Function at 0x14007ac10
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x14010c1f0]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rdi, rdx
mov r15d, ecx
xor esi, esi
mov dword [rsp + 0x30], esi
mov rbx, qword [0x1401110c8]
mov qword [rbp + 0xf0], rsi
lea rax, [0x1400dfae8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rsi
mov rax, qword [rbx]
cmp dword [rax], esi
je 0x14007accb
mov qword [rbp + 0x260], rsi
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x260]
mov qword [rbp + 0xf0], rax
lea r8, [0x1400ee51b]
mov qword [rsp + 0x28], r8
lea rax, str._DLLPROTECT__::_DllProtectStart___
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.140086ae0
nop
lea rcx, [rbp + 0x50]
call fcn.14007ff60
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x30], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007ad09
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.options:__d__proc_name:__s
lea rdx, [0x1400dfb70]
xor ecx, ecx
call fcn.140086c70
lea rax, str.bddllp_77C5D6EB_2669_4344_BA08_BAD4BF895666
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov dword [0x140110d90], r15d
mov ecx, r15d
and ecx, 0x30
mov dword [0x1401111a4], ecx
mov eax, r15d
shr eax, 1
and al, 1
mov byte [0x1401111a2], al
mov eax, r15d
shr eax, 3
and al, 1
mov byte [0x1401111ab], al
mov eax, r15d
shr eax, 2
and al, 1
mov byte [0x1401111a3], al
mov eax, r15d
shr eax, 6
and al, 1
mov byte [0x1401111a8], al
mov eax, r15d
shr eax, 7
and al, 1
mov byte [0x1401111a9], al
mov eax, r15d
shr eax, 8
and al, 1
mov byte [0x1401111aa], al
cmp ecx, 0x30
jne 0x14007ae68
lea rcx, [rbp + 0x50]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007ae16
mov dword [rbp + 0x270], esi
mov qword [rbp - 0x60], rsi
lea rax, [rbp + 0x270]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_activate_dllprotect_in_report_mode_and_block_mode_at_the_same_time
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], 0x49
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x50]
call fcn.14009eec0
nop
mov ebx, 0x201
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
jmp 0x14007ae1a
mov ebx, dword [rsp + 0x30]
test bl, 1
je 0x14007bd2b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007bd2b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b43b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd6a
jmp 0x14007b43b
mov rcx, rdi
call fcn.140090490
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
mov r14, qword [0x14010c180]
lea rdi, [0x14010c170]
cmp qword [0x14010c188], 8
cmovae rdi, qword [0x14010c170]
cmp r14, 8
jae 0x14007aeae
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x20], xmm0
mov ebx, 7
jmp 0x14007aeea
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x20]
call fcn.14003da80
mov qword [rbp + 0x20], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1400a5e80
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], rbx
lea rcx, [rbp + 0x20]
call fcn.140090670
call fcn.14008da90
call fcn.14008aea0
test r15b, 0x50
je 0x14007b27e
cmp qword [0x1401111f0], 0
je 0x14007b27e
lea rdx, [0x1400db2f0]
mov ecx, 0x18
call fcn.1400a3bf0
mov rcx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14007b19d
lea rax, vtable.EventsCbkDumper.0
mov qword [rcx], rax
mov rax, qword [0x1401111f0]
mov qword [rcx + 8], rax
mov rax, qword [0x1401111f8]
mov qword [rcx + 0x10], rax
mov qword [0x140111200], rcx
test rcx, rcx
je 0x14007b1a4
lea rdx, [0x1400db2f0]
mov ecx, 0xe8
call fcn.1400a3bf0
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14007b077
mov rbx, qword [0x140111200]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov ecx, 0x10
call fcn.1400a36b0
mov qword [rax + 8], rsi
mov qword [r14], rax
mov qword [rax], r14
lea rcx, [r14 + 0x28]
mov edx, 2
call fcn.140048140
lea rcx, [r14 + 0x78]
call fcn.1400d08b0
nop
lea r12, [r14 + 0xc0]
mov qword [rsp + 0x30], r12
mov qword [r12], r14
mov qword [r12 + 8], rbx
xor eax, eax
mov byte [r12 + 0x10], al
xorps xmm0, xmm0
movups xmmword [r12 + 0x18], xmm0
mov eax, 1
xchg byte [r12 + 0x10], al
mov ecx, 0x10
call fcn.1400a36b0
test rax, rax
je 0x14007b023
mov qword [rax], r12
lea rcx, [0x14007a450]
mov qword [rax + 8], rcx
jmp 0x14007b026
mov rax, rsi
mov qword [rbp + 0x280], rax
mov edi, 0x800
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140070ce0]
xor edx, edx
xor ecx, ecx
call fcn.1400bca10
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14007bd82
cmp dword [r12 + 0x20], 0
jne 0x14007bd7c
movaps xmm0, xmmword [rbp - 0x60]
movups xmmword [r12 + 0x18], xmm0
jmp 0x14007b07e
mov r14, rsi
mov edi, dword [rsp + 0x30]
mov qword [0x140111208], r14
test r14, r14
jne 0x14007b282
lea rcx, [rbp + 0x50]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], r14d
je 0x14007b11e
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x70], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_queue
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x1c
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x290]
call fcn.14009eec0
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0x10
cmovae r9, qword [rbp + 0x290]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
test dil, 4
je 0x14007b17e
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x14007b165
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b160
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd90
call fcn.1400a36a0
mov qword [rbp + 0x2a0], rsi
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
mov rcx, qword [0x140111200]
test rcx, rcx
je 0x14007bd2b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14007bd2b
mov qword [0x140111200], rsi
lea rcx, [rbp + 0x50]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b22c
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_consumer
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14009eec0
nop
mov ebx, 0x402
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
jmp 0x14007b230
mov ebx, dword [rsp + 0x30]
test bl, 2
je 0x14007bd2b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007bd2b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b43b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd70
jmp 0x14007b43b
mov edi, dword [rsp + 0x30]
test r15b, 1
jne 0x14007b293
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140110d88], rax
test rax, rax
je 0x14007b350
lea rdx, [0x1400df760]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140110f78]
test rax, rax
cmovne rcx, rax
mov qword [0x140110f78], rcx
lea rdx, [0x1400df7c0]
mov rcx, qword [0x140110d88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140110d98]
test rax, rax
cmovne rcx, rax
mov qword [0x140110d98], rcx
lea rdx, [0x1400df880]
mov rcx, qword [0x140110d88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140111168]
test rax, rax
cmovne rcx, rax
mov qword [0x140111168], rcx
lea rdx, [0x1400df820]
mov rcx, qword [0x140110d88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401110e0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401110e0], rcx
lea rcx, [0x1400dde00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140110d68], rax
test rax, rax
jne 0x14007b445
lea rcx, [rbp + 0x50]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b3f5
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_ntdll.dll_module_handle
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x22
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14009eec0
bts edi, 0xd
or edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
test dil, 8
je 0x14007bd2b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007bd2b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b43b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd96
call fcn.1400a36a0
jmp 0x14007bd2b
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140110d60], rax
test rax, rax
jne 0x14007b53c
lea rcx, [rbp + 0x50]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b4ed
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_NtCreateSection_proc_address
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x27
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14009eec0
bts edi, 0xe
or edi, 0x10
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
test dil, 0x10
je 0x14007bd2b
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14007bd2b
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b43b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd76
jmp 0x14007b43b
call fcn.1400a01e0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1400a0860
lea rdx, [0x140080840]
lea rcx, [0x140110d98]
call fcn.14009fa50
test eax, eax
jne 0x14007b5c2
lea rdx, [0x140080730]
lea rcx, [0x140110f78]
call fcn.14009fa50
test eax, eax
jne 0x14007b5c2
lea rdx, [0x140080450]
lea rcx, [0x1401110e0]
call fcn.14009fa50
test eax, eax
jne 0x14007b5c2
lea rdx, [0x1400805a0]
lea rcx, [0x140111168]
call fcn.14009fa50
test eax, eax
jne 0x14007b5c2
lea rdx, [0x1400841c0]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.14009fa50
test eax, eax
je 0x14007b5d6
call fcn.1400a0090
mov ecx, 1
call fcn.140085db0
jmp 0x14007bd2b
cmp byte [0x1401111a9], 0
je 0x14007b6e7
lea rcx, [rbp + 0x1d0]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b67c
mov dword [rbp + 0x2b0], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, str.activating_NtCreateSection_Hook
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x110]
call fcn.14009eec0
bts edi, 0xf
or edi, 0x20
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae r9, qword [rbp + 0x110]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
test dil, 0x20
je 0x14007b6c6
and edi, 0xffffffdf
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x14007b6c6
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b6c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd9c
call fcn.1400a36a0
lea rdx, [0x140080ab0]
lea rcx, [0x140110d60]
call fcn.14009fa50
test eax, eax
je 0x14007b6e7
call fcn.1400a0090
jmp 0x14007bd2b
call fcn.1400a02c0
lea rdx, [0x14010c0b0]
lea rcx, [rbp + 0x170]
call fcn.140021f90
nop
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
mov r8d, 0xd
lea rdx, str.cryptbase.dll
lea rcx, [rbp - 0x20]
call fcn.14003d900
or edi, 0x30000
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x170]
call fcn.140005be0
mov rbx, rax
lea rcx, [rbp - 0x20]
call fcn.140006060
mov rdx, rbx
lea rcx, [rbp + 0x360]
call fcn.140021f90
nop
lea rcx, [rbp + 0x170]
call fcn.140006060
lea rcx, [rbp + 0x360]
cmp qword [rbp + 0x378], 8
cmovae rcx, qword [rbp + 0x360]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140110d70], rax
test rax, rax
jne 0x14007b88e
lea rcx, [rbp + 0x200]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b844
mov dword [rbp + 0x2c0], esi
mov qword [rbp + 0x80], rsi
lea rax, [rbp + 0x2c0]
mov qword [rbp + 0x88], rax
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x2b0], xmm0
lea rax, str.cannot_load_cryptbase.dll
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 0x19
lea r8, [rbp + 0x2b0]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xb0]
call fcn.14009eec0
bts edi, 0x12
or edi, 0x40
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae r9, qword [rbp + 0xb0]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
test dil, 0x40
je 0x14007b88e
and edi, 0xffffffbf
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14007b88e
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b889
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bda2
call fcn.1400a36a0
lea rdx, [0x14010c0b0]
lea rcx, [rbp + 0x50]
call fcn.140021f90
nop
mov qword [rbp], rsi
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], 7
mov word [rbp], si
mov r8d, 0xb
lea rdx, str.profapi.dll
lea rcx, [rbp]
call fcn.14003d900
or edi, 0x180000
lea rdx, [rbp]
lea rcx, [rbp + 0x50]
call fcn.140005be0
mov rbx, rax
lea rcx, [rbp]
call fcn.140006060
mov rdx, rbx
lea rcx, [rbp + 0x340]
call fcn.140021f90
nop
lea rcx, [rbp + 0x50]
call fcn.140006060
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rcx, qword [rbp + 0x340]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140110d78], rax
test rax, rax
jne 0x14007ba1f
lea rcx, [rbp + 0x230]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007b9d5
mov dword [rbp + 0x310], esi
mov qword [rbp + 0xa0], rsi
lea rax, [rbp + 0x310]
