Function at 0x188fc
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x388
mov rax, qword [0x00012600]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov ebx, 0x58
mov r15, r8
mov qword [rsp + 0x60], r8
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x90], rcx
lea ebp, [rbx - 0x57]
mov r8d, 0x4d525356
mov rdx, rbx
mov ecx, ebp
mov qword [rsp + 0xe8], r9
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r13d, r13d
mov rdi, rax
cmp rax, r13
je 0x19aba
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.00011ce0
mov byte [rdi + 1], bpl
movabs rbx, 0xfffff78000000320
mov rbx, qword [rbx]
mov rcx, r12
mov qword [rsp + 0xb0], rbx
call fcn.000107c0
movzx r11d, byte [r12]
cmp r11d, 0x15
jg 0x1978c
je 0x1973c
cmp r11d, 0x10
jg 0x18b27
je 0x18ac5
cmp r11d, r13d
je 0x18a8f
lea edx, [rbp + 1]
sub r11d, edx
je 0x18a60
sub r11d, ebp
je 0x18a07
sub r11d, edx
je 0x189ec
cmp r11d, edx
jne 0x197d7
mov byte [rdi + 1], 0xf
jmp 0x1933b
mov eax, 0x7c07
mov byte [rdi + 1], r13b
mov word [rdi + 2], ax
mov eax, 0x400
mov word [rdi + 4], ax
jmp 0x19a59
mov byte [rdi + 1], r13b
movzx ecx, byte [r12 + 1]
mov eax, dword [r12 + 2]
shr rcx, 1
mov dword [rsi + rcx*2 + 0x3a4], eax
mov al, byte [r12 + 1]
movzx ecx, byte [rsi + 0xa3]
shr al, 1
mov byte [rsi + 0x3e4], al
cmp ecx, r13d
je 0x18a50
sub ecx, ebp
je 0x18ab7
cmp ecx, ebp
jne 0x19a59
mov word [rdi + 2], dx
mov eax, 0xa003
jmp 0x189fe
mov eax, 0x400
mov word [rdi + 2], ax
mov eax, 0xa703
jmp 0x189fe
mov byte [rdi + 1], r13b
movzx eax, byte [r12 + 1]
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x3a4]
mov word [rdi + 2], ax
movzx eax, byte [r12 + 1]
shr rax, 1
movzx eax, word [rsi + rax*2 + 0x3a6]
jmp 0x189fe
mov byte [rdi + 1], r13b
movzx ecx, byte [rsi + 0xa3]
cmp ecx, r13d
je 0x18a50
sub ecx, ebp
je 0x18ab2
cmp ecx, ebp
jne 0x19a59
mov eax, 0x300
jmp 0x18a55
mov edx, 2
mov word [rdi + 2], dx
mov eax, 0xb203
jmp 0x189fe
movzx eax, byte [r12 + 1]
mov r14d, 3
cmp byte [rax + rsi + 0x2a4], r14b
jae 0x18b14
cmp al, 0x3f
jbe 0x18ae8
cmp byte [rsi + 0xa3], r13b
je 0x18b14
cmp al, 0xff
jbe 0x18af5
cmp byte [rsi + 0xa3], bpl
je 0x18b14
cmp al, 0x7f
jbe 0x18b06
mov edx, 2
cmp byte [rsi + 0xa3], dl
je 0x18b14
movzx eax, word [rsi + rax*2 + 0xa4]
mov byte [rdi + 1], r13b
jmp 0x18b19
mov eax, 0x101
mov word [rdi + 4], r13w
mov word [rdi + 2], ax
jmp 0x19a59
sub r11d, 0x11
je 0x19688
sub r11d, ebp
je 0x19343
sub r11d, ebp
je 0x18b98
cmp r11d, ebp
jne 0x197d7
movzx eax, byte [r12 + 1]
cmp byte [rax + rsi + 0x2a4], r13b
jne 0x19a59
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
mov eax, 0xabcd
mov byte [rdi + 1], r13b
mov word [rdi + 2], ax
mov eax, 0x1234
mov word [rdi + 4], ax
movzx eax, byte [r12 + 1]
mov byte [rax + rsi + 0x2a4], r13b
jmp 0x19a45
mov r14d, 3
cmp byte [rsi + 0xa3], r13b
jne 0x18e4a
mov byte [rdi + 1], r13b
movzx eax, byte [r12 + 1]
xor edx, edx
lea r8d, [r14 + 0x35]
cmp byte [rax + rsi + 0x2a4], r14b
jne 0x18db7
lea rcx, [rsp + 0x108]
call fcn.00011ce0
movzx ebp, byte [rsi + 0x3e4]
mov r11d, dword [r12 + 2]
movsxd rcx, ebp
mov dword [rsp + 0x108], r11d
cmp rcx, r13
jl 0x18c1c
lea r8, [rsi + rcx*2 + 0x3a4]
add rcx, 2
lea rdx, [rsp + 0x10c]
shr rcx, 1
mov eax, dword [r8]
sub r8, 4
mov dword [rdx], eax
add rdx, 4
sub rcx, 1
jne 0x18c09
movzx eax, byte [r12 + 1]
movzx r10d, word [rsi + 0xb0]
movzx edx, word [rsi + 0xac]
movzx ecx, word [rsi + rax*2 + 0xa6]
movzx eax, word [rsi + rax*2 + 0xa4]
shl ecx, 0x10
or ecx, eax
bt ecx, 0x1f
jae 0x18d69
bt ecx, 0x1e
mov r9d, IoAttachDeviceToDeviceStack
jb 0x18c94
and ecx, 0x3fff3fff
mov eax, edx
shl eax, 0x10
or ecx, r9d
or eax, edx
mov dword [rsp + 0x84], ecx
or eax, r9d
mov dword [rsp + 0x7c], eax
test cl, 1
je 0x18c8a
bts ecx, 0x1e
mov dword [rsp + 0x84], ecx
mov dword [rsp + 0x78], r13d
jmp 0x18d52
mov r8d, ecx
movzx edx, cx
shr r8d, 0x10
and r8d, 0x3fff
mov ecx, r8d
or ecx, r9d
mov eax, ecx
shr ecx, 1
shl eax, 0xf
or eax, ecx
movzx ecx, ax
mov eax, ecx
shr eax, 0xf
xor eax, ecx
and ecx, 0xfffe
and eax, 1
or eax, ecx
mov dword [rsp + 0x80], eax
test r8b, 0xf
jne 0x18cda
or r8d, 0x10
mov ecx, 0x1e0
test ecx, r8d
jne 0x18ce9
bts r8d, 9
mov r9d, 0x3c00
test r9d, r8d
jne 0x18cf9
bts r8d, 0xe
bt edx, 0xf
jae 0x18d04
bts r8d, 0xe
mov eax, r8d
shl eax, 2
or eax, r14d
mov dword [rsp + 0x84], eax
test dl, 0xf
jne 0x18d1c
or edx, 0x10
test ecx, edx
jne 0x18d24
bts edx, 9
test r9d, edx
jne 0x18d2d
bts edx, 0xe
xor edx, 1
mov eax, r10d
mov dword [rsp + 0x78], 1
and edx, 0x7fff
shl eax, 2
or eax, r14d
mov dword [rsp + 0x88], edx
mov dword [rsp + 0x7c], eax
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x108]
mov edx, 0xe
call fcn.0001b1b0
cmp rbp, r13
mov ecx, r13d
jl 0x18da4
lea rcx, [rbp + 2]
lea r8, [rsi + rbp*2 + 0x3a4]
lea rdx, [rsp + 0x108]
shr rcx, 1
mov ebp, 1
mov r9, rcx
mov eax, dword [rdx]
add rdx, 4
mov dword [r8], eax
sub r8, 4
sub r9, rbp
jne 0x18d90
jmp 0x18da9
mov ebp, 1
mov eax, ecx
mov ecx, dword [rsp + rax*4 + 0x108]
jmp 0x18e47
lea rcx, [rsp + 0x140]
call fcn.00011ce0
movzx r9d, byte [rsi + 0x3e4]
mov r11d, dword [r12 + 2]
movsxd rcx, r9d
mov dword [rsp + 0x140], r11d
cmp rcx, r13
jl 0x18e0a
lea r8, [rsi + rcx*2 + 0x3a4]
add rcx, 2
lea rdx, [rsp + 0x144]
shr rcx, 1
mov eax, dword [r8]
sub r8, 4
