Function at 0x140078760
Capabilities:
Generate random numbers using a mersenne twister
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x199f0]
mov eax, 0x19af0
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x199e0], rax
xor edi, edi
mov qword [rbp - 0x78], rcx
lea r12, [rcx + 0x20]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov r13, rcx
mov qword [rcx + 0x10], rdi
xor edx, edx
mov qword [rcx + 0x18], rdi
mov r8d, 0x7fc
add rcx, 0x24
mov qword [rsp + 0x68], r12
mov dword [r12], edi
call fcn.1401d1c40
cmp qword [0x140328f28], rdi
jne 0x1400787fe
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x1400787fe
mov qword [rax], rdi
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
lea rcx, str.explorer.exe
call fcn.14003c550
mov r15d, eax
test eax, eax
jne 0x14007886e
lea rcx, [rbp + 0x1b8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1b8]
call fcn.14003ce50
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x1_:_0x0
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1d8]
call fcn.14003cf90
lea rax, str.ntoskrnl.exe
lea rdx, [rbp + 0x150]
mov qword [rbp + 0x150], rax
lea rcx, str.GetSystemModule:
call fcn.1400c03a0
mov r8d, edi
mov dword [rbp + 0x144], edi
nop dword [rax + rax]
xor edx, edx
lea r9, [rbp + 0x144]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400788c2
mov r8d, dword [rbp + 0x144]
jmp 0x1400788a0
lea rdx, [rbp + 0x144]
lea rcx, str.NtQuerySystemInformation:
call fcn.1400c0590
mov rbx, rdi
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x144]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x144]
lea r9, [rbp + 0x144]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400788e0
mov rdx, rbx
lea rcx, str.Module_Count:
call fcn.1400c0770
mov rsi, rdi
mov r14d, 2
cmp qword [rbx], rdi
jbe 0x140078aca
lea rdi, [rbx + 8]
nop dword [rax]
nop dword [rax + rax]
mov rax, rdi
lea rcx, [rbp + 0x2a0]
mov rdx, r14
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140078970
movups xmm0, xmmword [rax]
lea r9, [rbp + 0x148]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea r8, [0x1401f8e80]
movups xmmword [rcx], xmm0
lea rdx, [rbp - 0x80]
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rbp + 0x2c8]
mov rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x148], rax
movzx eax, word [rbp + 0x2c6]
add rcx, rax
mov qword [rbp - 0x80], rcx
lea rcx, [0x1401ff2b0]
call fcn.1400c0960
movzx eax, word [rbp + 0x2c6]
lea rcx, [rbp + 0x2c8]
mov rdx, qword [rbp + 0x150]
add rcx, rax
call fcn.1401af250
test eax, eax
je 0x140078a50
inc rsi
add rdi, 0x128
cmp rsi, qword [rbx]
jb 0x140078960
jmp 0x140078aca
lea rcx, [rbp + 0x1630]
mov rdx, r14
lea rax, [rbp + 0x2a0]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140078a61
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, str.win32k.sys
lea rdx, [rbp + 0x150]
mov qword [rbp + 0x150], rax
lea rcx, str.GetSystemModule:
call fcn.1400c03a0
xor r8d, r8d
mov dword [rbp + 0x144], r8d
nop word [rax + rax]
xor edx, edx
lea r9, [rbp + 0x144]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140078b32
mov r8d, dword [rbp + 0x144]
jmp 0x140078b10
lea rdx, [rbp + 0x144]
lea rcx, str.NtQuerySystemInformation:
call fcn.1400c0590
xor ebx, ebx
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x144]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x144]
lea r9, [rbp + 0x144]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140078b50
mov rdx, rbx
lea rcx, str.Module_Count:
call fcn.1400c0770
xor esi, esi
cmp qword [rbx], rsi
jbe 0x140078d29
lea rdi, [rbx + 8]
nop dword [rax]
mov rax, rdi
lea rcx, [rbp + 0x2a0]
mov rdx, r14
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140078bd0
movups xmm0, xmmword [rax]
lea r9, [rbp + 0x148]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea r8, [0x1401f8e80]
movups xmmword [rcx], xmm0
lea rdx, [rbp - 0x80]
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rbp + 0x2c8]
mov rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x148], rax
movzx eax, word [rbp + 0x2c6]
add rcx, rax
mov qword [rbp - 0x80], rcx
lea rcx, [0x1401ff2b0]
call fcn.1400c0960
movzx eax, word [rbp + 0x2c6]
lea rcx, [rbp + 0x2c8]
mov rdx, qword [rbp + 0x150]
add rcx, rax
call fcn.1401af250
test eax, eax
je 0x140078cb0
inc rsi
add rdi, 0x128
cmp rsi, qword [rbx]
jb 0x140078bc0
jmp 0x140078d29
lea rcx, [rbp + 0x189e0]
lea rax, [rbp + 0x2a0]
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub r14, 1
jne 0x140078cc0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, qword [rbp + 0x189f0]
mov rbx, qword [rbp + 0x1640]
test rdi, rdi
je 0x140078d52
test rbx, rbx
jne 0x140078daf
lea rcx, [rbp + 0x1b8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1b8]
call fcn.14003ce50
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x1_:_0x1
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1d8]
call fcn.14003cf90
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], rdi
call fcn.140076d50
movabs rcx, 0xffffff0000000fff
mov qword [r13], rax
test rcx, rax
jne 0x140078dd4
test rax, rax
jne 0x140078e31
lea rcx, [rbp + 0x1b8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1b8]
call fcn.14003ce50
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x1_:_0x2
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1d8]
call fcn.14003cf90
mov rbx, qword [r13]
lea r9, [rbp - 0x60]
lea r8, [0x1401f8e80]
mov qword [rbp - 0x60], rbx
lea rdx, [rbp - 0x58]
mov qword [rbp - 0x58], r15
lea rcx, str.GetProcessCR3:
call fcn.1400c1910
mov edx, r15d
mov rcx, rbx
call fcn.1400618a0
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x68], rax
lea rcx, str.Queried_EProcess:
mov qword [rbp - 0x70], rax
mov rdi, rax
call fcn.1400c24f0
movabs rsi, 0xfffffffff000
mov r14d, 0x5a4d
test rdi, rdi
jne 0x140078e9a
xor ebx, ebx
jmp 0x14007c530
xor eax, eax
mov qword [rbp + 0x150], 0
and rbx, rsi
mov qword [rsp + 0x70], 8
mov qword [rbp - 0x80], rbx
mov qword [rbp + 0x180], rax
jmp 0x140078ec6
mov r14d, 0x5a4d
mov r13d, dword [0x140322b68]
lea rcx, [0x1401fded8]
xor edx, edx
mov qword [rbp + 0x100], 0
xorps xmm0, xmm0
mov qword [rbp + 0x108], 0
add rdi, 0x28
mov qword [rbp + 0x110], 0
add rax, rdi
mov qword [rbp + 0xf0], 8
mov qword [rsp + 0x50], rax
lea r8d, [rdx + 1]
shr rax, 0x27
and eax, 0x1ff
movups xmmword [rbp + 0x290], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0xf8], rax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007917e
cmp word [rax], r14w
jne 0x14007917e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007917e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007917e
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140079178
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140078fc3
inc rbx
cmp rbx, r14
jb 0x140078fa0
jmp 0x140079178
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140079178
mov esi, dword [rcx + 4]
test esi, esi
js 0x140079178
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1630]
call fcn.1400be1b0
lea rcx, [rbp + 0x1630]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x1630]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x140079053
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x144]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x144], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xf0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x290]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x144]
lea r9, [rbp + 0x144]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007aa28
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x108]
test rbx, rbx
je 0x14007aa28
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rbp + 0x140], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007940b
cmp word [rax], r14w
jne 0x14007940b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007940b
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007940b
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007940b
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140079244
inc rdi
cmp rdi, r15
jb 0x140079220
jmp 0x14007940b
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007940b
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007940b
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1624], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x2a0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x2a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x1400792e0
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x188]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x188], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xf0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xf0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x140]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x290]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x188]
lea r9, [rbp + 0x188]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007aa28
test bl, 1
je 0x14007aa28
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xd8], 0
xor edx, edx
mov qword [rbp + 0xe0], 0
xorps xmm0, xmm0
mov qword [rbp + 0xe8], 0
movups xmmword [rbp + 0x260], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0xc8], 8
mov qword [rbp + 0xd0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400796de
cmp word [rax], r14w
jne 0x1400796de
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400796de
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400796de
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400796d8
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140079523
inc rbx
cmp rbx, r14
jb 0x140079500
jmp 0x1400796d8
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400796d8
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400796d8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x189d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x17650]
call fcn.1400be1b0
lea rcx, [rbp + 0x17650]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x17650]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400795b3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x18c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x18c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xc8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x260]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x18c]
lea r9, [rbp + 0x18c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007aa28
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0xe0]
test rbx, rbx
je 0x14007aa28
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rbp + 0x140], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007996b
cmp word [rax], r14w
jne 0x14007996b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007996b
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007996b
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007996b
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400797a4
inc rdi
cmp rdi, r15
jb 0x140079780
jmp 0x14007996b
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007996b
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007996b
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x100e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xed60]
call fcn.1400be1b0
lea rcx, [rbp + 0xed60]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0xed60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x140079840
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x190]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x190], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xc8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xc8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x140]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x190]
lea r9, [rbp + 0x190]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007aa28
test bl, 1
je 0x14007aa28
movzx eax, bl
shr al, 7
test al, 1
je 0x140079998
mov rdx, qword [rsp + 0x50]
movabs rax, 0xfffffc0000000
and edx, 0x3fffffff
jmp 0x14007a483
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x88], 0
xor edx, edx
mov qword [rbp + 0x90], 0
xorps xmm0, xmm0
mov qword [rbp + 0x98], 0
movups xmmword [rbp + 0x240], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x78], 8
mov qword [rbp + 0x80], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140079c58
cmp word [rax], r14w
jne 0x140079c58
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140079c58
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140079c58
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140079c52
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140079aa3
inc rbx
cmp rbx, r14
jb 0x140079a80
jmp 0x140079c52
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140079c52
mov esi, dword [rcx + 4]
test esi, esi
js 0x140079c52
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x11474], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x100f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x100f0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x100f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x140079b33
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1b0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1b0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x78]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x78]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x240]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1b0]
lea r9, [rbp + 0x1b0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007aa28
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x90]
test rbx, rbx
je 0x14007aa28
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rbp + 0x140], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140079ee5
cmp word [rax], r14w
jne 0x140079ee5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140079ee5
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140079ee5
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140079ee5
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140079d24
inc rdi
cmp rdi, r15
jb 0x140079d00
jmp 0x140079ee5
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140079ee5
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140079ee5
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x12804], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x11480]
call fcn.1400be1b0
lea rcx, [rbp + 0x11480]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x11480]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x140079dc0
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1ac]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x1ac], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x78]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x78]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x140]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x1ac]
lea r9, [rbp + 0x1ac]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007aa28
test bl, 1
je 0x14007aa28
movzx eax, bl
shr al, 7
test al, 1
je 0x140079f12
mov rdx, qword [rsp + 0x50]
movabs rax, 0x3ffffffe00000
and edx, 0x1fffff
jmp 0x14007a483
mov rax, qword [rsp + 0x50]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xb0], 0
xor edx, edx
mov qword [rbp + 0xb8], 0
xorps xmm0, xmm0
mov qword [rbp + 0xc0], 0
movups xmmword [rbp + 0x270], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0xa0], 8
mov qword [rbp + 0xa8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007a1de
cmp word [rax], r14w
jne 0x14007a1de
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007a1de
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007a1de
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007a1d8
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007a023
inc rbx
cmp rbx, r14
jb 0x14007a000
jmp 0x14007a1d8
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007a1d8
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007a1d8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x13b94], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x12810]
call fcn.1400be1b0
lea rcx, [rbp + 0x12810]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x12810]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007a0b3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1a8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1a8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xa0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x270]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1a8]
lea r9, [rbp + 0x1a8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007aa28
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0xb8]
test rbx, rbx
je 0x14007aa28
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rbp + 0x140], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007a465
cmp word [rax], r14w
jne 0x14007a465
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007a465
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007a465
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007a465
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007a2a4
inc rdi
cmp rdi, r15
jb 0x14007a280
jmp 0x14007a465
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007a465
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007a465
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x14f24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x13ba0]
call fcn.1400be1b0
lea rcx, [rbp + 0x13ba0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x13ba0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007a340
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1a0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x1a0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0xa0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x140]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x1a0]
lea r9, [rbp + 0x1a0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14007aa28
test bl, 1
je 0x14007aa28
mov rdx, qword [rsp + 0x50]
movabs rax, 0x3fffffffff000
and edx, 0xfff
and rbx, rax
add rdx, rbx
test rdx, rdx
je 0x14007aa28
mov r13, qword [rsp + 0x70]
mov rax, rdx
and eax, 0xfff
mov qword [rbp + 0x120], rdx
xorps xmm0, xmm0
mov qword [rbp + 0x128], 0
mov ecx, 0x1000
mov qword [rbp + 0x130], 0
sub rcx, rax
mov qword [rbp + 0x138], 0
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rbp + 0x140], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
xor edx, edx
mov qword [rbp + 0x118], r13
lea rcx, [0x1401fded8]
mov qword [rbp + 0x148], rax
movups xmmword [rbp + 0x200], xmm0
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007a759
cmp word [rax], bx
jne 0x14007a759
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007a759
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007a759
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007a754
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007a595
inc rbx
cmp rbx, r14
jb 0x14007a572
jmp 0x14007a754
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007a754
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007a754
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x162b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x14f30]
call fcn.1400be1b0
lea rcx, [rbp + 0x14f30]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop dword [rax]
lea rcx, [rbp + 0x14f30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007a630
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x198]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x198], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x118]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x118]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x140]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x198]
lea r9, [rbp + 0x198]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14007aa18
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14007aa18
lea rcx, [rbp + 0x150]
mov r8, r13
add rcx, qword [rbp + 0x180]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rbp + 0x140], eax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x148], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007a9e9
cmp word [rax], bx
jne 0x14007a9e9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007a9e9
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007a9e9
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007a9e9
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007a833
inc rbx
cmp rbx, r14
jb 0x14007a810
jmp 0x14007a9e9
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007a9e9
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007a9e9
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x17644], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x162c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x162c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x162c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007a8c3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x164]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x164], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x118]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x118]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x140]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x164]
lea r9, [rbp + 0x164]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007aa18
mov rbx, qword [rsp + 0x70]
mov rax, qword [rbp + 0x180]
sub rbx, r13
mov rdi, qword [rbp - 0x68]
add rax, r13
mov qword [rsp + 0x70], rbx
test rbx, rbx
mov rbx, qword [rbp - 0x80]
mov qword [rbp + 0x180], rax
jne 0x140078ec0
mov rbx, qword [rbp + 0x150]
test rbx, rbx
jne 0x14007c501
xor eax, eax
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x150], rax
mov qword [rsp + 0x78], 8
nop word [rax + rax]
mov rcx, qword [rbp - 0x68]
xor edx, edx
mov r13d, dword [0x140322b68]
add rcx, 0x388
add rax, rcx
mov qword [rbp + 0x60], 0
mov rcx, qword [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x50], 8
lea rax, [rcx + rax*8]
mov qword [rbp + 0x58], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007ad06
cmp word [rax], r14w
jne 0x14007ad06
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007ad06
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007ad06
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007ad00
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007ab53
inc rbx
cmp rbx, r14
jb 0x14007ab30
jmp 0x14007ad00
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007ad00
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007ad00
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x29c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x29c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007abe3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x168]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x168], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x210]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x168]
lea r9, [rbp + 0x168]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007c4ff
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x68]
test rbx, rbx
je 0x14007c4ff
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007af81
cmp word [rax], r14w
jne 0x14007af81
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007af81
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007af81
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007af81
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007adc4
inc rdi
cmp rdi, r15
jb 0x14007ada0
jmp 0x14007af81
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007af81
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007af81
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6464], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x50e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x50e0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x50e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007ae60
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x16c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x16c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x50]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x16c]
lea r9, [rbp + 0x16c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007c4ff
test bl, 1
je 0x14007c4ff
mov rax, qword [rsp + 0x70]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x38], 0
xor edx, edx
mov qword [rbp + 0x40], 0
xorps xmm0, xmm0
mov qword [rbp + 0x48], 0
movups xmmword [rbp + 0x220], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x28], 8
mov qword [rbp + 0x30], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007b235
cmp word [rax], bx
jne 0x14007b235
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007b235
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007b235
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007b230
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007b083
inc rbx
cmp rbx, r14
jb 0x14007b060
jmp 0x14007b230
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007b230
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007b230
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x77f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6470]
call fcn.1400be1b0
lea rcx, [rbp + 0x6470]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x6470]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007b113
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x170]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x170], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x170]
lea r9, [rbp + 0x170]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007c4ff
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x40]
test rdi, rdi
je 0x14007c4ff
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007b4b1
cmp word [rax], bx
jne 0x14007b4b1
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007b4b1
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007b4b1
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007b4b1
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007b2f4
inc rbx
cmp rbx, r15
jb 0x14007b2d0
jmp 0x14007b4b1
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007b4b1
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007b4b1
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8b84], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7800]
call fcn.1400be1b0
lea rcx, [rbp + 0x7800]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x7800]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007b390
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x174]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x174], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x28]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x174]
lea r9, [rbp + 0x174]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007c4ff
test dil, 1
je 0x14007c4ff
movzx eax, dil
shr al, 7
test al, 1
je 0x14007b4e2
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x70]
and eax, 0x3fffffff
jmp 0x14007bf8c
mov rax, qword [rsp + 0x70]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x10], 0
xor edx, edx
mov qword [rbp + 0x18], 0
xorps xmm0, xmm0
mov qword [rbp + 0x20], 0
movups xmmword [rbp + 0x230], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp], 8
mov qword [rbp + 8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007b796
cmp word [rax], r14w
jne 0x14007b796
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007b796
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007b796
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007b790
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007b5e3
inc rbx
cmp rbx, r14
jb 0x14007b5c0
jmp 0x14007b790
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007b790
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007b790
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x9f14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8b90]
call fcn.1400be1b0
lea rcx, [rbp + 0x8b90]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x8b90]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007b673
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x178]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x178], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x230]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x178]
lea r9, [rbp + 0x178]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007c4ff
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x18]
test rbx, rbx
je 0x14007c4ff
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007ba11
cmp word [rax], r14w
jne 0x14007ba11
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007ba11
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007ba11
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007ba11
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007b854
inc rdi
cmp rdi, r15
jb 0x14007b830
jmp 0x14007ba11
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007ba11
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007ba11
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xb2a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x9f20]
call fcn.1400be1b0
lea rcx, [rbp + 0x9f20]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x9f20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007b8f0
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x158]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x158]
lea r9, [rbp + 0x158]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007c4ff
test bl, 1
je 0x14007c4ff
movzx eax, bl
shr al, 7
test al, 1
je 0x14007ba44
mov rdi, qword [rsp + 0x70]
movabs rax, 0x3ffffffe00000
and edi, 0x1fffff
and rbx, rax
add rdi, rbx
jmp 0x14007bf8f
mov rax, qword [rsp + 0x70]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp - 0x18], 0
xor edx, edx
mov qword [rbp - 0x10], 0
xorps xmm0, xmm0
mov qword [rbp - 8], 0
movups xmmword [rbp + 0x1d8], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp - 0x28], 8
mov qword [rbp - 0x20], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007bcf5
cmp word [rax], bx
jne 0x14007bcf5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007bcf5
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007bcf5
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007bcf0
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007bb43
inc rbx
cmp rbx, r14
jb 0x14007bb20
jmp 0x14007bcf0
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007bcf0
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007bcf0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xc634], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xb2b0]
call fcn.1400be1b0
lea rcx, [rbp + 0xb2b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0xb2b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007bbd3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x15c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x15c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1d8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x15c]
lea r9, [rbp + 0x15c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007c4ff
mov ebx, 0x5a4d
mov rdi, qword [rbp - 0x10]
test rdi, rdi
je 0x14007c4ff
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007bf6b
cmp word [rax], bx
jne 0x14007bf6b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007bf6b
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007bf6b
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007bf6b
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007bdb4
inc rbx
cmp rbx, r15
jb 0x14007bd90
jmp 0x14007bf6b
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007bf6b
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007bf6b
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xd9c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xc640]
call fcn.1400be1b0
lea rcx, [rbp + 0xc640]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0xc640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007be50
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x160]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x160], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x28]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x160]
lea r9, [rbp + 0x160]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14007c4ff
test dil, 1
je 0x14007c4ff
movabs rax, 0x3fffffffff000
and rdi, rax
mov rax, qword [rsp + 0x70]
and eax, 0xfff
add rdi, rax
test rdi, rdi
je 0x14007c4ff
mov r13, qword [rsp + 0x78]
mov rax, rdi
and eax, 0xfff
mov qword [rbp - 0x40], 0
xorps xmm0, xmm0
mov qword [rbp - 0x38], 0
mov ecx, 0x1000
mov qword [rbp - 0x30], 0
sub rcx, rax
mov qword [rbp - 0x48], rdi
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
xor edx, edx
mov qword [rbp - 0x50], r13
lea rcx, [0x1401fded8]
mov qword [rsp + 0x60], rax
movups xmmword [rbp + 0x1b8], xmm0
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007c24f
cmp word [rax], bx
jne 0x14007c24f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007c24f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007c24f
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007c24a
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007c093
inc rbx
cmp rbx, r14
jb 0x14007c070
jmp 0x14007c24a
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007c24a
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007c24a
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xed54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xd9d0]
call fcn.1400be1b0
lea rcx, [rbp + 0xd9d0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0xd9d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007c130
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x180]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x180], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x180]
lea r9, [rbp + 0x180]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14007c4f6
mov ebx, 0x5a4d
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14007c4f6
lea rcx, [rbp + 0x148]
mov r8, r13
add rcx, qword [rbp + 0x150]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007c4cf
cmp word [rax], bx
jne 0x14007c4cf
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007c4cf
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007c4cf
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007c4cf
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007c323
inc rbx
cmp rbx, r14
jb 0x14007c300
jmp 0x14007c4cf
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007c4cf
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007c4cf
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x50d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d50]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d50]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x3d50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007c3b3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x140]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x140], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x140]
lea r9, [rbp + 0x140]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007c4f6
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbp + 0x150]
sub rbx, r13
add rax, r13
mov qword [rsp + 0x78], rbx
mov qword [rbp + 0x150], rax
test rbx, rbx
jne 0x14007aa50
mov rbx, qword [rbp + 0x148]
jmp 0x14007c501
xor ebx, ebx
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
lea rcx, str.Queried_CR3:
call fcn.1400c1130
mov r12, qword [rsp + 0x68]
movabs rsi, 0xfffffffff000
mov r13, qword [rbp - 0x78]
mov r14d, 0x5a4d
mov qword [r13 + 8], rbx
test rbx, rbx
jne 0x14007c592
lea rcx, [rbp + 0x1b8]
call fcn.14003cdd0
lea r8d, [rbx + 0xe]
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1b8]
call fcn.14003ce50
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
lea r8d, [rbx + 0xf]
lea rdx, str.Code:_0x1_:_0x3
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1d8]
call fcn.14003cf90
mov rdx, qword [r13 + 8]
lea rcx, str.MmGetPhysicalMemoryRanges
call fcn.1400c2ca0
mov qword [rbp + 0x1a0], rax
mov rbx, rax
test rax, rax
jne 0x14007c60a
lea rcx, [rbp + 0x270]
call fcn.14003cdd0
lea r8d, [rbx + 0xe]
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x270]
call fcn.14003ce50
lea rcx, [rbp + 0x240]
call fcn.14003cdd0
lea r8d, [rbx + 0xf]
lea rdx, str.Code:_0x1_:_0x4
lea rcx, [rbp + 0x240]
call fcn.14003ce50
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x240]
call fcn.14003cf90
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call fcn.1401d1c40
xor al, al
xor edx, edx
mov byte [rsp + 0x58], al
mov qword [rbp + 0x198], rdx
mov rcx, qword [r13]
xor eax, eax
mov dword [rbp + 0x164], edx
xorps xmm0, xmm0
movsxd rdx, edx
shl rdx, 4
and rcx, rsi
mov qword [rbp + 0x150], reloc.WS2_32.dll_recv
mov qword [rsp + 0x60], rcx
movups xmmword [rbp + 0x200], xmm0
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x70], rdx
mov r13d, dword [0x140322b68]
add rax, rdx
add rax, rbx
mov qword [rbp - 0x40], 0
mov qword [rsp + 0x70], rax
xor edx, edx
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
lea r8d, [rdx + 1]
mov qword [rbp - 0x50], 8
movups xmmword [rbp + 0x1b8], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp - 0x48], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007c900
cmp word [rax], r14w
jne 0x14007c900
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007c900
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007c900
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007c900
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007c753
inc rbx
cmp rbx, r14
jb 0x14007c730
jmp 0x14007c900
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007c900
mov edi, dword [rcx + 4]
test edi, edi
js 0x14007c900
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x50d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d50]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d50]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x3d50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007c7e3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x140]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x140], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1b8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x140]
lea r9, [rbp + 0x140]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007e0f2
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x14007e0f2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007cb86
cmp word [rax], r14w
jne 0x14007cb86
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007cb86
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007cb86
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007cb80
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007c9c4
inc rdi
cmp rdi, r15
jb 0x14007c9a0
jmp 0x14007cb80
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007cb80
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007cb80
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xed54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xd9d0]
call fcn.1400be1b0
lea rcx, [rbp + 0xd9d0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0xd9d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007ca60
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x180]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x180], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x50]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x180]
lea r9, [rbp + 0x180]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007e0f2
mov r14d, 0x5a4d
test bl, 1
je 0x14007e0f2
mov rax, qword [rsp + 0x70]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp - 0x18], 0
xor edx, edx
mov qword [rbp - 0x10], 0
xorps xmm0, xmm0
mov qword [rbp - 8], 0
movups xmmword [rbp + 0x1d8], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp - 0x28], 8
mov qword [rbp - 0x20], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007ce30
cmp word [rax], r14w
jne 0x14007ce30
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007ce30
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007ce30
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007ce30
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007cc83
inc rbx
cmp rbx, r14
jb 0x14007cc60
jmp 0x14007ce30
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007ce30
mov edi, dword [rcx + 4]
test edi, edi
js 0x14007ce30
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xd9c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xc640]
call fcn.1400be1b0
lea rcx, [rbp + 0xc640]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0xc640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007cd13
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x160]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x160], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1d8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x160]
lea r9, [rbp + 0x160]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007e0f2
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x14007e0f2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007d0b6
cmp word [rax], r14w
jne 0x14007d0b6
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007d0b6
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007d0b6
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007d0b0
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007cef4
inc rdi
cmp rdi, r15
jb 0x14007ced0
jmp 0x14007d0b0
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007d0b0
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007d0b0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xc634], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xb2b0]
call fcn.1400be1b0
lea rcx, [rbp + 0xb2b0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0xb2b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007cf90
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x15c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x15c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x28]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x15c]
lea r9, [rbp + 0x15c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007e0f2
mov r14d, 0x5a4d
test bl, 1
je 0x14007e0f2
movzx eax, bl
shr al, 7
test al, 1
je 0x14007d0e3
mov rdx, qword [rsp + 0x70]
movabs rax, 0xfffffc0000000
and edx, 0x3fffffff
jmp 0x14007db68
mov rax, qword [rsp + 0x70]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x10], 0
xor edx, edx
mov qword [rbp + 0x18], 0
xorps xmm0, xmm0
mov qword [rbp + 0x20], 0
movups xmmword [rbp + 0x230], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp], 8
mov qword [rbp + 8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007d380
cmp word [rax], r14w
jne 0x14007d380
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007d380
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007d380
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007d380
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007d1d3
inc rbx
cmp rbx, r14
jb 0x14007d1b0
jmp 0x14007d380
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007d380
mov edi, dword [rcx + 4]
test edi, edi
js 0x14007d380
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xb2a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x9f20]
call fcn.1400be1b0
lea rcx, [rbp + 0x9f20]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x9f20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007d263
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x158]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x230]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x158]
lea r9, [rbp + 0x158]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007e0f2
mov rbx, qword [rbp + 0x18]
test rbx, rbx
je 0x14007e0f2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14007d606
cmp word [rax], r14w
jne 0x14007d606
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007d606
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007d606
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007d600
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007d444
inc rdi
cmp rdi, r15
jb 0x14007d420
jmp 0x14007d600
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007d600
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007d600
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x9f14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8b90]
call fcn.1400be1b0
lea rcx, [rbp + 0x8b90]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x8b90]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007d4e0
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x178]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x178], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x178]
lea r9, [rbp + 0x178]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14007e0f2
mov r14d, 0x5a4d
test bl, 1
je 0x14007e0f2
movzx eax, bl
shr al, 7
test al, 1
je 0x14007d633
mov rdx, qword [rsp + 0x70]
movabs rax, 0x3ffffffe00000
and edx, 0x1fffff
jmp 0x14007db68
mov rax, qword [rsp + 0x70]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x38], 0
xor edx, edx
mov qword [rbp + 0x40], 0
xorps xmm0, xmm0
mov qword [rbp + 0x48], 0
movups xmmword [rbp + 0x220], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x28], 8
mov qword [rbp + 0x30], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007d8d0
cmp word [rax], r14w
jne 0x14007d8d0
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007d8d0
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007d8d0
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007d8d0
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007d723
inc rbx
cmp rbx, r14
jb 0x14007d700
jmp 0x14007d8d0
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007d8d0
mov edi, dword [rcx + 4]
test edi, edi
js 0x14007d8d0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8b84], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7800]
call fcn.1400be1b0
lea rcx, [rbp + 0x7800]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x7800]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007d7b3
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x174]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x174], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x220]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x174]
lea r9, [rbp + 0x174]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007e0f2
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x14007e0f2
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007db4a
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14007db4a
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007db4a
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007db4a
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007db4a
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007d994
inc rdi
cmp rdi, r15
jb 0x14007d970
jmp 0x14007db4a
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007db4a
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007db4a
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x77f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6470]
call fcn.1400be1b0
lea rcx, [rbp + 0x6470]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x6470]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189e0], rax
inc rdi
cmp rdi, 0x200
jl 0x14007da30
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x170]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x170], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x28]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x28]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x170]
lea r9, [rbp + 0x170]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14007e0f2
test bl, 1
je 0x14007e0f2
mov rdx, qword [rsp + 0x70]
movabs rax, 0x3fffffffff000
and edx, 0xfff
and rbx, rax
add rdx, rbx
test rdx, rdx
je 0x14007e0f2
mov r13, qword [rbp + 0x150]
mov rax, rdx
and eax, 0xfff
mov qword [rbp + 0x58], rdx
xorps xmm0, xmm0
mov qword [rbp + 0x60], 0
mov ecx, 0x1000
mov qword [rbp + 0x68], 0
sub rcx, rax
mov qword [rbp + 0x70], 0
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
xor edx, edx
mov qword [rbp + 0x50], r13
lea rcx, [0x1401fded8]
mov qword [rsp + 0x68], rax
movups xmmword [rbp + 0x210], xmm0
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007de2f
cmp word [rax], bx
jne 0x14007de2f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007de2f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007de2f
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007de2a
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007dc73
inc rbx
cmp rbx, r14
jb 0x14007dc50
jmp 0x14007de2a
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007de2a
mov edi, dword [rcx + 4]
test edi, edi
js 0x14007de2a
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6464], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x50e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x50e0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x50e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007dd10
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x16c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x16c], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x50]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x16c]
lea r9, [rbp + 0x16c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14007e0e9
mov ebx, 0x5a4d
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x14007e0e9
lea rcx, [rbp + 0x200]
mov r8, r13
add rcx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007e0ac
cmp word [rax], bx
jne 0x14007e0ac
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007e0ac
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007e0ac
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007e0ac
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007def5
inc rbx
cmp rbx, r14
jb 0x14007ded2
jmp 0x14007e0ac
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007e0ac
mov edi, dword [rcx + 4]
test edi, edi
js 0x14007e0ac
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x29c0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x29c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189e0], rax
inc rbx
cmp rbx, 0x200
jl 0x14007df90
mov r8d, 0x1000
lea rdx, [rbp + 0x189e0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x168]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x168], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x50]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x168]
lea r9, [rbp + 0x168]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14007e0e9
mov rbx, qword [rbp + 0x150]
mov r14d, 0x5a4d
mov rax, qword [rsp + 0x78]
sub rbx, r13
mov rcx, qword [rsp + 0x60]
add rax, r13
mov rdx, qword [rbp - 0x70]
test rbx, rbx
mov qword [rbp + 0x150], rbx
mov rbx, qword [rbp + 0x1a0]
mov qword [rsp + 0x78], rax
jne 0x14007c662
movaps xmm1, xmmword [rbp + 0x200]
jmp 0x14007e0f5
xorps xmm1, xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
test rax, rax
jne 0x14007e129
movq rax, xmm1
test rax, rax
jne 0x14007e129
mov edx, dword [rbp + 0x164]
test edx, edx
jne 0x14007e174
mov r8, qword [rbp + 0x198]
mov r13, qword [rbp - 0x78]
jmp 0x14007e14c
mov r8, qword [rbp + 0x198]
mov r13, qword [rbp - 0x78]
mov edx, dword [rbp + 0x164]
mov byte [rsp + 0x58], 1
lea rax, [r8 + 2]
add rax, rax
movups xmmword [r13 + rax*8], xmm1
mov rbx, qword [rbp + 0x1a0]
inc edx
inc r8
movabs rsi, 0xfffffffff000
mov qword [rbp + 0x198], r8
mov r14d, 0x5a4d
jmp 0x14007c629
cmp byte [rsp + 0x58], 0
jne 0x14007e1d8
lea rcx, [rbp + 0x1b8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1b8]
call fcn.14003ce50
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x1_:_0x5
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1d8]
call fcn.14003cf90
mov r12, qword [rbp - 0x78]
lea rcx, str.ExFreePool
mov r8, qword [rbp + 0x1a0]
mov rdx, qword [r12]
call fcn.1400c85f0
mov r14, qword [0x140328f28]
xor edi, edi
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14007e29c
lea rbx, [r14 + 0x10]
nop dword [rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp + 0x1c8], xmm0
test rax, rax
je 0x14007e28e
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14007e28e
movzx ecx, byte [rbp + 0x1c8]
test cl, cl
jne 0x14007e260
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14007e28e
cmp cl, 1
jne 0x14007e28e
mov rdx, rax
lea rcx, [rbp + 0x1b8]
call fcn.140040c90
xor edx, edx
lea rcx, [rbp + 0x1b8]
call fcn.1400bca40
lea rcx, [rbp + 0x1b8]
call fcn.1400b87b0
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x14007e220
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov rax, r12
mov qword [0x140328f28], 0
mov rcx, qword [rbp + 0x199e0]
xor rcx, rsp
call fcn.140190770
lea r11, [rsp + 0x19af0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret