Function at 0x14006e750
Capabilities:
Contain obfuscated stackstrings
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x710]
sub rsp, 0x810
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x700], rax
mov rdi, rdx
mov r15d, ecx
xor esi, esi
mov dword [rsp + 0x40], esi
xor eax, eax
mov byte [rsp + 0x48], al
mov dword [rsp + 0x38], 0x203e2d20
mov byte [rsp + 0x3c], al
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x580], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], al
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005f280
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.14005f8c0
lea r8, [rsp + 0x48]
mov rdx, rax
lea rcx, [rbp + 0x6b0]
call fcn.1400608d0
xor eax, eax
mov byte [rsp + 0x49], al
mov dword [rsp + 0x30], 0x202d3c20
mov byte [rsp + 0x34], al
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5d0], xmm1
mov byte [rbp + 0x5e0], al
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5d0]
lea rcx, [rbp + 0x228]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x2c8]
call fcn.14005f8c0
lea r8, [rsp + 0x49]
mov rdx, rax
lea rcx, [rbp + 0x6d8]
call fcn.1400608d0
mov rbx, qword [0x1400fbc38]
mov qword [rbp + 0x100], rsi
lea rax, [rbp + 0x6d8]
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], rsi
mov rax, qword [rbx]
cmp dword [rax], esi
je 0x14006e8f6
mov qword [rbp + 0x570], rsi
lea rcx, [rbp + 0x570]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x570]
mov qword [rbp + 0x100], rax
lea r8, [0x1400e01eb]
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x6b0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.14007cc00
nop
lea rcx, [rbp + 0x160]
call fcn.140074f30
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp + 0x30], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006e9f3
mov dword [rbp + 0x590], 0x290028
mov dword [rbp + 0x594], 0x2d0020
mov dword [rbp + 0x598], 0x20
mov dword [rbp - 0x58], 0x6c0044
mov dword [rbp - 0x54], 0x50006c
mov dword [rbp - 0x50], 0x6f0072
mov dword [rbp - 0x4c], 0x650074
mov dword [rbp - 0x48], 0x740063
mov dword [rbp - 0x44], 0x740053
mov dword [rbp - 0x40], 0x720061
mov dword [rbp - 0x3c], 0x74
mov dword [rbp - 0x28], 0x44005b
mov dword [rbp - 0x24], 0x4c004c
mov dword [rbp - 0x20], 0x520050
mov dword [rbp - 0x1c], 0x54004f
mov dword [rbp - 0x18], 0x430045
mov dword [rbp - 0x14], 0x5d0054
mov dword [rbp - 0x10], 0x3a0020
mov dword [rbp - 0xc], 0x20003a
mov word [rbp - 8], si
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x370]
call fcn.14005f370
lea r8, [rbp + 0x590]
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.14005fbc0
mov rdx, rax
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.options:__d__proc_name:__s
xor ecx, ecx
call fcn.14007cd90
lea rax, str.bddllp_77C5D6EB_2669_4344_BA08_BAD4BF895666
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov dword [0x1400fb900], r15d
mov ecx, r15d
and ecx, 0x30
mov dword [0x1400fbd14], ecx
mov eax, r15d
shr eax, 1
and al, 1
mov byte [0x1400fbd12], al
mov eax, r15d
shr eax, 3
and al, 1
mov byte [0x1400fbd1b], al
mov eax, r15d
shr eax, 2
and al, 1
mov byte [0x1400fbd13], al
mov eax, r15d
shr eax, 6
and al, 1
mov byte [0x1400fbd18], al
mov eax, r15d
shr eax, 7
and al, 1
mov byte [0x1400fbd19], al
mov eax, r15d
shr eax, 8
and al, 1
mov byte [0x1400fbd1a], al
cmp ecx, 0x30
jne 0x14006eba9
lea rcx, [rbp + 0x160]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006eb58
mov dword [rbp + 0x580], esi
mov qword [rbp], rsi
lea rax, [rbp + 0x580]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.cannot_activate_dllprotect_in_report_mode_and_block_mode_at_the_same_time
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x49
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140095680
nop
mov edi, 0x201
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
jmp 0x14006eb5c
mov edi, dword [rsp + 0x40]
test dil, 1
je 0x14006fda0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006fda0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fdde
jmp 0x14006f294
