Function at 0x140071d5b
Capabilities:
Map section object

Disassembly:
push rax
pushf
mov eax, 0x9d5b682
pushf
not eax
add eax, 0x3fb97005
xor eax, 0xe59a705
rol eax, 0x8a
popf
pushf
not eax
add eax, 0x54c220dd
xor eax, 0x2aed5caf
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x624d0142
xor eax, 0x47b7843c
rol eax, 0x22
popf
cmp eax, 0
jne 0x140071dab
popf
pop rax
jmp 0x140071ed7
cmp eax, 0xe
jne 0x140071dba
popf
pop rax
jmp 0x140072cab
cmp eax, 0x11
jne 0x140071dc9
popf
pop rax
jmp 0x140072dfb
cmp eax, 0xc
jne 0x140071dd8
popf
pop rax
jmp 0x140072bff
cmp eax, 4
jne 0x140071de7
popf
pop rax
jmp 0x1400723aa
cmp eax, 5
jne 0x140071df6
popf
pop rax
jmp 0x14007247a
cmp eax, 8
jne 0x140071e05
popf
pop rax
jmp 0x140072811
cmp eax, 0xb
jne 0x140071e14
popf
pop rax
jmp 0x140072bc9
cmp eax, 0x12
jne 0x140071e23
popf
pop rax
jmp 0x140072e9f
cmp eax, 0x14
jne 0x140071e32
popf
pop rax
jmp 0x140072f79
cmp eax, 6
jne 0x140071e41
popf
pop rax
jmp 0x14007252f
cmp eax, 3
jne 0x140071e50
popf
pop rax
jmp 0x1400722f0
cmp eax, 0x10
jne 0x140071e5f
popf
pop rax
jmp 0x140072d9c
cmp eax, 0x13
jne 0x140071e6e
popf
pop rax
jmp 0x140072f35
cmp eax, 0xf
jne 0x140071e7d
popf
pop rax
jmp 0x140072d03
cmp eax, 0xa
jne 0x140071e8c
popf
pop rax
jmp 0x140072aa8
cmp eax, 2
jne 0x140071e9b
popf
pop rax
jmp 0x140072141
cmp eax, 1
jne 0x140071eaa
popf
pop rax
jmp 0x1400720a1
cmp eax, 7
jne 0x140071eb9
popf
pop rax
jmp 0x140072631
cmp eax, 0xd
jne 0x140071ec8
popf
pop rax
jmp 0x140072c4f
cmp eax, 9
jne 0x140071ed7
popf
pop rax
jmp 0x1400729e6
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x9f0]
sub rsp, 0xaf0
mov rsi, qword [0x14002fa90]
lea rdi, [rbp + 0xb0]
xor r12d, r12d
mov dword [rbp + 0xa30], 0x3060663
xor eax, eax
mov dword [rbp + 0xa34], 0x65666c41
mov ecx, 0xbc2d023d
pushf
not ecx
add ecx, 0x55db8664
xor ecx, 0x43d58a6e
rol ecx, 0x88
popf
pushf
not ecx
add ecx, 0x151670e1
xor ecx, 0x2ab6c1de
rol ecx, 0xc0
popf
pushf
not ecx
add ecx, 0x17278bde
xor ecx, 0x2160e531
rol ecx, 0xb3
popf
pushf
not ecx
add ecx, 0x77b74eaa
xor ecx, 0x3e151467
rol ecx, 0x3f
popf
mov qword [rbp + 0xa40], r12
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0xa30]
lea rdx, [rbp + 0xb0]
xorps xmm0, xmm0
mov dword [rbp + 0xa38], r12d
xorps xmm1, xmm1
mov word [rbp + 0xa3c], 0x100
mov r14d, r12d
mov dword [rsp + 0x78], 0x30
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], r12d
movdqu xmmword [rbp - 0x68], xmm1
call fcn.140074177
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x58]
jmp 0x140071fcd
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
lea rdi, [rbp + 0x1b0]
mov ecx, 0x567ada75
pushf
not ecx
add ecx, 0x4187455e
xor ecx, 0x4c18696e
rol ecx, 0xf5
popf
pushf
not ecx
add ecx, 0x7f1e0f41
xor ecx, 0x6ca5d3d3
rol ecx, 0x79
popf
pushf
not ecx
add ecx, 0x54bef57f
xor ecx, 0x25cd1b80
rol ecx, 0xf0
popf
rep stosb byte [rdi], al
cmp dword [rsi + 0x14], r12d
je 0x14007206e
push rax
pushf
mov eax, 0x445aa6f8
pushf
not eax
add eax, 0x9bf83f6
xor eax, 0x51ebd978
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x7c9ddded
xor eax, 0x212f42e1
rol eax, 0xa8
popf
pushf
not eax
add eax, 0x77ccf253
xor eax, 0x18d1492d
rol eax, 0xad
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x390d5794
pushf
not eax
add eax, 0x606c1a7e
xor eax, 0x10feaade
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xad838eb
xor eax, 0x25f9b74a
rol eax, 0xa6
popf
jmp 0x140071d9c
mov edx, 0x1a3aec5c
pushf
not edx
add edx, 0x2b6cf3aa
xor edx, 0x28222439
rol edx, 7
popf
pushf
not edx
add edx, 0x1f72cedd
xor edx, 0x6faa0745
rol edx, 0x3f
popf
pushf
not edx
add edx, 0x273512de
xor edx, 0x2acf8b13
rol edx, 0x7f
popf
lea r8, [rsi + 0x890]
mov r9d, edx
lea rcx, [rbp + 0x1bc]
call fcn.140041f26
push rax
pushf
mov eax, 0x77c13a91
pushf
not eax
add eax, 0x66a1a70b
xor eax, 0x274b94e9
rol eax, 0x41
popf
pushf
not eax
add eax, 0x6b80f836
xor eax, 0x54fccc14
rol eax, 8
popf
pushf
not eax
add eax, 0x35b7954d
xor eax, 0x5fec14c0
rol eax, 0xb2
popf
jmp 0x140071d9c
mov eax, dword [rsi + 0xc]
mov dword [rbp + 0x1b8], eax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov eax, dword [rcx + 0x2c0]
mov dword [rbp + 0x1b4], eax
jmp 0x140072164
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
lea rcx, [rbp + 0xa30]
mov edi, 0x5a3c7ad5
pushf
not edi
add edi, 0x50b210fb
xor edi, 0x352722dc
rol edi, 0x22
popf
pushf
not edi
add edi, 0x68158527
xor edi, 0x7acab137
rol edi, 0xa6
popf
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x5d0]
mov ebx, 0xbef14e9d
pushf
not ebx
add ebx, 0x5b20f207
xor ebx, 0x1833e83a
rol ebx, 0x67
popf
pushf
not ebx
add ebx, 0x597ecfbc
xor ebx, 0x7f36061c
rol ebx, 0x2a
popf
pushf
not ebx
add ebx, 0x49682dbd
xor ebx, 0x7ade40ca
rol ebx, 8
popf
pushf
not ebx
add ebx, 0x1286fa2f
xor ebx, 0xbaeda38
rol ebx, 0x38
popf
mov rcx, rax
mov r9d, edi
mov edx, ebx
jmp 0x14007220e
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
jmp 0x140072215
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
jmp 0x14007221e
call qword [sym.imp.USER32.dll_GetThreadDesktop]
lea rcx, [rbp + 0xa30]
mov r9d, edi
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3c6]
mov rcx, rax
mov edx, ebx
jmp 0x140072240
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
xor edx, edx
lea rcx, [rsp + 0x58]
jmp 0x14007224e
call qword [sym.imp.ntdll.dll_RtlCreateBoundaryDescriptor]
mov qword [rbp + 0xa48], rax
test rax, rax
je 0x1400722bd
push rax
pushf
mov eax, 0xf459d3f2
pushf
not eax
add eax, 0x1612c86d
xor eax, 0x77f2e62b
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x641d4aa5
xor eax, 0x366c1aac