mov qword [rbp + 0xa8], rax
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x2c0], xmm0
lea rax, str.cannot_load_profapi.dll
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0x17
lea r8, [rbp + 0x2c0]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xd0]
call fcn.14009eec0
bts edi, 0x15
bts edi, 7
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae r9, qword [rbp + 0xd0]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
test dil, dil
jns 0x14007ba1f
btr edi, 7
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14007ba1f
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ba1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bda8
call fcn.1400a36a0
lea rdx, [0x14010c0b0]
lea rcx, [rbp - 0x50]
call fcn.140021f90
nop
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov r8d, 0xc
lea rdx, str.wintrust.dll
lea rcx, [rsp + 0x50]
call fcn.14003d900
or edi, 0xc00000
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140005be0
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140006060
mov rdx, rbx
lea rcx, [rbp + 0x320]
call fcn.140021f90
nop
lea rcx, [rbp - 0x50]
call fcn.140006060
lea rcx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rcx, qword [rbp + 0x320]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140110d80], rax
test rax, rax
jne 0x14007bbca
lea rcx, [rbp + 0x1a0]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007bb76
mov dword [rbp + 0x290], esi
mov qword [rbp + 0x260], rsi
lea rax, [rbp + 0x290]
mov qword [rbp + 0x268], rax
movaps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x310], xmm0
lea rax, str.cannot_load_wintrust.dll
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], 0x18
lea r8, [rbp + 0x310]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x140]
call fcn.14009eec0
bts edi, 0x18
bts edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae r9, qword [rbp + 0x140]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.140086950
nop
bt edi, 8
jae 0x14007bd04
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x14007bd04
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bbc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007bd64
call fcn.1400a36a0
jmp 0x14007bd04
mov qword [rbp + 0x260], rsi
lea rdi, [0x14010ce10]
mov qword [rbp + 0x268], rdi
lea r8, [rbp + 0x260]
mov rdx, qword [0x140110d68]
lea rcx, [rbp + 0x2f0]
call fcn.14008a200
nop
lea rcx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 8
cmovae rcx, qword [rbp + 0x2f0]
xor edx, edx
call fcn.140083fc0
mov ebx, eax
lea rcx, [rbp + 0x1a0]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007bc5e
lea r9, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 8
cmovae r9, qword [rbp + 0x2f0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x1400dfb70]
xor ecx, ecx
call fcn.140086c70
mov dword [rbp + 0x260], esi
mov qword [rbp + 0x268], rdi
lea r8, [rbp + 0x260]
xor edx, edx
lea rcx, [rbp + 0x2d0]
call fcn.14008a200
nop
lea rcx, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 8
cmovae rcx, qword [rbp + 0x2d0]
xor edx, edx
call fcn.140083fc0
mov ebx, eax
lea rcx, [rbp + 0x140]
call fcn.14007ff60
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14007bce5
lea r9, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 8
cmovae r9, qword [rbp + 0x2d0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x1400dfb70]
xor ecx, ecx
call fcn.140086c70
mov esi, 1
lea rcx, [rbp + 0x2d0]
call fcn.140006060
nop
lea rcx, [rbp + 0x2f0]
call fcn.140006060
nop
lea rcx, [rbp + 0x320]
call fcn.140006060
nop
lea rcx, [rbp + 0x340]
call fcn.140006060
nop
lea rcx, [rbp + 0x360]
call fcn.140006060
nop
lea rcx, [rbp + 0xf0]
call fcn.1400796d0
mov eax, esi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1400a3640
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400aa5b0
nop
call fcn.1400aa5b0
int3
call fcn.1400aa5b0
int3
call fcn.1400aa5b0
nop
call fcn.1400b4730
nop
mov dword [rbp - 0x58], esi
mov ecx, 6
call fcn.1400467b0
nop
call fcn.1400aa5b0
int3
call fcn.1400aa5b0
int3
call fcn.1400aa5b0
nop
call fcn.1400aa5b0
nop
call fcn.1400aa5b0
int3