mov rcx, rdi
call fcn.140086c50
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], rsi
mov r14, qword [0x1400f81c0]
lea rdi, [0x1400f81b0]
cmp qword [0x1400f81c8], 8
cmovae rdi, qword [0x1400f81b0]
cmp r14, 8
jae 0x14006ebfb
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x80], xmm0
mov ebx, 7
jmp 0x14006ec3d
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x80]
call fcn.1400045d0
mov qword [rbp + 0x80], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.14009bb80
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0x80]
call fcn.140086e30
call fcn.140083f50
call fcn.140080f20
test r15b, 0x50
je 0x14006f07b
cmp qword [0x1400fbd60], 0
je 0x14006f07b
lea rdx, [0x1400ce826]
mov ecx, 0x18
call fcn.14005d5a4
mov rcx, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14006ef40
lea rax, vtable.EventsCbkDumper.0
mov qword [rcx], rax
mov rax, qword [0x1400fbd60]
mov qword [rcx + 8], rax
mov rax, qword [0x1400fbd68]
mov qword [rcx + 0x10], rax
mov qword [0x1400fbd70], rcx
test rcx, rcx
je 0x14006ef47
lea rdx, [0x1400ce826]
mov ecx, 0xe8
call fcn.14005d5a4
mov r14, rax
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14006edd3
mov rbx, qword [0x1400fbd70]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov ecx, 0x10
call fcn.14005c860
mov qword [rax + 8], rsi
mov qword [r14], rax
mov qword [rax], r14
lea rcx, [r14 + 0x28]
mov edx, 2
call fcn.140035fac
lea rcx, [r14 + 0x78]
call fcn.1400c6264
nop
lea r12, [r14 + 0xc0]
mov qword [rsp + 0x40], r12
mov qword [r12], r14
mov qword [r12 + 8], rbx
xor eax, eax
mov byte [r12 + 0x10], al
xorps xmm0, xmm0
movups xmmword [r12 + 0x18], xmm0
mov eax, 1
xchg byte [r12 + 0x10], al
mov ecx, 0x10
call fcn.14005c860
test rax, rax
je 0x14006ed7f
mov qword [rax], r12
lea rcx, [0x14006def0]
mov qword [rax + 8], rcx
jmp 0x14006ed82
mov rax, rsi
mov qword [rbp + 0x590], rax
mov edi, 0x800
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140063a70]
xor edx, edx
xor ecx, ecx
call fcn.1400b4d40
mov qword [rbp], rax
test rax, rax
je 0x14006fdf6
cmp dword [r12 + 0x20], 0
jne 0x14006fdf0
movaps xmm0, xmmword [rbp]
movups xmmword [r12 + 0x18], xmm0
jmp 0x14006edda
mov r14, rsi
mov edi, dword [rsp + 0x40]
mov qword [0x1400fbd78], r14
test r14, r14
jne 0x14006f07f
lea rcx, [rbp + 0x160]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], r14d
je 0x14006eed0
mov dword [rbp + 0x580], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x580]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.failed_to_alloc_events_queue
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1c
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.140095680
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rbx, qword [rbp - 0x58]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], r14b
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, 4
je 0x14006ef21
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x14006ef11
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ef0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fe04
call fcn.14005c5c0
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rcx, qword [0x1400fbd70]
test rcx, rcx
je 0x14006fda0
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14006fda0
mov qword [0x1400fbd70], rsi
lea rcx, [rbp + 0x160]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f02a
mov dword [rbp + 0x580], esi
mov qword [rbp], rsi
lea rax, [rbp + 0x580]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.failed_to_alloc_events_consumer
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x1f
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140095680
nop
mov edi, 0x402
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
jmp 0x14006f02e
mov edi, dword [rsp + 0x40]
test dil, 2
je 0x14006fda0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006fda0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fde4
jmp 0x14006f294
mov edi, dword [rsp + 0x40]
test r15b, 1
jne 0x14006f090
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400fb8f8], rax
