Function at 0x14007b0a0
Capabilities:
Create device object

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x78], rcx
mov eax, dword [0x140099c0c]
mov ecx, dword [0x1400979b8]
mov edx, dword [0x1400979bc]
shrd edx, ecx, 4
xor edx, eax
xor edx, 0x6337113
imul ecx, dword [0x1400979c0], 0x2936597c
imul r8d, dword [0x1400979c4], 0x8c0556e4
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xfbc26555
and eax, edx
mov ecx, dword [0x1400979c8]
mov edx, dword [0x1400979cc]
shrd edx, ecx, 0x16
imul ecx, dword [0x1400979d0], 0xde47583d
imul r8d, dword [0x1400979d4], 0x4a20e8d2
xor edx, 0x1fe6a466
mov r9d, dword [0x1400979d8]
mov r10d, dword [0x1400979dc]
shrd r10d, r9d, 9
mov r9d, dword [0x1400979e0]
mov r11d, dword [0x1400979e4]
shrd r11d, r9d, 2
xor r10d, 0xd18caf58
xor r11d, 0xe58f7f0c
cmp eax, edx
mov eax, r8d
lea eax, [rcx + rax - 0x6b53958b]
cmove r11d, r10d
cmp dword [0x140099c10], eax
cmovl r11d, r10d
mov dword [rbp - 0x6c], r11d
xorps xmm6, xmm6
mov edx, 0x982aa3cf
mov r13d, edx
mov edx, ecx
mov ecx, ebx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], rsi
mov rsi, r15
mov qword [rbp - 0x30], rdi
mov rdi, r9
mov rbx, r8
mov r15b, byte [rbp - 0x11]
mov r8b, byte [rbp - 0x12]
mov r14b, byte [rbp - 0x13]
cmp r13d, 0x1aa0d038
jle 0x14007b389
cmp r13d, 0x554b5460
jg 0x14007b529
cmp r13d, 0x418e2de3
jg 0x14007b6e1
cmp r13d, 0x279dd1fa
jle 0x14007bcca
cmp r13d, 0x371bc283
mov byte [rbp - 0x15], al
mov dword [rbp - 0x1c], edx
jg 0x14007c433
cmp r13d, 0x279dd1fb
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
je 0x14007ce63
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x2d60e7d8
jne 0x14007b18a
mov rcx, qword [0x140099dc8]
sub rsp, 0x20
lea rdx, [0x140099db8]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
add rsp, 0x20
mov rsi, qword [rbp - 0x38]
mov dword [rsi], eax
mov ecx, dword [0x140097da8]
mov edx, dword [0x140097da4]
shrd ecx, edx, 6
xor ecx, 0xc31b1bb2
cmp eax, ecx
mov eax, dword [0x140097db0]
setg bl
mov ecx, dword [0x140097dac]
shrd eax, ecx, 6
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x54b89595
imul eax, ecx
mov ecx, dword [0x140097dc0]
mov edx, dword [0x140097dbc]
shrd ecx, edx, 6
imul edx, dword [0x140097db8], 0x8ea8d7f6
imul r8d, dword [0x140097db4], 0x48a0f3dc
add edx, r8d
add edx, 0x489f2ac9
mov r8d, dword [0x140097dc8]
mov r9d, dword [0x140097dc4]
shrd r8d, r9d, 0xa
mov r9d, dword [0x140097dd0]
mov r10d, dword [0x140097dcc]
shrd r9d, r10d, 2
and edx, eax
xor ecx, 0x62247829
xor r8d, 0x81af5214
imul eax, dword [0x140097dd4], 0xcb54838e
xor r9d, 0x5eb877a
imul r10d, dword [0x140097dd8], 0xc9345715
cmp edx, ecx
mov ecx, r10d
lea edx, [rax + rcx - 0x4965aba0]
cmove edx, r9d
cmp dword [0x140099c10], r8d
cmovl edx, r9d
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
jmp 0x14007c250
cmp r13d, 0xbf6bd228
mov byte [rbp - 0x15], al
mov dword [rbp - 0x1c], edx
mov byte [rbp - 0x14], cl
jle 0x14007b60d
cmp r13d, 0xa451909
jg 0x14007bb15
cmp r13d, 0xdbe0537d
jle 0x14007c343
cmp r13d, 0xe69c32ad
jg 0x14007c989
cmp r13d, 0xdbe0537e
je 0x14007dbaa
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xe1c8468b
jne 0x14007b18a
mov eax, dword [0x140097e80]
mov ecx, dword [0x140097e7c]
shrd eax, ecx, 0x1a
xor eax, 0x6b0a1f47
mov rbx, qword [rbp - 0x60]
mov dword [rbx], eax
mov eax, dword [0x140097e88]
mov ecx, dword [0x140097e84]
shrd eax, ecx, 0x10
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0xb7df1f6f
imul eax, ecx
mov ecx, dword [0x140097e90]
mov edx, dword [0x140097e8c]
shrd ecx, edx, 0x1b
xor ecx, 0xb5f3e889
and ecx, eax
imul eax, dword [0x140097e98], 0xf55113e2
imul edx, dword [0x140097e94], 0x5dad43d4
imul r8d, dword [0x140097e9c], 0x2f679e08
imul r9d, dword [0x140097ea0], 0x8a6ee61c
imul r10d, dword [0x140097ea4], 0x2b2af259
imul r11d, dword [0x140097ea8], 0xf414fdff
imul esi, dword [0x140097eac], 0x243c3c68
imul edi, dword [0x140097eb0], 0xd71c902f
add eax, edx
add eax, 0x1ab8eb66
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0xfdfdcd6]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x10a8f716]
mov edx, edi
mov r8d, esi
lea edx, [r8 + rdx + 0x7453aeb6]
cmove edx, ecx
cmp dword [0x140099c10], eax
cmovl edx, ecx
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, rbx
jmp 0x14007cd06
cmp r13d, 0x70f784fa
jg 0x14007b9c0
cmp r13d, 0x5fb666e1
mov byte [rbp - 0x15], al
jle 0x14007be62
cmp r13d, 0x67dc7105
jg 0x14007c4e5
cmp r13d, 0x5fb666e2
je 0x14007d070
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov byte [rbp - 0x14], cl
mov ecx, edx
mov dword [rbp - 0x1c], edx
mov edx, r13d
cmp r13d, 0x64cbe6b5
jne 0x14007b18a
mov rsi, qword [rbp - 0x38]
mov eax, dword [rsi]
mov r14, qword [rbp - 0x28]
mov dword [r14], eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov r12, qword [rbp - 0x40]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0xa45190a
jmp 0x14007b18a
cmp r13d, 0xa66e68a0
jg 0x14007bc01
cmp r13d, 0x8cdf8077
jle 0x14007c175
cmp r13d, 0x9fc991dd
jg 0x14007c856
cmp r13d, 0x8cdf8078
mov byte [rbp - 0x16], r8b
je 0x14007d702
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x982aa3cf
jne 0x14007b18a
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x6c]
jmp 0x14007b18a
cmp r13d, 0x49a8b258
mov dword [rbp - 0x1c], edx
mov byte [rbp - 0x14], cl
jle 0x14007bf20
cmp r13d, 0x52b3b53a
mov byte [rbp - 0x15], al
jg 0x14007c606
cmp r13d, 0x49a8b259
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x60], rbx
je 0x14007d0ca
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x4b133934
jne 0x14007b18a
mov r15, qword [rbp - 0x48]
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x20
mov rax, qword [str.e5txX]
mov rcx, qword [0x140098118]
shrd rcx, rax, 0x2d
movabs rax, 0x369bf3a1a8df3479
xor rcx, rax
mov rdi, qword [rbp - 0x30]
mov qword [rdi], rcx
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rdi], rax
sub rsp, 0x20
mov rcx, rdi
call fcn.140004232
add rsp, 0x20
mov dword [0x140099dd0], eax
imul eax, dword [0x140098120], 0x3426a
imul ecx, dword [0x140098124], 0xd06d2574
imul edx, dword [0x140098128], 0xffae4d33
imul r9d, dword [0x14009812c], 0x7b89cbba
lea r8d, [rax + rcx]
add r8d, 0xc625df88
mov eax, r9d
mov ecx, edx
add eax, ecx
add eax, 0xab8af0b6
sub rsp, 0x30
mov dword [rsp + 0x20], eax
lea rcx, [0x140088e5c]
lea rdx, [0x140088ec0]
lea r9, [0x140099dd0]
call fcn.1400146b2
add rsp, 0x10
mov r8d, 0x1fe
mov rsi, qword [rbp - 0x58]
mov rcx, rsi
lea rdx, [0x140088ee0]
call fcn.140089380
add rsp, 0x20
mov rax, qword [0x140098130]
movabs rcx, 0x43a00aae0d878153
imul rax, rcx
mov rcx, qword [0x140098138]
movabs rdx, 0xb0887763298acd4f
imul rcx, rdx
add rcx, rax
mov rdx, rcx
movabs rax, 0x954c9be0085890c1
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call fcn.140002e76
mov r8d, 0x1fe
mov rbx, qword [rbp - 0x50]
mov rcx, rbx
xor edx, edx
call fcn.140089280
add rsp, 0x20
mov rax, qword [0x140098140]