mov dword [rdx], eax
add rdx, 4
sub rcx, rbp
jne 0x18df8
cmp r9, r13
mov ecx, r13d
jl 0x18e3e
lea rcx, [r9 + 2]
lea r8, [rsi + r9*2 + 0x3a4]
lea rdx, [rsp + 0x140]
shr rcx, 1
mov r9, rcx
mov eax, dword [rdx]
add rdx, 4
mov dword [r8], eax
sub r8, 4
sub r9, rbp
jne 0x18e2c
mov eax, ecx
mov ecx, dword [rsp + rax*4 + 0x140]
mov dword [rdi + 2], ecx
cmp byte [rsi + 0xa3], bpl
jb 0x1933b
mov byte [rdi + 1], r13b
mov eax, dword [r15]
mov dword [rsp + 0x68], ebp
and eax, 0xfffffff8
mov ebp, 8
cmp eax, ebp
jbe 0x18ea8
mov ebx, dword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r15d, ebp
mov ecx, r15d
add rcx, r12
call fcn.000107c0
mov eax, dword [rsi]
inc ebx
shr eax, 3
add r15d, ebp
cmp ebx, eax
jb 0x18e7a
mov rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
xor edx, edx
lea rcx, [rsp + 0x180]
lea r8d, [rdx + 0x50]
call fcn.00011ce0
xor edx, edx
lea rcx, [rsp + 0x1d0]
lea r8d, [rdx + 0x50]
call fcn.00011ce0
mov r8d, dword [r15]
mov r11d, dword [r12 + 2]
mov r9d, r8d
mov dword [rsp + 0x1d0], r11d
shr r9d, 3
cmp r9d, 1
jbe 0x18f22
mov r11d, r8d
mov r10d, r13d
lea rdx, [r12 + 8]
shr r11d, 3
dec r11d
mov eax, dword [rdx]
mov ecx, r10d
add r10d, 6
mov dword [rsp + rcx + 0x180], eax
movzx eax, word [rdx + 4]
add rdx, rbp
sub r11, 1
mov word [rsp + rcx + 0x184], ax
jne 0x18efd
lea eax, [r9 + r9]
mov edx, 2
sub r8d, eax
mov al, byte [r12 + 6]
sub r8d, edx
and al, 6
mov dword [rsp + 0x68], r8d
cmp al, 4
jne 0x18f4a
add r8d, 0xfffffffe
mov dword [rsp + 0x68], r8d
mov r11d, 0xfffffffc
cmp al, dl
jne 0x18f5c
add r8d, r11d
mov dword [rsp + 0x68], r8d
mov r15d, r8d
mov r10b, 1
shr r15d, 2
lea edx, [r15 - 1]
cmp edx, r13d
jbe 0x18f97
lea r9d, [rdx*4 - 4]
mov eax, dword [rsp + r9 + 0x180]
movzx ecx, r10b
dec edx
inc r10b
add r9d, r11d
mov dword [rsp + rcx*4 + 0x1d0], eax
cmp edx, r13d
ja 0x18f77
movzx eax, byte [r12 + 1]
mov qword [rsp + 0x100], rax
cmp byte [rax + rsi + 0x2a4], r14b
jne 0x1927c
mov r12d, 0x50
lea rcx, [rsp + 0x180]
xor edx, edx
mov r8, r12
call fcn.00011ce0
lea rcx, [rsp + 0x320]
mov r8, r12
xor edx, edx
call fcn.00011ce0
mov r12d, dword [rsp + 0x68]
cmp r12d, r13d
jbe 0x19006
mov rcx, r13
mov rdx, r12
mov al, byte [rsp + rcx + 0x1d0]
inc rcx
xor al, 0x69
sub rdx, 1
mov byte [rsp + rcx + 0x31f], al
jne 0x18fed
mov r14d, 0x100
lea rcx, [rsp + 0x220]
xor edx, edx
mov r8, r14
call fcn.00011ce0
movzx r11d, byte [rsp + 0x100]
lea rcx, [0x0001b7a0]
mov dword [rsp + 0x48], r11d
mov qword [rsp + 0x40], rcx
lea rax, [rsi + 0x14f8]
mov qword [rsp + 0x38], rax
lea rax, str.RegistryMACHINESystemCurrentControlSetMkbus
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x30], rax
lea rax, [0x0001b7b0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x20], 0x800
call fcn.00010590
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0xf0]
lea r8, [rsp + 0xb8]
lea rcx, [rsp + 0x70]
mov edx, 0x20019
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], r13
mov dword [rsp + 0xd0], 0x40
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x191c1
lea rcx, [rsp + 0x220]
mov r8, r14
xor edx, edx
call fcn.00011ce0
cmp r15d, r13d
jbe 0x19199
lea r14, [rsp + 0x1d2]
mov ebx, r15d
lea rcx, [rsp + 0x220]
xor edx, edx
mov r8d, 0x100
call fcn.00011ce0
movzx r11d, byte [r14 + 1]
movzx eax, byte [r14]
movzx ecx, byte [r14 - 1]
movzx edx, byte [r14 - 2]
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
lea rax, [rsp + 0x220]
lea rcx, [rsp + 0x220]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [0x0001b7d0]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.00010590
add r14, 4
sub rbx, 1
jne 0x19115
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x320]
lea rdx, [rsp + 0x220]
mov r9d, r12d
call fcn.0001099c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov r8b, r13b
cmp r15d, r13d
jbe 0x191f1
lea edx, [r15*4 - 4]
mov eax, dword [rsp + rdx + 0x320]
movzx ecx, r8b
dec r15d
inc r8b
add edx, 0xfffffffc
mov dword [rsp + rcx*4 + 0x180], eax
cmp r15d, r13d
ja 0x191d1
mov eax, dword [rsp + 0x180]
mov r15, qword [rsp + 0x60]
mov r12d, 1
mov dword [rdi + 2], eax
mov eax, dword [r15]
and eax, 0xfffffff8
cmp eax, ebp
jbe 0x1933b
mov rsi, qword [rsp + 0x60]
lea r15d, [r12 + 5]
mov r14d, 0x4d2
mov eax, r13d
movzx r8d, r12w
lea rcx, [rax + rdi + 8]
lea eax, [r15 - 2]
imul r8w, r14w
mov edx, eax
mov eax, dword [rsp + rax + 0x180]
xor r8w, bx
mov dword [rcx], eax
movzx eax, word [rsp + rdx + 0x184]
mov word [rcx + 4], ax
lea eax, [r13 + 6]
mov word [rax + rdi + 8], r8w
call fcn.000107c0
mov eax, dword [rsi]
shr eax, 3
inc r12d
add r15d, 6
add r13d, ebp
cmp r12d, eax
jb 0x19224
jmp 0x1932e
mov r8b, r13b
cmp r15d, r13d
jbe 0x192ac
lea edx, [r15*4 - 4]
mov eax, dword [rsp + rdx + 0x1d0]
movzx ecx, r8b
dec r15d
inc r8b
add edx, r11d
mov dword [rsp + rcx*4 + 0x180], eax
cmp r15d, r13d
ja 0x1928c
mov eax, dword [rsp + 0x180]
mov r15, qword [rsp + 0x60]
mov r12d, 1
mov dword [rdi + 2], eax
mov eax, dword [r15]
and eax, 0xfffffff8
cmp eax, ebp
jbe 0x1933b
mov rsi, qword [rsp + 0x60]
lea r15d, [r12 + 5]
mov r14d, 0x4d2
mov eax, r13d
movzx r8d, r12w
lea rcx, [rax + rdi + 8]
lea eax, [r15 - 2]
imul r8w, r14w
mov edx, eax
mov eax, dword [rsp + rax + 0x180]
xor r8w, bx
mov dword [rcx], eax
movzx eax, word [rsp + rdx + 0x184]