test rax, rax
je 0x14006f14d
lea rdx, [0x1400d1740]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fbae8]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fbae8], rcx
lea rdx, [0x1400d1750]
mov rcx, qword [0x1400fb8f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fb908]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fb908], rcx
lea rdx, [0x1400d1770]
mov rcx, qword [0x1400fb8f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fbcd8]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fbcd8], rcx
lea rdx, [0x1400d1760]
mov rcx, qword [0x1400fb8f8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1400fbc50]
test rax, rax
cmovne rcx, rax
mov qword [0x1400fbc50], rcx
lea rcx, [0x1400d03a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x1400fb8d8], rax
test rax, rax
jne 0x14006f29e
lea rcx, [rbp + 0x160]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f250
mov dword [rbp + 0x580], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x580]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.cannot_get_ntdll.dll_module_handle
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x22
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.140095680
bts edi, 0xd
or edi, 8
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, 8
je 0x14006fda0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006fda0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fe0a
call fcn.14005c5c0
jmp 0x14006fda0
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400fb8d0], rax
test rax, rax
jne 0x14006f3f1
lea rcx, [rbp + 0x160]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f3a4
mov dword [rbp + 0x580], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x580]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rax, str.cannot_get_NtCreateSection_proc_address
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x27
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x78]
call fcn.140095680
bts edi, 0xe
or edi, 0x10
mov dword [rsp + 0x40], edi
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x5a0], xmm1
mov byte [rbp + 0x5b0], 0
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x60]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, 0x10
je 0x14006fda0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14006fda0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fdea
jmp 0x14006f294
call fcn.1400969a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140097020
lea rdx, [0x140075a80]
lea rcx, [0x1400fb908]
call fcn.140096210
test eax, eax
jne 0x14006f477
lea rdx, [0x1400758b0]
lea rcx, [0x1400fbae8]
call fcn.140096210
test eax, eax
jne 0x14006f477
lea rdx, [0x140075420]
lea rcx, [0x1400fbc50]
call fcn.140096210
test eax, eax
jne 0x14006f477
lea rdx, [0x140075650]
lea rcx, [0x1400fbcd8]
call fcn.140096210
test eax, eax
jne 0x14006f477
lea rdx, [0x140079b40]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.140096210
test eax, eax
je 0x14006f48b
call fcn.140096850
mov ecx, 1
call fcn.14007be40
jmp 0x14006fda0
cmp byte [0x1400fbd19], 0
je 0x14006f5f1
lea rcx, [rbp + 0x460]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f586
mov dword [rbp + 0x600], esi
mov qword [rbp + 0x40], rsi
lea rax, [rbp + 0x600]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
lea rax, str.activating_NtCreateSection_Hook
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 0x1f
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x140]
call fcn.140095680
bts edi, 0xf
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae rbx, qword [rbp + 0x140]
mov dword [rsp + 0x30], 0x2d202928
mov word [rsp + 0x34], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x1d0], xmm1
mov byte [rbp + 0x1e0], 0
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x348]
call fcn.14005f280
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, 0x20
je 0x14006f5d0
and edi, 0xffffffdf
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14006f5d0
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f5cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006fdd8
call fcn.14005c5c0
lea rdx, [0x140075dd0]
lea rcx, [0x1400fb8d0]
call fcn.140096210
test eax, eax
je 0x14006f5f1
call fcn.140096850
jmp 0x14006fda0
call fcn.140096a80
lea rdx, [0x1400f80f0]
lea rcx, [rbp + 0x248]
call fcn.1400138b0
nop
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], si
mov r8d, 0xd
lea rdx, str.cryptbase.dll
lea rcx, [rbp + 0xd0]
call fcn.1400043e0
or edi, 0x30000
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x248]
call fcn.140009b70
mov rbx, rax
lea rcx, [rbp + 0xd0]
call fcn.140003e50
mov rdx, rbx
lea rcx, [rbp + 0x690]
call fcn.1400138b0
nop
lea rcx, [rbp + 0x248]
call fcn.140003e50
lea rcx, [rbp + 0x690]
cmp qword [rbp + 0x6a8], 8
cmovae rcx, qword [rbp + 0x690]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400fb8e0], rax
test rax, rax
jne 0x14006f7db
lea rcx, [rbp + 0x400]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f7c6
mov dword [rbp + 0x5f0], esi
mov qword [rbp + 0x190], rsi
lea rax, [rbp + 0x5f0]
mov qword [rbp + 0x198], rax
movaps xmm0, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x600], xmm0
lea rax, str.cannot_load_cryptbase.dll
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0x19
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x208]
call fcn.140095680
bts edi, 0x12
or edi, 0x40
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x208]
cmp qword [rbp + 0x220], 0x10
cmovae rbx, qword [rbp + 0x208]
mov dword [rsp + 0x38], 0x2d202928
mov word [rsp + 0x3c], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x600], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x1a0], xmm1
mov byte [rbp + 0x1b0], 0
lea r8, [rbp + 0x600]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2c8]
call fcn.14005f280
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, 0x40
je 0x14006f7db
and edi, 0xffffffbf
lea rcx, [rbp + 0x208]
call fcn.140004190
lea rdx, [0x1400f80f0]
lea rcx, [rbp + 0x228]
call fcn.1400138b0
nop
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], si
mov r8d, 0xb
lea rdx, str.profapi.dll
lea rcx, [rbp + 0xb0]
call fcn.1400043e0
or edi, 0x180000
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x228]
call fcn.140009b70
mov rbx, rax
lea rcx, [rbp + 0xb0]
call fcn.140003e50
mov rdx, rbx
lea rcx, [rbp + 0x670]
call fcn.1400138b0
nop
lea rcx, [rbp + 0x228]
call fcn.140003e50
lea rcx, [rbp + 0x670]
cmp qword [rbp + 0x688], 8
cmovae rcx, qword [rbp + 0x670]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400fb8e8], rax
test rax, rax
jne 0x14006f9b8
lea rcx, [rbp + 0x430]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006f9a3
mov dword [rbp + 0x5d0], esi
mov qword [rsp + 0x60], rsi
lea rax, [rbp + 0x5d0]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rax, str.cannot_load_profapi.dll
mov qword [rbp + 0x580], rax
mov qword [rbp + 0x588], 0x17
lea r8, [rbp + 0x5f0]
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x1e8]
call fcn.140095680
bts edi, 0x15
bts edi, 7
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x1e8]
cmp qword [rbp + 0x200], 0x10
cmovae rbx, qword [rbp + 0x1e8]
mov dword [rbp - 0x80], 0x2d202928
mov word [rbp - 0x7c], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x5f0], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp + 0x1b8], xmm1
mov byte [rbp + 0x1c8], 0
lea r8, [rbp + 0x5f0]
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x2f0]
call fcn.14005f280
lea r8, [rbp - 0x80]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
test dil, dil
jns 0x14006f9b8
btr edi, 7
lea rcx, [rbp + 0x1e8]
call fcn.140004190
lea rdx, [0x1400f80f0]
lea rcx, [rbp + 0x60]
call fcn.1400138b0
nop
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
mov r8d, 0xc
lea rdx, str.wintrust.dll
lea rcx, [rbp - 0x78]
call fcn.1400043e0
or edi, 0xc00000
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x60]
call fcn.140009b70
mov rbx, rax
lea rcx, [rbp - 0x78]
call fcn.140003e50
mov rdx, rbx
lea rcx, [rbp + 0x650]
call fcn.1400138b0
nop
lea rcx, [rbp + 0x60]
call fcn.140003e50
lea rcx, [rbp + 0x650]
cmp qword [rbp + 0x668], 8
cmovae rcx, qword [rbp + 0x650]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1400fb8f0], rax
test rax, rax
jne 0x14006fb71
lea rcx, [rbp + 0x318]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006fb56
mov dword [rbp + 0x5a0], esi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x5a0]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp + 0x5d0], xmm0
lea rax, str.cannot_load_wintrust.dll
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x18
lea r8, [rbp + 0x5d0]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x120]
call fcn.140095680
bts edi, 0x18
bts edi, 8
mov dword [rsp + 0x40], edi
lea rbx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0x10
cmovae rbx, qword [rbp + 0x120]
mov dword [rbp + 0x570], 0x2d202928
mov word [rbp + 0x574], 0x20
movdqa xmm0, xmmword [str.DllProtectStart]
movdqu xmmword [rbp + 0x5d0], xmm0
movdqa xmm1, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x58], xmm1
mov byte [rbp - 0x48], 0
lea r8, [rbp + 0x5d0]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x28]
call fcn.14005f280
lea r8, [rbp + 0x570]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14005fa40
mov r9, rbx
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call fcn.14007ca70
nop
bt edi, 8
jae 0x14006fd79
lea rcx, [rbp + 0x120]
call fcn.140004190
jmp 0x14006fd79
mov qword [rsp + 0x50], rsi
lea r15, [0x1400f8e00]
mov qword [rsp + 0x58], r15
lea r8, [rsp + 0x50]
mov rdx, qword [0x1400fb8d8]
lea rcx, [rbp + 0x610]
call fcn.1400801a0
nop
lea rcx, [rbp + 0x610]
cmp qword [rbp + 0x628], 8
cmovae rcx, qword [rbp + 0x610]
xor edx, edx
call fcn.140079710
mov r14d, eax
lea rcx, [rbp + 0x318]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006fc6d
lea rdi, [rbp + 0x610]
cmp qword [rbp + 0x628], 8
cmovae rdi, qword [rbp + 0x610]
mov dword [rbp + 0x570], 0x290028
mov dword [rbp + 0x574], 0x2d0020
mov dword [rbp + 0x578], 0x20
lea rdx, [0x1400d1990]
lea rcx, [rbp - 0x28]
call fcn.1400679e0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rbp - 0x58]
call fcn.140067a60
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x490]
call fcn.14005f370
lea r8, [rbp + 0x570]
mov rdx, rax
lea rcx, [rbp + 0x520]
call fcn.14005fbc0
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, str.signature_check_moking_mocking_for__s_returned__d
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], r15
lea r8, [rsp + 0x50]
xor edx, edx
lea rcx, [rbp + 0x630]
call fcn.1400801a0
nop
lea rcx, [rbp + 0x630]
cmp qword [rbp + 0x648], 8
cmovae rcx, qword [rbp + 0x630]
xor edx, edx
call fcn.140079710
mov r14d, eax
lea rcx, [rbp + 0x370]
call fcn.140074f30
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14006fd5a
lea rdi, [rbp + 0x630]
cmp qword [rbp + 0x648], 8
cmovae rdi, qword [rbp + 0x630]
mov dword [rsp + 0x70], 0x290028
mov dword [rsp + 0x74], 0x2d0020
mov dword [rsp + 0x78], 0x20
lea rdx, [0x1400d1990]
lea rcx, [rbp + 0x120]
call fcn.1400679e0
mov rbx, rax
lea rdx, str._DLLPROTECT__::
lea rcx, [rbp + 0x5a0]
call fcn.140067a60
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.14005f370
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x4d0]
call fcn.14005fbc0
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, str.signature_check_moking_mocking_for__s_returned__d
mov rdx, rax
xor ecx, ecx
call fcn.14007cd90
mov esi, 1
lea rcx, [rbp + 0x630]
call fcn.140003e50
nop
lea rcx, [rbp + 0x610]
call fcn.140003e50
nop
lea rcx, [rbp + 0x650]
call fcn.140003e50
nop
lea rcx, [rbp + 0x670]
call fcn.140003e50
nop
lea rcx, [rbp + 0x690]
call fcn.140003e50
nop
lea rcx, [rbp + 0x100]
call fcn.14006d200
mov eax, esi
mov rcx, qword [rbp + 0x700]
xor rcx, rsp
call fcn.14005c5a0
mov rbx, qword [rsp + 0x860]
add rsp, 0x810
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a87d8
nop
call fcn.1400a87d8
int3
call fcn.1400a87d8
int3
call fcn.1400a87d8
nop
call fcn.1400abf48
nop
mov dword [rbp + 8], esi
mov ecx, 6
call fcn.140035b8c
nop
call fcn.1400a87d8
int3
call fcn.1400a87d8
int3