mov rcx, qword [0x140098148]
shrd rcx, rax, 0x31
mov rdx, rcx
movabs rax, 0xa2120d7b60709ea8
xor rdx, rax
sub rsp, 0x20
mov rcx, rbx
lea r8, [0x1400890de]
mov r9, rsi
call fcn.14007eb45
lea rcx, [0x140099db8]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add rsp, 0x20
mov eax, dword [0x140098150]
mov ecx, dword [0x140098154]
shrd ecx, eax, 0x1d
xor ecx, 0x7d2ef281
mov rax, qword [0x140098158]
movabs rdx, 0xf950f75bfdb60390
imul rax, rdx
mov rdx, qword [0x140098160]
movabs r8, 0x8802e77ac5a2f513
imul rdx, r8
add rdx, rax
imul eax, dword [0x140098168], 0x781f7dc0
imul r8d, dword [0x14009816c], 0x49a39e8d
movabs r9, 0x5b6fd82c43c20520
add rdx, r9
add r8d, eax
add r8d, 0x13b01f99
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
add rsp, 0x20
mov qword [0x140099dc8], rax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, rbx
mov r11, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x67dc7106
jmp 0x14007b18a
cmp r13d, 0x7e5cff6b
jle 0x14007bfe4
cmp r13d, 0x7f1f4ae3
jg 0x14007c79e
cmp r13d, 0x7e5cff6c
mov byte [rbp - 0x15], al
mov byte [rbp - 0x14], cl
je 0x14007d1c4
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov dword [rbp - 0x1c], edx
mov edx, r13d
cmp r13d, 0x7ef4f0be
jne 0x14007b18a
mov eax, dword [0x140097e50]
mov ecx, dword [0x140097e4c]
shrd eax, ecx, 9
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x6a5f8c99
imul eax, ecx
imul ecx, dword [0x140097e58], 0xb78438d1
imul edx, dword [0x140097e54], 0xf4b69e87
add ecx, edx
add ecx, 0x89fc7751
and ecx, eax
mov eax, dword [0x140097e60]
mov edx, dword [0x140097e5c]
shrd eax, edx, 3
imul edx, dword [0x140097e64], 0xd03f0095
imul r8d, dword [0x140097e68], 0x93db8ef9
imul r9d, dword [0x140097e6c], 0xdd85d0fd
imul r10d, dword [0x140097e70], 0x46297dda
imul r11d, dword [0x140097e74], 0x4f25346f
imul esi, dword [0x140097e78], 0x27908804
xor eax, 0x87a35c07
cmp ecx, eax
mov eax, r8d
mov ecx, edx
lea eax, [rcx + rax + 0x31442525]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx + 0x16c9921b]
mov edx, esi
mov r8d, r11d
lea edx, [r8 + rdx - 0x13fc522e]
cmove edx, ecx
cmp dword [0x140099c10], eax
cmovl edx, ecx
jmp 0x14007ccf0
cmp r13d, 0xfc9f87f
jle 0x14007c3bb
cmp r13d, 0x17a64802
jg 0x14007cbca
cmp r13d, 0xfc9f880
mov byte [rbp - 0x16], r8b
mov qword [rbp - 0x50], r10
je 0x14007dc82
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x15ddd576
jne 0x14007b18a
imul eax, dword [0x1400981c0], 0x5fd099a5
imul ecx, dword [0x1400981bc], 0x5ac9fbcf
add eax, ecx
mov r8, qword [rbp - 0x60]
mov ecx, dword [r8]
lea eax, [rcx + rax - 0x34328151]
mov dword [r8], eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x800e650d
jmp 0x14007b18a
cmp r13d, 0xae7f9996
jg 0x14007c25d
cmp r13d, 0xa73d1e72
jle 0x14007cd52
cmp r13d, 0xa73d1e73
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x60], rbx
je 0x14007cd98
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xa8a015f1
jne 0x14007b18a
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0xdbe0537e
jmp 0x14007b18a
cmp r13d, 0x1aa0d039
je 0x14007e340
cmp r13d, 0x1e84193d
je 0x14007dfcf
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov byte [rbp - 0x14], cl
mov ecx, edx
mov dword [rbp - 0x1c], edx
mov edx, r13d
cmp r13d, 0x2295da54
jne 0x14007b18a
mov eax, dword [0x140097ee8]
mov ecx, dword [0x140097ee4]
shrd eax, ecx, 0xc
xor eax, 0x6a575d96
mov rdi, qword [rbp - 0x60]
cmp dword [rdi], eax
mov ecx, dword [0x140097ef0]
setl al
mov edx, dword [0x140097eec]
shrd ecx, edx, 0x16
mov edx, dword [0x140099c0c]
xor ecx, edx
xor ecx, 0x3a4726a
imul ecx, edx
mov edx, dword [0x140097ef8]
mov r8d, dword [0x140097ef4]
shrd edx, r8d, 0x1c
xor edx, 0x62c71d53
and edx, ecx
mov ecx, dword [0x140097f00]
mov r8d, dword [0x140097efc]
shrd ecx, r8d, 0x11
mov r8d, dword [0x140097f08]
mov r9d, dword [0x140097f04]
shrd r8d, r9d, 6
xor ecx, 0x579ad874
xor r8d, 0xee080f6b
imul r9d, dword [0x140097f0c], 0x9e92d8a3
imul r10d, dword [0x140097f10], 0xa31f55e5
imul r11d, dword [0x140097f14], 0xaecf46ba
imul esi, dword [0x140097f18], 0xa6481247
cmp edx, ecx
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx - 0x459255eb]
mov edx, esi
mov r9d, r11d
lea edx, [r9 + rdx + 0x624a6bab]
cmove edx, ecx
cmp dword [0x140099c10], r8d
cmovl edx, ecx
mov cl, byte [rbp - 0x17]
mov byte [rbp - 0x13], cl
mov cl, byte [rbp - 0x16]
mov byte [rbp - 0x12], cl
mov cl, byte [rbp - 0x18]
mov byte [rbp - 0x11], cl
mov r8, rdi
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov ecx, dword [rbp - 0x1c]
jmp 0x14007b18a
cmp r13d, 0x554b5461
mov byte [rbp - 0x14], cl
mov qword [rbp - 0x48], rsi
je 0x14007e373
cmp r13d, 0x5bb07aa5
mov dword [rbp - 0x1c], edx
mov byte [rbp - 0x16], r8b
mov qword [rbp - 0x60], rbx
je 0x14007e023
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x5eda7c61
jne 0x14007b18a
mov eax, dword [0x140097d08]
mov ecx, dword [0x140097d04]
shrd eax, ecx, 0xd
imul ecx, dword [0x140097d10], 0x6453970a
imul edx, dword [0x140097d0c], 0xeecde110
add edx, ecx
add edx, 0x17c3f276
xor eax, 0x7e3c36ba
mov r8b, byte [rbp - 0x17]
test r8b, 1
cmovne edx, eax
mov byte [rbp - 0x13], r8b
jmp 0x14007ccf6
cmp r13d, 0x418e2de4
je 0x14007e47c
cmp r13d, 0x42c33e19
mov byte [rbp - 0x15], al
je 0x14007e144
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x47757637
jne 0x14007b18a
mov rsi, qword [rbp - 0x38]
mov eax, dword [rsi]
mov r14, qword [rbp - 0x28]
mov dword [r14], eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov r12, qword [rbp - 0x40]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x5bb07aa5
jmp 0x14007b18a
cmp r13d, 0x70f784fb
je 0x14007e4ea
cmp r13d, 0x72bbe3b9
je 0x14007e214
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov byte [rbp - 0x14], cl
mov byte [rbp - 0x15], al
mov ecx, edx
mov dword [rbp - 0x1c], edx
mov edx, r13d
cmp r13d, 0x759ffa54
jne 0x14007b18a
mov rcx, qword [0x140099db0]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
add rsp, 0x20
mov rsi, qword [rbp - 0x38]
mov eax, dword [rsi]
mov r14, qword [rbp - 0x28]
mov dword [r14], eax
imul eax, dword [0x140097e20], 0x35296dd2
imul ecx, dword [0x140097e1c], 0xbaecb9bc
add eax, ecx
add eax, 0xa6448ae5
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
mov ecx, dword [0x140097e28]
mov edx, dword [0x140097e24]
shrd ecx, edx, 0x17
xor ecx, 0x3c338a8f
and ecx, eax
imul eax, dword [0x140097e30], 0x9af9e7cf
imul edx, dword [0x140097e2c], 0x656f5b4e
add eax, edx
add eax, 0x1a68e7d0
mov edx, dword [0x140097e38]
mov r8d, dword [0x140097e34]
shrd edx, r8d, 0x1c
mov r8d, dword [0x140097e48]
mov r9d, dword [0x140097e44]
shrd r8d, r9d, 0x1e
xor edx, 0xd1d77646
imul r9d, dword [0x140097e3c], 0xea9f5fe4
xor r8d, 0xe2b29378
imul r10d, dword [0x140097e40], 0x6739a3ae
cmp ecx, eax
mov eax, r10d
mov ecx, r9d
lea eax, [rcx + rax + 0x1c184248]
cmove r8d, eax
cmp dword [0x140099c10], edx
mov edx, r8d
cmovl edx, eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov r12, qword [rbp - 0x40]
jmp 0x14007e9c8
cmp r13d, 0x800e650d
je 0x14007e5ac
cmp r13d, 0x80e8f517
mov qword [rbp - 0x60], rbx
je 0x14007e247
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x8c8b50d6
jne 0x14007b18a
mov eax, dword [0x140097de0]
mov ecx, dword [0x140097ddc]
shrd eax, ecx, 3
imul ecx, dword [0x140097de8], 0x95582d8b
imul edx, dword [0x140097de4], 0xe57025c
add edx, ecx
add edx, 0x40b066c8
xor eax, 0xe434936b
mov bl, byte [rbp - 0x14]
test bl, 1
cmovne edx, eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
jmp 0x14007e9cb
cmp r13d, 0xae7f9997
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x58], r11
je 0x14007e871
cmp r13d, 0xba2e65ac
je 0x14007e53e
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xbcea79fd
jne 0x14007b18a
mov r12, qword [rbp - 0x40]
mov rax, qword [r12]
lea rcx, [0x14007ff8d]
mov qword [rax + 0xe0], rcx
mov eax, dword [0x1400981c8]
mov ecx, dword [0x1400981c4]
shrd eax, ecx, 0x14
xor eax, 0xfa8dedde
mov r14, qword [rbp - 0x28]
mov dword [r14], eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x53fb0e71
jmp 0x14007b18a
cmp r13d, 0xbf6bd229
je 0x14007e8da
cmp r13d, 0xc2dd0533
je 0x14007e6bc
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xd03f6104
je 0x14007c80d
jmp 0x14007b18a
cmp r13d, 0xa45190a
mov qword [rbp - 0x48], rsi
je 0x14007e9d6
cmp r13d, 0xb8d6269
je 0x14007e77d
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xc89fa00
je 0x14007c80d
jmp 0x14007b18a
cmp r13d, 0x371bc284
mov byte [rbp - 0x14], cl
je 0x14007d234
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x3af2675b
jne 0x14007b18a
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x554b5461
jmp 0x14007b18a
cmp r13d, 0x67dc7106
mov dword [rbp - 0x1c], edx
mov byte [rbp - 0x14], cl
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x58], r11
je 0x14007d304
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x68607c03
jne 0x14007b18a
mov eax, dword [str.hv__]
mov ecx, dword [0x140097d74]
shrd eax, ecx, 0x1a
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x1538a8e9
mov edx, eax
imul edx, ecx
mov eax, dword [0x140097d80]
mov ecx, dword [0x140097d7c]
shrd eax, ecx, 9
xor eax, 0x56593969
and eax, edx
imul ecx, dword [0x140097d88], 0x70405445
imul edx, dword [0x140097d84], 0xc77f64af
add ecx, edx
add ecx, 0xe2701287
mov edx, dword [0x140097d90]
mov r8d, dword [0x140097d8c]
shrd edx, r8d, 0x12
mov r8d, dword [0x140097d98]
mov r9d, dword [0x140097d94]
shrd r8d, r9d, 3
mov r9d, dword [0x140097da0]
mov r10d, dword [0x140097d9c]
shrd r9d, r10d, 0xf
xor edx, 0x43f5b0af
xor r8d, 0xac17d71d
xor r9d, 0x83fafce0
cmp eax, ecx
cmove r9d, r8d
cmp dword [0x140099c10], edx
mov edx, r9d
jmp 0x14007ccec
cmp r13d, 0x52b3b53b
je 0x14007d61a
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x53fb0e71
jne 0x14007b18a
mov r12, qword [rbp - 0x40]
mov rax, qword [r12]
lea rcx, [0x14007ff8d]
mov qword [rax + 0xe0], rcx
imul eax, dword [0x140098028], 0x82a84c75
imul ecx, dword [0x140098024], 0xc735127
add eax, ecx
add eax, 0x43e45c2c
mov r14, qword [rbp - 0x28]
mov dword [r14], eax
imul eax, dword [0x140098030], 0x14776276
imul ecx, dword [0x14009802c], 0x3645917a
add eax, ecx
add eax, 0x698d3d47
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
mov ecx, dword [0x140098038]
mov edx, dword [0x140098034]
shrd ecx, edx, 5
xor ecx, 0x90248110
and ecx, eax
mov eax, dword [0x140098040]
mov edx, dword [0x14009803c]
shrd eax, edx, 5
imul edx, dword [0x140098044], 0x997ee218
imul r8d, dword [0x140098048], 0x661e48ab
imul r9d, dword [0x14009804c], 0x55be227c
imul r10d, dword [0x140098050], 0xcecc8581
imul r11d, dword [0x140098054], 0x3a32105c
imul esi, dword [0x140098058], 0x80d0dbd
xor eax, 0x46b2a919
cmp ecx, eax
mov eax, r8d
mov ecx, edx
lea eax, [rcx + rax + 0x19c1471a]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx + 0x11411605]
mov edx, esi
mov r8d, r11d
lea edx, [r8 + rdx - 0x3e497251]
cmove edx, ecx
cmp dword [0x140099c10], eax
cmovl edx, ecx
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
jmp 0x14007e9c8
cmp r13d, 0x7f1f4ae4
je 0x14007d6cf
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov byte [rbp - 0x14], cl
mov byte [rbp - 0x15], al
mov ecx, edx
mov dword [rbp - 0x1c], edx
mov edx, r13d
cmp r13d, 0x7f509822
jne 0x14007b18a
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x189f1a04
jmp 0x14007b18a
cmp r13d, 0x9fc991de
je 0x14007cd1f
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xa22f78b8
jne 0x14007b18a
imul eax, dword [0x140097d18], 0xbe83c32e
imul ecx, dword [0x140097d14], 0x19562059
add eax, ecx
add eax, 0xc9ccd208
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
imul ecx, dword [0x140097d20], 0xfe9e4e02
imul edx, dword [0x140097d1c], 0xf51c4e51
add ecx, edx
add ecx, 0xfc532f9
and ecx, eax
mov eax, dword [str._C_1]
mov edx, dword [0x140097d24]
shrd eax, edx, 0x10
mov edx, dword [str.L52]
mov r8d, dword [0x140097d2c]
shrd edx, r8d, 1
xor eax, 0xc041315f
xor edx, 0x9aa64566
imul r8d, dword [0x140097d34], 0xf4f2f995
imul r9d, dword [0x140097d38], 0x9d99de04
imul r10d, dword [0x140097d3c], 0x547027e
imul r11d, dword [0x140097d40], 0x89c84cdd
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0xbb7bc18]
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx - 0x11bd0986]
cmove ecx, eax
cmp dword [0x140099c10], edx
mov edx, ecx
cmovl edx, eax
jmp 0x14007ccf0
cmp r13d, 0xe69c32ae
je 0x14007cd1f
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xf814b458
jne 0x14007b18a
mov rcx, qword [0x140099dc8]
sub rsp, 0x20
mov r8d, 0x1000
xor edx, edx
call fcn.140089280
mov r8d, 0x1fe
mov rbx, qword [rbp - 0x68]
mov rcx, rbx
xor edx, edx
call fcn.140089280
add rsp, 0x20
mov rax, qword [0x140098178]
mov rcx, qword [0x140098180]
shrd rcx, rax, 7
mov rdx, rcx
movabs rax, 0xfeb68c64a82319f3
xor rdx, rax
sub rsp, 0x20
mov rcx, rbx
lea r8, [0x1400890f6]
mov rdi, qword [rbp - 0x58]
mov r9, rdi
call fcn.14007eb45
add rsp, 0x20
mov rcx, qword [0x140099dc8]
sub rsp, 0x20
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add rsp, 0x20
imul eax, dword [0x140098188], 0x43b45b20
imul ecx, dword [0x14009818c], 0x93579305
imul edx, dword [0x140098190], 0x3553fea4
imul r9d, dword [0x140098194], 0xb7ed7595
lea r8d, [rax + rcx]
add r8d, 0xb1fb322d
mov eax, r9d
mov ecx, edx
add eax, ecx
add eax, 0x7a6ad9d0
sub rsp, 0x30
mov dword [rsp + 0x20], eax
lea rcx, [0x140088e5c]
lea rdx, [0x140089116]
mov r9, rdi
call fcn.1400146b2
add rsp, 0x30
imul eax, dword [0x140098198], 0x978f520f
imul edx, dword [0x14009819c], 0xe652b134
mov r12, qword [rbp - 0x40]
mov rcx, qword [r12]
add edx, eax
add edx, 0x9906bcca
imul eax, dword [0x1400981a0], 0xa7b13b09
imul r8d, dword [0x1400981a4], 0x53890dfb
imul r10d, dword [0x1400981a8], 0x57868d0f
lea r9d, [rax + r8]
add r9d, 0x7180d4c3
imul eax, dword [0x1400981ac], 0x709d4ee8
mov r8d, r10d
add eax, r8d
add eax, 0xd6eeb9b7
mov r8b, byte [0x1400981b0]
mov r10b, byte [0x1400981b1]
shr r10b, 3
shl r8b, 5
or r8b, r10b
xor r8b, 0x4f
sub rsp, 0x40
lea r10, [0x140099db0]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x20], eax
mov byte [rsp + 0x28], r8b
lea r8, [0x140099db8]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
add rsp, 0x40
mov rsi, qword [rbp - 0x38]
mov dword [rsi], eax
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, rbx
mov r10, qword [rbp - 0x50]
mov r11, rdi
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0xfc9f880
jmp 0x14007b18a
cmp r13d, 0x17a64803
je 0x14007df20
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov byte [rbp - 0x16], r8b
mov r8, rbx
mov r9, rdi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], r10
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x68], rdi
mov rdi, qword [rbp - 0x30]
mov byte [rbp - 0x18], r15b
mov qword [rbp - 0x48], rsi
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov byte [rbp - 0x17], r14b
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0x189f1a04
jne 0x14007b18a
imul eax, dword [0x140098060], 0xf6953a70
imul ecx, dword [0x14009805c], 0xd097e3a3
add eax, ecx
add eax, 0xba72db8d
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
mov ecx, dword [0x140098068]
mov edx, dword [0x140098064]
shrd ecx, edx, 0x12
xor ecx, 0xd1a81649
and ecx, eax
imul eax, dword [0x140098070], 0x99bf0a95
imul edx, dword [0x14009806c], 0x574e4db0
add eax, edx
add eax, 0xd0e2cca4
mov edx, dword [0x140098078]
mov r8d, dword [0x140098074]
shrd edx, r8d, 0x1e
mov r8d, dword [0x140098080]
mov r9d, dword [0x14009807c]
shrd r8d, r9d, 0x1e
xor edx, 0xa5f2498c
imul r9d, dword [0x140098084], 0x35a4334b
xor r8d, 0xbba0c5b5
imul r10d, dword [0x140098088], 0xdc17c9cc
cmp ecx, eax
mov eax, r10d
mov ecx, r9d
lea eax, [rcx + rax + 0xe43e05c]
cmove eax, r8d
cmp dword [0x140099c10], edx
mov edx, eax
cmovl edx, r8d
mov al, byte [rbp - 0x17]
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov al, byte [rbp - 0x18]
mov byte [rbp - 0x11], al
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
jmp 0x14007e9bc
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, 0x189f1a04
jmp 0x14007b18a
cmp r13d, 0xa672af2e
jne 0x14007eaf4
mov eax, dword [0x140097bec]
mov ecx, dword [0x140097be8]
shrd eax, ecx, 4
mov ecx, dword [0x140097bf4]
mov r13d, edx
mov edx, dword [0x140097bf0]
shrd ecx, edx, 5
xor eax, 0xaaf086c2
mov edx, ecx
xor edx, 0x6c987485
test r8b, 1
jmp 0x14007d1fe
imul eax, dword [0x140097f90], 0xf9c584ff
imul ecx, dword [0x140097f8c], 0xee0df18c
add eax, ecx
add eax, 0xf00dea90
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
imul ecx, dword [0x140097f98], 0x5a9c777b
imul edx, dword [0x140097f94], 0xc0ca6b48
add ecx, edx
add ecx, 0x35dbb7a
and ecx, eax
mov eax, dword [0x140097fa0]
mov edx, dword [0x140097f9c]
shrd eax, edx, 2
mov edx, dword [0x140097fb0]
mov r12d, r8d
mov r8d, dword [0x140097fac]
shrd edx, r8d, 3
xor eax, 0x2ebd2a4a
xor edx, 0x3356fc79
imul r8d, dword [0x140097fa4], 0xebc22ed
imul r9d, dword [0x140097fa8], 0xd6ea4a97
mov rbx, r10
imul r10d, dword [0x140097fb4], 0x26f2568f
mov rsi, rbx
mov rbx, r11
imul r11d, dword [0x140097fb8], 0xadbf5095
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax - 0x354c069f]
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx + 0x87b1d1d]
jmp 0x14007d18a
imul eax, dword [0x1400980bc], 0xd5d1a3ae
mov byte [rbp - 0x14], cl
imul ecx, dword [0x1400980c0], 0xca6af4ff
add eax, ecx
add eax, 0x24ddc663
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
imul eax, dword [0x1400980c4], 0xc059036
imul edx, dword [0x1400980c8], 0x7203adae
add eax, edx
add eax, 0xb9d94a41
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r13d, r8d
mov r8, rsp
mov eax, dword [0x1400980cc]
mov edx, dword [0x1400980d0]
shrd edx, eax, 6
xor edx, 0x5b7eefbf
mov eax, edx
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r10, rsp
imul eax, dword [0x1400980d4], 0x2589291b
imul edx, dword [0x1400980d8], 0x8c2784e7
add eax, edx
add eax, 0xa4a2e8d2
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
movzx edx, word [0x1400980dc]
movzx r9d, word [0x1400980de]
imul edx, edx, 0x1219
imul r9d, r9d, 0xffff8fa8
add edx, r9d
add edx, 0x6258
movzx r9d, word [0x1400980e0]
movzx r11d, word [0x1400980e2]
shrd r11w, r9w, 0xb
mov word [rax], dx
mov edx, r11d
xor edx, 0x3b28
mov word [rax + 2], dx
imul edx, dword [0x1400980e4], 0xe0830196
lea r9, [0x140088e5c]
mov qword [rax + 8], r9
imul r9d, dword [0x1400980e8], 0xab3c24a7
add edx, r9d
add edx, 0xc9e57dfc
mov dword [r8], edx
xor r11d, r11d
mov qword [r8 + 8], r11
mov edx, dword [0x1400980ec]
mov r9d, dword [0x1400980f0]
shrd r9d, edx, 8
xor r9d, 0x325659f9
mov dword [r8 + 0x18], r9d
mov qword [r8 + 0x10], rax
imul eax, dword [0x1400980f4], 0x73d99829
movups xmmword [r8 + 0x20], xmm6
imul edx, dword [0x1400980f8], 0x2677fe93
add edx, eax
add edx, 0x720ce572
mov eax, dword [0x1400980fc]
mov r9d, dword [0x140098100]
shrd r9d, eax, 0x17
xor r9d, 0xeaf6777f
mov eax, dword [0x140098104]
mov r12, rsi
mov esi, dword [0x140098108]
shrd esi, eax, 1
xor esi, 0x53e6284a
sub rsp, 0x40
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
add rsp, 0x40
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r13b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, r12
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x8cdf8078
jmp 0x14007b18a
imul eax, dword [0x140098170], 0x8386c59f
mov r13d, ecx
imul ecx, dword [0x140098174], 0x6d2a240a
add eax, ecx
add eax, 0xdf6d4c90
mov rcx, qword [rbp - 0x28]
mov dword [rcx], eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, rcx
mov ebx, r13d
mov al, byte [rbp - 0x15]
mov ecx, edx
mov edx, 0x371bc284
jmp 0x14007b18a
mov eax, dword [0x140097ff8]
mov ecx, dword [0x140097ff4]
shrd eax, ecx, 0x19
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x94bc2c11
imul eax, ecx
imul ecx, dword [0x140098000], 0x88b0b056
imul edx, dword [0x140097ffc], 0xf55d1a6f
add ecx, edx
add ecx, 0x2dfdf4f6
and ecx, eax
mov eax, dword [0x140098008]
mov edx, dword [0x140098004]
shrd eax, edx, 6
mov edx, dword [0x140098018]
mov r12d, r8d
mov r8d, dword [0x140098014]
shrd edx, r8d, 0x15
xor eax, 0x4acd2800
xor edx, 0x4d188207
imul r8d, dword [0x14009800c], 0xd29c6c00
imul r9d, dword [0x140098010], 0xdd220c2c
mov rbx, r10
imul r10d, dword [0x14009801c], 0x4aa59b1a
mov rsi, rbx
mov rbx, r11
imul r11d, dword [0x140098020], 0x377a612d
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x78462832]
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx + 0x6f97c35e]
cmove ecx, edx
cmp dword [0x140099c10], eax
mov r13d, ecx
cmovl r13d, edx
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r12b
mov byte [rbp - 0x11], r15b
mov r8, qword [rbp - 0x60]
mov r9, rdi
mov r10, rsi
mov r11, rbx
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
jmp 0x14007e12b
imul eax, dword [0x140097abc], 0x7d37bb1f
imul ecx, dword [0x140097ab8], 0xa202959b
add eax, ecx
add eax, 0x3d4533ad
mov ecx, dword [0x140097ac4]
mov r13d, edx
mov edx, dword [0x140097ac0]
shrd ecx, edx, 0x12
mov edx, ecx
xor edx, 0xca75578e
test r15b, 1
cmovne edx, eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, r13d
jmp 0x14007b18a
imul eax, dword [0x140097c2c], 0xca8463d
imul ecx, dword [0x140097c28], 0x72c257d3
add eax, ecx
add eax, 0xf4a7fed5
mov rcx, qword [rbp - 0x28]
mov dword [rcx], eax
mov eax, dword [0x140097c34]
mov ecx, dword [0x140097c30]
shrd eax, ecx, 9
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0xa4ef7735
mov edx, eax
imul edx, ecx
mov eax, dword [0x140097c3c]
mov ecx, dword [0x140097c38]
shrd eax, ecx, 0x1b
xor eax, 0x8b57da31
and eax, edx
imul ecx, dword [0x140097c44], 0x443743b4
imul edx, dword [0x140097c40], 0xbc232912
lea r13d, [rdx + rcx]
add r13d, 0x8c497de8
mov edx, dword [0x140097c4c]
mov r12d, r8d
mov r8d, dword [0x140097c48]
shrd edx, r8d, 0x1e
mov r8d, dword [0x140097c54]
mov r9d, dword [0x140097c50]
shrd r8d, r9d, 0xe
mov r9d, dword [0x140097c5c]
mov rcx, r10
mov r10d, dword [0x140097c58]
shrd r9d, r10d, 7
xor edx, 0xfb45a37
xor r8d, 0x4bf5aba
xor r9d, 0x3001f956
jmp 0x14007dc54
mov rcx, qword [rsi]
sub rsp, 0x20
mov r12, r11
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x20
mov rax, qword [0x140097b58]
mov rcx, qword [0x140097b60]
shrd rcx, rax, 0x14
movabs rax, 0x8056217f389841a3
xor rcx, rax
mov rdx, qword [rbp - 0x30]
mov qword [rdx], rcx
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rdx], rax
sub rsp, 0x20
mov rcx, rdx
call fcn.140004232
add rsp, 0x20
mov dword [0x140099dd0], eax
imul eax, dword [0x140097b68], 0xf8646571
imul ecx, dword [0x140097b6c], 0xa6b7755
imul edx, dword [0x140097b70], 0x69cdab15
imul r9d, dword [0x140097b74], 0xb05b9540
lea r8d, [rax + rcx]
add r8d, 0xccabfb34
mov eax, r9d
mov ecx, edx
add eax, ecx
add eax, 0x63fc2aa2
sub rsp, 0x30
mov dword [rsp + 0x20], eax
lea rcx, [0x140088e5c]
lea rdx, [0x140088ec0]
lea r9, [0x140099dd0]
call fcn.1400146b2
add rsp, 0x10
mov r8d, 0x1fe
mov rcx, r12
lea rdx, [0x140088ee0]
call fcn.140089380
add rsp, 0x20
mov rax, qword [0x140097b78]
movabs rcx, 0xb528ded6962e9ee6
imul rax, rcx
mov rcx, qword [str.1ck]
movabs rdx, 0x5169cd13bde628ee
imul rcx, rdx
add rcx, rax
mov rdx, rcx
movabs rax, 0x491a58c885efa174
add rdx, rax
sub rsp, 0x20
mov rcx, r12
call fcn.140002e76
mov r8d, 0x1fe
mov r13, qword [rbp - 0x50]
mov rcx, r13
xor edx, edx
call fcn.140089280
add rsp, 0x20
mov rax, qword [0x140097b88]
mov rcx, qword [0x140097b90]
shrd rcx, rax, 0x31
mov rdx, rcx
movabs rax, 0x9f82aa4308e4987
xor rdx, rax
sub rsp, 0x20
mov rcx, r13
lea r8, [0x1400890de]
mov r9, r12
call fcn.14007eb45
lea rcx, [0x140099db8]
mov rdx, r13
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add rsp, 0x20
imul eax, dword [str.ece], 0x643510ac
imul ecx, dword [0x140097b9c], 0x9ab93141
add ecx, eax
add ecx, 0xa4dc9a91
mov rax, qword [0x140097ba0]
movabs rdx, 0xcf2f630b9db174f9
imul rax, rdx
mov rdx, qword [0x140097ba8]
movabs r8, 0xffe82ebdc0d46a1d
imul rdx, r8
add rdx, rax
imul eax, dword [0x140097bb0], 0x7aae03c4
imul r8d, dword [0x140097bb4], 0x3b589ae5
movabs r9, 0x4045cbb673e38958
add rdx, r9
add r8d, eax
add r8d, 0x35e2071c
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
add rsp, 0x20
mov rcx, rax
test rax, rax
setne byte [rbp - 0x12]
imul edx, dword [0x140097bbc], 0xf3820832
imul r8d, dword [0x140097bb8], 0x95fc7ab5
add edx, r8d
add edx, 0x990b32a
mov r8d, dword [0x140099c0c]
xor edx, r8d
imul edx, r8d
mov r8d, dword [0x140097bc4]
mov r9d, dword [0x140097bc0]
shrd r8d, r9d, 0x14
xor r8d, 0x7b24026
and r8d, edx
imul edx, dword [0x140097bcc], 0xfa996536
imul r9d, dword [0x140097bc8], 0xf276b292
add edx, r9d
add edx, 0xe3a872d0
mov r9d, dword [0x140097bdc]
mov r10d, dword [0x140097bd8]
shrd r9d, r10d, 0x12
xor r9d, 0x6ab69cff
imul r10d, dword [0x140097bd0], 0x76b6f297
imul r11d, dword [0x140097bd4], 0xed78385d
imul esi, dword [0x140097be0], 0xde9d1f12
mov r12, rdi
imul edi, dword [0x140097be4], 0x6261b01b
cmp r8d, edx
mov edx, r11d
mov r8d, r10d
lea edx, [r8 + rdx + 0x3a14c17d]
mov r8d, edi
mov r10d, esi
lea r8d, [r10 + r8 - 0x5d8e2915]
cmove r8d, r9d
cmp dword [0x140099c10], edx
mov qword [0x140099dc8], rax
mov edx, r8d
cmovl edx, r9d
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, r12
mov r10, r13
jmp 0x14007cd0e
imul eax, dword [0x140097b2c], 0x345ebb0c
imul ecx, dword [0x140097b28], 0x8a7bc92c
add eax, ecx
add eax, 0x5d9c9a7
mov ecx, dword [0x140099c0c]
xor eax, ecx
mov edx, eax
imul edx, ecx
mov eax, dword [0x140097b34]
mov ecx, dword [0x140097b30]
shrd eax, ecx, 0x1e
xor eax, 0xef932df
and eax, edx
imul ecx, dword [0x140097b3c], 0xba0b0cea
imul edx, dword [0x140097b38], 0xf42d8888
lea r13d, [rdx + rcx]
add r13d, 0x9febe21e
mov edx, dword [0x140097b44]
mov r12d, r8d
mov r8d, dword [0x140097b40]
shrd edx, r8d, 6
mov r8d, dword [0x140097b4c]
mov r9d, dword [0x140097b48]
shrd r8d, r9d, 0xe
mov r9d, dword [0x140097b54]
mov rcx, r10
mov r10d, dword [0x140097b50]
shrd r9d, r10d, 3
xor edx, 0xcd89c525
xor r8d, 0x8989650
xor r9d, 0x69027cd6
jmp 0x14007dc54
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, 0xdbe0537e
jmp 0x14007b18a
imul eax, dword [0x1400979e8], 0xa4a82eb7
imul ecx, dword [0x1400979ec], 0x6dde660
add eax, ecx
add eax, 0x8daad76b
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov eax, dword [0x1400979f0]
mov ecx, dword [0x1400979f4]
shrd ecx, eax, 0x14
xor ecx, 0xd844bdf1
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
mov qword [rbp - 0x30], rdx
mov eax, dword [0x1400979f8]
mov ecx, dword [0x1400979fc]
shrd ecx, eax, 0x1e
xor ecx, 0xcd15462
mov eax, ecx
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov qword [rbp - 0x40], r9
imul eax, dword [0x140097a00], 0x3d63b860
imul ecx, dword [0x140097a04], 0x9b6a80cd
add eax, ecx
add eax, 0xf2683110
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x38], rcx
imul eax, dword [0x140097a08], 0xbc6872de
mov r12d, r14d
imul r8d, dword [0x140097a0c], 0xacde568a
add eax, r8d
add eax, 0xf4c047b3
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
imul eax, dword [0x140097a10], 0x7a4ebd55
imul r10d, dword [0x140097a14], 0xa90495d0
add eax, r10d
add eax, 0x9ae2e0bb
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r10, rsp
mov eax, dword [0x140097a18]
mov r11d, dword [0x140097a1c]
shrd r11d, eax, 0x16
xor r11d, 0xbbcecdf8
mov eax, r11d
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r11, rsp
mov eax, dword [0x140097a20]
mov esi, dword [0x140097a24]
shrd esi, eax, 0xd
xor esi, 0xdbbc215a
mov eax, esi
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r15, rsp
mov eax, dword [0x140097a28]
mov esi, dword [0x140097a2c]
shrd esi, eax, 0x1d
xor esi, 0x5a05e6cd
mov eax, esi
lea rsi, [rax + rax]
shl rax, 9
sub rax, rsi
add rax, 0xf
movabs rdi, 0x3fffffffff0
and rax, rdi
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r14, rsp
imul eax, dword [0x140097a30], 0xa00b53e7
imul esi, dword [0x140097a34], 0xd490e10a
add eax, esi
add eax, 0x1fba804b
lea rsi, [rax + rax]
shl rax, 9
sub rax, rsi
add rax, 0xf
and rax, rdi
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r13, rsp
mov eax, dword [0x140097a38]
mov esi, dword [0x140097a3c]
shrd esi, eax, 0x16
xor esi, 0xf539e3d1
mov eax, esi
lea rsi, [rax + rax]
shl rax, 9
sub rax, rsi
add rax, 0xf
and rax, rdi
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov eax, dword [0x140097a40]
mov esi, dword [0x140097a44]
shrd esi, eax, 3
xor esi, 0x3e0912f
mov eax, esi
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rsi, rsp
mov rax, qword [rbp - 0x78]
mov qword [rdx], rax
mov eax, dword [0x140097a48]
mov edx, dword [str.k_G]
shrd edx, eax, 9
xor edx, 0x36bda39e
mov dword [r9], edx
movzx eax, word [0x140097a50]
movzx edx, word [0x140097a52]
imul eax, eax, 0x69f9
imul edx, edx, 0xffffa24e
add eax, edx
add eax, 0x53a8
mov word [r11], ax
movzx eax, word [0x140097a54]
movzx edx, word [0x140097a56]
imul eax, eax, 0xffff84ac
imul edx, edx, 0x521
add eax, edx
add eax, 0xffffbb95
mov word [r11 + 2], ax
mov eax, dword [0x140097a58]
mov edx, dword [0x140097a5c]
shrd edx, eax, 9
lea rax, [0x140088e5c]
mov qword [r11 + 8], rax
xor edx, 0x2b00efa5
mov dword [r8], edx
xor ebx, ebx
mov qword [r8 + 8], rbx
mov eax, dword [0x140097a60]
mov edx, dword [0x140097a64]
shrd edx, eax, 0x17
xor edx, 0xf87a50a5
mov dword [r8 + 0x18], edx
mov qword [r8 + 0x10], r11
imul eax, dword [0x140097a68], 0x6643a0e
movups xmmword [r8 + 0x20], xmm6
imul edx, dword [0x140097a6c], 0xe11c2c46
add edx, eax
add edx, 0xfb2d33c9
mov eax, dword [0x140097a70]
mov r9d, dword [0x140097a74]
shrd r9d, eax, 0x17
imul eax, dword [0x140097a78], 0x55f05641
imul r11d, dword [0x140097a7c], 0x4d3633fd
xor r9d, 0xb398795e
add eax, r11d
add eax, 0xe084657f
sub rsp, 0x40
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
add rsp, 0x40
mov ecx, dword [0x140097a84]
mov edx, dword [0x140097a80]
shrd ecx, edx, 7
xor ecx, 0x946f0a39
cmp eax, ecx
setg bl
imul ecx, dword [0x140097a8c], 0xf4e6db9e
imul edx, dword [0x140097a88], 0x1805c3f0
add ecx, edx
add ecx, 0xf2179057
mov edx, dword [0x140099c0c]
xor ecx, edx
imul ecx, edx
mov edx, dword [0x140097a94]
mov r8d, dword [0x140097a90]
shrd edx, r8d, 0x14
xor edx, 0xeb01f
and edx, ecx
imul ecx, dword [0x140097a9c], 0x25dcc2ff
imul r8d, dword [0x140097a98], 0x328ebf61
add ecx, r8d
add ecx, 0x2fec4c41
mov r8d, dword [0x140097ab4]
mov r9d, dword [0x140097ab0]
shrd r8d, r9d, 0x1b
xor r8d, 0xbae1bf8
imul r9d, dword [0x140097aa0], 0xad422542
imul r10d, dword [0x140097aa4], 0x97936e81
imul r11d, dword [0x140097aa8], 0xb3f0b105
imul eax, dword [0x140097aac], 0xcadc3b91
cmp edx, ecx
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx + 0x7857f829]
mov edx, r11d
lea eax, [rdx + rax - 0x7c6527ab]
mov edx, r8d
cmove edx, eax
cmp dword [0x140099c10], ecx
cmovl edx, eax
mov byte [rbp - 0x13], r12b
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], bl
mov r8, rsi
mov r9, rdi
mov r10, r13
mov r11, r14
mov rdi, r15
mov r15, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x40]
mov r12, qword [rbp - 0x30]
jmp 0x14007e9c4
mov eax, dword [0x140097eb8]
mov ecx, dword [0x140097eb4]
shrd eax, ecx, 0x17
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x45c42bc9
mov edx, eax
imul edx, ecx
mov eax, dword [0x140097ec0]
mov ecx, dword [0x140097ebc]
shrd eax, ecx, 0xf
xor eax, 0x574658d0
and eax, edx
imul ecx, dword [0x140097ec8], 0x71ccd272
imul edx, dword [0x140097ec4], 0x7edd3116
lea r13d, [rdx + rcx]
add r13d, 0x401c8eba
mov edx, dword [0x140097ed0]
mov r12d, r8d
mov r8d, dword [0x140097ecc]
shrd edx, r8d, 4
mov r8d, dword [0x140097ed8]
mov r9d, dword [0x140097ed4]
shrd r8d, r9d, 0x1b
mov r9d, dword [0x140097ee0]
mov rcx, r10
mov r10d, dword [0x140097edc]
shrd r9d, r10d, 3
xor edx, 0xa79f0e6f
xor r8d, 0xccafd9be
xor r9d, 0xa6aef7ff
cmp eax, r13d
cmove r9d, r8d
cmp dword [0x140099c10], edx
mov edx, r9d
cmovl edx, r8d
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r12b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov r10, rcx
jmp 0x14007e9b5
mov rcx, qword [0x140099dc8]
sub rsp, 0x20
mov r8d, 0x1000
xor edx, edx
mov r13, r11
call fcn.140089280
mov r8d, 0x1fe
mov rcx, rdi
xor edx, edx
call fcn.140089280
add rsp, 0x20
mov rax, qword [0x140097c90]
mov rcx, qword [0x140097c98]
shrd rcx, rax, 0x31
mov rdx, rcx
movabs rax, 0x814202c59a9d82fe
xor rdx, rax
sub rsp, 0x20
mov rcx, rdi
lea r8, [0x1400890f6]
mov r9, r13
call fcn.14007eb45
add rsp, 0x20
mov rcx, qword [0x140099dc8]
sub rsp, 0x20
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add rsp, 0x20
imul eax, dword [0x140097ca0], 0x535e65b7
imul ecx, dword [0x140097ca4], 0x443c04f3
lea r8d, [rax + rcx]
add r8d, 0xece2d41c
mov eax, dword [0x140097ca8]
mov ecx, dword [0x140097cac]
shrd ecx, eax, 2
xor ecx, 0xa8eda252
sub rsp, 0x30
mov dword [rsp + 0x20], ecx
lea rcx, [0x140088e5c]
lea rdx, [0x140089116]
mov r9, r13
call fcn.1400146b2
add rsp, 0x30
mov r14, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov rcx, qword [r12]
imul eax, dword [0x140097cb0], 0x6ed3e022
imul edx, dword [0x140097cb4], 0xb21dc8bd
add edx, eax
add edx, 0xfddd3d0e
mov eax, dword [0x140097cb8]
mov r8d, dword [0x140097cbc]
shrd r8d, eax, 0xa
mov r9d, r8d
xor r9d, 0x273285c6
imul eax, dword [0x140097cc0], 0xe3adc2c4
imul r8d, dword [0x140097cc4], 0xa4779148
add eax, r8d
add eax, 0x462392f4
movzx r8d, byte [0x140097cc8]
movzx r10d, byte [0x140097cc9]
add r8d, r8d
lea r8d, [r8 + r8*4]
neg r8d
imul r10d, r10d, 0x26
add r10b, r8b
add r10b, 0x9a
sub rsp, 0x40
lea r8, [0x140099db0]
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x20], eax
mov byte [rsp + 0x28], r10b
lea r8, [0x140099db8]
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
add rsp, 0x40
mov dword [rsi], eax
imul ecx, dword [str.5__9], 0x7e6d3589
imul edx, dword [0x140097cd0], 0x74691
add ecx, edx
add ecx, 0x9d6667d4
cmp eax, ecx
setg al
imul ecx, dword [0x140097cd8], 0x84fda62e
imul edx, dword [0x140097cd4], 0x9f5e3ec9
add ecx, edx
add ecx, 0x1d0832c7
mov edx, dword [0x140099c0c]
xor ecx, edx
imul ecx, edx
mov edx, dword [0x140097ce0]
mov r8d, dword [0x140097cdc]
shrd edx, r8d, 0x1e
xor edx, 0x7cccc6f2
and edx, ecx
imul ecx, dword [0x140097ce8], 0xd5d6bfa7
imul r8d, dword [0x140097ce4], 0x28a9fdc3
add ecx, r8d
add ecx, 0xb457ef0c
mov r8d, dword [0x140097cf0]
mov r9d, dword [0x140097cec]
shrd r8d, r9d, 9
mov r9d, dword [0x140097cf8]
mov r10d, dword [0x140097cf4]
shrd r9d, r10d, 0x1d
xor r8d, 0xd8dfd401
imul r10d, dword [0x140097cfc], 0xc6c234bd
xor r9d, 0x1250c022
imul r11d, dword [0x140097d00], 0x4cf7a17d
cmp edx, ecx
mov ecx, r11d
mov edx, r10d
lea edx, [rdx + rcx + 0x47343c8c]
cmove edx, r9d
cmp dword [0x140099c10], r8d
cmovl edx, r9d
mov byte [rbp - 0x13], al
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov r10, qword [rbp - 0x50]
mov r11, r13
mov rdi, qword [rbp - 0x30]
mov r15, r14
jmp 0x14007e9c4
mov eax, dword [0x140097df0]
mov ecx, dword [0x140097dec]
shrd eax, ecx, 0xb
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0xd5e10c61
imul eax, ecx
mov ecx, dword [0x140097e00]
mov edx, dword [0x140097dfc]
shrd ecx, edx, 0xf
imul edx, dword [0x140097df8], 0xe3c0930c
mov r12, rbx
mov ebx, r8d
imul r8d, dword [0x140097df4], 0x832d3d46
add edx, r8d
add edx, 0x1282814f
mov r8d, dword [0x140097e08]
mov r9d, dword [0x140097e04]
shrd r8d, r9d, 4
mov r9d, dword [0x140097e10]
mov r13, r10
mov r10d, dword [0x140097e0c]
shrd r9d, r10d, 0x10
and edx, eax
mov eax, dword [0x140097e18]
mov r10d, dword [0x140097e14]
shrd eax, r10d, 0x1c
xor ecx, 0xc87dcaf6
xor r8d, 0xf1945fba
xor r9d, 0xcda2de15
xor eax, 0x8072e2f1
jmp 0x14007e1ee
mov byte [rbp - 0x15], al
mov eax, dword [0x1400981b8]
mov r13d, ecx
mov ecx, dword [0x1400981b4]
shrd eax, ecx, 0x1e
xor eax, 0xd93333fe
mov dword [rbx], eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, r13d
mov al, byte [rbp - 0x15]
mov ecx, edx
mov edx, 0xe1c8468b
jmp 0x14007b18a
mov r12, qword [rbp - 0x38]
mov eax, dword [r12]
mov r9, qword [rbp - 0x28]
mov dword [r9], eax
imul eax, dword [0x140097afc], 0x61ad60b1
imul ecx, dword [0x140097af8], 0x307177e1
add eax, ecx
add eax, 0xac67c45e
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
imul ecx, dword [0x140097b04], 0xbbbc334
imul edx, dword [0x140097b00], 0xce9b7096
add ecx, edx
add ecx, 0x5b796671
and ecx, eax
mov eax, dword [0x140097b0c]
mov edx, dword [0x140097b08]
shrd eax, edx, 2
mov edx, dword [0x140097b1c]
mov r8d, dword [0x140097b18]
shrd edx, r8d, 0x13
xor eax, 0x6d170f2e
xor edx, 0xea30545a
imul r8d, dword [0x140097b10], 0xc7d73351
imul r9d, dword [str.H_f], 0x5b3062c7
mov rbx, r10
imul r10d, dword [0x140097b20], 0xd81d560c
mov rsi, rbx
mov rbx, r11
imul r11d, dword [0x140097b24], 0xa032322f
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x707aab6f]
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx - 0x77429fb7]
cmove ecx, edx
cmp dword [0x140099c10], eax
mov r13d, ecx
cmovl r13d, edx
mov byte [rbp - 0x13], r14b
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], r15b
mov r8, qword [rbp - 0x60]
mov r9, rdi
mov r10, rsi
mov r11, rbx
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, r12
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, r13d
jmp 0x14007b18a
mov eax, dword [0x140097acc]
mov ecx, dword [0x140097ac8]
shrd eax, ecx, 0x16
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x57e22cb9
imul eax, ecx
mov ecx, dword [0x140097adc]
mov edx, dword [0x140097ad8]
shrd ecx, edx, 0x1e
imul edx, dword [0x140097ad4], 0x22ef2ce0
mov r12, rbx
mov ebx, r8d
imul r8d, dword [0x140097ad0], 0x5bf1b6c9
add edx, r8d
add edx, 0x51b58902
mov r8d, dword [0x140097ae4]
mov r9d, dword [0x140097ae0]
shrd r8d, r9d, 0xb
mov r9d, dword [0x140097aec]
mov r13, r10
mov r10d, dword [0x140097ae8]
shrd r9d, r10d, 0x12
and edx, eax
mov eax, dword [0x140097af4]
mov r10d, dword [0x140097af0]
shrd eax, r10d, 0x16
xor ecx, 0xeac3499e
xor r8d, 0x6be4069d
xor r9d, 0xdc36cf81
xor eax, 0xc8fd7fd9
cmp edx, ecx
mov edx, eax
cmove edx, r9d
cmp dword [0x140099c10], r8d
cmovl edx, r9d
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], bl
mov byte [rbp - 0x11], r15b
mov r8, r12
jmp 0x14007e9af
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, 0xa73d1e73
jmp 0x14007b18a
mov r12, qword [rbp - 0x40]
mov rax, qword [r12]
movsxd rcx, dword [rbx]
lea rdx, [0x14007fc92]
mov qword [rax + rcx*8 + 0x70], rdx
mov eax, dword [0x140097f60]
mov ecx, dword [0x140097f5c]
shrd eax, ecx, 1
mov ecx, dword [0x140097f68]
mov edx, dword [0x140097f64]
shrd ecx, edx, 0x19
mov edx, dword [0x140097f70]
mov ebx, r8d
mov r8d, dword [0x140097f6c]
shrd edx, r8d, 0x1d
mov r8d, dword [0x140097f78]
mov r9d, dword [0x140097f74]
shrd r8d, r9d, 6
mov r9d, dword [0x140097f80]
mov r13, r10
mov r10d, dword [0x140097f7c]
shrd r9d, r10d, 0x1c
mov r10d, dword [0x140099c0c]
xor eax, r10d
xor eax, 0x9cc1a9ed
imul eax, r10d
xor ecx, 0x30641fe0
and ecx, eax
xor edx, 0x5df7078c
xor r8d, 0xc8833048
imul eax, dword [0x140097f84], 0xe9e322fa
xor r9d, 0xac9eb915
imul r10d, dword [0x140097f88], 0xa90cd7ed
cmp ecx, edx
mov ecx, r10d
lea edx, [rax + rcx + 0x6f352348]
cmove edx, r9d
cmp dword [0x140099c10], r8d
cmovl edx, r9d
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], bl
mov byte [rbp - 0x11], r15b
mov r8, qword [rbp - 0x60]
mov r9, rdi
mov r10, r13
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
jmp 0x14007e9c4
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, 0x2295da54
jmp 0x14007b18a
mov eax, dword [0x140098090]
mov ecx, dword [0x14009808c]
shrd eax, ecx, 9
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0xc0d1f777
imul eax, ecx
imul ecx, dword [0x140098098], 0x133a300a
imul edx, dword [0x140098094], 0xf3e8093
add ecx, edx
add ecx, 0x7dc363d5
and ecx, eax
mov eax, dword [0x1400980a0]
mov edx, dword [0x14009809c]
shrd eax, edx, 0xf
mov edx, dword [0x1400980b8]
mov r12d, r8d
mov r8d, dword [0x1400980b4]
shrd edx, r8d, 0x1f
xor eax, 0x542d8f3
xor edx, 0x76b04a50
imul r8d, dword [0x1400980a4], 0x1e1ddb52
imul r9d, dword [0x1400980a8], 0xde49446e
mov r13, rbx
mov rbx, r10
imul r10d, dword [0x1400980ac], 0x1d3d77e5
mov rsi, rbx
mov rbx, r11
imul r11d, dword [0x1400980b0], 0x7c350bd9
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x3b71018e]
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx + 0x47fb2f8a]
cmove edx, ecx
cmp dword [0x140099c10], eax
cmovl edx, ecx
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r12b
mov byte [rbp - 0x11], r15b
mov r8, r13
mov r9, rdi
mov r10, rsi
mov r11, rbx
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ecx, dword [r14]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
jmp 0x14007b18a
mov r13d, eax
mov eax, dword [0x140097f20]
mov ecx, dword [0x140097f1c]
shrd eax, ecx, 0xa
imul ecx, dword [0x140097f28], 0xa64770e2
imul edx, dword [0x140097f24], 0xd3014295
add edx, ecx
add edx, 0x5fc63505
xor eax, 0xaa1f0a95
test r13b, 1
cmovne edx, eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov eax, r13d
mov ecx, dword [rbp - 0x1c]
jmp 0x14007b18a
mov r13d, eax
mov r12, qword [rbp - 0x40]
mov rax, qword [r12]
mov byte [rbp - 0x14], cl
movsxd rcx, dword [rbx]
mov dword [rbp - 0x1c], edx
lea rdx, [0x14007fc92]
mov qword [rax + rcx*8 + 0x70], rdx
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov eax, r13d
mov ecx, dword [rbp - 0x1c]
mov edx, 0x80e8f517
jmp 0x14007b18a
mov rcx, qword [0x140099db0]
sub rsp, 0x20
mov r13, r10
mov esi, r15d
mov r15, rbx
mov rbx, qword [rbp - 0x38]
mov r12, rdi
mov edi, r8d
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
add rsp, 0x20
mov eax, dword [rbx]
mov rcx, qword [rbp - 0x28]
mov dword [rcx], eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], dil
mov byte [rbp - 0x11], sil
mov r8, r15
mov r9, r12
mov r10, r13
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, rbx
mov r12, qword [rbp - 0x40]
mov r14, rcx
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x759ffa54
jmp 0x14007b18a
mov eax, dword [0x140097fc0]
mov ecx, dword [0x140097fbc]
shrd eax, ecx, 0xa
xor eax, 0xa5219b15
add dword [rbx], eax
mov eax, dword [0x140097fc8]
mov ecx, dword [0x140097fc4]
shrd eax, ecx, 0x15
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x1048ec8
imul eax, ecx
mov ecx, dword [0x140097fd0]
mov edx, dword [0x140097fcc]
shrd ecx, edx, 8
xor ecx, 0x462ad1a6
and ecx, eax
imul eax, dword [0x140097fd8], 0x29eb1c62
mov r13d, eax
imul edx, dword [0x140097fd4], 0xd99c25c4
mov byte [rbp - 0x16], r8b
imul r8d, dword [0x140097fdc], 0x686d8827
imul r9d, dword [0x140097fe0], 0xa9c06a06
mov qword [rbp - 0x50], r10
imul r10d, dword [0x140097fe4], 0xeff2bd51
mov qword [rbp - 0x58], r11
imul r11d, dword [0x140097fe8], 0xc76a6209
mov qword [rbp - 0x48], rsi
imul esi, dword [0x140097fec], 0x28cf90
mov r12, rdi
imul edi, dword [0x140097ff0], 0x484fe1ed
lea eax, [rdx + r13]
add eax, 0x574d8252
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x12567959]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx - 0x5a37c086]
mov edx, edi
mov r8d, esi
lea edx, [r8 + rdx + 0x5d80477b]
cmove edx, ecx
cmp dword [0x140099c10], eax
cmovl edx, ecx
mov byte [rbp - 0x13], r14b
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, r12
jmp 0x14007cd0a
imul eax, dword [0x140097f30], 0xeb3ae5d3
imul ecx, dword [0x140097f2c], 0xdeb8035a
add eax, ecx
add eax, 0x8a2af085
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
imul ecx, dword [0x140097f38], 0xe74b5fc8
imul edx, dword [0x140097f34], 0xbc0f333e
add ecx, edx
add ecx, 0x59679863
and ecx, eax
imul eax, dword [0x140097f40], 0xfef1eb8
imul edx, dword [0x140097f3c], 0x90bdad8b
add eax, edx
add eax, 0x895573e0
mov edx, dword [0x140097f48]
mov r12d, r8d
mov r8d, dword [0x140097f44]
shrd edx, r8d, 0x1a
mov r8d, dword [0x140097f58]
mov r9d, dword [0x140097f54]
shrd r8d, r9d, 0x11
xor edx, 0x5f68928
imul r9d, dword [0x140097f4c], 0x867906e9
xor r8d, 0xf4fafec8
mov r13, r10
imul r10d, dword [0x140097f50], 0x96f1a6ae
cmp ecx, eax
mov eax, r10d
mov ecx, r9d
lea eax, [rcx + rax - 0x3829ffc4]
jmp 0x14007e990
mov eax, dword [0x140097bfc]
mov ecx, dword [0x140097bf8]
shrd eax, ecx, 0x1e
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x377f72a6
imul eax, ecx
imul ecx, dword [0x140097c04], 0xd57237a0
imul edx, dword [0x140097c00], 0xcf33d9af
add ecx, edx
add ecx, 0x894c3934
and ecx, eax
imul eax, dword [0x140097c0c], 0x3e66ca13
imul edx, dword [0x140097c08], 0xcd8a3306
add eax, edx
add eax, 0xebb932d0
mov edx, dword [0x140097c14]
mov r12d, r8d
mov r8d, dword [0x140097c10]
shrd edx, r8d, 0x13
xor edx, 0xedc57d24
imul r8d, dword [0x140097c18], 0x2febb9c9
imul r9d, dword [0x140097c1c], 0x7a6f0913
mov r13, rbx
mov rbx, r10
imul r10d, dword [0x140097c20], 0x3398de6b
mov rsi, rbx
mov rbx, r11
imul r11d, dword [0x140097c24], 0x7dd56c85
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x30ecd466]
mov ecx, r11d
mov r8d, r10d
lea ecx, [r8 + rcx - 0xc6b62f4]
cmove ecx, eax
cmp dword [0x140099c10], edx
mov edx, ecx
cmovl edx, eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r12b
mov byte [rbp - 0x11], r15b
mov r8, r13
mov r9, rdi
mov r10, rsi
mov r11, rbx
jmp 0x14007cd12
mov rcx, qword [0x140099dc8]
sub rsp, 0x20
lea rdx, [0x140099db8]
mov qword [rbp - 0x50], r10
mov rsi, qword [rbp - 0x38]
mov r13, rdi
mov edi, r8d
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
add rsp, 0x20
mov dword [rsi], eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], dil
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, r13
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
mov edx, 0x2d60e7d8
jmp 0x14007b18a
mov eax, dword [0x140097c64]
mov ecx, dword [0x140097c60]
shrd eax, ecx, 9
mov ecx, dword [0x140099c0c]
xor eax, ecx
xor eax, 0x2dab900a
imul eax, ecx
imul ecx, dword [0x140097c6c], 0x7a1838f8
imul edx, dword [0x140097c68], 0x8668c6da
add ecx, edx
add ecx, 0xc7fdcf6f
and ecx, eax
imul eax, dword [0x140097c74], 0xbda86f5a
imul edx, dword [0x140097c70], 0x25b31af2
add eax, edx
add eax, 0xdaa80840
mov edx, dword [0x140097c7c]
mov r12d, r8d
mov r8d, dword [0x140097c78]
shrd edx, r8d, 0x16
mov r8d, dword [0x140097c8c]
mov r9d, dword [0x140097c88]
shrd r8d, r9d, 0xe
xor edx, 0xd525f25d
imul r9d, dword [0x140097c80], 0xddd94b51
xor r8d, 0x86729d43
mov r13, r10
imul r10d, dword [0x140097c84], 0x66657404
cmp ecx, eax
mov eax, r10d
mov ecx, r9d
lea eax, [rcx + rax + 0x7fc435eb]
cmove r8d, eax
cmp dword [0x140099c10], edx
mov edx, r8d
cmovl edx, eax
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r12b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov r10, r13
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov bl, byte [rbp - 0x14]
mov al, byte [rbp - 0x15]
mov ecx, dword [rbp - 0x1c]
jmp 0x14007b18a
mov r13, qword [rbp - 0x38]
mov eax, dword [r13]
mov r9, qword [rbp - 0x28]
mov dword [r9], eax
imul eax, dword [0x140097d48], 0x67e8755c
imul ecx, dword [0x140097d44], 0x9c074348
add eax, ecx
add eax, 0x913df27b
mov ecx, dword [0x140099c0c]
xor eax, ecx
imul eax, ecx
imul ecx, dword [0x140097d50], 0x7aef12e
imul edx, dword [0x140097d4c], 0x54154b71
add ecx, edx
add ecx, 0x67db00b8
and ecx, eax
imul eax, dword [0x140097d58], 0x4c592b8e
imul edx, dword [0x140097d54], 0x3e20d70b
mov byte [rbp - 0x16], r8b
imul r8d, dword [0x140097d5c], 0x218c2e26
imul r9d, dword [0x140097d60], 0x2211be58
mov qword [rbp - 0x50], r10
imul r10d, dword [0x140097d64], 0xb8a0632a
mov qword [rbp - 0x58], r11
imul r11d, dword [0x140097d68], 0x4597dc6b
imul esi, dword [0x140097d6c], 0x26a93ff4
mov r12, rdi
imul edi, dword [0x140097d70], 0xcba92532
add eax, edx
add eax, 0x3ac0ee1f
cmp ecx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x444f9fce]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx - 0x5b3d07d5]
mov edx, edi
mov r8d, esi
lea edx, [r8 + rdx - 0x4044a2e1]
cmove edx, ecx
cmp dword [0x140099c10], eax
cmovl edx, ecx
mov byte [rbp - 0x13], r14b
mov al, byte [rbp - 0x16]
mov byte [rbp - 0x12], al
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, r12
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x48]
mov rsi, r13
jmp 0x14007e9c0
mov byte [rbp - 0x13], r14b
mov byte [rbp - 0x12], r8b
mov byte [rbp - 0x11], r15b
mov r8, rbx
mov r9, rdi
mov rdi, qword [rbp - 0x30]
mov r15, rsi
mov rsi, qword [rbp - 0x38]
mov r12, qword [rbp - 0x40]
mov r14, qword [rbp - 0x28]
mov ebx, ecx
mov ecx, edx
mov edx, r13d
cmp r13d, 0xa66e68a1
jne 0x14007b18a
mov eax, dword [rbp - 0x1c]
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret