Function at 0x1400291c0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
lea rcx, [0x140128f38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r12b
lea r8d, [r12 + 0x18]
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400292bc
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400292bc
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400292b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a76c
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029301
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400292fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a772
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x28
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400293bf
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400293bf
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400293b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a778
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029404
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400293ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a77e
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400294c2
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400294c2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400294bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a784
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029507
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a78a
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400295c5
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400295c5
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400295bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a790
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002960a
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029605
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a796
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlHashUnicodeString
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400296c8
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400296c8
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400296c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a79c
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002970d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7a2
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlUpcaseUnicodeChar
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400297cb
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400297cb
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400297c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7a8
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029810
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002980b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7ae
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400298ce
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400298ce
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400298c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7b4
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029913
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002990e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7ba
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x17
lea rdx, str.NtSetInformationProcess
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400299d1
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400299d1
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400299cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7c0
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029a16
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029a11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7c6
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140029ad4
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140029ad4
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029ace
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7cc
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029b19
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029b14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7d2
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x11
lea rdx, str.NtDuplicateObject
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140029bd7
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140029bd7
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029bd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7d8
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029c1c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029c17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7de
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtQueryObject
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140029cda
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140029cda
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029cd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7e4
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029d1f
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029d1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7ea
call fcn.1400a031c
call fcn.14000bbf0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtQuerySection
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140029ddd
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140009b10
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14002a830
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140029ddd
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7f0
call fcn.1400a031c
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029e22
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029e1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7f6
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.RtlCreateActivationContext
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029e9c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029e97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a7fc
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029f16
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a802
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140029f90
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029f8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a808
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x13
lea rdx, str.NtLockVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002a00a
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a005
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a80e
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtSuspendProcess
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002a084
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a07f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a814
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xf
lea rdx, str.NtResumeProcess
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002a0fe
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a0f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a81a
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.RtlImageNtHeader
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002a178
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a173
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a820
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xc
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002a1f2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a1ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a826
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14002a26c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a766
call fcn.1400a031c
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1c
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a2c5
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xb
lea rdx, str.NtOpenEvent
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a31e
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtCreateEvent
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a377
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtQueueApcThread
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a3d0
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlEncodeSystemPointer
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a429
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a482
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x20
lea rdx, str.NtWow64QueryInformationProcess64
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a4db
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a534
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1b
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a58d
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x15
lea rdx, str.Wow64GetThreadContext
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a5e6
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x15
lea rdx, str.Wow64SetThreadContext
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a63f
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x12
lea rdx, str.Wow64SuspendThread
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a698
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x13
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a6f1
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
call fcn.14000bbf0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rbp - 0x50]
call fcn.14000c3c0
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140028c00
nop
mov r8, qword [rbp - 0x38]
cmp r8, 0x10
jb 0x14002a74a
inc r8
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x50]
call fcn.140009ec0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3
call fcn.1400d0a24
int3