mov word [rcx + 4], ax
lea eax, [r13 + 6]
mov word [rax + rdi + 8], r8w
call fcn.000107c0
mov eax, dword [rsi]
shr eax, 3
inc r12d
add r15d, 6
add r13d, ebp
cmp r12d, eax
jb 0x192db
mov r15, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
mov ebp, dword [r15]
jmp 0x19a5e
mov r14d, 3
cmp byte [rsi + 0xa3], r13b
jne 0x194d2
mov byte [rdi + 1], r13b
movzx eax, byte [r12 + 1]
cmp byte [rax + rsi + 0x2a4], r14b
jne 0x194be
movzx eax, byte [r12 + 1]
movzx r10d, word [rsi + 0xb0]
movzx edx, word [rsi + 0xac]
movzx ecx, word [rsi + rax*2 + 0xa6]
movzx eax, word [rsi + rax*2 + 0xa4]
shl ecx, 0x10
or ecx, eax
bt ecx, 0x1f
jae 0x194be
bt ecx, 0x1e
mov r9d, IoAttachDeviceToDeviceStack
jb 0x193ec
and ecx, 0x3fff3fff
mov eax, edx
shl eax, 0x10
or ecx, r9d
or eax, edx
mov dword [rsp + 0xa4], ecx
or eax, r9d
mov dword [rsp + 0x9c], eax
test bpl, cl
je 0x193df
bts ecx, 0x1e
mov dword [rsp + 0xa4], ecx
mov dword [rsp + 0x98], r13d
jmp 0x194aa
mov r8d, ecx
movzx edx, cx
shr r8d, 0x10
and r8d, 0x3fff
mov ecx, r8d
or ecx, r9d
mov eax, ecx
shr ecx, 1
shl eax, 0xf
or eax, ecx
movzx ecx, ax
mov eax, ecx
shr eax, 0xf
xor eax, ecx
and ecx, 0xfffe
and eax, ebp
or eax, ecx
mov dword [rsp + 0xa0], eax
test r8b, 0xf
jne 0x19431
or r8d, 0x10
mov ecx, 0x1e0
test ecx, r8d
jne 0x19440
bts r8d, 9
mov r9d, 0x3c00
test r9d, r8d
jne 0x19450
bts r8d, 0xe
bt edx, 0xf
jae 0x1945b
bts r8d, 0xe
mov eax, r8d
shl eax, 2
or eax, r14d
mov dword [rsp + 0xa4], eax
test dl, 0xf
jne 0x19473
or edx, 0x10
test ecx, edx
jne 0x1947b
bts edx, 9
test r9d, edx
jne 0x19484
bts edx, 0xe
xor edx, ebp
mov eax, r10d
mov dword [rsp + 0x98], ebp
and edx, 0x7fff
shl eax, 2
or eax, r14d
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0x9c], eax
lea rcx, [r12 + 2]
lea r8, [rsp + 0x98]
mov edx, ebp
call fcn.0001b1b0
movzx eax, word [r12 + 2]
mov word [rdi + 2], ax
movzx eax, word [r12 + 4]
mov word [rdi + 4], ax
cmp byte [rsi + 0xa3], bpl
jb 0x19a59
mov byte [rdi + 1], r13b
mov eax, dword [r12 + 2]
mov dword [rdi + 2], eax
movzx eax, byte [r12 + 1]
cmp byte [rax + rsi + 0x2a4], r14b
jne 0x19683
mov eax, 0x69ad
mov ebp, 0x100
lea rcx, [rsp + 0x220]
xor word [rdi + 2], ax
mov eax, 0x5c9f
mov r8, rbp
xor word [rdi + 4], ax
xor edx, edx
call fcn.00011ce0
movzx r11d, byte [r12 + 1]
lea rcx, [0x0001b7a0]
mov dword [rsp + 0x48], r11d
mov qword [rsp + 0x40], rcx
lea rax, [rsi + 0x14f8]
mov qword [rsp + 0x38], rax
lea rax, str.RegistryMACHINESystemCurrentControlSetMkbus
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x30], rax
lea rax, [0x0001b7b0]
mov r14d, 0x800
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x20], r14d
call fcn.00010590
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0xf0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0xf0]
lea r8, [rsp + 0xb8]
lea rcx, [rsp + 0x70]
mov edx, 0x20019
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xb8], 0x30
mov qword [rsp + 0xc0], r13
mov dword [rsp + 0xd0], 0x40
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0xe0], r13
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, r13d
jl 0x19683
lea rcx, [rsp + 0x220]
mov r8, rbp
xor edx, edx
call fcn.00011ce0
movzx eax, byte [r12 + 4]
movzx ecx, byte [r12 + 3]
movzx r9d, byte [r12 + 2]
movzx r11d, byte [r12 + 5]
xor r8d, r8d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], r9d
lea rax, [0x0001b800]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov rdx, rbp
mov dword [rsp + 0x20], r14d
call fcn.00010590
mov rcx, qword [rsp + 0x70]
lea r8, [rdi + 2]
lea rdx, [rsp + 0x220]
mov r9d, 4
call fcn.0001099c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x19a59
mov al, byte [r12 + 1]
cmp al, 0x3f
jbe 0x1969a
cmp byte [rsi + 0xa3], r13b
je 0x196b8
cmp al, 0xff
jbe 0x196a7
cmp byte [rsi + 0xa3], bpl
je 0x196b8
cmp al, 0x7f
jbe 0x196cb
mov edx, 2
cmp byte [rsi + 0xa3], dl
jne 0x196cb
mov eax, 0x101
mov word [rdi + 4], r13w
mov word [rdi + 2], ax
jmp 0x19a59
movzx eax, al
mov r14d, 3
cmp byte [rax + rsi + 0x2a4], r14b
jb 0x196ed
mov word [rdi + 2], r13w
mov word [rdi + 4], r14w
jmp 0x19a59
movzx eax, byte [r12 + 1]
mov r9d, 0xff00
movzx r8d, word [rsi + rax*2 + 0xa4]
mov dl, byte [rsi + rax + 0x2a4]
movzx eax, bx
movzx ecx, r8w
and ax, r9w
and dl, r14b
shr cx, 0xe
shl r8w, 2
or cx, ax
movzx eax, dl
or r8w, ax
mov word [rdi + 2], cx
mov word [rdi + 4], r8w
mov byte [rdi + 1], r13b
jmp 0x19a59
movzx eax, byte [r12 + 1]
cmp byte [rax + rsi + 0x2a4], r13b
jne 0x19a59
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
mov eax, 0xabcd
mov byte [rdi + 1], r13b
mov word [rdi + 2], ax
mov eax, 0x1234
mov word [rdi + 4], ax
movzx eax, byte [r12 + 1]
mov byte [rax + rsi + 0x2a4], bpl
jmp 0x19a45
sub r11d, 0x16
je 0x199fe
sub r11d, ebp
je 0x199dc
sub r11d, ebp
je 0x199a2
sub r11d, ebp
je 0x19968
sub r11d, ebp
je 0x1992e
sub r11d, ebp
je 0x198c4
mov edx, 2
sub r11d, edx
je 0x19869
sub r11d, 4
je 0x197e0
mov byte [rdi + 1], r13b
jmp 0x1933b
cmp byte [rsi + 0xa3], bpl
jb 0x19a59
movzx eax, word [r12 + 4]
movzx ecx, word [r12 + 2]
mov r9d, 0xff00
mov edx, eax
and eax, r9d
mov r9d, 0x20
shl edx, 0x10
or edx, eax
mov eax, ecx
shr eax, 8
shl edx, 8
movzx r8d, al
movzx eax, cl
shl eax, 8
or r8d, eax
mov ecx, edx
mov eax, r8d
sub r9d, ebp
shl eax, 0xc
and ecx, 0xfffff000
shr r8d, 1
xor ecx, eax
mov eax, edx
and eax, 0xfff00000
shl ecx, 8
xor ecx, eax
mov eax, edx
shl ecx, 0xb
shr eax, 1
mov edx, ecx
or edx, eax
cmp r9d, r13d
jg 0x19824
mov word [rdi + 2], dx
movzx eax, word [r12 + 4]
mov word [rdi + 4], ax
jmp 0x19733
movzx eax, byte [r12 + 1]
mov cl, byte [rax + rsi + 0x2a4]
cmp cl, r13b
je 0x19883
cmp cl, dl
jne 0x19a59
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
mov eax, 0xabcd
mov byte [rdi + 1], r13b
mov ecx, 0xffff
mov word [rdi + 2], ax
mov eax, 0x1234
mov word [rdi + 4], ax
movzx eax, byte [r12 + 1]
add word [rsi + rax*2 + 0xa4], cx
jmp 0x19a59
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a4]
cmp word [rsi + 0xa8], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a6]
cmp word [rsi + 0xaa], ax
jne 0x19a59
mov eax, 0xabcd
mov byte [rdi + 1], r13b
mov r14d, 3
mov word [rdi + 2], ax
mov eax, 0x1234
mov word [rdi + 4], ax
movzx eax, byte [r12 + 1]
mov byte [rax + rsi + 0x2a4], r14b
jmp 0x19a45
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a4]
cmp word [rsi + 0xa8], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a6]
cmp word [rsi + 0xaa], ax
jmp 0x19a1b
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a4]
cmp word [rsi + 0xa8], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a6]
cmp word [rsi + 0xaa], ax
jmp 0x1975d
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a4]
cmp word [rsi + 0xa8], ax
jne 0x19a59
movzx eax, word [rsi + 0x3a6]
cmp word [rsi + 0xaa], ax
jmp 0x18b69
movzx eax, byte [r12 + 1]
cmp byte [rax + rsi + 0x2a4], r13b
jne 0x19a59
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jmp 0x198f9
movzx eax, byte [r12 + 1]
cmp byte [rax + rsi + 0x2a4], r13b
jne 0x19a59
movzx eax, word [r12 + 4]
cmp word [rsi + 0xac], ax
jne 0x19a59
mov eax, 0xabcd
mov byte [rdi + 1], r13b
mov edx, 2
mov word [rdi + 2], ax
mov eax, 0x1234
mov word [rdi + 4], ax
movzx eax, byte [r12 + 1]
mov byte [rax + rsi + 0x2a4], dl
movzx ecx, byte [r12 + 1]
movzx eax, word [r12 + 2]
mov word [rsi + rcx*2 + 0xa4], ax
mov ebp, 8
mov al, byte [rdi + 5]
mov rcx, rdi
add al, byte [rdi + 4]
add al, byte [rdi + 3]
add al, byte [rdi + 2]
add al, byte [rdi + 1]
mov word [rdi + 6], bx
mov byte [rdi], al
call fcn.000107c0
mov eax, dword [r15]
mov rcx, qword [rsp + 0xe8]
mov r11d, ebp
mov rdx, rdi
add r11, 2
cmp r11, rax
cmovb rax, r11
mov r8d, eax
mov dword [r15], eax
call fcn.00011990
mov r11d, dword [r15]
mov edx, 0x4d525356
mov rcx, rdi
mov dword [rsi + 0x436], r11d
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.00011e70
add rsp, 0x388
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret