Function at 0x14009eee0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
call fcn.1400867c0
mov rsi, rax
xor r12d, r12d
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], r12b
lea r8d, [r12 + 0x18]
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009efaf
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, Ordinal_41
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f053
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f0f7
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f19b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.RtlHashUnicodeString
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f23f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.RtlUpcaseUnicodeChar
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f2e3
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationProcess
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f387
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.NtSetInformationProcess
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f42b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, Ordinal_27
lea rdx, str.NtQueryInformationThread
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f4cf
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.NtDuplicateObject
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f573
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.NtQueryObject
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f617
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, recvfrom
lea rdx, str.NtQuerySection
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f6bb
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.RtlCreateActivationContext
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f75f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f803
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.NtCreateThreadEx
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f8a7
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.NtLockVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f94b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.NtSuspendProcess
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009f9ef
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.NtResumeProcess
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fa93
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.RtlImageNtHeader
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fb37
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, recvfrom
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fbdb
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, recvfrom
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fc7f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, Ordinal_33
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fd23
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, ntohs
lea rdx, str.NtOpenEvent
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fdc7
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.NtCreateEvent
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009fe6b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.NtQueueApcThread
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009ff0f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.RtlEncodeSystemPointer
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14009ffb3
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400a0057
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_32
lea rdx, str.NtWow64QueryInformationProcess64
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400a00fb
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400a019f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rsi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rdi, [rsi + 0x40]
mov qword [rbp + 0x30], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400a0243
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], rbx
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rdi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Wow64GetThreadContext
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rbx, [rdi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400a02e7
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], rsi
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rdi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Wow64SetThreadContext
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rbx, [rdi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400a038b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], rsi
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rdi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Wow64SuspendThread
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rbx, [rdi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400a042f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], rsi
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rdi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rbx, [rdi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400a04d3
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], rsi
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
call fcn.1400867c0
mov rdi, rax
mov qword [rbp - 0x50], r12
movdqa xmm0, xmmword [0x14022bce0]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rbp - 0x50]
call fcn.140008ae0
nop
lea rbx, [rdi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x1400a0577
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.1400084e0
mov qword [rbp - 0x10], rsi
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.1400a05b0
nop
lea rcx, [rbp - 0x30]
call fcn.140008a80
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.140008a80
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret