Function at 0x14007a830
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rdi, rdx
mov r15d, ecx
xor esi, esi
mov dword [rsp + 0x30], esi
mov rbx, qword [0x140111088]
mov qword [rbp + 0x110], rsi
lea rax, [0x1400dfa78]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], rsi
mov rax, qword [rbx]
cmp dword [rax], esi
je 0x14007a8eb
mov qword [rbp + 0x250], rsi
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x110], rax
lea r8, [0x1400ee34b]
mov qword [rsp + 0x28], r8
lea rax, str._DLLPROTECT__::_DllProtectStart___
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.140086600
nop
lea rcx, [rbp - 0x20]
call fcn.14007fc10
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x48], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007a929
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.options:__d__proc_name:__s
lea rdx, [0x1400dfb00]
xor ecx, ecx
call fcn.140086790
lea rax, str.bddllp_77C5D6EB_2669_4344_BA08_BAD4BF895666
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov dword [0x140110d50], r15d
mov ecx, r15d
and ecx, 0x30
mov dword [0x140111164], ecx
mov eax, r15d
shr eax, 1
and al, 1
mov byte [0x140111161], al
mov eax, r15d
shr eax, 3
and al, 1
mov byte [0x14011116a], al
mov eax, r15d
shr eax, 2
and al, 1
mov byte [0x140111162], al
mov eax, r15d
shr eax, 6
and al, 1
mov byte [0x140111163], al
mov eax, r15d
shr eax, 7
and al, 1
mov byte [0x140111168], al
mov eax, r15d
shr eax, 8
and al, 1
mov byte [0x140111169], al
cmp ecx, 0x30
jne 0x14007aa88
lea rcx, [rbp - 0x20]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007aa36
mov dword [rbp + 0x260], esi
mov qword [rbp - 0x30], rsi
lea rax, [rbp + 0x260]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_activate_dllprotect_in_report_mode_and_block_mode_at_the_same_time
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], 0x49
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x50]
call fcn.14009e2d0
nop
mov ebx, 0x201
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
jmp 0x14007aa3a
mov ebx, dword [rsp + 0x30]
test bl, 1
je 0x14007b9e4
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007b9e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b05b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba23
jmp 0x14007b05b
mov rcx, rdi
call fcn.14008ff90
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov r14, qword [0x14010c160]
lea rdi, [0x14010c150]
cmp qword [0x14010c168], 8
cmovae rdi, qword [0x14010c150]
cmp r14, 8
jae 0x14007aace
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x30], xmm0
mov ebx, 7
jmp 0x14007ab0a
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.14003d9e0
mov qword [rbp + 0x30], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1400a5290
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rbx
lea rcx, [rbp + 0x30]
call fcn.140090170
call fcn.14008d590
call fcn.14008a8b0
test r15b, 0x50
je 0x14007ae9e
cmp qword [0x1401111b0], 0
je 0x14007ae9e
lea rdx, [0x1400db340]
mov ecx, 0x18
call fcn.1400a3000
mov rcx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14007adbd
lea rax, vtable.EventsCbkDumper.0
mov qword [rcx], rax
mov rax, qword [0x1401111b0]
mov qword [rcx + 8], rax
mov rax, qword [0x1401111b8]
mov qword [rcx + 0x10], rax
mov qword [0x1401111c0], rcx
test rcx, rcx
je 0x14007adc4
lea rdx, [0x1400db340]
mov ecx, 0xe8
call fcn.1400a3000
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14007ac97
mov rbx, qword [0x1401111c0]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov ecx, 0x10
call fcn.1400a2ac0
mov qword [rax + 8], rsi
mov qword [r14], rax
mov qword [rax], r14
lea rcx, [r14 + 0x28]
mov edx, 2
call fcn.140047f20
lea rcx, [r14 + 0x78]
call fcn.1400cfcc0
nop
lea r12, [r14 + 0xc0]
mov qword [rsp + 0x30], r12
mov qword [r12], r14
mov qword [r12 + 8], rbx
xor eax, eax
mov byte [r12 + 0x10], al
xorps xmm0, xmm0
movups xmmword [r12 + 0x18], xmm0
mov eax, 1
xchg byte [r12 + 0x10], al
mov ecx, 0x10
call fcn.1400a2ac0
test rax, rax
je 0x14007ac43
mov qword [rax], r12
lea rcx, [0x14007a070]
mov qword [rax + 8], rcx
jmp 0x14007ac46
mov rax, rsi
mov qword [rbp + 0x270], rax
mov edi, 0x800
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140070900]
xor edx, edx
xor ecx, ecx
call fcn.1400bbe20
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14007ba3b
cmp dword [r12 + 0x20], 0
jne 0x14007ba35
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [r12 + 0x18], xmm0
jmp 0x14007ac9e
mov r14, rsi
mov edi, dword [rsp + 0x30]
mov qword [0x1401111c8], r14
test r14, r14
jne 0x14007aea2
lea rcx, [rbp - 0x20]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], r14d
je 0x14007ad3e
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x70], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_queue
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x1c
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x290]
call fcn.14009e2d0
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0x10
cmovae r9, qword [rbp + 0x290]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
test dil, 4
je 0x14007ad9e
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x14007ad85
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ad80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba49
call fcn.1400a2ab0
mov qword [rbp + 0x2a0], rsi
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
mov rcx, qword [0x1401111c0]
test rcx, rcx
je 0x14007b9e4
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14007b9e4
mov qword [0x1401111c0], rsi
lea rcx, [rbp - 0x20]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007ae4c
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_consumer
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14009e2d0
nop
mov ebx, 0x402
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
jmp 0x14007ae50
mov ebx, dword [rsp + 0x30]
test bl, 2
je 0x14007b9e4
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007b9e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b05b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba29
jmp 0x14007b05b
mov edi, dword [rsp + 0x30]
test r15b, 1
jne 0x14007aeb3
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140110d48], rax
test rax, rax
je 0x14007af70
lea rdx, [0x1400df6f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140110f38]
test rax, rax
cmovne rcx, rax
mov qword [0x140110f38], rcx
lea rdx, [0x1400df750]
mov rcx, qword [0x140110d48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140110d58]
test rax, rax
cmovne rcx, rax
mov qword [0x140110d58], rcx
lea rdx, [0x1400df810]
mov rcx, qword [0x140110d48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140111128]
test rax, rax
cmovne rcx, rax
mov qword [0x140111128], rcx
lea rdx, [0x1400df7b0]
mov rcx, qword [0x140110d48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401110a0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401110a0], rcx
lea rcx, [0x1400dde20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140110d28], rax
test rax, rax
jne 0x14007b065
lea rcx, [rbp - 0x20]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b015
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_ntdll.dll_module_handle
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x22
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14009e2d0
bts edi, 0xd
or edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
test dil, 8
je 0x14007b9e4
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007b9e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b05b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba4f
call fcn.1400a2ab0
jmp 0x14007b9e4
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140110d20], rax
test rax, rax
jne 0x14007b15c
lea rcx, [rbp - 0x20]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b10d
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_NtCreateSection_proc_address
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x27
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14009e2d0
bts edi, 0xe
or edi, 0x10
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
test dil, 0x10
je 0x14007b9e4
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007b9e4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b05b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba2f
jmp 0x14007b05b
call fcn.14009f5f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.14009fc70
lea rdx, [0x1400804f0]
lea rcx, [0x140110d58]
call fcn.14009ee60
test eax, eax
jne 0x14007b1e2
lea rdx, [0x1400803e0]
lea rcx, [0x140110f38]
call fcn.14009ee60
test eax, eax
jne 0x14007b1e2
lea rdx, [0x140080100]
lea rcx, [0x1401110a0]
call fcn.14009ee60
test eax, eax
jne 0x14007b1e2
lea rdx, [0x140080250]
lea rcx, [0x140111128]
call fcn.14009ee60
test eax, eax
jne 0x14007b1e2
lea rdx, [0x140083ce0]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.14009ee60
test eax, eax
je 0x14007b1f6
call fcn.14009f4a0
mov ecx, 1
call fcn.1400858d0
jmp 0x14007b9e4
cmp byte [0x140111168], 0
je 0x14007b307
lea rcx, [rbp + 0x1c0]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b29c
mov dword [rbp + 0x280], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x280]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, str.activating_NtCreateSection_Hook
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x130]
call fcn.14009e2d0
bts edi, 0xf
or edi, 0x20
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae r9, qword [rbp + 0x130]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
test dil, 0x20
je 0x14007b2e6
and edi, 0xffffffdf
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x14007b2e6
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b2e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba55
call fcn.1400a2ab0
lea rdx, [0x140080760]
lea rcx, [0x140110d20]
call fcn.14009ee60
test eax, eax
je 0x14007b307
call fcn.14009f4a0
jmp 0x14007b9e4
call fcn.14009f6d0
lea r14, [0x14010c0b0]
mov rdx, r14
cmp qword [0x14010c0c8], 8
cmovae rdx, qword [0x14010c0b0]
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], si
mov r8, qword [0x14010c0c0]
lea rcx, [rbp + 0x80]
call fcn.14003d860
or edi, 0x30000
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], si
mov r8d, 0xd
lea rdx, str.cryptbase.dll
lea rcx, [rbp + 0x60]
call fcn.14003d860
or edi, 0xc0000
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140005b60
mov rbx, rax
lea rcx, [rbp + 0x60]
call fcn.140005fe0
mov rdx, rbx
lea rcx, [rbp + 0x360]
call fcn.140021ef0
nop
lea rcx, [rbp + 0x80]
call fcn.140005fe0
lea rcx, [rbp + 0x360]
cmp qword [rbp + 0x378], 8
cmovae rcx, qword [rbp + 0x360]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140110d30], rax
test rax, rax
jne 0x14007b4ed
lea rcx, [rbp + 0x1f0]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b4a3
mov dword [rbp + 0x310], esi
mov qword [rbp + 0xe0], rsi
lea rax, [rbp + 0x310]
mov qword [rbp + 0xe8], rax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x280], xmm0
lea rax, str.cannot_load_cryptbase.dll
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0x19
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x160]
call fcn.14009e2d0
bts edi, 0x14
or edi, 0x40
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r9, qword [rbp + 0x160]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
test dil, 0x40
je 0x14007b4ed
and edi, 0xffffffbf
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x14007b4ed
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b4e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba5b
call fcn.1400a2ab0
mov rdx, r14
cmp qword [0x14010c0c8], 8
cmovae rdx, qword [0x14010c0b0]
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], si
mov r8, qword [0x14010c0c0]
lea rcx, [rbp + 0xc0]
call fcn.14003d860
or edi, 0x600000
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], si
mov r8d, 0xb
lea rdx, str.profapi.dll
lea rcx, [rbp + 0xa0]
call fcn.14003d860
or edi, 0x1800000
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xc0]
call fcn.140005b60
mov rbx, rax
lea rcx, [rbp + 0xa0]
call fcn.140005fe0
mov rdx, rbx
lea rcx, [rbp + 0x340]
call fcn.140021ef0
nop
lea rcx, [rbp + 0xc0]
call fcn.140005fe0
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rcx, qword [rbp + 0x340]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140110d38], rax
test rax, rax
jne 0x14007b6be
lea rcx, [rbp + 0x220]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b67a
mov dword [rbp + 0x300], esi
mov qword [rbp + 0x100], rsi
lea rax, [rbp + 0x300]
mov qword [rbp + 0x108], rax
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x310], xmm0
lea rax, str.cannot_load_profapi.dll
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0x17
lea r8, [rbp + 0x310]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.14009e2d0
bts edi, 0x19
bts edi, 7
mov dword [rsp + 0x30], edi
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r9, qword [rbp - 0x20]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
test dil, dil
jns 0x14007b6be
btr edi, 7
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14007b6be
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b6b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba61
call fcn.1400a2ab0
cmp qword [0x14010c0c8], 8
cmovae r14, qword [0x14010c0b0]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov r8, qword [0x14010c0c0]
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14003d860
or edi, 0xc000000
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], si
mov r8d, 0xc
lea rdx, str.wintrust.dll
lea rcx, [rbp + 0x10]
call fcn.14003d860
or edi, 0x30000000
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140005b60
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.140005fe0
mov rdx, rbx
lea rcx, [rbp + 0x320]
call fcn.140021ef0
nop
lea rcx, [rsp + 0x50]
call fcn.140005fe0
lea rcx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rcx, qword [rbp + 0x320]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140110d40], rax
test rax, rax
jne 0x14007b883
lea rcx, [rbp + 0x190]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b835
mov dword [rbp + 0x290], esi
mov qword [rbp + 0x250], rsi
lea rax, [rbp + 0x290]
mov qword [rbp + 0x258], rax
movaps xmm0, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x300], xmm0
lea rax, str.cannot_load_wintrust.dll
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x268], 0x18
lea r8, [rbp + 0x300]
lea rdx, [rbp + 0x260]
lea rcx, [rbp - 0x68]
call fcn.14009e2d0
bts edi, 0x1e
bts edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r9, qword [rbp - 0x68]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086470
nop
bt edi, 8
jae 0x14007b9bd
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14007b9bd
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b879
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007ba1d
call fcn.1400a2ab0
jmp 0x14007b9bd
mov qword [rbp + 0x250], rsi
lea rdi, [0x14010cdf0]
mov qword [rbp + 0x258], rdi
lea r8, [rbp + 0x250]
mov rdx, qword [0x140110d28]
lea rcx, [rbp + 0x2e0]
call fcn.140089d20
nop
lea rcx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rcx, qword [rbp + 0x2e0]
xor edx, edx
call fcn.140083ae0
mov ebx, eax
lea rcx, [rbp + 0x190]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b917
lea r9, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae r9, qword [rbp + 0x2e0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x1400dfb00]
xor ecx, ecx
call fcn.140086790
mov dword [rbp + 0x250], esi
mov qword [rbp + 0x258], rdi
lea r8, [rbp + 0x250]
xor edx, edx
lea rcx, [rbp + 0x2c0]
call fcn.140089d20
nop
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 8
cmovae rcx, qword [rbp + 0x2c0]
xor edx, edx
call fcn.140083ae0
mov ebx, eax
lea rcx, [rbp + 0x290]
call fcn.14007fc10
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b99e
lea r9, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 8
cmovae r9, qword [rbp + 0x2c0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x1400dfb00]
xor ecx, ecx
call fcn.140086790
mov esi, 1
lea rcx, [rbp + 0x2c0]
call fcn.140005fe0
nop
lea rcx, [rbp + 0x2e0]
call fcn.140005fe0
nop
lea rcx, [rbp + 0x320]
call fcn.140005fe0
nop
lea rcx, [rbp + 0x340]
call fcn.140005fe0
nop
lea rcx, [rbp + 0x360]
call fcn.140005fe0
nop
lea rcx, [rbp + 0x110]
call fcn.1400792f0
mov eax, esi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1400a2a50
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400a99c0
nop
call fcn.1400a99c0
int3
call fcn.1400a99c0
int3
call fcn.1400a99c0
nop
call fcn.1400b3b40
nop
mov dword [rbp - 0x28], esi
mov ecx, 6
call fcn.140046590
nop
call fcn.1400a99c0
int3
call fcn.1400a99c0
int3
call fcn.1400a99c0
nop
call fcn.1400a99c0
nop
call fcn.1400a99c0
int3