Function at 0x14006df90
Capabilities:
Contain obfuscated stackstrings
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x710]
sub rsp, 0x810
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov rdi, rdx
mov r15d, ecx
xor esi, esi
mov dword [rsp + 0x40], esi
xor eax, eax
mov byte [rsp + 0x48], al
mov dword [rsp + 0x38], 0x203e2d20
mov byte [rsp + 0x3c], al
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x580], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], al
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005eac0
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.14005f100
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x6b0]
call fcn.140060110
xor eax, eax
mov byte [rsp + 0x49], al
mov dword [rsp + 0x30], 0x202d3c20
mov byte [rsp + 0x34], al
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5d0], xmm1
mov byte [rbp + 0x5e0], al
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp + 0x228]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x2c8]
call fcn.14005f100
lea r8, [rsp + 0x49]
mov rdx, rax
lea rcx, [rbp + 0x6d8]
call fcn.140060110
mov rbx, qword [0x1400fbc38]
mov qword [rbp + 0x100], rsi
lea rax, [rbp + 0x6d8]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], rsi
mov rax, qword [rbx]
cmp dword [rax], esi
je 0x14006e136
mov qword [rbp + 0x570], rsi
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x100], rax
lea r8, [0x1400e01eb]
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x6b0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.14007c440
nop
lea rcx, [rbp + 0x160]
call fcn.140074770
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x30], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006e233
mov dword [rbp + 0x590], 0x290028
mov dword [rbp + 0x594], 0x2d0020
mov dword [rbp + 0x598], 0x20
mov dword [rbp - 0x58], 0x6c0044
mov dword [rbp - 0x54], 0x50006c
mov dword [rbp - 0x50], 0x6f0072
mov dword [rbp - 0x4c], 0x650074
mov dword [rbp - 0x48], 0x740063
mov dword [rbp - 0x44], 0x740053
mov dword [rbp - 0x40], 0x720061
mov dword [rbp - 0x3c], 0x74
mov dword [rbp - 0x28], 0x44005b
mov dword [rbp - 0x24], 0x4c004c
mov dword [rbp - 0x20], 0x520050
mov dword [rbp - 0x1c], 0x54004f
mov dword [rbp - 0x18], 0x430045
mov dword [rbp - 0x14], 0x5d0054
mov dword [rbp - 0x10], 0x3a0020
mov dword [rbp - 0xc], 0x20003a
mov word [rbp - 8], si
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x370]
call fcn.14005ebb0
lea r8, [rbp + 0x590]
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.14005f400
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.options:__d__proc_name:__s
xor ecx, ecx
call fcn.14007c5d0
lea rax, str.bddllp_77C5D6EB_2669_4344_BA08_BAD4BF895666
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov dword [0x1400fb900], r15d
mov ecx, r15d
and ecx, 0x30
mov dword [0x1400fbd14], ecx
mov eax, r15d
shr eax, 1
and al, 1
mov byte [0x1400fbd12], al
mov eax, r15d
shr eax, 3
and al, 1
mov byte [0x1400fbd1b], al
mov eax, r15d
shr eax, 2
and al, 1
mov byte [0x1400fbd13], al
mov eax, r15d
shr eax, 6
and al, 1
mov byte [0x1400fbd18], al
mov eax, r15d
shr eax, 7
and al, 1
mov byte [0x1400fbd19], al
mov eax, r15d
shr eax, 8
and al, 1
mov byte [0x1400fbd1a], al
cmp ecx, 0x30
jne 0x14006e3e9
lea rcx, [rbp + 0x160]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006e398
mov dword [rbp + 0x580], esi
mov qword [rbp], rsi
lea rax, [rbp + 0x580]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.cannot_activate_dllprotect_in_report_mode_and_block_mode_at_the_same_time
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x49
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140094ec0
nop
mov edi, 0x201
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
jmp 0x14006e39c
mov edi, dword [rsp + 0x40]
test dil, 1
je 0x14006f5e0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006f5e0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ead4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f61e
jmp 0x14006ead4
mov rcx, rdi
call fcn.140086490
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rsi
mov r14, qword [0x1400f81c0]
lea rdi, [0x1400f81b0]
cmp qword [0x1400f81c8], 8
cmovae rdi, qword [0x1400f81b0]
cmp r14, 8
jae 0x14006e43b
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x80], xmm0
mov ebx, 7
jmp 0x14006e47d
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x80]
call fcn.1400045d0
mov qword [rbp + 0x80], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.14009b3c0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0x80]
call fcn.140086670
call fcn.140083790
call fcn.140080760
test r15b, 0x50
je 0x14006e8bb
cmp qword [0x1400fbd60], 0
je 0x14006e8bb
lea rdx, [0x1400ce826]
mov ecx, 0x18
call fcn.14005cde4
mov rcx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14006e780
lea rax, vtable.EventsCbkDumper.0
mov qword [rcx], rax
mov rax, qword [0x1400fbd60]
mov qword [rcx + 8], rax
mov rax, qword [0x1400fbd68]
mov qword [rcx + 0x10], rax
mov qword [0x1400fbd70], rcx
test rcx, rcx
je 0x14006e787
lea rdx, [0x1400ce826]
mov ecx, 0xe8
call fcn.14005cde4
mov r14, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14006e613
mov rbx, qword [0x1400fbd70]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov ecx, 0x10
call fcn.14005c0a0
mov qword [rax + 8], rsi
mov qword [r14], rax
mov qword [rax], r14
lea rcx, [r14 + 0x28]
mov edx, 2
call fcn.1400357ec
lea rcx, [r14 + 0x78]
call fcn.1400c5aa4
nop
lea r12, [r14 + 0xc0]
mov qword [rsp + 0x40], r12
mov qword [r12], r14
mov qword [r12 + 8], rbx
xor eax, eax
mov byte [r12 + 0x10], al
xorps xmm0, xmm0
movups xmmword [r12 + 0x18], xmm0
mov eax, 1
xchg byte [r12 + 0x10], al
mov ecx, 0x10
call fcn.14005c0a0
test rax, rax
je 0x14006e5bf
mov qword [rax], r12
lea rcx, [0x14006d730]
mov qword [rax + 8], rcx
jmp 0x14006e5c2
mov rax, rsi
mov qword [rbp + 0x590], rax
mov edi, 0x800
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400632b0]
xor edx, edx
xor ecx, ecx
call fcn.1400b4580
mov qword [rbp], rax
test rax, rax
je 0x14006f636
cmp dword [r12 + 0x20], 0
jne 0x14006f630
movaps xmm0, xmmword [rbp]
movups xmmword [r12 + 0x18], xmm0
jmp 0x14006e61a
mov r14, rsi
mov edi, dword [rsp + 0x40]
mov qword [0x1400fbd78], r14
test r14, r14
jne 0x14006e8bf
lea rcx, [rbp + 0x160]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], r14d
je 0x14006e710
mov dword [rbp + 0x580], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x580]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.failed_to_alloc_events_queue
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1c
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140094ec0
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rbx, qword [rbp - 0x58]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], r14b
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
test dil, 4
je 0x14006e761
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14006e751
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006e74c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f644
call fcn.14005be00
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rcx, qword [0x1400fbd70]
test rcx, rcx
je 0x14006f5e0
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14006f5e0
mov qword [0x1400fbd70], rsi
lea rcx, [rbp + 0x160]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006e86a
mov dword [rbp + 0x580], esi
mov qword [rbp], rsi
lea rax, [rbp + 0x580]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.failed_to_alloc_events_consumer
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x1f
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140094ec0
nop
mov edi, 0x402
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
jmp 0x14006e86e
mov edi, dword [rsp + 0x40]
test dil, 2
je 0x14006f5e0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006f5e0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ead4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f624
jmp 0x14006ead4
mov edi, dword [rsp + 0x40]
test r15b, 1
jne 0x14006e8d0
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400fb8f8], rax
test rax, rax
je 0x14006e98d
lea rdx, [0x1400d1740]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fbae8]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fbae8], rcx
lea rdx, [0x1400d1750]
mov rcx, qword [0x1400fb8f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fb908]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fb908], rcx
lea rdx, [0x1400d1770]
mov rcx, qword [0x1400fb8f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fbcd8]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fbcd8], rcx
lea rdx, [0x1400d1760]
mov rcx, qword [0x1400fb8f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fbc50]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fbc50], rcx
lea rcx, [0x1400d03a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400fb8d8], rax
test rax, rax
jne 0x14006eade
lea rcx, [rbp + 0x160]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006ea90
mov dword [rbp + 0x580], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x580]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.cannot_get_ntdll.dll_module_handle
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x22
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.140094ec0
bts edi, 0xd
or edi, 8
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
test dil, 8
je 0x14006f5e0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006f5e0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ead4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f64a
call fcn.14005be00
jmp 0x14006f5e0
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400fb8d0], rax
test rax, rax
jne 0x14006ec31
lea rcx, [rbp + 0x160]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006ebe4
mov dword [rbp + 0x580], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x580]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.cannot_get_NtCreateSection_proc_address
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x27
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.140094ec0
bts edi, 0xe
or edi, 0x10
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
test dil, 0x10
je 0x14006f5e0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006f5e0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ead4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f62a
jmp 0x14006ead4
call fcn.1400961e0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140096860
lea rdx, [0x1400752c0]
lea rcx, [0x1400fb908]
call fcn.140095a50
test eax, eax
jne 0x14006ecb7
lea rdx, [0x1400750f0]
lea rcx, [0x1400fbae8]
call fcn.140095a50
test eax, eax
jne 0x14006ecb7
lea rdx, [0x140074c60]
lea rcx, [0x1400fbc50]
call fcn.140095a50
test eax, eax
jne 0x14006ecb7
lea rdx, [0x140074e90]
lea rcx, [0x1400fbcd8]
call fcn.140095a50
test eax, eax
jne 0x14006ecb7
lea rdx, [0x140079380]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.140095a50
test eax, eax
je 0x14006eccb
call fcn.140096090
mov ecx, 1
call fcn.14007b680
jmp 0x14006f5e0
cmp byte [0x1400fbd19], 0
je 0x14006ee31
lea rcx, [rbp + 0x460]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006edc6
mov dword [rbp + 0x600], esi
mov qword [rbp + 0x40], rsi
lea rax, [rbp + 0x600]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
lea rax, str.activating_NtCreateSection_Hook
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0x1f
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x140]
call fcn.140094ec0
bts edi, 0xf
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae rbx, qword [rbp + 0x140]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x1d0], xmm1
mov byte [rbp + 0x1e0], 0
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x348]
call fcn.14005eac0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
test dil, 0x20
je 0x14006ee10
and edi, 0xffffffdf
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14006ee10
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ee0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f618
call fcn.14005be00
lea rdx, [0x140075610]
lea rcx, [0x1400fb8d0]
call fcn.140095a50
test eax, eax
je 0x14006ee31
call fcn.140096090
jmp 0x14006f5e0
call fcn.1400962c0
lea rdx, [0x1400f80f0]
lea rcx, [rbp + 0x248]
call fcn.1400130f0
nop
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], si
mov r8d, 0xd
lea rdx, str.cryptbase.dll
lea rcx, [rbp + 0xd0]
call fcn.1400043e0
or edi, 0x30000
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x248]
call fcn.140009b70
mov rbx, rax
lea rcx, [rbp + 0xd0]
call fcn.140003e50
mov rdx, rbx
lea rcx, [rbp + 0x690]
call fcn.1400130f0
nop
lea rcx, [rbp + 0x248]
call fcn.140003e50
lea rcx, [rbp + 0x690]
cmp qword [rbp + 0x6a8], 8
cmovae rcx, qword [rbp + 0x690]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400fb8e0], rax
test rax, rax
jne 0x14006f01b
lea rcx, [rbp + 0x400]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f006
mov dword [rbp + 0x5f0], esi
mov qword [rbp + 0x190], rsi
lea rax, [rbp + 0x5f0]
mov qword [rbp + 0x198], rax
movaps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x600], xmm0
lea rax, str.cannot_load_cryptbase.dll
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0x19
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x208]
call fcn.140094ec0
bts edi, 0x12
or edi, 0x40
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x208]
cmp qword [rbp + 0x220], 0x10
cmovae rbx, qword [rbp + 0x208]
mov dword [rsp + 0x38], 0x2d202928
mov word [rsp + 0x3c], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x600], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x1a0], xmm1
mov byte [rbp + 0x1b0], 0
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2c8]
call fcn.14005eac0
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
test dil, 0x40
je 0x14006f01b
and edi, 0xffffffbf
lea rcx, [rbp + 0x208]
call fcn.140004190
lea rdx, [0x1400f80f0]
lea rcx, [rbp + 0x228]
call fcn.1400130f0
nop
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], si
mov r8d, 0xb
lea rdx, str.profapi.dll
lea rcx, [rbp + 0xb0]
call fcn.1400043e0
or edi, 0x180000
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x228]
call fcn.140009b70
mov rbx, rax
lea rcx, [rbp + 0xb0]
call fcn.140003e50
mov rdx, rbx
lea rcx, [rbp + 0x670]
call fcn.1400130f0
nop
lea rcx, [rbp + 0x228]
call fcn.140003e50
lea rcx, [rbp + 0x670]
cmp qword [rbp + 0x688], 8
cmovae rcx, qword [rbp + 0x670]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400fb8e8], rax
test rax, rax
jne 0x14006f1f8
lea rcx, [rbp + 0x430]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f1e3
mov dword [rbp + 0x5d0], esi
mov qword [rsp + 0x60], rsi
lea rax, [rbp + 0x5d0]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rax, str.cannot_load_profapi.dll
mov qword [rbp + 0x580], rax
mov qword [rbp + 0x588], 0x17
lea r8, [rbp + 0x5f0]
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x1e8]
call fcn.140094ec0
bts edi, 0x15
bts edi, 7
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 0x10
cmovae rbx, qword [rbp + 0x1e8]
mov dword [rbp - 0x80], 0x2d202928
mov word [rbp - 0x7c], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x5f0], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x1b8], xmm1
mov byte [rbp + 0x1c8], 0
lea r8, [rbp + 0x5f0]
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x2f0]
call fcn.14005eac0
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
test dil, dil
jns 0x14006f1f8
btr edi, 7
lea rcx, [rbp + 0x1e8]
call fcn.140004190
lea rdx, [0x1400f80f0]
lea rcx, [rbp + 0x60]
call fcn.1400130f0
nop
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
mov r8d, 0xc
lea rdx, str.wintrust.dll
lea rcx, [rbp - 0x78]
call fcn.1400043e0
or edi, 0xc00000
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x60]
call fcn.140009b70
mov rbx, rax
lea rcx, [rbp - 0x78]
call fcn.140003e50
mov rdx, rbx
lea rcx, [rbp + 0x650]
call fcn.1400130f0
nop
lea rcx, [rbp + 0x60]
call fcn.140003e50
lea rcx, [rbp + 0x650]
cmp qword [rbp + 0x668], 8
cmovae rcx, qword [rbp + 0x650]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400fb8f0], rax
test rax, rax
jne 0x14006f3b1
lea rcx, [rbp + 0x318]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f396
mov dword [rbp + 0x5a0], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x5a0]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x5d0], xmm0
lea rax, str.cannot_load_wintrust.dll
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x18
lea r8, [rbp + 0x5d0]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x120]
call fcn.140094ec0
bts edi, 0x18
bts edi, 8
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rbx, qword [rbp + 0x120]
mov dword [rbp + 0x570], 0x2d202928
mov word [rbp + 0x574], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x5d0], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x58], xmm1
mov byte [rbp - 0x48], 0
lea r8, [rbp + 0x5d0]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x28]
call fcn.14005eac0
lea r8, [rbp + 0x570]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14005f280
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007c2b0
nop
bt edi, 8
jae 0x14006f5b9
lea rcx, [rbp + 0x120]
call fcn.140004190
jmp 0x14006f5b9
mov qword [rsp + 0x50], rsi
lea r15, [0x1400f8e00]
mov qword [rsp + 0x58], r15
lea r8, [rsp + 0x50]
mov rdx, qword [0x1400fb8d8]
lea rcx, [rbp + 0x610]
call fcn.14007f9e0
nop
lea rcx, [rbp + 0x610]
cmp qword [rbp + 0x628], 8
cmovae rcx, qword [rbp + 0x610]
xor edx, edx
call fcn.140078f50
mov r14d, eax
lea rcx, [rbp + 0x318]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f4ad
lea rdi, [rbp + 0x610]
cmp qword [rbp + 0x628], 8
cmovae rdi, qword [rbp + 0x610]
mov dword [rbp + 0x570], 0x290028
mov dword [rbp + 0x574], 0x2d0020
mov dword [rbp + 0x578], 0x20
lea rdx, [0x1400d1990]
lea rcx, [rbp - 0x28]
call fcn.140067220
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rbp - 0x58]
call fcn.1400672a0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x490]
call fcn.14005ebb0
lea r8, [rbp + 0x570]
mov rdx, rax
lea rcx, [rbp + 0x520]
call fcn.14005f400
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, str.signature_check_moking_mocking_for__s_returned__d
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], r15
lea r8, [rsp + 0x50]
xor edx, edx
lea rcx, [rbp + 0x630]
call fcn.14007f9e0
nop
lea rcx, [rbp + 0x630]
cmp qword [rbp + 0x648], 8
cmovae rcx, qword [rbp + 0x630]
xor edx, edx
call fcn.140078f50
mov r14d, eax
lea rcx, [rbp + 0x370]
call fcn.140074770
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f59a
lea rdi, [rbp + 0x630]
cmp qword [rbp + 0x648], 8
cmovae rdi, qword [rbp + 0x630]
mov dword [rsp + 0x70], 0x290028
mov dword [rsp + 0x74], 0x2d0020
mov dword [rsp + 0x78], 0x20
lea rdx, [0x1400d1990]
lea rcx, [rbp + 0x120]
call fcn.140067220
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rbp + 0x5a0]
call fcn.1400672a0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.14005ebb0
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x4d0]
call fcn.14005f400
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, str.signature_check_moking_mocking_for__s_returned__d
mov rdx, rax
xor ecx, ecx
call fcn.14007c5d0
mov esi, 1
lea rcx, [rbp + 0x630]
call fcn.140003e50
nop
lea rcx, [rbp + 0x610]
call fcn.140003e50
nop
lea rcx, [rbp + 0x650]
call fcn.140003e50
nop
lea rcx, [rbp + 0x670]
call fcn.140003e50
nop
lea rcx, [rbp + 0x690]
call fcn.140003e50
nop
lea rcx, [rbp + 0x100]
call fcn.14006ca40
mov eax, esi
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.14005bde0
mov rbx, qword [rsp + 0x860]
add rsp, 0x810
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a8018
nop
call fcn.1400a8018
int3
call fcn.1400a8018
int3
call fcn.1400a8018
nop
call fcn.1400ab788
nop
mov dword [rbp + 8], esi
mov ecx, 6
call fcn.1400353cc
nop
call fcn.1400a8018
int3
call fcn.1400a8018
int3