Function at 0x180022780
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
call fcn.180009850
mov rsi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r12b
lea r8d, [r12 + 0x18]
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x180022880
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180005600
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1800237e0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180022880
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002287a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002377b
call fcn.180093588
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1800228c5
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800228c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023781
call fcn.180093588
call fcn.180009850
mov rsi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x28
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x180022987
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180005600
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1800237e0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180022987
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022981
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023787
call fcn.180093588
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1800229cc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800229c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002378d
call fcn.180093588
call fcn.180009850
mov rsi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x180022a8e
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180005600
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1800237e0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180022a8e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022a88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023793
call fcn.180093588
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022ad3
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023799
call fcn.180093588
call fcn.180009850
mov rsi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x180022b95
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180005600
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1800237e0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180022b95
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022b8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002379f
call fcn.180093588
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022bda
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022bd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237a5
call fcn.180093588
call fcn.180009850
mov rsi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlHashUnicodeString
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x180022c9c
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180005600
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1800237e0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180022c9c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237ab
call fcn.180093588
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022ce1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022cdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237b1
call fcn.180093588
call fcn.180009850
mov rsi, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlUpcaseUnicodeChar
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x180022da3
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180005600
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1800237e0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x180022da3
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022d9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237b7
call fcn.180093588
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022de8
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022de3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237bd
call fcn.180093588
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022e66
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022e61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237c3
call fcn.180093588
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x17
lea rdx, str.NtSetInformationProcess
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022ee4
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022edf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237c9
call fcn.180093588
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022f62
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022f5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800237cf
call fcn.180093588
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x11
lea rdx, str.NtDuplicateObject
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x180022fe0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180022fdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023775
call fcn.180093588
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtQueryObject
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x18002303d
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.180005d60
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtQuerySection
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x18002309a
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.180005d60
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.RtlCreateActivationContext
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x1800230f7
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.180005d60
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x13
lea rdx, str.NtLockVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtSuspendProcess
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0xf
lea rdx, str.NtResumeProcess
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.RtlImageNtHeader
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0xc
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x1c
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0xb
lea rdx, str.NtOpenEvent
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtCreateEvent
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtQueueApcThread
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlEncodeSystemPointer
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x20
lea rdx, str.NtWow64QueryInformationProcess64
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x1b
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x15
lea rdx, str.Wow64GetThreadContext
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, 0x15
lea rdx, str.Wow64SetThreadContext
lea rcx, [rbp - 0x50]
call fcn.1800058b0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x1800e4080]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
lea rdx, str.Wow64SuspendThread
lea rcx, [rbp - 0x50]
call fcn.180005890
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x50]
call fcn.1800055c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
call fcn.180009850
mov rbx, rax
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rbp - 0x50]
call fcn.1800055c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1800221c0
nop
lea rcx, [rbp - 0x50]
call fcn.180005560
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
nop
call fcn.18009a4c4
int3
call fcn.18009a4c4
int3
call fcn.18009a4c4
int3
call fcn.18009a4c4
int3