Function at 0x140086dd0
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x50], rcx
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009bd74], 0x19a1e052
imul edx, dword [0x14009bd78], 0xe680e2ab
add ecx, edx
add ecx, 0xe56a1f09
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009bd7c]
mov edx, dword [0x14009bd80]
shrd edx, eax, 0xa
xor edx, 0xfe378f3d
and edx, ecx
mov eax, dword [0x14009bd84]
mov ecx, dword [0x14009bd88]
shrd ecx, eax, 0x1e
imul eax, dword [0x14009bd8c], 0x77ff7085
imul r8d, dword [0x14009bd90], 0x821bff50
imul r9d, dword [0x14009bd94], 0xe71cd3e0
imul r10d, dword [0x14009bd98], 0x8ab35320
imul r11d, dword [0x14009bd9c], 0xc03e8cc5
imul esi, dword [0x14009bda0], 0x6ee13fae
xor ecx, 0x96257bdd
cmp edx, ecx
mov ecx, r8d
lea eax, [rax + rcx + 0x27bf2f3f]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx - 0xa73fa7e]
mov edx, esi
mov r8d, r11d
lea edx, [r8 + rdx + 0x5d1876f8]
cmove edx, ecx
cmp dword [0x14009cc44], eax
cmovl edx, ecx
mov dword [rbp - 0x48], edx
xorps xmm6, xmm6
mov esi, 0x613945ec
mov r10d, esi
mov byte [rbp - 0x11], r11b
mov r12, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
cmp r10d, 0xd45027f
jle 0x140087010
cmp r10d, 0x5556ced9
jg 0x140087145
cmp r10d, 0x3842b9d8
jle 0x1400872b2
cmp r10d, 0x43b58d9f
jg 0x1400875a1
cmp r10d, 0x3842b9d9
je 0x140087d35
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov bl, byte [rbp - 0x11]
mov r11d, ebx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x3a810d9e
jne 0x140086ebf
mov eax, edi
mov r14d, r13d
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009c0c0], 0xdd63ddfc
imul edx, dword [0x14009c0c4], 0xc14998eb
add ecx, edx
add ecx, 0x407a8575
xor ecx, eax
imul edx, dword [0x14009c0c8], 0x960f9489
imul ecx, eax
imul eax, dword [0x14009c0cc], 0x455115a5
add eax, edx
add eax, 0xbd750ae1
mov edx, dword [0x14009c0d0]
mov r8d, dword [0x14009c0d4]
shrd r8d, edx, 0x17
and eax, ecx
xor r8d, 0xdac78154
mov ecx, dword [0x14009c0d8]
mov edx, dword [0x14009c0dc]
shrd edx, ecx, 0xe
xor edx, 0x8105f786
imul ecx, dword [0x14009c0e0], 0x6e0e95c4
imul r9d, dword [0x14009c0e4], 0xef1de54f
imul r10d, dword [0x14009c0e8], 0xd65f917a
imul r11d, dword [0x14009c0ec], 0x7848e0e9
cmp eax, r8d
mov eax, r9d
lea eax, [rcx + rax + 0x9b3e16c]
mov ecx, r11d
mov r8d, r10d
lea esi, [r8 + rcx + 0x178086a4]
cmove esi, eax
cmp dword [0x14009cc44], edx
cmovl esi, eax
mov r15d, dword [r12]
jmp 0x1400877d7
cmp r10d, 0xdd884f37
jg 0x140087230
cmp r10d, 0xbb48074c
jle 0x1400873da
cmp r10d, 0xd62e7c7c
jg 0x1400877f1
cmp r10d, 0xbb48074d
je 0x140087f85
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov bl, byte [rbp - 0x11]
mov r11d, ebx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0xd0c73f3b
jne 0x140086ebf
mov r14d, r13d
mov eax, r15d
mov eax, dword [0x14009cc40]
mov ecx, dword [0x14009bef0]
mov edx, dword [0x14009bef4]
shrd edx, ecx, 0x1c
xor edx, eax
xor edx, 0xcaf98eb
imul ecx, dword [0x14009bef8], 0x51a17e7d
imul r8d, dword [0x14009befc], 0xf5be09d2
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xe54e05e4
and eax, edx
imul ecx, dword [0x14009bf00], 0xa5634605
imul edx, dword [0x14009bf04], 0x3dfc0395
imul r8d, dword [0x14009bf08], 0xfedf6f38
imul r9d, dword [0x14009bf0c], 0xd6ed67dd
add ecx, edx
add ecx, 0xd57946b2
mov edx, dword [0x14009bf18]
mov esi, dword [0x14009bf1c]
shrd esi, edx, 0x1a
imul edx, dword [0x14009bf10], 0x8c82f1cd
xor esi, 0x7c237d5a
imul r11d, dword [0x14009bf14], 0x387836
cmp eax, ecx
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x46a5acd8]
mov ecx, r11d
lea ecx, [rdx + rcx - 0x762a14ba]
cmove esi, ecx
cmp dword [0x14009cc44], eax
cmovl esi, ecx
jmp 0x1400877d3
cmp r10d, 0x613945eb
jle 0x14008732a
cmp r10d, 0x7d3e8b98
jg 0x1400876cf
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov rax, r12
mov r9, r12
mov r12, r11
mov r11b, byte [rbp - 0x11]
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, dword [rbp - 0x48]
cmp r10d, 0x613945ec
je 0x140086ebf
mov ebx, r13d
mov r14, r12
mov r12d, r15d
mov dil, byte [rbp - 0x38]
mov rcx, r14
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov r9, rax
mov r11b, byte [rbp - 0x11]
mov esi, r10d
cmp r10d, 0x7063afb0
jne 0x140086ebf
mov rsi, qword [rbp - 0x28]
mov rcx, qword [rsi]
mov r15, rax
movzx eax, byte [0x14009c174]
movzx edx, byte [0x14009c175]
mov r8d, eax
add eax, eax
shl r8d, 7
sub r8d, eax
mov eax, r8d
mov r8d, edx
lea r9d, [r8 + r8*4]
lea r8d, [r8 + r9*4]
add r8d, edx
mov edx, r8d
add dl, al
add dl, 0x60
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov dil, byte [rbp - 0x38]
mov rcx, r14
mov rdx, qword [rbp - 0x30]
mov r8, rsi
mov r9, r15
mov r11b, byte [rbp - 0x11]
mov r13d, ebx
mov r15d, r12d
mov esi, 0x4ea6a366
jmp 0x140086ebf
cmp r10d, 0xf138e478
jg 0x140087518
cmp r10d, 0xe249fc00
jle 0x140087927
cmp r10d, 0xe249fc01
je 0x140088288
mov al, byte [rbp - 0x11]
mov rbx, r12
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov r11d, eax
mov byte [rbp - 0x12], r13b
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0xec8ef91c
jne 0x140086ebf
mov r12d, edi
mov r14d, r15d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov r9, rbx
mov r11d, eax
mov r13b, byte [rbp - 0x12]
mov esi, 0xd62e7c7d
jmp 0x140086ebf
cmp r10d, 0xd450280
je 0x1400881c3
cmp r10d, 0x2727ce53
je 0x14008794e
mov rax, r12
mov r12b, byte [rbp - 0x11]
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, rax
mov qword [rbp - 0x20], r11
mov r11d, r12d
mov byte [rbp - 0x12], r13b
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x279c741f
jne 0x140086ebf
mov ebx, edi
mov r14d, r15d
mov r10d, r12d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov r9, rax
mov r11d, r12d
mov r13b, byte [rbp - 0x12]
mov esi, 0x3a810d9e
jmp 0x140086ebf
cmp r10d, 0x5556ceda
je 0x14008826e
cmp r10d, 0x55cabbc2
je 0x140087996
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x20], r11
mov r12b, byte [rbp - 0x11]
mov r11d, r12d
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x5f503664
jne 0x140086ebf
mov ebx, r13d
mov rax, r14
mov r14d, r15d
mov r8, rax
imul eax, dword [0x14009bee0], 0x1b4d9f53
imul ecx, dword [0x14009bee4], 0xe5a12e52
add eax, ecx
add eax, 0x12e10423
imul ecx, dword [0x14009bee8], 0x64b41851
imul edx, dword [0x14009beec], 0xc3e09a12
lea esi, [rcx + rdx]
add esi, 0x2965592b
test r12b, 1
cmovne esi, eax
mov dil, byte [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r9, qword [rbp - 0x40]
mov r11d, r12d
jmp 0x140086ebf
cmp r10d, 0x84f7dfa9
je 0x140088363
cmp r10d, 0x9bb47699
je 0x140087f22
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov bl, byte [rbp - 0x11]
mov r11d, ebx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x9c9b7fb6
jne 0x140086ebf
mov r14d, r13d
sub rsp, 0x20
mov r13, qword [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r12], eax
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009bf9c], 0xeb2450e5
imul edx, dword [0x14009bfa0], 0xbc90ab79
add ecx, edx
add ecx, 0x6519bf7f
xor ecx, eax
imul edx, dword [0x14009bfa4], 0xa873adc3
imul r8d, dword [0x14009bfa8], 0x3097148f
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x2e6212b1
and eax, ecx
mov ecx, dword [0x14009bfac]
mov edx, dword [0x14009bfb0]
shrd edx, ecx, 0x12
imul ecx, dword [0x14009bfb4], 0x275ca3ba
imul r8d, dword [0x14009bfb8], 0xcef1b2a
xor edx, 0x345398b4
mov r9d, dword [0x14009bfbc]
mov r10d, dword [0x14009bfc0]
shrd r10d, r9d, 0x18
xor r10d, 0x1ecd4e95
imul r9d, dword [0x14009bfc4], 0x73293eca
imul r11d, dword [0x14009bfc8], 0xd369b52a
cmp eax, edx
mov eax, r8d
lea eax, [rcx + rax - 0x542648a0]
mov ecx, r11d
mov edx, r9d
lea esi, [rdx + rcx - 0x19a64195]
cmove esi, r10d
cmp dword [0x14009cc44], eax
cmovl esi, r10d
mov dil, byte [rbp - 0x38]
mov rcx, r13
jmp 0x1400877db
cmp r10d, 0xf138e479
mov qword [rbp - 0x20], r11
je 0x1400884ca
cmp r10d, 0xfc87a4ae
je 0x1400880a1
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x40], r12
mov al, byte [rbp - 0x11]
mov r11d, eax
mov qword [rbp - 0x28], r14
mov r12, rsi
mov esi, r10d
cmp r10d, 0x5657a2a
jne 0x140086ebf
mov ebx, r13d
mov r14d, r15d
mov rcx, qword [r12]
sub rsp, 0x20
mov esi, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov dil, byte [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x40]
mov r11d, esi
mov esi, 0xdd6706e2
jmp 0x140086ebf
cmp r10d, 0x43b58da0
je 0x140087d7a
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov bl, byte [rbp - 0x11]
mov r11d, ebx
mov byte [rbp - 0x12], r13b
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x4ea6a366
jne 0x140086ebf
mov rcx, qword [r14]
mov al, byte [0x14009c05c]
mov dl, byte [0x14009c05d]
shr dl, 3
shl al, 5
or al, dl
mov edx, eax
xor dl, 0x7e
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, dword [0x14009cc40]
mov ecx, dword [0x14009c060]
mov edx, dword [0x14009c064]
shrd edx, ecx, 0x1a
xor edx, eax
xor edx, 0xb7968583
imul ecx, dword [0x14009c068], 0x6c70264a
imul r8d, dword [0x14009c06c], 0x3e0578de
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x1fae787f
and eax, edx
mov ecx, dword [0x14009c070]
mov edx, dword [0x14009c074]
shrd edx, ecx, 0x18
xor edx, 0xf59a3a7c
mov ecx, dword [0x14009c078]
mov r8d, dword [0x14009c07c]
shrd r8d, ecx, 0x10
mov ecx, dword [0x14009c080]
mov r9d, dword [0x14009c084]
shrd r9d, ecx, 0x1c
xor r8d, 0xf760189b
xor r9d, 0xe3f39ee
mov ecx, dword [0x14009c088]
mov esi, dword [0x14009c08c]
shrd esi, ecx, 0x1d
xor esi, 0xb13c4661
cmp eax, edx
cmove esi, r9d
cmp dword [0x14009cc44], r8d
cmovl esi, r9d
mov dil, byte [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r8, r14
jmp 0x140087918
cmp r10d, 0x7d3e8b99
je 0x140087e46
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov bl, byte [rbp - 0x11]
mov r11d, ebx
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x30], rsi
mov esi, r10d
cmp r10d, 0x7f62cc5f
jne 0x140086ebf
mov r14d, r13d
mov eax, r15d
mov eax, dword [0x14009cc40]
mov ecx, dword [0x14009be64]
mov edx, dword [0x14009be68]
shrd edx, ecx, 6
xor edx, eax
xor edx, 0x3236126a
imul ecx, dword [0x14009be6c], 0xe971eaa1
imul r8d, dword [0x14009be70], 0xf3d9c5e1
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xcc14c5a8
and eax, edx
imul ecx, dword [0x14009be74], 0xca5dbadb
imul edx, dword [0x14009be78], 0xb0498a9c
add ecx, edx
add ecx, 0xe8698b56
mov edx, dword [0x14009be7c]
mov r8d, dword [0x14009be80]
shrd r8d, edx, 0x15
imul edx, dword [0x14009be84], 0x611293fa
mov r9d, dword [0x14009be8c]
mov esi, dword [0x14009be90]
shrd esi, r9d, 0xc
imul r9d, dword [0x14009be88], 0x9cb2cb2
xor r8d, 0xe4749805
xor esi, 0xcbfbbb2c
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax + 0x4cd1c1a3]
cmove esi, eax
cmp dword [0x14009cc44], r8d
cmovl esi, eax
mov dil, byte [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
mov r9, r12
mov r11d, ebx
mov r13d, r14d
jmp 0x140086ebf
cmp r10d, 0xd62e7c7d
je 0x140087fc3
mov byte [rbp - 0x38], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov qword [rbp - 0x20], r11
mov bl, byte [rbp - 0x11]
mov r11d, ebx
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x12], r13b
mov r14, rsi
mov esi, r10d
cmp r10d, 0xdd6706e2
jne 0x140086ebf
mov rcx, qword [r14]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009bffc], 0xb3d08dc1
imul edx, dword [0x14009c000], 0x129f68fe
add ecx, edx
add ecx, 0xc1ee9af5
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009c004]
mov edx, dword [0x14009c008]
shrd edx, eax, 0x15
xor edx, 0x1a07c87
and edx, ecx
imul eax, dword [0x14009c00c], 0xf5a9abe5
imul ecx, dword [0x14009c010], 0x8865851d
imul r8d, dword [0x14009c014], 0x492692dd
imul r9d, dword [0x14009c018], 0xe66ac983
add eax, ecx
add eax, 0xa46dc08b
mov ecx, dword [0x14009c01c]
mov r10d, dword [0x14009c020]
shrd r10d, ecx, 3
xor r10d, 0xba201ff9
imul ecx, dword [0x14009c024], 0xb9ea2fe5
imul r11d, dword [0x14009c028], 0x946275c8
cmp edx, eax
mov eax, r9d
mov edx, r8d
lea eax, [rdx + rax + 0x733bc71d]
mov edx, r11d
lea esi, [rcx + rdx + 0x14eb35a]
cmove esi, r10d
cmp dword [0x14009cc44], eax
cmovl esi, r10d
mov dil, byte [rbp - 0x38]
mov rcx, qword [rbp - 0x20]
mov rdx, r14
mov r8, qword [rbp - 0x28]
mov r9, r12
mov r11d, ebx
mov r13b, byte [rbp - 0x12]
jmp 0x140086ebf
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
cmp r10d, 0xdd884f38
jne 0x140088708
mov r11b, byte [rbp - 0x11]
mov esi, 0x7d3e8b99
jmp 0x140086ebf
imul eax, dword [0x14009bf5c], 0x5c137acf
imul ecx, dword [0x14009bf60], 0x3a0bae92
add eax, ecx
add eax, 0x37d531fd
imul ecx, dword [0x14009bf64], 0xea86b63f
imul edx, dword [0x14009bf68], 0xf07146ad
add ecx, edx
add ecx, 0xdaac45b0
test r13b, 1
mov rdx, rsi
mov esi, ecx
cmovne esi, eax
jmp 0x140087d72
imul eax, dword [0x14009bda4], 0x40da8bf0
imul ecx, dword [0x14009bda8], 0x82eeb236
add eax, ecx
add eax, 0x5c26c9ef
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x20], rax
imul eax, dword [0x14009bdac], 0x6db2dec1
imul ecx, dword [0x14009bdb0], 0x31fbb79a
add eax, ecx
add eax, 0x2332c46c
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x28], rcx
imul eax, dword [0x14009bdb4], 0x9ab40ee7
imul edx, dword [0x14009bdb8], 0xbf31f7b6
add eax, edx
add eax, 0xcaf6a3c4
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
imul eax, dword [0x14009bdbc], 0x4525781c
mov qword [rbp - 0x38], rdx
imul r8d, dword [0x14009bdc0], 0x5534f962
add eax, r8d
add eax, 0x12290253
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
imul eax, dword [0x14009bdc4], 0x98fdefd5
imul r8d, dword [0x14009bdc8], 0xcb15a7d6
add eax, r8d
add eax, 0xc31e0dd9
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor eax, eax
mov qword [rdx], rax
mov edx, dword [0x14009bdcc]
mov r10d, dword [0x14009bdd0]
shrd r10d, edx, 0x18
xor r10d, 0xc48cf847
mov dword [r8], r10d
mov edx, dword [0x14009bdd4]
mov r10d, dword [0x14009bdd8]
shrd r10d, edx, 0x19
mov qword [r8 + 8], rax
xor r10d, 0xa6c99af2
mov dword [r8 + 0x18], r10d
imul edx, dword [0x14009bddc], 0xa4cabb94
imul r10d, dword [0x14009bde0], 0xd0061351
imul r11d, dword [0x14009bde4], 0xed4e61c5
add edx, r10d
add edx, 0x530e2bd6
imul r10d, dword [0x14009bde8], 0x360e2376
add r10d, r11d
add r10d, 0x55c7ea5c
imul r11d, dword [0x14009bdec], 0x5e469f8e
mov dword [rbp - 0x30], r15d
imul r15d, dword [0x14009bdf0], 0xc2311bb3
imul r12d, dword [0x14009bdf4], 0x64e854
mov byte [rbp - 0x12], r13b
imul r13d, dword [0x14009bdf8], 0x425c3875
add r11d, r15d
add r11d, 0x1b63be61
mov r15d, r13d
add r12d, r15d
add r12d, 0xe3058d1
imul r15d, dword [0x14009bdfc], 0xc1a83012
imul r13d, dword [0x14009be00], 0xdce84dc6
add r13d, r15d
add r13d, 0x8865062e
mov r15d, dword [0x14009be04]
mov esi, dword [0x14009be08]
shrd esi, r15d, 0x13
imul r15d, dword [0x14009be0c], 0xa8cde1c0
imul edi, dword [0x14009be10], 0x6ef7b005
add edi, r15d
add edi, 0x30e69170
mov r15d, dword [0x14009be14]
mov ebx, dword [0x14009be18]
shrd ebx, r15d, 0x17
mov r15, r8
mov qword [rcx], rax
mov r14, qword [rbp - 0x50]
mov qword [r8 + 0x10], r14
movups xmmword [r8 + 0x20], xmm6
xor esi, 0x7de6dfc
xor ebx, 0x1541521e
sub rsp, 0x80
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov rcx, qword [rbp - 0x40]
mov dword [rcx], eax
imul ecx, dword [0x14009be1c], 0x86552ae5
imul edx, dword [0x14009be20], 0x771481da
add ecx, edx
add ecx, 0xf22c0f73
cmp eax, ecx
setg dil
mov ecx, dword [0x14009cc40]
imul edx, dword [0x14009be24], 0x2e671d47
imul r8d, dword [0x14009be28], 0x7a88a800
add edx, r8d
add edx, 0xc6469f9b
xor edx, ecx
imul edx, ecx
mov ecx, dword [0x14009be2c]
mov r8d, dword [0x14009be30]
shrd r8d, ecx, 0x14
xor r8d, 0x4a743bed
and r8d, edx
imul ecx, dword [0x14009be34], 0x7d6cd49d
imul edx, dword [0x14009be38], 0x732c51c5
add ecx, edx
add ecx, 0xd3a6a273
mov edx, dword [0x14009be3c]
mov r9d, dword [0x14009be40]
shrd r9d, edx, 5
imul edx, dword [0x14009be44], 0xa16e610
mov r10d, dword [0x14009be4c]
mov esi, dword [0x14009be50]
shrd esi, r10d, 0x1f
imul r10d, dword [0x14009be48], 0x6b9c3a4
xor r9d, 0xac5ee266
xor esi, 0xf71f5744
cmp r8d, ecx
mov ecx, r10d
lea ecx, [rdx + rcx + 0x60fbcd71]
cmove esi, ecx
cmp dword [0x14009cc44], r9d
cmovl esi, ecx
mov rcx, r15
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x20]
mov r11b, byte [rbp - 0x11]
mov r13b, byte [rbp - 0x12]
mov r15d, dword [rbp - 0x30]
jmp 0x140086ebf
mov eax, dword [0x14009be54]
mov ecx, dword [0x14009be58]
shrd ecx, eax, 0x1b
xor ecx, 0xf7c75aa2
imul eax, dword [0x14009be5c], 0xbb30b1e7
imul edx, dword [0x14009be60], 0x3263271b
add eax, edx
add eax, 0x32a7792a
test dil, 1
mov rdx, rsi
mov esi, eax
cmovne esi, ecx
mov rcx, r11
jmp 0x140088092
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009bf6c], 0xfdf2e0ea
imul edx, dword [0x14009bf70], 0xfd06556e
add ecx, edx
add ecx, 0x32bd5eaf
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009bf74]
mov edx, dword [0x14009bf78]
shrd edx, eax, 5
xor edx, 0x8166cbca
and edx, ecx
mov eax, dword [0x14009bf7c]
mov ecx, dword [0x14009bf80]
shrd ecx, eax, 0xb
imul eax, dword [0x14009bf84], 0x8e914166
imul r8d, dword [0x14009bf88], 0x27542118
xor ecx, 0x6dac1912
mov r9d, dword [0x14009bf94]
mov r10d, dword [0x14009bf98]
shrd r10d, r9d, 8
imul r9d, dword [0x14009bf8c], 0x8e99502e
xor r10d, 0xf44e0620
mov rbx, r11
imul r11d, dword [0x14009bf90], 0xd644a1ed
cmp edx, ecx
mov ecx, r8d
lea eax, [rax + rcx + 0x4054ce88]
mov ecx, r11d
mov edx, r9d
lea ecx, [rdx + rcx + 0x1cf46b9d]
cmove r10d, ecx
cmp dword [0x14009cc44], eax
cmovl r10d, ecx
mov rcx, rbx
jmp 0x14008834e
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009bfcc], 0x3821663d
imul edx, dword [0x14009bfd0], 0xc1e6aa2c
add ecx, edx
add ecx, 0x4c608e18
xor ecx, eax
imul edx, dword [0x14009bfd4], 0xee0b5cbf
imul r8d, dword [0x14009bfd8], 0x9465749f
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x396688ba
and eax, ecx
imul ecx, dword [0x14009bfdc], 0x226d7560
imul edx, dword [0x14009bfe0], 0x1ac00d8f
mov ebx, edi
imul edi, dword [0x14009bfe4], 0x48823198
imul r9d, dword [0x14009bfe8], 0x222d6f7a
add ecx, edx
add ecx, 0x947b35d9
mov edx, dword [0x14009bff4]
mov r10d, dword [0x14009bff8]
shrd r10d, edx, 9
imul edx, dword [str._zN], 0x1823e2ca
xor r10d, 0xca0c6b17
mov r8, r11
imul r11d, dword [0x14009bff0], 0xd1dea205
cmp eax, ecx
mov eax, r9d
mov ecx, edi
lea eax, [rcx + rax + 0x2030bbfa]
mov ecx, r11d
lea ecx, [rdx + rcx - 0x46fd2f09]
cmove r10d, ecx
cmp dword [0x14009cc44], eax
cmovl r10d, ecx
mov edi, ebx
mov rcx, r8
jmp 0x14008834e
mov rax, qword [rsi]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsi]
mov rcx, qword [rax + 0x28]
mov eax, dword [0x14009c16c]
mov edx, dword [0x14009c170]
shrd edx, eax, 0x1f
xor edx, 0xba47cf6a
sub rsp, 0x20
mov ebx, r15d
mov r15d, r13d
mov r13, r11
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov rcx, r13
mov rdx, rsi
mov r8, r14
mov r9, r12
mov r11b, byte [rbp - 0x11]
mov r13d, r15d
mov r15d, ebx
mov esi, 0xfc87a4ae
jmp 0x140086ebf
sub rsp, 0x20
mov rcx, r11
mov ebx, r15d
mov r15d, r13d
mov r13, r11
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov r9, r12
mov dword [r12], eax
mov rcx, r13
mov rdx, rsi
mov r8, r14
mov r11b, byte [rbp - 0x11]
mov r13d, r15d
mov r15d, ebx
mov esi, 0x9c9b7fb6
jmp 0x140086ebf
mov eax, dword [0x14009cc40]
imul ecx, dword [0x14009c02c], 0x919a2c8
imul edx, dword [0x14009c030], 0xe0c8deef
add ecx, edx
add ecx, 0xc28c02a7
xor ecx, eax
imul ecx, eax
mov eax, dword [0x14009c034]
mov edx, dword [0x14009c038]
shrd edx, eax, 6
xor edx, 0x128aacc3
and edx, ecx
imul eax, dword [0x14009c03c], 0x7be8b5ee
imul ecx, dword [0x14009c040], 0x4017f127
add eax, ecx
add eax, 0xff993b29
mov ecx, dword [0x14009c044]
mov r8d, dword [0x14009c048]
shrd r8d, ecx, 7
xor r8d, 0x5678cad
imul ecx, dword [0x14009c04c], 0x834658c1
imul r9d, dword [0x14009c050], 0x8a2db2a9
imul r10d, dword [0x14009c054], 0xa0b11c8d
mov rbx, r11
imul r11d, dword [0x14009c058], 0x37a515a1
cmp edx, eax
mov eax, r9d
lea eax, [rcx + rax - 0x1f384ac8]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x55ab43b7]
cmove ecx, eax
cmp dword [0x14009cc44], r8d
mov rdx, rsi
mov esi, ecx
cmovl esi, eax
mov rcx, rbx
mov r8, r14
mov r9, r12
mov r11b, byte [rbp - 0x11]
jmp 0x140086ebf
mov rax, qword [rsi]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsi]
mov rcx, qword [rax + 0x28]
mov eax, dword [0x14009bf20]
mov edx, dword [0x14009bf24]
shrd edx, eax, 1
xor edx, 0xd082cfd9
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov cl, byte [0x14009bf28]
mov dl, byte [0x14009bf29]
shr dl, 7
add cl, cl
or cl, dl
xor cl, 0x58
cmp al, cl
setne r13b
mov eax, dword [0x14009cc40]
mov ecx, dword [0x14009bf2c]
mov edx, dword [0x14009bf30]
shrd edx, ecx, 0x1a
xor edx, eax
xor edx, 0x3a097e2e
imul ecx, dword [0x14009bf34], 0xf3d85532
imul r8d, dword [0x14009bf38], 0x84a93f83
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xf4571e17
and eax, edx
imul ecx, dword [0x14009bf3c], 0x2ba5d32b
imul edx, dword [0x14009bf40], 0xfa56f65b
add ecx, edx
add ecx, 0x512b27d4
mov edx, dword [0x14009bf44]
mov r8d, dword [0x14009bf48]
shrd r8d, edx, 0x19
imul edx, dword [0x14009bf4c], 0x56805205
mov r9d, dword [0x14009bf54]
mov r10d, dword [0x14009bf58]
shrd r10d, r9d, 8
imul r9d, dword [0x14009bf50], 0x7ed98d96
xor r8d, 0xa4b4a781
xor r10d, 0xd6363b76
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax - 0x16d3f2e9]
cmove r10d, eax
cmp dword [0x14009cc44], r8d
cmovl r10d, eax
mov rcx, qword [rbp - 0x20]
jmp 0x14008834e
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rcx, qword [r14]
imul eax, dword [str._n_N_], 0x6202cfa6
imul edx, dword [0x14009c15c], 0x13a0583
add edx, eax
add edx, 0x3b6dad54
mov al, byte [0x14009c160]
mov r9b, byte [0x14009c161]
shr r9b, 6
shl al, 2
or al, r9b
mov r9d, eax
imul eax, dword [0x14009c164], 0x664535a5
imul r10d, dword [0x14009c168], 0xa6985f05
xor r9b, 0xfe
add eax, r10d
add eax, 0x83ecad59
sub rsp, 0x40
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
mov ebx, r13d
mov r13, r11
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov r9, r12
mov dword [r12], eax
mov rcx, r13
mov rdx, rsi
mov r8, r14
mov r11b, byte [rbp - 0x11]
mov r13d, ebx
mov esi, 0x84f7dfa9
jmp 0x140086ebf
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov r11b, byte [rbp - 0x11]
mov esi, 0xe249fc01
jmp 0x140086ebf
mov eax, dword [0x14009cc40]
mov ecx, dword [0x14009c090]
mov edx, dword [0x14009c094]
shrd edx, ecx, 0xa
xor edx, eax
xor edx, 0x65051943
imul ecx, dword [0x14009c098], 0xa9d3aa65
imul r8d, dword [0x14009c09c], 0xa4c2dff8
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x7c2e30e4
and eax, edx
imul ecx, dword [0x14009c0a0], 0x9b8098ac
imul edx, dword [0x14009c0a4], 0xeeda47b8
add ecx, edx
add ecx, 0xacc7b0ac
mov edx, dword [0x14009c0a8]
mov r8d, dword [0x14009c0ac]
shrd r8d, edx, 0x16
imul edx, dword [0x14009c0b0], 0xf4305f1
mov r9d, dword [0x14009c0b8]
mov r10d, dword [0x14009c0bc]
shrd r10d, r9d, 0x1b
imul r9d, dword [0x14009c0b4], 0xbe38e3f6
xor r8d, 0xc87e9464
xor r10d, 0x7e81ab2c
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax - 0xc39b9c1]
cmove r10d, eax
cmp dword [0x14009cc44], r8d
cmovl r10d, eax
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r12
mov r11b, byte [rbp - 0x11]
mov esi, r10d
jmp 0x140086ebf
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov eax, dword [0x14009be94]
mov edx, dword [0x14009be98]
shrd edx, eax, 0x10
mov rcx, qword [r14]
xor edx, 0x47bd517
movzx eax, byte [0x14009be9c]
mov r9b, byte [0x14009be9d]
imul eax, eax, 0xffffff8a
shl r9b, 6
add r9b, al
imul eax, dword [0x14009bea0], 0x243a4eef
imul r10d, dword [0x14009bea4], 0x85ffd0e5
add r9b, 0x3e
add eax, r10d
add eax, 0xddb9e480
sub rsp, 0x40
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
mov rbx, r11
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [r12], eax
mov ecx, dword [0x14009bea8]
mov edx, dword [0x14009beac]
shrd edx, ecx, 0x12
xor edx, 0xcbaa7861
cmp eax, edx
setg r11b
mov eax, dword [0x14009cc40]
mov ecx, dword [0x14009beb0]
mov edx, dword [0x14009beb4]
shrd edx, ecx, 0x1a
xor edx, eax
xor edx, 0xf07fabdf
imul ecx, dword [0x14009beb8], 0x597fac4e
imul r8d, dword [0x14009bebc], 0x5def161b
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xc4850651
and eax, edx
mov ecx, dword [0x14009bec0]
mov edx, dword [0x14009bec4]
shrd edx, ecx, 0x10
xor edx, 0x5f57cd1
mov ecx, dword [0x14009bec8]
mov r8d, dword [0x14009becc]
shrd r8d, ecx, 8
mov ecx, dword [0x14009bed0]
mov r9d, dword [0x14009bed4]
shrd r9d, ecx, 2
xor r8d, 0xec461b5e
xor r9d, 0xb2988965
mov ecx, dword [0x14009bed8]
mov r10d, dword [0x14009bedc]
shrd r10d, ecx, 5
xor r10d, 0x850ec1c3
cmp eax, edx
cmove r10d, r9d
cmp dword [0x14009cc44], r8d
cmovl r10d, r9d
mov rcx, rbx
mov rdx, rsi
mov r8, r14
mov r9, r12
mov esi, r10d
jmp 0x140086ebf
mov eax, dword [0x14009c0f0]
mov ecx, dword [0x14009c0f4]
shrd ecx, eax, 0x17
xor ecx, 0xf32a1055
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov qword [rbp - 0x38], r9
imul eax, dword [0x14009c0f8], 0x4f853366
imul edx, dword [0x14009c0fc], 0xebaf6aa6
add eax, edx
add eax, 0x18d7846f
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x28], rsp
imul eax, dword [0x14009c100], 0x87696e1e
imul edx, dword [0x14009c104], 0xeaedd507
add eax, edx
add eax, 0x7c7e27a6
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor ecx, ecx
mov qword [r9], rcx
mov eax, dword [0x14009c108]
mov edx, dword [0x14009c10c]
shrd edx, eax, 0xe
xor edx, 0xfb8722a0
mov dword [r8], edx
mov qword [r8 + 8], rcx
mov eax, dword [0x14009c110]
mov edx, dword [0x14009c114]
shrd edx, eax, 4
xor edx, 0x9daa6b86
mov dword [r8 + 0x18], edx
mov rax, qword [rbp - 0x50]
mov qword [r8 + 0x10], rax
movups xmmword [r8 + 0x20], xmm6
imul eax, dword [0x14009c118], 0x48901dd
imul edx, dword [0x14009c11c], 0x98c35480
imul r10d, dword [0x14009c120], 0x7ef5662f
add eax, edx
add eax, 0x430b3ced
mov dword [rbp - 0x44], eax
imul eax, dword [0x14009c124], 0x8e2d500
lea edx, [r10 + rax]
add edx, 0xa5f57682
mov r10d, dword [str._E_ny]
mov r11d, dword [0x14009c12c]
shrd r11d, r10d, 0xe
mov r10d, r11d
imul r11d, dword [0x14009c130], 0x181f992b
mov rbx, rsi
imul esi, dword [0x14009c134], 0x6337c9e7
xor r10d, 0xf325e6fb
add r11d, esi
add r11d, 0xfdbf1731
imul esi, dword [0x14009c138], 0x34375f32
mov dword [rbp - 0x30], r15d
imul r15d, dword [0x14009c13c], 0xd725440c
add esi, r15d
add esi, 0x650a2eb0
mov r15d, dword [str.G5X_]
mov byte [rbp - 0x12], r13b
mov r13d, dword [0x14009c144]
shrd r13d, r15d, 0x1e
xor r13d, 0xf960d51d
imul r15d, dword [0x14009c148], 0x3d677452
imul eax, dword [0x14009c14c], 0x51427d8d
add eax, r15d
add eax, 0x8acd5a70
mov r15d, dword [0x14009c150]
mov r9d, dword [0x14009c154]
shrd r9d, r15d, 0x13
xor r9d, 0xe6cbd670
sub rsp, 0x80
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x68], r9d
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x38]
mov edx, dword [rbp - 0x44]
mov r9, qword [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
mov r8, r14
mov r9, r12
mov r11b, byte [rbp - 0x11]
mov r13b, byte [rbp - 0x12]
mov r15d, dword [rbp - 0x30]
mov esi, 0x55cabbc2
jmp 0x140086ebf
mov r11b, byte [rbp - 0x11]
mov esi, r10d
cmp r10d, 0xe105c94d
jne 0x140086ebf
mov eax, r15d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret