f0], xmm1
call fcn.1400bfbe0
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x230]
call fcn.140042c50
lea rcx, [rbp + 0x4c0]
call fcn.1400baff0
test rax, rax
jne 0x14008b330
mov rax, qword [rbp + 0x4b0]
movsxd rcx, dword [rax + 4]
mov eax, 4
cmp qword [rbp + rcx + 0x4f8], 0
mov edx, dword [rbp + rcx + 0x4c4]
cmovne eax, ebx
or eax, dword [rbp + rcx + 0x4c0]
and eax, 0x15
or eax, 2
mov dword [rbp + rcx + 0x4c0], eax
and edx, eax
jne 0x14008cc36
cmp qword [rbp + 0x270], 0xf
lea r8, [rbp + 0x258]
lea rcx, [rbp + 0x258]
cmova r8, qword [rbp + 0x258]
cmova rcx, qword [rbp + 0x258]
movsxd rax, dword [r8 + 0x3c]
add rax, rcx
mov qword [rbp - 0x30], rax
call fcn.140060830
mov r15, rax
test rax, rax
jne 0x14008b623
lea rdx, [0x140322de0]
lea rcx, [rbp - 0x58]
call fcn.140040c90
xorps xmm0, xmm0
lea rdi, [0x1403293e8]
xorps xmm1, xmm1
mov rbx, rax
movups xmmword [rbp - 0x80], xmm0
movdqu xmmword [rbp - 0x70], xmm1
nop dword [rax + rax]
inc r13
cmp byte [rdi + r13], 0
jne 0x14008b3a0
mov r8, r13
lea rcx, [rbp - 0x80]
mov rdx, rdi
call fcn.14003ce50
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x230]
cmp qword [rbp + 0x240], r8
lea rcx, [rbp + 0x210]
xorps xmm0, xmm0
xorps xmm1, xmm1
cmovb r8, qword [rbp + 0x240]
cmp qword [rbp + 0x248], 0xf
movups xmmword [rbp + 0x210], xmm0
cmova rdx, qword [rbp + 0x230]
movdqu xmmword [rbp + 0x220], xmm1
call fcn.14003ce50
mov r9d, 9
lea r8, str.Uni_KIST_
xor edx, edx
lea rcx, [rbp + 0x210]
call fcn.140101720
xorps xmm0, xmm0
lea r8, [rbp - 0x80]
movups xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
xor r13d, r13d
xorps xmm1, xmm1
mov byte [rsp + 0x20], r13b
movdqu xmmword [rsp + 0x70], xmm1
mov r9, rbx
lea rcx, [rbp + 0x2f0]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r13b
call fcn.140052050
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x14008b4b3
mov rcx, qword [rbp + 0x210]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008b4ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc8d
call fcn.140190a2c
movdqa xmm0, xmmword [0x140204db0]
movdqu xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], r13b
cmp byte [rbp + 0x2f0], r13b
jne 0x14008b5f1
cmp dword [rbp + 0x2f4], 0x27
jne 0x14008b5c3
mov rcx, qword [0x140329430]
lea r8, str.Bypass_Failure
mov r9d, 4
lea rdx, str.Unsupported_Version_of_Windows_Detected__nWould_you_like_to_upload_the_unrecognized_files_
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x14008cc93
lea rdx, [0x140322de0]
lea rcx, [rbp - 0x58]
call fcn.140040c90
mov rdx, rdi
lea rcx, [rbp + 0x210]
mov rsi, rax
call fcn.14003ce10
lea rdx, [rbp + 0x258]
mov rdi, rax
lea rcx, [rbp + 0x18]
call fcn.140040c90
mov r9d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x60]
xor r8d, r8d
lea rcx, [rbp + 0x230]
mov rbx, rax
call fcn.1400b8450
mov r8, rax
lea rdx, str.ntoskrnl.exe_
lea rcx, [rbp - 0x80]
call fcn.1400bf270
mov rdx, rax
lea r8, str..dat
lea rcx, [rbp - 8]
call fcn.1400bf120
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call fcn.14005b150
lea rcx, [rbp - 0x80]
call fcn.1400b87b0
lea rcx, [rsp + 0x60]
call fcn.1400b87b0
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Files_Successfully_Uploaded__Please_wait_on_our_team_to_manually_update_
jmp 0x14008b5da
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x3
lea rcx, [rbp - 0x80]
mov rbx, rax
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rcx, [rbp + 0x2f8]
call fcn.140040db0
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0xa]
call fcn.1401ada5c
mov r15, rax
lea rcx, [rbp + 0x2f0]
xor r15, 0x90b584
call fcn.140054370
jmp 0x14008b626
xor r13d, r13d
lea rdx, [rbp + 0x1f0]
mov qword [rbp + 0x1f0], r15
call fcn.1400cdf70
mov r14, qword [0x140328f28]
mov edi, r13d
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r12, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14008b72c
lea rbx, [r14 + 0x10]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp + 0x200], xmm0
test rax, rax
je 0x14008b71a
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14008b71a
movzx ecx, byte [rbp + 0x200]
test cl, cl
jne 0x14008b6ab
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14008b71a
cmp cl, 1
jne 0x14008b71a
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140040c90
cmp qword [rbp + 0x228], 0xf
lea rax, [rbp + 0x210]
cmova rax, qword [rbp + 0x210]
mov byte [rax], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x14008b71a
mov rcx, qword [rbp + 0x210]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008b715
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cc9e
call fcn.140190a2c
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x14008b663
mov r8, r12
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov ecx, 0x26b0
mov qword [0x140328f28], r13
call fcn.1401ab860
test rax, rax
je 0x14008b769
mov qword [rax], r13
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
lea rcx, [rbp + 0x280]
mov byte [rbp + 0x278], 0
call fcn.14003cdb0
call fcn.140077520
lea rdx, [0x140322de0]
lea rcx, [rbp - 0x58]
test al, al
jne 0x14008b7b1
call fcn.140040c90
lea rdx, [0x1403293e8]
mov rdi, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
lea rdx, str.EFI.efi
jmp 0x14008b7d0
call fcn.140040c90
lea rdx, [0x1403293e8]
mov rdi, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
lea rdx, str.TEFI.efi
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.14003ce10
mov r9, rdi
lea rcx, [rbp + 0xa8]
mov r8, rbx
mov rdx, rax
call fcn.14005c730
mov rdx, rax
lea rcx, [rbp + 0x278]
call fcn.14008ce00
lea rcx, [rbp + 0xa8]
call fcn.140058270
cmp byte [rbp + 0x278], 0
jne 0x14008b844
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x4
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rdx, str.V7UHGXCcEZCNULJV
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.WgQR0deoNloq6JgqEkmEy34sBhXrl2Oz
mov rdi, rax
lea rcx, [rsp + 0x60]
call fcn.14003ce10
lea rdx, [rbp + 0x280]
mov rbx, rax
lea rcx, [rbp + 0x210]
call fcn.140040c90
mov r9, rdi
lea rcx, [rbp - 0x80]
mov r8, rbx
mov rdx, rax
call fcn.1400438d0
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.1400b8810
lea rcx, [rbp - 0x80]
call fcn.1400b87b0
lea rcx, [rbp + 0x280]
call fcn.1400b8540
test rax, rax
jne 0x14008b8e7
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x5
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rdx, [0x140322de0]
lea rcx, [rbp - 0x58]
call fcn.140040c90
lea rdx, [0x1403293e8]
mov rdi, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
lea rdx, str.Uni_RPH
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14003ce10
mov r9, rdi
mov byte [rsp + 0x20], 0
mov r8, rbx
lea rcx, [rbp + 0x340]
mov rdx, rax
call fcn.140052050
cmp byte [rbp + 0x340], 0
jne 0x14008b96f
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x6
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rdx, str.Bypass_Warning
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Product_Requires_a_System_Restart__Press__Ok__to_Restart_
mov rdi, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
cmp qword [rdi + 0x18], 0xf
mov rbx, rax
mov r8, rdi
jbe 0x14008b9a2
mov r8, qword [rdi]
cmp qword [rax + 0x18], 0xf
mov rdx, rbx
jbe 0x14008b9af
mov rdx, qword [rax]
mov rcx, qword [0x140329430]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14008b9f9
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14008b9f4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cca4
mov rcx, r8
call fcn.140190a2c
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14008ba42
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14008ba3d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008cca4
mov rcx, r8
call fcn.140190a2c
lea rcx, str.SeShutdownPrivilege
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
call fcn.14003c8a0
lea rcx, str.SeSystemEnvironmentPrivilege
call fcn.14003c8a0
lea rcx, str.mountvol_X:__s
call fcn.1401aeba8
test eax, eax
je 0x14008bb52
xor edx, edx
lea rcx, [rbp + 0x390]
mov r8d, 0x104
xor dil, dil
call fcn.1401d1c40
mov edx, 0x104
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008bb24
nop
lea rdx, [rbp + 0x390]
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
test eax, eax
je 0x14008baea
lea rcx, str.X:EFIBoot_bootx64.efi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x14008bb13
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.efi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x14008bb13
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov r8d, 0x104
lea rdx, [rbp + 0x390]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeA]
test eax, eax
jne 0x14008bab0
jmp 0x14008bb16
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
test dil, dil
jne 0x14008bb52
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x7
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.efi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea rcx, str.X:EFIBoot_bootx64.efi
mov edi, eax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esi, eax
test edi, edi
jne 0x14008bbcc
test eax, eax
jne 0x14008bd42
lea rcx, str.mountvol_X:__d
call fcn.1401aeba8
test eax, eax
je 0x14008bb99
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x8
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
jmp 0x14008bf24
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14008bbfe
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.efi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.X:EFIMicrosoftBoot_bootmgfw.efi
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, str.X:EFIMicrosoftBoot_bootmgfw.bak
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.efi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x14008bc61
lea rcx, str.mountvol_X:__d
call fcn.1401aeba8
test eax, eax
je 0x14008bc33
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x9
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rcx, [rbp + 0x390]
call fcn.140041370
mov r8d, Ordinal_35
lea rdx, str.X:EFIMicrosoftBoot_bootmgfw.efi
lea rcx, [rbp + 0x390]
call fcn.1400b5610
lea rcx, [rbp + 0x390]
call fcn.1400b5600
test al, al
jne 0x14008bcf5
lea rdx, str.X:EFIMicrosoftBoot_bootmgfw.efi
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, str.mountvol_X:__d
call fcn.1401aeba8
test eax, eax
je 0x14008bcc7
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x10
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rcx, [rbp + 0x280]
call fcn.1400b8540
lea rcx, [rbp + 0x280]
mov rbx, rax
call fcn.140040db0
mov rdx, rax
lea rcx, [rbp + 0x3a0]
mov r8, rbx
call fcn.1400b7bd0
lea rcx, [rbp + 0x390]
call fcn.1400b5560
lea rcx, [rbp + 0x390]
call fcn.140041270
test esi, esi
je 0x14008bf24
lea rcx, str.X:EFIBoot_bootx64.bak
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14008bd74
lea rcx, str.X:EFIBoot_bootx64.efi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.X:EFIBoot_bootx64.efi
lea rcx, str.X:EFIBoot_bootx64.bak
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, str.X:EFIBoot_bootx64.bak
lea rcx, str.X:EFIBoot_bootx64.efi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x14008be11
test edi, edi
je 0x14008bdc6
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14008bdc6
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.efi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.X:EFIMicrosoftBoot_bootmgfw.efi
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, str.mountvol_X:__d
call fcn.1401aeba8
test eax, eax
je 0x14008bde3
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x11
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rcx, [rbp + 0x390]
call fcn.140041370
mov r8d, Ordinal_35
lea rdx, str.X:EFIBoot_bootx64.efi
lea rcx, [rbp + 0x390]
call fcn.1400b5610
lea rcx, [rbp + 0x390]
call fcn.1400b5600
test al, al
jne 0x14008bedf
test edi, edi
je 0x14008be80
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x14008be80
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.efi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str.X:EFIMicrosoftBoot_bootmgfw.efi
lea rcx, str.X:EFIMicrosoftBoot_bootmgfw.bak
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rdx, str.X:EFIBoot_bootx64.efi
lea rcx, str.X:EFIBoot_bootx64.bak
call qword [sym.imp.KERNEL32.dll_MoveFileA]
lea rcx, str.mountvol_X:__d
call fcn.1401aeba8
test eax, eax
je 0x14008beb1
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
lea rdx, str.Bypass_Failure
lea rcx, [rbp - 0x58]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x12
mov rbx, rax
lea rcx, [rbp - 0x80]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
lea rcx, [rbp + 0x280]
call fcn.140040db0
lea rcx, [rbp + 0x280]
mov rbx, rax
call fcn.1400b8540
mov r8, rax
lea rcx, [rbp + 0x3a0]
mov rdx, rbx
call fcn.1400b7bd0
lea rcx, [rbp + 0x390]
call fcn.1400b5560
lea rcx, [rbp + 0x390]
call fcn.140041270
xor edx, edx
lea rcx, [rbp + 0x1a58]
mov r8d, 0x1ce
call fcn.1401d1c40
lea rcx, [rbp + 0x5c0]
mov dword [rbp + 0x19d0], 0xffffffff
call fcn.1400b7000
shr eax, 0x10
lea rdx, [rbp + 0x348]
inc eax
mov dword [rbp + 0x1950], 0xaaccaacc
imul r12d, eax, 0x2fc3ead4
lea rcx, [rbp + 0xf0]
mov qword [rbp + 0x1954], r15
mov dword [rbp + 0x19d4], r12d
call fcn.140040c90
mov ecx, reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov rdx, r13
mov byte [rbp + 0x38], 0
mov qword [rbp + 0x48], rdx
mov rsi, rax
mov qword [rbp + 0x50], rcx
mov r14d, r13d
cmp qword [rax + 0x18], rcx
jbe 0x14008bfb7
mov rdi, qword [rax]
mov r8, rdi
mov r9, rdi
jmp 0x14008bfc0
mov rdi, rsi
mov r8, rsi
mov r9, rsi
mov r15, qword [rax + 0x10]
add r15, r8
cmp r9, r15
je 0x14008c042
movzx ebx, byte [rsp + 0x40]
movzx r9d, byte [rdi]
cmp r9b, 0x3a
jne 0x14008bff9
test r14d, r14d
je 0x14008c042
inc r14d
mov qword [rbp + 0x48], r13
cmp rcx, 0xf
lea rax, [rbp + 0x38]
cmova rax, qword [rbp + 0x38]
mov byte [rax], 0
jmp 0x14008c030
cmp rdx, rcx
jae 0x14008c01e
lea rax, [rdx + 1]
cmp rcx, 0xf
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x38]
cmova rax, qword [rbp + 0x38]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], 0
jmp 0x14008c030
movzx r8d, bl
lea rcx, [rbp + 0x38]
mov edx, 1
call fcn.1400fe5c0
inc rdi
cmp rdi, r15
je 0x14008c042
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x48]
jmp 0x14008bfd1
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14008c07c
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14008c077
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008ccaa
mov rcx, r8
call fcn.140190a2c
mov qword [rsi + 0x10], r13
lea rcx, [rbp + 0x38]
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
call fcn.140040db0
mov rdx, rax
xor r9d, r9d
mov r8b, 1
call fcn.1400607a0
lea rcx, [rbp + 0x38]
mov dword [rbp + 0x195c], eax
call fcn.1400b87b0
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0x110]
call fcn.140040c90
mov ecx, reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov rdx, r13
mov byte [rbp + 0x58], 0
mov qword [rbp + 0x68], rdx
mov rsi, rax
mov qword [rbp + 0x70], rcx
mov r14d, r13d
cmp qword [rax + 0x18], rcx
jbe 0x14008c0f6
mov rdi, qword [rax]
mov r8, rdi
mov r9, rdi
jmp 0x14008c0ff
mov rdi, rsi
mov r8, rsi
mov r9, rsi
mov r15, qword [rax + 0x10]
add r15, r8
cmp r9, r15
je 0x14008c182
movzx ebx, byte [rsp + 0x40]
movzx r9d, byte [rdi]
cmp r9b, 0x3a
jne 0x14008c139
cmp r14d, 2
je 0x14008c182
inc r14d
mov qword [rbp + 0x68], r13
cmp rcx, 0xf
lea rax, [rbp + 0x58]
cmova rax, qword [rbp + 0x58]
mov byte [rax], 0
jmp 0x14008c170
cmp rdx, rcx
jae 0x14008c15e
lea rax, [rdx + 1]
cmp rcx, 0xf
mov qword [rbp + 0x68], rax
lea rax, [rbp + 0x58]
cmova rax, qword [rbp + 0x58]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], 0
jmp 0x14008c170
movzx r8d, bl
lea rcx, [rbp + 0x58]
mov edx, 1
call fcn.1400fe5c0
inc rdi
cmp rdi, r15
je 0x14008c182
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x68]
jmp 0x14008c110
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14008c1bc
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14008c1b7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008ccb0
mov rcx, r8
call fcn.140190a2c
mov qword [rsi + 0x10], r13
lea rcx, [rbp + 0x58]
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
call fcn.140040db0
mov rdx, rax
xor r9d, r9d
mov r8b, 1
call fcn.1400607a0
lea rcx, [rbp + 0x58]
mov dword [rbp + 0x1960], eax
call fcn.1400b87b0
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0xd0]
call fcn.140040c90
mov ecx, reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov rdx, r13
mov byte [rbp - 8], 0
mov qword [rbp + 8], rdx
mov rsi, rax
mov qword [rbp + 0x10], rcx
mov r14d, r13d
cmp qword [rax + 0x18], rcx
jbe 0x14008c236
mov rdi, qword [rax]
mov r8, rdi
mov r9, rdi
jmp 0x14008c23f
mov rdi, rsi
mov r8, rsi
mov r9, rsi
mov r15, qword [rax + 0x10]
add r15, r8
cmp r9, r15
je 0x14008c2c2
movzx ebx, byte [rsp + 0x40]
movzx r9d, byte [rdi]
cmp r9b, 0x3a
jne 0x14008c279
cmp r14d, 1
je 0x14008c2c2
inc r14d
mov qword [rbp + 8], r13
cmp rcx, 0xf
lea rax, [rbp - 8]
cmova rax, qword [rbp - 8]
mov byte [rax], 0
jmp 0x14008c2b0
cmp rdx, rcx
jae 0x14008c29e
lea rax, [rdx + 1]
cmp rcx, 0xf
mov qword [rbp + 8], rax
lea rax, [rbp - 8]
cmova rax, qword [rbp - 8]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], 0
jmp 0x14008c2b0
movzx r8d, bl
lea rcx, [rbp - 8]
mov edx, 1
call fcn.1400fe5c0
inc rdi
cmp rdi, r15
je 0x14008c2c2
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rbp + 8]
jmp 0x14008c250
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14008c2fc
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14008c2f7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008ccb6
mov rcx, r8
call fcn.140190a2c
mov qword [rsi + 0x10], r13
lea rcx, [rbp - 8]
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
call fcn.140040db0
mov rdx, rax
xor r9d, r9d
mov r8b, 1
call fcn.1400607a0
lea rcx, [rbp - 8]
mov dword [rbp + 0x1964], eax
call fcn.1400b87b0
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0xa8]
call fcn.140040c90
mov ecx, reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov rdx, r13
mov byte [rbp + 0x18], 0
mov qword [rbp + 0x28], rdx
mov rsi, rax
mov qword [rbp + 0x30], rcx
mov r14d, r13d
cmp qword [rax + 0x18], rcx
jbe 0x14008c376
mov rdi, qword [rax]
mov r8, rdi
mov r9, rdi
jmp 0x14008c37f
mov rdi, rsi
mov r8, rsi
mov r9, rsi
mov r15, qword [rax + 0x10]
add r15, r8
cmp r9, r15
je 0x14008c402
movzx ebx, byte [rsp + 0x40]
movzx r9d, byte [rdi]
cmp r9b, 0x3a
jne 0x14008c3b9
cmp r14d, 3
je 0x14008c402
inc r14d
mov qword [rbp + 0x28], r13
cmp rcx, 0xf
lea rax, [rbp + 0x18]
cmova rax, qword [rbp + 0x18]
mov byte [rax], 0
jmp 0x14008c3f0
cmp rdx, rcx
jae 0x14008c3de
lea rax, [rdx + 1]
cmp rcx, 0xf
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmova rax, qword [rbp + 0x18]
mov byte [rax + rdx], r9b
mov byte [rax + rdx + 1], 0
jmp 0x14008c3f0
movzx r8d, bl
lea rcx, [rbp + 0x18]
mov edx, 1
call fcn.1400fe5c0
inc rdi
cmp rdi, r15
je 0x14008c402
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x28]
jmp 0x14008c390
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14008c43c
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14008c437
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008ccbc
mov rcx, r8
call fcn.140190a2c
mov qword [rsi + 0x10], r13
lea rcx, [rbp + 0x18]
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
call fcn.140040db0
mov rdx, rax
xor r9d, r9d
mov r8b, 1
call fcn.1400607a0
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x1968], eax
call fcn.1400b87b0
mov r8, qword [rsp + 0x50]
mov rax, qword [rbp - 0x10]
xor rax, r8
mov eax, dword [rax + 4]
mov dword [rbp + 0x196c], eax
mov rax, qword [rbp - 0x60]
xor rax, r8
mov eax, dword [rax + 4]
mov dword [rbp + 0x1970], eax
call fcn.140077510
movzx edx, al
test al, al
jne 0x14008c4c4
mov rcx, qword [rsp + 0x58]
xor rcx, r8
mov ecx, dword [rcx + 4]
mov dword [rbp + 0x1974], ecx
mov rcx, qword [rsp + 0x48]
xor rcx, r8
mov ecx, dword [rcx + 4]
mov dword [rbp + 0x1978], ecx
mov rax, qword [rbp - 0x30]
mov r9d, r13d
mov dword [rsp + 0x58], 0xff000000
mov r8, r13
mov dword [rsp + 0x5c], r12d
mov byte [rbp + 0x1984], dl
mov ecx, dword [rax + 8]
mov eax, dword [rax + 0x58]
mov dword [rbp + 0x1980], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x197c], ecx
mov qword [rbp + 0x1f0], r13
nop dword [rax]
movzx ecx, byte [rsp + r8 + 0x50]
lea eax, [r9 + 1]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x48]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 2]
mov byte [rbp + r8 + 0x1f0], cl
movzx ecx, byte [rsp + r8 + 0x51]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x49]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 3]
mov byte [rbp + r8 + 0x1f1], cl
movzx ecx, byte [rsp + r8 + 0x52]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x4a]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 4]
mov byte [rbp + r8 + 0x1f2], cl
movzx ecx, byte [rsp + r8 + 0x53]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x4b]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 5]
mov byte [rbp + r8 + 0x1f3], cl
movzx ecx, byte [rsp + r8 + 0x54]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x4c]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 6]
mov byte [rbp + r8 + 0x1f4], cl
movzx ecx, byte [rsp + r8 + 0x55]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x4d]
xor ecx, eax
mov eax, 0x80808081
imul ecx
lea r8, [r8 + 8]
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 7]
mov byte [rbp + r8 + 0x1ed], cl
movzx ecx, byte [rsp + r8 + 0x4e]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x46]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
lea eax, [r9 + 8]
mov r9d, eax
mov byte [rbp + r8 + 0x1ee], cl
movzx ecx, byte [rsp + r8 + 0x4f]
imul ecx, eax
movzx eax, byte [rsp + r8 + 0x47]
xor ecx, eax
mov eax, 0x80808081
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
mov byte [rbp + r8 + 0x1ef], cl
cmp r9d, 8
jb 0x14008c510
mov rdi, qword [rbp + 0x1f0]
lea r11, [rbp + 0x1950]
mov r9d, r13d
movabs r15, 0x8080808080808081
nop dword [rax]
mov eax, r9d
lea rbx, [rbp + 0x1f1]
and eax, 7
mov esi, r13d
movzx r8d, byte [rbp + rax + 0x1f0]
movzx r10d, r8b
mov r14d, r8d
xor r10b, 0x80
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbx - 1]
movzx eax, r8b
add rcx, rax
mov rax, r15
xor rcx, rdi
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub rcx, rax
movzx eax, byte [rbx]
movzx r8d, cl
add r8, rax
mov rax, r15
xor r8, rdi
imul r8
add rdx, r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub r8, rax
movzx eax, byte [rbx + 1]
movzx ecx, r8b
add rcx, rax
mov rax, r15
xor rcx, rdi
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub rcx, rax
movzx eax, byte [rbx + 2]
movzx r8d, cl
add r8, rax
mov rax, r15
xor r8, rdi
imul r8
add rdx, r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub r8, rax
movzx eax, byte [rbx + 3]
movzx ecx, r8b
add rcx, rax
mov rax, r15
xor rcx, rdi
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub rcx, rax
movzx eax, byte [rbx + 4]
movzx r8d, cl
add r8, rax
mov rax, r15
xor r8, rdi
imul r8
add rdx, r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub r8, rax
movzx eax, byte [rbx + 5]
movzx ecx, r8b
add rcx, rax
xor rcx, rdi
lea rbx, [rbx + 8]
mov rax, r15
add esi, 8
imul rcx
add rdx, rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub rcx, rax
movzx eax, byte [rbx - 2]
movzx r8d, cl
add r8, rax
mov rax, r15
xor r8, rdi
imul r8
add rdx, r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xff
sub r8, rax
cmp esi, 8
jb 0x14008c730
movzx eax, r8b
inc r9d
movzx ecx, r10b
add ecx, r14d
add ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
add cl, byte [r11]
xor cl, r8b
mov byte [r11], cl
inc r11
cmp r9d, 0x80
jb 0x14008c700
movaps xmm0, xmmword [rbp + 0x1950]
lea r8, [rbp + 0x19d0]
movaps xmm1, xmmword [rbp + 0x1960]
lea rdx, str.00000000_0000_0000_0000_000000000000
movups xmmword [rbp + 0x19d8], xmm0
lea rcx, str.EKEY
mov r9d, 0x256
movaps xmm0, xmmword [rbp + 0x1970]
movups xmmword [rbp + 0x19e8], xmm1
mov dword [rsp + 0x20], 7
movaps xmm1, xmmword [rbp + 0x1980]
movups xmmword [rbp + 0x19f8], xmm0
movaps xmm0, xmmword [rbp + 0x1990]
movups xmmword [rbp + 0x1a08], xmm1
movaps xmm1, xmmword [rbp + 0x19a0]
movups xmmword [rbp + 0x1a18], xmm0
movaps xmm0, xmmword [rbp + 0x19b0]
movups xmmword [rbp + 0x1a28], xmm1
movaps xmm1, xmmword [rbp + 0x19c0]
movups xmmword [rbp + 0x1a38], xmm0
movups xmmword [rbp + 0x1a48], xmm1
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExA]
test eax, eax
jne 0x14008ca5d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rbp + 0x1f0]
mov dword [rbp + 0x1f0], eax
call fcn.1400ce160
lea rcx, [rbp + 0x390]
call fcn.140041370
mov r8d, Ordinal_35
lea rdx, str.X:EFI_bootdat.dat
lea rcx, [rbp + 0x390]
call fcn.1400b5610
lea rcx, [rbp + 0x390]
call fcn.1400b5600
test al, al
jne 0x14008ca2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rbp + 0x1f0]
mov dword [rbp + 0x1f0], eax
call fcn.1400ce340
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0xa8]
call fcn.14003ce10
lea rdx, str.Code:_0x3_:_0x14
mov rbx, rax
lea rcx, [rbp + 0xd0]
call fcn.14003ce10
mov rdx, rbx
mov rcx, rax
call fcn.14003cf90
mov r8d, 0x256
lea rdx, [rbp + 0x19d0]
lea rcx, [rbp + 0x3a0]
call fcn.1400b7bd0
lea rcx, [rbp + 0x390]
call fcn.1400b5560
lea rcx, [rbp + 0x390]
call fcn.140041270
lea rcx, str.mountvol_X:__d
call fcn.1401aeba8
test eax, eax
je 0x14008ca7a
lea rcx, [0x1401ffd70]
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
mov r14, qword [0x140328f28]
mov edi, r13d
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14008cbd7
lea rbx, [r14 + 0x10]
nop dword [rax]
nop dword [rax + rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp - 0x20], xmm0
test rax, rax
je 0x14008cb59
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14008cb59
movzx ecx, byte [rbp - 0x20]
test cl, cl
jne 0x14008caee
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14008cb59
cmp cl, 1
jne 0x14008cb59
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.140040c90
cmp qword [rbp + 0x228], 0xf
lea rax, [rbp + 0x210]
cmova rax, qword [rbp + 0x210]
mov byte [rax], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 0xf
jbe 0x14008cb59
mov rcx, qword [rbp + 0x210]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008cb54
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008cbd1
call fcn.140190a2c
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jge 0x14008cbd7
jmp 0x14008cab0
mov rbx, qword [rbp - 0x30]
lea rcx, [rbp + 0x2a0]
movups xmm0, xmmword [rbp + 0x78]
movups xmm1, xmmword [rbp + 0x88]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rbp + 0x98]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
call fcn.140054370
mov r15, qword [rsp + 0x1d80]
mov rax, rbx
mov r14, qword [rsp + 0x1d78]
mov r12, qword [rsp + 0x1d70]
mov rcx, qword [rbp + 0x1c30]
xor rcx, rsp
call fcn.140190770
add rsp, 0x1d40
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401ac538
int3
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov edx, 1
mov qword [0x140328f28], r13
lea ecx, [rdx + 5]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call fcn.1401ac890
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
test dl, 4
je 0x14008cc44
lea rbx, str.ios_base::badbit_set
jmp 0x14008cc59
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x30]
call fcn.14003ba70
mov r8, rax
lea rcx, [rbp + 0xa8]
mov rdx, rbx
call fcn.14003c0e0
lea rdx, [0x14021e110]
lea rcx, [rbp + 0xa8]
call fcn.140192fb4
int3
call fcn.1401ac538
int3
mov ecx, 1
call fcn.1401ac890
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3