Function at 0x140001260
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push r12
push r14
lea rbp, [rsp - 0xf8]
sub rsp, 0x1f8
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor eax, eax
mov r12, r8
mov qword [rsp + 0x30], rax
mov rdi, rcx
mov dword [rsp + 0x28], eax
lea rcx, str..RTCore64
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400012ca
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x228], rbx
mov rbx, rdi
mov qword [rsp + 0x1f0], rsi
movabs rsi, 0xcc00000000000000
mov qword [rsp + 0x1e8], r13
movabs r13, 0x1008000000000001
mov qword [rsp + 0x1e0], r15
movabs r15, 0x9000000000000000
nop dword [rax + rax]
xor eax, eax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
mov r9d, 0x30
mov dword [rbp - 0x7c], eax
mov edx, 0x80002048
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x30], rax
mov rcx, r14
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x30
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x74], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rdx, [rbx + 5]
mov rcx, r14
call fcn.1400010d0
movzx ecx, byte [rsp + 0x74]
add cl, 0x18
cmp cl, 1
ja 0x140001548
movzx ecx, al
add rcx, 0xffffffffffffff70
cmp rcx, 0x3c
ja 0x1400013a6
bt r13, rcx
jb 0x140001668
mov rcx, rax
and ecx, 0xff00
cmp rcx, 0xc300
je 0x140001668
cmp rcx, 0xcc00
je 0x140001668
cmp rcx, 0x9000
je 0x140001668
mov rcx, rax
and ecx, 0xff0000
cmp rcx, 0xc30000
je 0x140001668
cmp rcx, 0xcc0000
je 0x140001668
cmp rcx, 0x900000
je 0x140001668
mov edx, 0xff000000
mov rcx, rax
and rcx, rdx
mov edx, 0xc3000000
cmp rcx, rdx
je 0x140001668
mov edx, 0xcc000000
cmp rcx, rdx
je 0x140001668
mov edx, 0x90000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0xff00000000
mov rcx, rax
and rcx, rdx
movabs rdx, 0xc300000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0xcc00000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0x9000000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0xff0000000000
mov rcx, rax
and rcx, rdx
movabs rdx, 0xc30000000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0xcc0000000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0x900000000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0xff000000000000
mov rcx, rax
and rcx, rdx
movabs rdx, 0xc3000000000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0xcc000000000000
cmp rcx, rdx
je 0x140001668
movabs rdx, 0x90000000000000
cmp rcx, rdx
je 0x140001668
movabs rcx, 0xff00000000000000
and rax, rcx
movabs rcx, 0xc300000000000000
cmp rax, rcx
je 0x140001668
cmp rax, rsi
je 0x140001668
cmp rax, r15
je 0x140001668
inc rbx
mov rax, rbx
sub rax, rdi
cmp rax, 0x20
jb 0x140001310
movabs r15, 0xffffffff00000000
mov rsi, rdi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r13, rax
mov rdi, rsi
nop dword [rax]
xor ebx, ebx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x30
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 0x30]
mov qword [rsp + 0x58], rbx
mov edx, 0x80002048
mov qword [rsp + 0x68], rbx
mov rcx, r14
mov dword [rbp - 0x7c], ebx
movdqu xmmword [rsp + 0x74], xmm0
mov dword [rsp + 0x70], 1
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x78]
mov qword [rbp - 0x78], rbx
lea rax, [rbp - 0x78]
mov qword [rbp - 0x68], rbx
xorps xmm0, xmm0
mov dword [rbp - 0x4c], ebx
mov r9d, 0x30
lea rbx, [rdi + 1]
mov dword [rsp + 0x28], 0x30
mov edx, 0x80002048
mov qword [rsp + 0x20], rax
mov rcx, r14
mov qword [rbp - 0x70], rbx
movdqu xmmword [rbp - 0x5c], xmm0
mov dword [rbp - 0x60], 1
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx eax, byte [rsp + 0x74]
sub al, 0x48
test al, 0xfb
jne 0x140001650
cmp byte [rbp - 0x5c], 0x8d
je 0x1400016ee
mov rdi, rbx
sub rbx, rsi
cmp rbx, 0x200
jb 0x140001580
jmp 0x1400022a3
xor ecx, ecx
mov dword [rsp + 0x70], 4
mov qword [rsp + 0x38], rcx
lea rax, [rbx + 1]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x30], rax
lea r9d, [rcx + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
mov dword [rbp - 0x7c], ecx
mov dword [rsp + 0x28], 0x30
mov edx, 0x80002048
mov rcx, r14
mov qword [rsp + 0x20], rax
movdqu xmmword [rsp + 0x74], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x74]
movabs r15, 0xffffffff00000000
add eax, ebx
and rbx, r15
lea rsi, [rbx + 5]
add rsi, rax
jne 0x140001568
jmp 0x140001565
mov qword [rsp + 0x38], 0
lea rax, [rdi + 3]
mov qword [rbp - 0x70], rax
lea r8, [rbp - 0x78]
lea rax, [rsp + 0x54]
mov qword [rbp - 0x78], 0
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x30
mov r9d, 0x30
mov qword [rsp + 0x20], rax
mov edx, 0x80002048
mov qword [rbp - 0x68], 0
mov rcx, r14
mov dword [rbp - 0x4c], 0
movdqu xmmword [rbp - 0x5c], xmm0
mov dword [rbp - 0x60], 4
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp - 0x5c]
add eax, edi
and rdi, r15
lea rcx, [rdi + 7]
add rcx, rax
xor al, al
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x40], al
movzx eax, al
lea r15, [rcx + rax*8]
mov rcx, r14
mov rdx, r15
call fcn.1400010d0
test rax, rax
je 0x14000228b
and rax, 0xfffffffffffffff0
mov rcx, r14
lea rdx, [rax + 8]
call fcn.1400010d0
xor edi, edi
mov rsi, rax
xor ebx, ebx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r12 + rbx*8]
cmp rsi, rcx
jbe 0x14000226c
cmp rsi, qword [r12 + rbx*8 + 8]
jae 0x14000226c
mov r8d, 0x104
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
lea rdx, str.EX64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.Eng64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.teefer2.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.teefer3.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.srtsp64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.srtspx64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.srtspl64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.Ironx64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.fekern.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cbk7.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.WdFilter.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cbstream.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.atrsdfw.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.avgtpx86.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.avgtpx64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.naswSP.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.edrsensor.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CarbonBlackK.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.parity.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.csacentr.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.csaenh.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.csareg.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.csascr.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.csaav.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.csaam.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.rvsavd.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cfrmd.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cmdccav.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cmdguard.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CmdMnEfs.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.MyDLPMF.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
xor ecx, ecx
lea rdx, [rbp - 0x40]
lea r8, str.im.sys
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140001ae9
cmp rcx, 7
jne 0x140001ad0
jmp 0x1400021a9
lea rdx, str.csagent.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CybKernelTracker.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CRExecPrev.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CyOptics.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CyProtectDrv32.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.CyProtectDrv64.sys.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.groundling32.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.groundling64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.esensor.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.edevmon.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.ehdrv.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.FeKern.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.WFP_MRT.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.xfsgk.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.fsatp.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.fshs.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.HexisFSMonitor.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.klifks.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.klifaa.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.Klifsm.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.mbamwatchdog.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.mfeaskm.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.mfencfilter.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.PSINPROC.SYS
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.PSINFILE.SYS
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.amfsm.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.amm8660.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.amm6460.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
xor ecx, ecx
lea rdx, [rbp - 0x40]
lea r8, str.eaw.sys
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140001db9
cmp rcx, 8
jne 0x140001da0
jmp 0x1400021a9
lea rdx, str.SAFE_Agent.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.SentinelMonitor.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.SAVOnAccess.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.savonaccess.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
xor eax, eax
lea rdx, [rbp - 0x40]
lea r8, str.sld.sys
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001e49
cmp rax, 8
jne 0x140001e30
jmp 0x1400021a9
lea rdx, str.pgpwdefs.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.GEProtection.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.diflt.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.sysMon.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.ssrfsf.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.emxdrv2.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.reghook.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.spbbcdrv.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.bhdrvx86.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.bhdrvx64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.symevent.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.vxfsrep.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.VirtFile.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.SymAFR.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.symefasi.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.symefa.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.symefa64.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.SymHsm.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.evmf.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.GEFCMP.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.VFSEnc.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.pgpfs.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.fencry.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.symrg.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.ndgdmk.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.ssfmonm.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.SISIPSFileFilter.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cyverak.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cyvrfsfd.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cyvrmtgn.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.tdevflt.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.tedrdrv.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.tedrpers.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.telam.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.cyvrlpc.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.EsProbe.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400021a9
lea rdx, str.MpKslf8d86dba.sys
lea rcx, [rbp - 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000226c
mov edx, 9
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
mov qword [rbp - 0x70], r15
mov qword [rsp + 0x38], rax
lea r8, [rbp - 0x78]
mov qword [rbp - 0x78], rax
xorps xmm0, xmm0
mov qword [rbp - 0x68], rax
mov r9d, 0x30
lea rax, [rsp + 0x54]
mov qword [rbp - 0x60], 4
mov qword [rsp + 0x30], rax
mov edx, 0x8000204c
lea rax, [rbp - 0x78]
mov dword [rsp + 0x28], 0x30
mov rcx, r14
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ecx, ecx
mov qword [rsp + 0x70], 4
mov qword [rsp + 0x38], rcx
lea rax, [r15 + 4]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x30], rax
lea r9d, [rcx + 0x30]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x30
mov edx, 0x8000204c
mov qword [rsp + 0x20], rax
mov rcx, r14
movdqu xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
inc edi
inc rbx
cmp edi, 0x3ff
jb 0x1400017b0
mov edx, 7
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
inc al
mov byte [rsp + 0x40], al
cmp al, 0x10
jb 0x140001772
mov r13, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x228]
mov r15, qword [rsp + 0x1e0]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140002eb0
add rsp, 0x1f8
pop r14
pop r12
pop rdi
pop rbp
ret