Function at 0x165d4
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xfe8
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0xfd0], rax
mov ebx, 0x32
mov rsi, rcx
mov qword [rsp + 0x160], rcx
mov r13, r8
mov qword [rsp + 0x4c0], r8
mov r14, rdx
mov qword [rsp + 0x188], rdx
lea ecx, [rbx - 0x31]
mov r8d, 0x4d525356
mov rdx, rbx
mov r15, r9
mov qword [rsp + 0x168], r9
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
mov qword [rsp + 0x170], rax
xor eax, eax
cmp rbp, rax
je 0x16d69
mov r8, rbx
xor edx, edx
mov rcx, rbp
call fcn.00011ce0
mov byte [rbp], 1
mov edx, dword [r13]
xor r9d, r9d
movabs rdi, 0xfffff78000000320
mov ebx, 0xff
mov rdi, qword [rdi]
movzx ecx, byte [r14]
lea eax, [rbx - 0x67]
cmp ecx, eax
mov r12d, r9d
jg 0x16ab9
je 0x16a73
sub ecx, 0x1d
je 0x16a0c
sub ecx, 1
je 0x16966
sub ecx, 0x11
je 0x16935
sub ecx, 0x51
je 0x168bc
sub ecx, 1
je 0x1684f
sub ecx, 1
je 0x167f7
sub ecx, 1
je 0x16770
sub ecx, 1
je 0x1673b
lea r13d, [r9 + 7]
cmp ecx, r13d
jne 0x16cb1
lea edx, [r9 + 2]
lea rcx, [r14 + 1]
mov r8, rsi
call fcn.000163d0
xor r9d, r9d
cmp byte [rsi + 2], r9b
je 0x16cc7
cmp word [r14 + 1], r13w
ja 0x16cc7
mov byte [rbp], r9b
movzx ecx, word [r14 + 1]
mov eax, dword [rsi + rcx*2 + 0x456]
mov dword [rbp + 2], eax
movzx eax, word [rsi + rcx*2 + 0x45a]
mov word [rbp + 6], ax
mov r12d, 6
mov r13b, 1
jmp 0x16cca
cmp byte [rsi + 2], r9b
je 0x16cc7
mov byte [rbp], r9b
mov r13d, 7
lea rcx, [rbp + 2]
mov al, byte [rsi + r13 + 0x44e]
dec r13
mov byte [rcx], al
inc rcx
cmp r13, r9
jge 0x16753
mov r12d, 8
jmp 0x16733
lea r13, [r14 + 1]
mov r8, rsi
mov edx, 4
mov rcx, r13
call fcn.000163d0
xor r9d, r9d
cmp byte [rsi + 2], r9b
je 0x16cc7
mov rcx, rsi
call fcn.0001643c
movzx ecx, word [r13]
add ecx, ecx
cmp ecx, eax
jge 0x16cc7
mov byte [rbp], r9b
movzx ecx, word [r13]
movzx eax, word [r14 + 3]
mov word [rsi + rcx*2 + 0x4a6], ax
mov rcx, rsi
mov r13b, r9b
call fcn.0001643c
lea rdx, [rsi + 0x4a6]
lea rcx, [0x0001b520]
mov r8d, eax
mov r9, rsi
call fcn.00016478
xor r9d, r9d
cmp eax, r9d
jne 0x16cca
mov byte [rbp], r9b
jmp 0x16cca
lea r13, [r14 + 1]
mov r8, rsi
mov edx, 2
mov rcx, r13
call fcn.000163d0
xor r9d, r9d
cmp byte [rsi + 2], r9b
je 0x16cc7
mov rcx, rsi
call fcn.0001643c
movzx ecx, word [r13]
add ecx, ecx
cmp ecx, eax
jge 0x16cc7
mov byte [rbp], r9b
movzx ecx, word [r13]
mov eax, dword [rsi + rcx*2 + 0x4a6]
mov dword [rbp + 2], eax
movzx eax, word [rsi + rcx*2 + 0x4aa]
jmp 0x16729
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
call fcn.000163d0
mov eax, dword [rsi + 0x43c]
cmp dword [r14 + 1], eax
jne 0x18405
cmp byte [rsi + 1], 1
jne 0x18405
xor eax, eax
mov rcx, rsi
mov byte [rbp], al
call fcn.0001643c
mov rcx, rsi
mov byte [rbp + 2], al
call fcn.0001643c
mov r13b, 1
sar eax, 8
mov byte [rbp + 3], al
mov eax, 0x10
mov byte [rbp + 4], al
lea r12d, [rax - 0xd]
mov eax, dword [rsi + 0x43c]
mov dword [0x00012768], eax
mov byte [rsi + 2], r13b
jmp 0x16cca
movzx eax, word [r14 + 1]
mov byte [rsi + 3], sil
mov byte [rsi + 1], 1
mov word [rsi + 0xc], ax
mov eax, 0xa0cb
mov ebx, 0xa
mov word [rsi + 0xe], ax
mov byte [rbp], r9b
mov byte [rbp + 2], 2
mov byte [rbp + 3], bl
mov al, byte [rsi + 0x45a]
lea edx, [rbx - 7]
cmp al, dl
je 0x168f9
cmp al, 5
mov eax, ebx
jne 0x168fe
mov eax, 0x1a
mov byte [rbp + 3], al
movzx eax, byte [rsi + 0x43a]
mov r12d, 5
cmp al, 5
mov byte [rbp + 4], r9b
mov byte [rbp + 5], sil
cmova ebx, eax
movzx eax, si
shr ax, 8
mov byte [rbp + 3], bl
mov byte [rbp + 6], al
mov r13b, 1
mov ebx, 0xff
jmp 0x16cca
xor eax, eax
mov byte [rbp], r9b
mov r8d, 8
mov qword [rsi + 4], rax
mov eax, dword [r14 + 1]
lea rcx, [rsi + 8]
mov dword [rsi + 4], eax
mov eax, dword [r13]
mov rdx, r15
cmp eax, r8d
cmova eax, r8d
mov r8d, eax
jmp 0x16d56
cmp byte [rsi + 2], r9b
je 0x16cc7
mov eax, dword [r13]
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
mov dword [rsi + 0x14c2], eax
call fcn.000163d0
mov edx, dword [rsi + 0x14c2]
mov rcx, r15
call fcn.000163d0
mov edx, 3
cmp word [r14 + 1], dx
lea r13d, [rdx + 4]
seta al
mov byte [rsi + 0x14c6], al
cmp word [r14 + 1], r13w
jae 0x169be
movzx r8d, byte [r14 + 1]
jmp 0x169c4
mov r8d, 8
mov byte [rsi + 0x14c7], r8b
mov ebx, 0x30
lea rcx, [rsi + 0x14c8]
mov r8, rbx
xor edx, edx
call fcn.00011ce0
movsxd r11, dword [rsi + 0x14c2]
cmp r11d, ebx
jae 0x169f0
mov rbx, r11
lea rcx, [rsi + 0x14c8]
mov r8, rbx
mov rdx, r15
call fcn.00011990
xor eax, eax
mov byte [rbp], al
jmp 0x16d5b
cmp byte [rsi + 2], r9b
je 0x16cc7
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
mov byte [rbp], r9b
call fcn.000163d0
movzx edi, byte [r14 + 4]
movzx r11d, word [r14 + 1]
mov r8, rdi
mov rdx, r15
movzx eax, r11b
mov dword [0x00012760], edi
lea rbx, [rax + rsi + 0x466]
mov dword [0x00012764], eax
mov rcx, rbx
call fcn.00011990
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.000163d0
xor eax, eax
mov dword [r13], eax
jmp 0x16d5b
lea r13, [r14 + 1]
mov r8, rsi
mov edx, 4
mov rcx, r13
call fcn.000163d0
xor r9d, r9d
cmp byte [rsi + 2], r9b
je 0x16cc7
mov byte [rbp], r9b
mov eax, dword [r13]
lea rcx, [rbp + 2]
lea rdx, [rsi + 0x14a6]
mov dword [rcx], eax
call fcn.00011800
mov r12d, 4
jmp 0x16733
cmp ecx, 0x9c
je 0x182f5
cmp ecx, 0x9d
je 0x1817f
cmp ecx, 0x9e
je 0x17847
cmp ecx, 0xa0
je 0x1782c
cmp ecx, 0xa1
je 0x17535
cmp ecx, 0xa2
je 0x16d8d
cmp ecx, 0xa9
jle 0x16cb9
cmp ecx, 0xab
jle 0x1782c
cmp ecx, 0xaf
jne 0x16cb9
mov r8d, dword [r13]
xor edx, edx
mov rcx, r15
mov byte [rsp + 0x4d8], 0x79
mov byte [rsp + 0x4d9], 0x4c
mov byte [rsp + 0x4da], 0xe1
mov byte [rsp + 0x4db], 0x88
mov byte [rsp + 0x4dc], 0xcb
mov byte [rsp + 0x4dd], 0xc1
mov byte [rsp + 0x4de], 0x78
mov byte [rsp + 0x4df], 0x53
mov byte [rsp + 0x4e0], 0x11
mov byte [rsp + 0x4e1], 0x69
mov byte [rsp + 0x4e2], 0xe0
mov byte [rsp + 0x4e3], 0xb2
mov byte [rsp + 0x4e4], 0xca
mov byte [rsp + 0x4e5], 0x97
mov byte [rsp + 0x4e6], 0xc9
mov byte [rsp + 0x4e7], 0x76
call fcn.00011ce0
mov al, byte [rsi + 4]
xor r11d, r11d
lea rdx, [rsp + 0x4d8]
lea rcx, [rsp + 0x300]
mov qword [rsp + 0x4e8], r11
mov r8d, 0x80
mov byte [rsp + 0x4e8], al
mov qword [rsp + 0x4f0], r11
call fcn.00010da0
mov ebx, 0xa
lea r9, [rsp + 0x540]
lea r8, [rsp + 0x4e8]
lea rcx, [rsp + 0x300]
mov edx, ebx
call fcn.000111a0
xor eax, eax
xor r11d, r11d
mov qword [rsp + 0x4e8], rax
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x4f0], rax
shr rax, 8
mov dword [rsp + 0x508], r11d
xor al, byte [rsp + 0x4f0]
lea r8d, [rbx + 0x76]
lea rdx, [rsp + 0x540]
and al, 0x1f
lea rcx, [rsp + 0x300]
mov qword [rsp + 0x4f8], r11
mov byte [rsp + 0x4ea], al
mov byte [rsp + 0x50a], al
mov qword [rsp + 0x500], r11
call fcn.00010da0
lea r9, [rsp + 0x4f8]
lea r8, [rsp + 0x4e8]
lea rcx, [rsp + 0x300]
mov edx, ebx
call fcn.000111a0
xor eax, eax
lea rdx, [rsp + 0x4f8]
mov byte [rbp], al
mov r8d, dword [r13]
jmp 0x16d53
mov r13, qword [rsp + 0x4c0]
cmp byte [rsi + 2], r9b
je 0x16cc3
mov byte [rbp], r9b
mov dword [r13], r9d
mov r13b, r9b
xor byte [rsi + 3], dil
cmp byte [rbp], 0x1f
ja 0x16cf1
inc byte [rsi + 3]
mov al, byte [rsi + 3]
mov r8, rbp
mov byte [rbp + 1], al
mov cl, byte [r14]
mov dl, 2
and cl, 0x7f
call fcn.000108bc
test eax, eax
je 0x16cd4
mov dil, byte [rbp]
mov r14b, byte [rbp + 1]
mov r8, rsi
mov edx, 2
mov rcx, rbp
call fcn.000163d0
xor eax, eax
cmp r13b, al
je 0x16d1e
lea rcx, [rbp + 2]
mov edx, r12d
call fcn.000163d0
xor eax, eax
cmp dil, al
jne 0x16d33
and word [rsi + 0xe], bx
movzx eax, r14b
shl ax, 8
or word [rsi + 0xe], ax
mov rdx, qword [rsp + 0x4c0]
mov eax, r12d
mov ecx, dword [rdx]
add rax, 2
cmp rax, rcx
cmovb rcx, rax
mov dword [rdx], ecx
mov rdx, rbp
mov r8d, ecx
mov rcx, r15
call fcn.00011990
mov edx, 0x4d525356
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0xfd0]
xor rcx, rsp
call fcn.00011e70
add rsp, 0xfe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov byte [rbp], r9b
movzx eax, word [r14 + 1]
cmp ax, r9w
jne 0x16d5b
mov edi, 0x7c1
cmp dword [r13], edi
jne 0x17163
mov ecx, ebx
mov r8d, 8
mov byte [rsp + 0x451], 0xc0
lea edx, [r8 - 5]
lea r13d, [r8 - 1]
mov byte [rsp + 0x452], r9b
lea eax, [rdx + 3]
lea ebx, [rdx + 7]
mov byte [rsp + 0x450], cl
mov byte [rsp + 0x453], r9b
mov byte [rsp + 0x454], r9b
mov byte [rsp + 0x455], 4
mov byte [rsp + 0x47d], al
mov byte [rsp + 0x483], bl
mov byte [rsp + 0x48b], al
mov byte [rsp + 0x497], al
mov byte [rsp + 0x456], 4
mov byte [rsp + 0x457], r9b
mov byte [rsp + 0x458], cl
mov byte [rsp + 0x459], 0xc1
mov byte [rsp + 0x45a], r9b
mov byte [rsp + 0x45b], 4
mov byte [rsp + 0x45c], r9b
mov byte [rsp + 0x45d], 1
mov byte [rsp + 0x45e], r9b
mov byte [rsp + 0x45f], 1
mov byte [rsp + 0x460], cl
mov byte [rsp + 0x461], 0xc2
mov byte [rsp + 0x462], r9b
mov byte [rsp + 0x463], 5
mov byte [rsp + 0x464], r9b
mov byte [rsp + 0x465], 0xfd
mov byte [rsp + 0x466], r9b
mov byte [rsp + 0x467], 2
mov byte [rsp + 0x468], cl
mov byte [rsp + 0x469], 0xc8
mov byte [rsp + 0x46a], 1
mov byte [rsp + 0x46b], 2
mov byte [rsp + 0x46c], r9b
mov byte [rsp + 0x46d], r8b
mov byte [rsp + 0x46e], 4
mov byte [rsp + 0x46f], dl
mov byte [rsp + 0x470], cl
mov byte [rsp + 0x471], 0xc9
mov byte [rsp + 0x472], 2
mov byte [rsp + 0x473], 0x89
mov byte [rsp + 0x474], r9b
mov byte [rsp + 0x475], 2
mov byte [rsp + 0x476], r9b
mov byte [rsp + 0x477], r13b
mov byte [rsp + 0x478], cl
mov byte [rsp + 0x479], 0xcc
mov byte [rsp + 0x47a], 2
mov byte [rsp + 0x47b], 0x8b
mov byte [rsp + 0x47c], r9b
mov byte [rsp + 0x47e], 4
mov byte [rsp + 0x47f], 0xd
mov byte [rsp + 0x480], cl
mov byte [rsp + 0x481], 0xf4
mov byte [rsp + 0x482], 1
mov byte [rsp + 0x484], r9b
mov byte [rsp + 0x485], 0xfc
mov byte [rsp + 0x486], r9b
mov byte [rsp + 0x487], 4
mov byte [rsp + 0x488], cl
mov byte [rsp + 0x489], 0xf5
mov byte [rsp + 0x48a], 2
mov byte [rsp + 0x48c], r9b
mov byte [rsp + 0x48d], 0x80
mov byte [rsp + 0x48e], r9b
mov byte [rsp + 0x48f], 5
mov byte [rsp + 0x490], cl
mov byte [rsp + 0x491], 0xca
mov byte [rsp + 0x492], 2
mov byte [rsp + 0x493], 0x86
mov byte [rsp + 0x494], r9b
mov byte [rsp + 0x495], dl
mov byte [rsp + 0x496], r9b
mov byte [rsp + 0x498], cl
mov byte [rsp + 0x499], 0xcd
mov byte [rsp + 0x49a], 2
mov byte [rsp + 0x4a0], cl
mov byte [rsp + 0x4a8], cl
mov byte [rsp + 0x4a9], cl
mov byte [rsp + 0x4aa], cl
mov byte [rsp + 0x4ab], cl
mov byte [rsp + 0x4ac], cl
mov byte [rsp + 0x4ad], cl
mov byte [rsp + 0x4ae], cl
mov byte [rsp + 0x4af], cl
mov byte [rsp + 0x4b0], cl
mov byte [rsp + 0x4b1], cl
mov byte [rsp + 0x4b2], cl
mov byte [rsp + 0x4b3], cl
mov byte [rsp + 0x4b4], cl
mov byte [rsp + 0x4b5], cl
mov byte [rsp + 0x4b6], cl
mov byte [rsp + 0x4b7], cl
mov byte [rsp + 0x4b8], cl
mov byte [rsp + 0x4b9], cl
mov byte [rsp + 0x4ba], cl
mov byte [rsp + 0x4bb], cl
mov byte [rsp + 0x4bc], cl
mov byte [rsp + 0x4bd], cl
mov byte [rsp + 0x4be], cl
mov byte [rsp + 0x4bf], cl
mov edx, ecx
lea rcx, [rsp + 0x800]
mov r8, rdi
mov byte [rsp + 0x49b], 0x91
mov byte [rsp + 0x49c], r9b
mov byte [rsp + 0x49d], 1
mov byte [rsp + 0x49e], r9b
mov byte [rsp + 0x49f], 9
mov byte [rsp + 0x4a1], 0xcb
mov byte [rsp + 0x4a2], 2
mov byte [rsp + 0x4a3], 0x92
mov byte [rsp + 0x4a4], r9b
mov byte [rsp + 0x4a5], 1
mov byte [rsp + 0x4a6], r9b
mov byte [rsp + 0x4a7], 0xb
call fcn.00011ce0
lea rcx, [rsp + 0x800]
lea rdx, [rsp + 0x450]
lea r8d, [r13 + 0x69]
call fcn.00011990
mov rdx, qword [rsp + 0x4c0]
xor eax, eax
mov dword [rdx], edi
lea rdx, [rsp + 0x800]
mov byte [rsp + 0xfc0], al
jmp 0x1752d
cmp ax, r9w
jne 0x16d5b
mov edi, 0x1a1
cmp edx, edi
jne 0x16d5b
mov ecx, ebx
mov r8d, 8
mov byte [rsp + 0x451], 0xc0
lea edx, [r8 - 5]
lea r13d, [r8 - 1]
mov byte [rsp + 0x452], r9b
lea eax, [rdx + 3]
lea ebx, [rdx + 7]
mov byte [rsp + 0x450], cl
mov byte [rsp + 0x453], r9b
mov byte [rsp + 0x454], r9b
mov byte [rsp + 0x455], 4
mov byte [rsp + 0x47d], al
mov byte [rsp + 0x483], bl
mov byte [rsp + 0x48b], al
mov byte [rsp + 0x497], al
mov byte [rsp + 0x456], 4
mov byte [rsp + 0x457], r9b
mov byte [rsp + 0x458], cl
mov byte [rsp + 0x459], 0xc1
mov byte [rsp + 0x45a], r9b
mov byte [rsp + 0x45b], 4
mov byte [rsp + 0x45c], r9b
mov byte [rsp + 0x45d], 1
mov byte [rsp + 0x45e], r9b
mov byte [rsp + 0x45f], 1
mov byte [rsp + 0x460], cl
mov byte [rsp + 0x461], 0xc2
mov byte [rsp + 0x462], r9b
mov byte [rsp + 0x463], 5
mov byte [rsp + 0x464], r9b
mov byte [rsp + 0x465], 0xfd
mov byte [rsp + 0x466], r9b
mov byte [rsp + 0x467], 2
mov byte [rsp + 0x468], cl
mov byte [rsp + 0x469], 0xc8
mov byte [rsp + 0x46a], 1
mov byte [rsp + 0x46b], 2
mov byte [rsp + 0x46c], r9b
mov byte [rsp + 0x46d], r8b
mov byte [rsp + 0x46e], 4
mov byte [rsp + 0x46f], dl
mov byte [rsp + 0x470], cl
mov byte [rsp + 0x471], 0xc9
mov byte [rsp + 0x472], 2
mov byte [rsp + 0x473], 0x89
mov byte [rsp + 0x474], r9b
mov byte [rsp + 0x475], 2
mov byte [rsp + 0x476], r9b
mov byte [rsp + 0x477], r13b
mov byte [rsp + 0x478], cl
mov byte [rsp + 0x479], 0xcc
mov byte [rsp + 0x47a], 2
mov byte [rsp + 0x47b], 0x8b
mov byte [rsp + 0x47c], r9b
mov byte [rsp + 0x47e], 4
mov byte [rsp + 0x47f], 0xd
mov byte [rsp + 0x480], cl
mov byte [rsp + 0x481], 0xf4
mov byte [rsp + 0x482], 1
mov byte [rsp + 0x484], r9b
mov byte [rsp + 0x485], 0xfc
mov byte [rsp + 0x486], r9b
mov byte [rsp + 0x487], 4
mov byte [rsp + 0x488], cl
mov byte [rsp + 0x489], 0xf5
mov byte [rsp + 0x48a], 2
mov byte [rsp + 0x48c], r9b
mov byte [rsp + 0x48d], 0x80
mov byte [rsp + 0x48e], r9b
mov byte [rsp + 0x48f], 5
mov byte [rsp + 0x490], cl
mov byte [rsp + 0x491], 0xca
mov byte [rsp + 0x492], 2
mov byte [rsp + 0x493], 0x86
mov byte [rsp + 0x494], r9b
mov byte [rsp + 0x495], dl
mov byte [rsp + 0x496], r9b
mov byte [rsp + 0x498], cl
mov byte [rsp + 0x499], 0xcd
mov byte [rsp + 0x49a], 2
mov byte [rsp + 0x4a0], cl
mov byte [rsp + 0x4a8], cl
mov byte [rsp + 0x4a9], cl
mov byte [rsp + 0x4aa], cl
mov byte [rsp + 0x4ab], cl
mov byte [rsp + 0x4ac], cl
mov byte [rsp + 0x4ad], cl
mov byte [rsp + 0x4ae], cl
mov byte [rsp + 0x4af], cl
mov byte [rsp + 0x4b0], cl
mov byte [rsp + 0x4b1], cl
mov byte [rsp + 0x4b2], cl
mov byte [rsp + 0x4b3], cl
mov byte [rsp + 0x4b4], cl
mov byte [rsp + 0x4b5], cl
mov byte [rsp + 0x4b6], cl
mov byte [rsp + 0x4b7], cl
mov byte [rsp + 0x4b8], cl
mov byte [rsp + 0x4b9], cl
mov byte [rsp + 0x4ba], cl
mov byte [rsp + 0x4bb], cl
mov byte [rsp + 0x4bc], cl
mov byte [rsp + 0x4bd], cl
mov byte [rsp + 0x4be], cl
mov byte [rsp + 0x4bf], cl
mov edx, ecx
lea rcx, [rsp + 0x650]
mov r8, rdi
mov byte [rsp + 0x49b], 0x91
mov byte [rsp + 0x49c], r9b
mov byte [rsp + 0x49d], 1
mov byte [rsp + 0x49e], r9b
mov byte [rsp + 0x49f], 9
mov byte [rsp + 0x4a1], 0xcb
mov byte [rsp + 0x4a2], 2
mov byte [rsp + 0x4a3], 0x92
mov byte [rsp + 0x4a4], r9b
mov byte [rsp + 0x4a5], 1
mov byte [rsp + 0x4a6], r9b
mov byte [rsp + 0x4a7], 0xb
call fcn.00011ce0
lea rcx, [rsp + 0x650]
lea rdx, [rsp + 0x450]
lea r8d, [r13 + 0x69]
call fcn.00011990
mov rdx, qword [rsp + 0x4c0]
xor eax, eax
mov dword [rdx], edi
lea rdx, [rsp + 0x650]
mov byte [rsp + 0x7f0], al
mov r8, rdi
jmp 0x16d53
movzx ecx, word [r14 + 1]
cmp ecx, r9d
je 0x177f9
sub ecx, 1
je 0x17655
sub ecx, 1
je 0x175ae
cmp ecx, 1
jne 0x16d5b
lea r8d, [rcx + 7]
mov byte [rsp + 0x4c0], r9b
mov byte [rsp + 0x4c1], r9b
mov byte [rsp + 0x4c3], r9b
mov byte [rsp + 0x4c4], r9b
mov byte [rsp + 0x4c5], r9b
mov byte [rsp + 0x4c2], r8b
mov byte [rsp + 0x4c6], r9b
mov byte [rsp + 0x4c7], r9b
mov rax, qword [rsp + 0x4c0]
mov qword [r15], rax
jmp 0x16d5b
mov al, byte [rsi + 0x459]
lea rcx, [rsp + 0x4c8]
mov byte [rsp + 0x4cc], r9b
mov byte [rsp + 0x4c8], al
mov al, byte [rsi + 0x458]
mov byte [rsp + 0x4cd], r9b
mov byte [rsp + 0x4c9], al
mov al, byte [rsi + 0x457]
mov byte [rsp + 0x4ce], 1
mov byte [rsp + 0x4ca], al
mov al, byte [rsi + 0x456]
mov byte [rsp + 0x4cf], r9b
mov byte [rsp + 0x4d0], 1
mov byte [rsp + 0x4d1], 0x21
mov byte [rsp + 0x4d2], r9b
mov byte [rsp + 0x4cb], al
mov byte [rsp + 0x4d3], r9b
mov byte [rsp + 0x4d4], 1
mov byte [rsp + 0x4d5], r9b
mov rax, qword [rcx]
mov qword [r15], rax
mov eax, dword [rcx + 8]
mov dword [r15 + 8], eax
movzx eax, word [rcx + 0xc]
mov word [r15 + 0xc], ax
jmp 0x16d5b
mov eax, 6
mov byte [rsp + 0x425], 1
mov byte [rsp + 0x426], r9b
lea edx, [rax - 3]
mov byte [rsp + 0x424], al
mov al, byte [rsi + 0x459]
mov byte [rsp + 0x420], al
mov al, byte [rsi + 0x458]
mov byte [rsp + 0x438], dl
mov byte [rsp + 0x421], al
mov al, byte [rsi + 0x457]
mov byte [rsp + 0x446], dl
mov byte [rsp + 0x422], al
mov al, byte [rsi + 0x456]
mov byte [rsp + 0x427], r9b
mov byte [rsp + 0x428], 2
mov byte [rsp + 0x429], 0xca
mov byte [rsp + 0x42a], r9b
mov byte [rsp + 0x423], al
mov byte [rsp + 0x42b], 0xe
mov byte [rsp + 0x42c], r9b
mov byte [rsp + 0x42d], r9b
mov byte [rsp + 0x42e], 0x39
mov byte [rsp + 0x42f], 0x37
mov byte [rsp + 0x430], 2
mov byte [rsp + 0x431], 0x24
mov byte [rsp + 0x432], r9b
mov byte [rsp + 0x433], 2
mov byte [rsp + 0x434], r9b
mov byte [rsp + 0x435], 2
mov byte [rsp + 0x436], r9b
mov byte [rsp + 0x437], r9b
mov byte [rsp + 0x439], 0x19
mov byte [rsp + 0x43a], 0x22
mov byte [rsp + 0x43b], 0xc3
mov byte [rsp + 0x43c], 0x7b
mov byte [rsp + 0x43d], r9b
mov byte [rsp + 0x43e], r9b
mov byte [rsp + 0x43f], r9b
mov byte [rsp + 0x440], r9b
mov byte [rsp + 0x441], r9b
mov byte [rsp + 0x442], r9b
mov byte [rsp + 0x443], r9b
mov byte [rsp + 0x444], 0xf8
mov byte [rsp + 0x445], r9b
mov byte [rsp + 0x447], 0x7e
mov byte [rsp + 0x448], r9b
mov byte [rsp + 0x449], r9b
mov byte [rsp + 0x44a], 0x92
mov byte [rsp + 0x44b], 0x8b
mov byte [rsp + 0x44c], r9b
mov byte [rsp + 0x44d], r9b
mov byte [rsp + 0x44e], r9b
lea rdx, [rsp + 0x420]
mov r8d, 0x2f
jmp 0x16d53
lea rcx, [rsp + 0x144]
mov byte [rsp + 0x144], 1
mov byte [rsp + 0x145], r9b
mov byte [rsp + 0x146], r9b
movzx eax, word [rcx]
mov word [r15], ax
mov al, byte [rcx + 2]
mov byte [r15 + 2], al
jmp 0x16d5b
mov byte [rbp], r9b
mov byte [rbp + 4], r9b
mov dword [r13], 1
mov al, byte [rbp + 2]
mov byte [r15], al
jmp 0x16d5b
cmp byte [rsi + 2], r9b
je 0x16cc7
mov ebx, 0x30
lea rcx, [rsp + 0x510]
xor edx, edx
mov r8, rbx
call fcn.00011ce0
lea rcx, [rsp + 0x420]
mov r8, rbx
xor edx, edx
call fcn.00011ce0
movsxd r12, dword [rsi + 0x14c2]
mov r8, r12
cmp r12d, ebx
jb 0x1788c
mov r8, rbx
lea rdx, [rsi + 0x14c8]
lea rcx, [rsp + 0x420]
call fcn.00011990
mov r8, r12
cmp r12d, ebx
jb 0x178ab
mov r8, rbx
lea rdx, [rsi + 0x14c8]
lea rcx, [rsp + 0x510]
call fcn.00011990
mov r13d, 0x100
lea rcx, [rsp + 0x550]
mov r8, r13
xor edx, edx
xor r12d, r12d
call fcn.00011ce0
xor r9d, r9d
xor r8d, r8d
lea r11, [rsi + 0x14f8]
mov rdx, r13
lea rcx, [rsp + 0x550]
lea rax, [0x0001b570]
cmp byte [rsi + 0x14c6], r12b
je 0x17909
lea rax, [0x0001b5a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r11
lea rax, str.RegistryMACHINESystemCurrentControlSetMkbuz
mov qword [rsp + 0x30], rax
lea rax, [0x0001b580]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x1d0]
lea r8, [rsp + 0x1a0]
lea rcx, [rsp + 0x190]
mov edx, 0x20019
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x1a0], ebx
mov qword [rsp + 0x1a8], r12
mov dword [rsp + 0x1b8], 0x40
mov qword [rsp + 0x1c0], r12
mov qword [rsp + 0x1c8], r12
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov r12d, 0x10
mov qword [rsp + 0x148], r12
test eax, eax
js 0x17f9a
lea rcx, [rsp + 0x550]
mov r8, r13
xor edx, edx
call fcn.00011ce0
mov r11d, dword [rsi + 0x14c2]
cmp r11d, r12d
je 0x17e05
cmp r11d, 0x20
je 0x17c12
cmp r11d, ebx
jne 0x17f5c
lea rcx, [rsp + 0x550]
mov r8, r13
xor edx, edx
call fcn.00011ce0
movzx eax, byte [rsp + 0x43e]
movzx r11d, byte [rsp + 0x43f]
movzx ecx, byte [rsp + 0x43d]
movzx edx, byte [rsp + 0x43c]
movzx r8d, byte [rsp + 0x43b]
movzx r9d, byte [rsp + 0x43a]
movzx r10d, byte [rsp + 0x439]
movzx ebx, byte [rsp + 0x438]
movzx esi, byte [rsp + 0x437]
movzx ebp, byte [rsp + 0x436]
movzx r12d, byte [rsp + 0x435]
movzx r13d, byte [rsp + 0x434]
movzx r14d, byte [rsp + 0x433]
movzx r15d, byte [rsp + 0x432]
mov dword [rsp + 0x130], r11d
mov dword [rsp + 0x128], eax
movzx eax, byte [rsp + 0x431]
mov dword [rsp + 0x120], ecx
mov dword [rsp + 0x118], edx
mov dword [rsp + 0x110], r8d
mov dword [rsp + 0x108], r9d
mov dword [rsp + 0x100], r10d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [rsp + 0x430]
mov dword [rsp + 0xb8], eax
movzx eax, byte [rsp + 0x42f]
mov dword [rsp + 0xb0], eax
movzx eax, byte [rsp + 0x42e]
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x42d]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rsp + 0x42c]
mov dword [rsp + 0x98], eax
movzx eax, byte [rsp + 0x42b]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x42a]
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x429]
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x428]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x427]
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x426]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x425]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x424]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x423]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x422]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x421]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x420]
mov dword [rsp + 0x38], eax
lea rax, [0x0001b770]
mov qword [rsp + 0x30], rax
lea rax, [0x0001b660]
lea rcx, [rsp + 0x550]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.00010590
jmp 0x17f34
lea rcx, [rsp + 0x550]
mov r8, r13
xor edx, edx
call fcn.00011ce0
movzx eax, byte [rsp + 0x43e]
movzx r11d, byte [rsp + 0x43f]
movzx ecx, byte [rsp + 0x43d]
movzx edx, byte [rsp + 0x43c]
movzx r8d, byte [rsp + 0x43b]
movzx r9d, byte [rsp + 0x43a]
movzx r10d, byte [rsp + 0x439]
movzx ebx, byte [rsp + 0x438]
movzx esi, byte [rsp + 0x437]
movzx ebp, byte [rsp + 0x436]
movzx r12d, byte [rsp + 0x435]
movzx r13d, byte [rsp + 0x434]
movzx r14d, byte [rsp + 0x433]
movzx r15d, byte [rsp + 0x432]
mov dword [rsp + 0x130], r11d
mov dword [rsp + 0x128], eax
movzx eax, byte [rsp + 0x431]
mov dword [rsp + 0x120], ecx
mov dword [rsp + 0x118], edx
mov dword [rsp + 0x110], r8d
mov dword [rsp + 0x108], r9d
mov dword [rsp + 0x100], r10d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], ebp
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xd8], r13d
mov dword [rsp + 0xd0], r14d
mov dword [rsp + 0xc8], r15d
mov dword [rsp + 0xc0], eax
movzx eax, byte [rsp + 0x430]
mov dword [rsp + 0xb8], eax
movzx eax, byte [rsp + 0x42f]
mov dword [rsp + 0xb0], eax
movzx eax, byte [rsp + 0x42e]
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x42d]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rsp + 0x42c]
mov dword [rsp + 0x98], eax
movzx eax, byte [rsp + 0x42b]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x42a]
mov dword [rsp + 0x88], eax
movzx eax, byte [rsp + 0x429]
mov dword [rsp + 0x80], eax
movzx eax, byte [rsp + 0x428]
mov dword [rsp + 0x78], eax
movzx eax, byte [rsp + 0x427]
mov dword [rsp + 0x70], eax
movzx eax, byte [rsp + 0x426]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x425]
mov dword [rsp + 0x60], eax
movzx eax, byte [rsp + 0x424]
mov dword [rsp + 0x58], eax
movzx eax, byte [rsp + 0x423]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x422]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x421]
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x420]
mov dword [rsp + 0x38], eax
lea rax, [0x0001b650]
jmp 0x17bdc
lea rcx, [rsp + 0x550]
mov r8, r13
xor edx, edx
call fcn.00011ce0
movzx eax, byte [rsp + 0x42e]
movzx r11d, byte [rsp + 0x42f]
movzx ecx, byte [rsp + 0x42d]
movzx edx, byte [rsp + 0x42c]
movzx r8d, byte [rsp + 0x42b]
movzx r9d, byte [rsp + 0x42a]
movzx r10d, byte [rsp + 0x429]
movzx ebx, byte [rsp + 0x428]
movzx esi, byte [rsp + 0x427]
movzx ebp, byte [rsp + 0x426]
movzx r12d, byte [rsp + 0x425]
movzx r13d, byte [rsp + 0x424]
movzx r14d, byte [rsp + 0x423]
movzx r15d, byte [rsp + 0x422]
mov dword [rsp + 0xb0], r11d
mov dword [rsp + 0xa8], eax
movzx eax, byte [rsp + 0x421]
mov dword [rsp + 0xa0], ecx
mov dword [rsp + 0x98], edx
mov dword [rsp + 0x90], r8d
mov dword [rsp + 0x88], r9d
mov dword [rsp + 0x80], r10d
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], eax
movzx eax, byte [rsp + 0x420]
lea rcx, [rsp + 0x550]
mov dword [rsp + 0x38], eax
lea rax, [0x0001b5b0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [0x0001b5c0]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.00010590
mov rsi, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x170]
mov r12, qword [rsp + 0x148]
mov r14, qword [rsp + 0x188]
mov r15, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x190]
lea r8, [rsp + 0x420]
lea rdx, [rsp + 0x550]
mov r9d, r12d
call fcn.0001099c
mov rcx, qword [rsp + 0x190]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor r13d, r13d
cmp ebx, r13d
jge 0x1815e
jmp 0x17f9d
xor r13d, r13d
movzx ecx, byte [rsi + 0x14c7]
cmp ecx, r13d
je 0x18122
mov r8d, 1
sub ecx, r8d
je 0x180c5
sub ecx, r8d
je 0x18048
sub ecx, 2
je 0x18008
sub ecx, r8d
je 0x18027
cmp ecx, r8d
jne 0x1815e
lea rcx, [rsp + 0x510]
mov rdx, r12
mov al, byte [rcx + 0x10]
xor byte [rcx], al
add rcx, r8
sub rdx, r8
jne 0x17fe3
lea rcx, [rsp + 0x510]
mov rdx, r12
mov al, byte [rcx + 0x20]
xor byte [rcx], al
add rcx, r8
sub rdx, r8
jne 0x17ffb
lea rdx, [rsi + 0x1520]
lea rcx, [rsp + 0x1e0]
mov r8d, 0x80
call fcn.00011060
jmp 0x1813c
mov rcx, r13
mov rdx, r12
mov al, byte [rsp + rcx + 0x520]
xor byte [rsp + rcx + 0x420], al
add rcx, r8
sub rdx, r8
jne 0x1802d
jmp 0x1815e
lea rdx, [rsi + 0x1520]
lea rcx, [rsp + 0x1e0]
mov r8d, 0x80
call fcn.00010da0
lea r9, [rsp + 0x420]
lea r8, [rsp + 0x510]
lea rcx, [rsp + 0x1e0]
mov edx, 0xa
call fcn.000111a0
mov r11, r13
mov rcx, r12
mov al, byte [rsp + r11 + 0x520]
inc r11
xor byte [rsp + r11 + 0x41f], al
sub rcx, 1
jne 0x1808a
mov rcx, r13
mov rdx, r12
mov al, byte [rsp + rcx + 0x530]
inc rcx
xor byte [rsp + rcx + 0x41f], al
sub rdx, 1
jne 0x180a9
jmp 0x1815e
lea rdx, [rsi + 0x1520]
lea rcx, [rsp + 0x1e0]
mov r8d, 0x80
call fcn.00010da0
lea r9, [rsp + 0x420]
lea r8, [rsp + 0x510]
lea rcx, [rsp + 0x1e0]
mov edx, 0xa
call fcn.000111a0
mov r11, r13
mov rcx, r12
mov al, byte [rsp + r11 + 0x520]
inc r11
xor byte [rsp + r11 + 0x41f], al
sub rcx, 1
jne 0x18107
jmp 0x1815e
lea rdx, [rsi + 0x1520]
lea rcx, [rsp + 0x1e0]
mov r8d, 0x80
call fcn.00010da0
lea r9, [rsp + 0x420]
lea r8, [rsp + 0x510]
lea rcx, [rsp + 0x1e0]
mov edx, 0xa
call fcn.000111a0
mov byte [rbp], r13b
movsxd r8, dword [rsi + 0x14c2]
lea rcx, [rbp + 2]
lea rdx, [rsp + 0x420]
call fcn.00011990
jmp 0x16928
cmp byte [rsi + 2], r9b
je 0x16cc7
mov r13d, 7
cmp dword [0x00012764], r13d
jl 0x181bd
lea rdx, [rsi + 0x466]
lea r8d, [r13 + 0x31]
lea rcx, [0x0001b530]
mov r9, rsi
call fcn.00016478
xor r9d, r9d
mov r13b, r9b
jmp 0x167e5
movabs rax, 0xfffff78000000014
lea r13, [rsi + 0x49e]
lea rdx, [rsp + 0x150]
mov rbx, qword [rax]
mov rax, qword [r13]
lea rcx, [rbx + rax]
mov qword [rsp + 0x198], rcx
lea rcx, [rsp + 0x198]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
xor eax, eax
cmp dword [0x00012764], eax
jne 0x18252
and byte [rsi + 0x466], 0x7f
mov cl, byte [rsi + 0x466]
call fcn.00010984
mov cl, byte [rsi + 0x467]
movzx r8d, al
mov word [rsp + 0x15a], r8w
call fcn.00010984
mov cl, byte [rsi + 0x468]
movzx r8d, al
mov word [rsp + 0x158], r8w
call fcn.00010984
movzx r8d, al
mov word [rsp + 0x156], r8w
jmp 0x182ae
mov cl, byte [rsi + 0x469]
call fcn.00010984
mov cl, byte [rsi + 0x46a]
movzx r8d, al
mov word [rsp + 0x154], r8w
call fcn.00010984
mov cl, byte [rsi + 0x46c]
movzx r8d, al
mov word [rsp + 0x152], r8w
call fcn.00010984
movzx r8d, al
mov eax, 0x7d0
cmp r8d, 0x5a
jl 0x182a1
mov eax, 0x76c
add r8w, ax
mov word [rsp + 0x150], r8w
lea rdx, [rsp + 0x4c8]
lea rcx, [rsp + 0x150]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov r11, qword [rsp + 0x4c8]
lea rcx, [0x0001b550]
sub r11, rbx
mov r9, rsi
mov r8d, 8
mov rdx, r13
mov qword [r13], r11
call fcn.00016478
mov ebx, 0xff
jmp 0x181b2
cmp byte [rsi + 2], r9b
je 0x16cc7
lea rcx, [r14 + 1]
mov r8, rsi
mov edx, 4
mov byte [rbp], r9b
call fcn.000163d0
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x148], rax
mov rax, qword [rsi + 0x49e]
add qword [rsp + 0x148], rax
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx eax, word [r14 + 1]
and ax, bx
jne 0x1837c
mov cl, byte [rsp + 0x17e]
call fcn.00010954
mov cl, byte [rsp + 0x180]
mov byte [rbp + 4], al
call fcn.00010954
mov cl, byte [rsp + 0x182]
jmp 0x183ce
mov edx, 3
cmp ax, dx
jne 0x183db
movsx ecx, word [rsp + 0x178]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
call fcn.00010954
mov cl, byte [rsp + 0x186]
mov byte [rbp + 5], al
call fcn.00010954
mov cl, byte [rsp + 0x17a]
mov byte [rbp + 4], al
call fcn.00010954
mov cl, byte [rsp + 0x17c]
mov byte [rbp + 3], al
call fcn.00010954
mov byte [rbp + 2], al
jmp 0x183fb
movzx eax, word [r14 + 1]
lea rcx, [rbp + 2]
mov r8, rax
movzx eax, al
lea rdx, [rax + rsi + 0x466]
shr r8, 8
call fcn.00011990
movzx r12d, byte [r14 + 2]
jmp 0x16733
mov r13b, r12b
jmp 0x16cca