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x60a90af6
xor eax, 0x668b82fb
rol eax, 0xeb
popf
pushf
not eax
add eax, 0x118e14e6
xor eax, 0x22e727b3
rol eax, 0xef
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x58abfe49
pushf
not eax
add eax, 0x220b55fa
xor eax, 0x327334aa
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x43a0f72b
xor eax, 0x12136794
rol eax, 0xd7
popf
jmp 0x140071d9c
lea ecx, [rbx - 1]
jmp 0x1400722f4
call qword [sym.imp.ntdll.dll_RtlLengthRequiredSid]
mov rcx, qword [0x14002fa90]
lea edx, [rbx + 6]
mov r8d, eax
mov rcx, qword [rcx + 0x18]
jmp 0x14007230c
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x140072351
push rax
pushf
mov eax, 0xf68836db
pushf
not eax
add eax, 0x39296569
xor eax, 0x23b5374f
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x14c2c83e
xor eax, 0x73f43535
rol eax, 0x53
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x7230b697
pushf
not eax
add eax, 0x1925365d
xor eax, 0x26a5c110
rol eax, 9
popf
pushf
not eax
add eax, 0x5e3b8f85
xor eax, 0x1affa20e
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x23484c97
xor eax, 0x14fefb32
rol eax, 0xa5
popf
pushf
not eax
add eax, 0x15e66a92
xor eax, 0x16c6c24f
rol eax, 0x9c
popf
jmp 0x140071d9c
mov r8b, 0x48
pushf
not r8b
add r8b, 0x2a
xor r8b, 0x42
rol r8b, 0x11
popf
pushf
not r8b
add r8b, 0x69
xor r8b, 0x20
rol r8b, 0x98
popf
lea rdx, [rbp + 0xa38]
mov rcx, rax
jmp 0x1400723de
call qword [sym.imp.ntdll.dll_RtlInitializeSid]
xor edx, edx
test eax, eax
js 0x140072421
push rax
pushf
mov eax, 0x428effe8
pushf
not eax
add eax, 0x340f4d19
xor eax, 0x659e82df
rol eax, 0x46
popf
pushf
not eax
add eax, 0x1f37711b
xor eax, 0x17832535
rol eax, 0x74
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0xf4672f2
pushf
not eax
add eax, 0x3100595e
xor eax, 0x616fb6bf
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x700af8ac
xor eax, 0x38ebff92
rol eax, 0x57
popf
pushf
not eax
add eax, 0x3d96514f
xor eax, 0x60485060
rol eax, 0xd
popf
pushf
not eax
add eax, 0x7e3423df
xor eax, 0x2d1043a4
rol eax, 0x13
popf
jmp 0x140071d9c
mov rcx, rbx
jmp 0x14007247e
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
mov rdx, rbx
lea rcx, [rbp + 0xa48]
mov rdi, rbx
mov dword [rax], r12d
jmp 0x140072495
call qword [sym.imp.ntdll.dll_RtlAddSIDToBoundaryDescriptor]
test eax, eax
js 0x1400724e9
push rax
pushf
mov eax, 0xbf2de4a8
pushf
not eax
add eax, 0x6824916d
xor eax, 0x5306b3d2
rol eax, 0x80
popf
pushf
not eax
add eax, 0x3b87ae0e
xor eax, 0x519b9fe6
rol eax, 0xac
popf
pushf
not eax
add eax, 0x5073f0a
xor eax, 0x43f629a9
rol eax, 0xda
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x782e4964
pushf
not eax
add eax, 0x173fc82f
xor eax, 0x4272e0fb
rol eax, 0xad
popf
pushf
not eax
add eax, 0x1314e7a4
xor eax, 0x4eb33367
rol eax, 0xde
popf
pushf
not eax
add eax, 0x4c115c6b
xor eax, 0x1791f546
rol eax, 0xba
popf
jmp 0x140071d9c
mov r9, qword [rbp + 0xa48]
lea r8, [rsp + 0x78]
mov edx, 0x31d15c50
pushf
not edx
add edx, 0x3d6c997d
xor edx, 0x256b6ca6
rol edx, 0xf5
popf
pushf
not edx
add edx, 0x4c7e4c92
xor edx, 0x6b6de039
rol edx, 0x1c
popf
pushf
not edx
add edx, 0xcd3abb
xor edx, 0x19c5e1cf
rol edx, 8
popf
lea rcx, [rsi + 0x50]
jmp 0x140072584
call qword [sym.imp.ntdll.dll_NtCreatePrivateNamespace]
test eax, eax
js 0x1400725eb
push rax
pushf
mov eax, 0xa0637ad7
pushf
not eax
add eax, 0x6843f83c
xor eax, 0x4fbcdc82
rol eax, 0x8d
popf
pushf
not eax
add eax, 0x1478854d
xor eax, 0xcef9c2b
rol eax, 0xe6
popf
pushf
not eax
add eax, 0x685d9531
xor eax, 0x290d80e
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x33edf7f3
xor eax, 0x4b4d2b8c
rol eax, 0x5f
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x282fbf8c
pushf
not eax
add eax, 0x6ff2f9a8
xor eax, 0x424d0f13
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x62b42110
xor eax, 0x7c42b1bc
rol eax, 0x74
popf
pushf
not eax
add eax, 0x2b17ed48
xor eax, 0x6dfa0939
rol eax, 0xf0
popf
jmp 0x140071d9c
mov rax, qword [rsi + 0x50]
lea rdi, [rbp - 0x50]
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x50], 0x3060663
mov qword [rbp - 0x78], rax
mov ecx, 0x1be2dc9
pushf
not ecx
add ecx, 0x5024bdbc
xor ecx, 0x3c1c2af8
rol ecx, 0x45
popf
pushf
not ecx
add ecx, 0x75e44e93
xor ecx, 0x268fad04
rol ecx, 0xa2
popf
xor eax, eax
mov dword [rsp + 0x54], 0x61626c41
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x50]
mov dword [rbp - 0x70], 0x40
call fcn.140074177
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
jmp 0x1400726a8
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x7da]
call fcn.140041acc
mov r8d, 0xdf5cae86
pushf
not r8d
add r8d, 0x3d806f4
xor r8d, 0x63a1af11
rol r8d, 0xc2
popf
pushf
not r8d
add r8d, 0x26b5213b
xor r8d, 0x74b4e49
rol r8d, 0xba
popf
lea rdx, [rbp + 0x1b0]
xor ecx, ecx
jmp 0x140072700
call qword [sym.imp.ntdll.dll_RtlComputeCrc32]
lea rcx, [rsi + 0x60]
mov byte [rsp + 0x20], r12b
xor r9d, r9d
mov dword [rbp + 0x1b0], eax
lea r8, [rsp + 0x78]
mov edx, 0xc611ef12
pushf
not edx
add edx, 0x2b1104b7
xor edx, 0x79e1a589
rol edx, 0x1e
popf
pushf
not edx
add edx, 0x7aa4c999
xor edx, 0x72430986
rol edx, 0xd9
popf
pushf
not edx
add edx, 0x1b919ae4
xor edx, 0x3b0f58bb
rol edx, 0x17
popf
mov rdi, rbx
jmp 0x140072765
call qword [sym.imp.ntdll.dll_NtCreateEvent]
test eax, eax
js 0x1400727b9
push rax
pushf
mov eax, 0xad390368
pushf
not eax
add eax, 0x59fe90ab
xor eax, 0x1d6e704b
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x5cdef437
xor eax, 0x243fe6c2
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x4a44ed22
xor eax, 0x243bd3b7
rol eax, 0x9a
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0xc9c42afc
pushf
not eax
add eax, 0x20c9dd8b
xor eax, 0x11936514
rol eax, 1
popf
pushf
not eax
add eax, 0x609637a
xor eax, 0x24efe11a
rol eax, 0x45
popf
pushf
not eax
add eax, 0x742b59be
xor eax, 0x6a4a257
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x229574b8
xor eax, 0x12575c8b
rol eax, 0x7b
popf
jmp 0x140071d9c
xor eax, eax
mov dword [rsp + 0x50], 0x3060663
mov r15d, 0x572c64b2
pushf
not r15d
add r15d, 0x4aee8b29
xor r15d, 0x4b8e062
rol r15d, 0x57
popf
pushf
not r15d
add r15d, 0x407d78fb
xor r15d, 0x3601bbb7
rol r15d, 0xc7
popf
mov dword [rsp + 0x54], 0x63646c41
lea rdi, [rbp - 0x50]
mov qword [rsp + 0x68], r15
mov ecx, 0x94393bf
pushf
not ecx
add ecx, 0x5577cb9d
xor ecx, 0x3b3a80d4
rol ecx, 0xa7
popf
pushf
not ecx
add ecx, 0x52758a17
xor ecx, 0x3cd92455
rol ecx, 0x58
popf
pushf
not ecx
add ecx, 0x2d15c71b
xor ecx, 0x9189382
rol ecx, 0x6d
popf
pushf
not ecx
add ecx, 0x41cf26e5
xor ecx, 0x4fbfc404
rol ecx, 0xb
popf
mov qword [rsp + 0x70], r15
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x50]
call fcn.140074177
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x58]
jmp 0x1400728dc
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x68]
mov dword [rsp + 0x28], 0x8000000
lea r8, [rsp + 0x78]
mov edx, 0x20c19668
pushf
not edx
add edx, 0x6009bdb9
xor edx, 0x6445b452
rol edx, 0xab
popf
pushf
not edx
add edx, 0xcba9905
xor edx, 0xf060b9a
rol edx, 0x32
popf
pushf
not edx
add edx, 0x400a81c5
xor edx, 0x3a2bea3a
rol edx, 0xf
popf
pushf
not edx
add edx, 0x282a2ecb
xor edx, 0x10a615a8
rol edx, 0xfb
popf
mov dword [rsp + 0x20], 4
lea rcx, [rsi + 0x58]
jmp 0x14007295f
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
js 0x1400729b3
push rax
pushf
mov eax, 0x35c777f7
pushf
not eax
add eax, 0x13a40d23
xor eax, 0x27c4ab93
rol eax, 0x58
popf
pushf
not eax
add eax, 0x1da71758
xor eax, 0x6c08a845
rol eax, 0x2b
popf
pushf
not eax
add eax, 0x2756c8a8
xor eax, 0x49be162
rol eax, 0x38
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0xe9a7d5e
pushf
not eax
add eax, 0x64d1b858
xor eax, 0x24dba9e0
rol eax, 0x93
popf
pushf
not eax
add eax, 0x1dd57203
xor eax, 0x509da9b
rol eax, 0xc1
popf
jmp 0x140071d9c
mov rcx, qword [rsi + 0x58]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0xa40]
mov dword [rsp + 0x40], 0x100000
xor r9d, r9d
mov dword [rsp + 0x38], 2
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
jmp 0x140072a25
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
js 0x140072a75
push rax
pushf
mov eax, 0x47a6983e
pushf
not eax
add eax, 0x33ade026
xor eax, 0xa4f7cbf
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x2471a998
xor eax, 0x6a1e870a
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x4006cef3
xor eax, 0x7c30e51
rol eax, 0xa2
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0xcd36487f
pushf
not eax
add eax, 0x25006153
xor eax, 0xc7ea1ea
rol eax, 0x5a
popf
pushf
not eax
add eax, 0x5a3c27df
xor eax, 0x74c8d4fa
rol eax, 0xd1
popf
jmp 0x140071d9c
mov rdi, qword [rbp + 0xa40]
lea rdx, [rbp + 0x1b0]
xor eax, eax
mov ecx, r15d
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0xa40]
mov r8d, 0xc37fe929
pushf
not r8d
add r8d, 0x2cc66648
xor r8d, 0x30dc91d2
rol r8d, 0x17
popf
pushf
not r8d
add r8d, 0x635f13c7
xor r8d, 0x3c8241a9
rol r8d, 0xce
popf
pushf
not r8d
add r8d, 0x3fd81ce1
xor r8d, 0x5e504313
rol r8d, 0x56
popf
pushf
not r8d
add r8d, 0x4eb056bd
xor r8d, 0x74d672c1
rol r8d, 0x9b
popf
call fcn.14001ab70
mov rdx, qword [rbp + 0xa40]
or rcx, 0xffffffffffffffff
jmp 0x140072b3f
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov r14d, 0x1b2d6d9f
pushf
not r14d
add r14d, 0x574c335d
xor r14d, 0xdc2aceb
rol r14d, 0x7f
popf
pushf
not r14d
add r14d, 0x5276d447
xor r14d, 0x262cafde
rol r14d, 0x61
popf
pushf
not r14d
add r14d, 0x1fb1ea8c
xor r14d, 0x60698a01
rol r14d, 0xc1
popf
push rax
pushf
mov eax, 0xce5bb8ce
pushf
not eax
add eax, 0x686a9fb0
xor eax, 0x104085ee
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x76f947f4
xor eax, 0x4fd1c02e
rol eax, 0xcf
popf
jmp 0x140071d9c
mov rdi, rbx
push rax
pushf
mov eax, 0x67185f
pushf
not eax
add eax, 0xb058794
xor eax, 0x48ed8888
rol eax, 0xb5
popf
pushf
not eax
add eax, 0x7e97384
xor eax, 0x10612907
rol eax, 0xf8
popf
jmp 0x140071d9c
mov r8, rdi
xor edx, edx
jmp 0x140072cab
mov r8, rbx
push rax
pushf
mov eax, 0xab06cbde
pushf
not eax
add eax, 0x4b426559
xor eax, 0x1ec4603a
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x2c9d99e
xor eax, 0x369bcaa2
rol eax, 0x16
popf
pushf
not eax
add eax, 0x3db5bb53
xor eax, 0x3b4a4d81
rol eax, 0x50
popf
pushf
not eax
add eax, 0x2578de5a
xor eax, 0x3e29c4ca
rol eax, 0x75
popf
jmp 0x140071d9c
mov rcx, qword [0x14002fa90]
mov rcx, qword [rcx + 0x18]
jmp 0x140072cb7
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
push rax
pushf
mov eax, 0x5ad6a766
pushf
not eax
add eax, 0x55130107
xor eax, 0x69cd4d44
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x69e38beb
xor eax, 0x2da3baa2
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x689a47c
xor eax, 0x2832515d
rol eax, 0xdd
popf
jmp 0x140071d9c
mov rcx, qword [rbp + 0xa48]
test rcx, rcx
je 0x140072d68
push rax
pushf
mov eax, 0x8c7deec6
pushf
not eax
add eax, 0x7f0635c
xor eax, 0x5099f285
rol eax, 0xa
popf
pushf
not eax
add eax, 0x457bb93c
xor eax, 0x2392f66c
rol eax, 0x76
popf
pushf
not eax
add eax, 0x1ad65813
xor eax, 0x44ce2ace
rol eax, 0x72
popf
pushf
not eax
add eax, 0xb35a7d4
xor eax, 0x47b10e37
rol eax, 0x4b
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x49d033f1
pushf
not eax
add eax, 0x5fccdb78
xor eax, 0x2d53f8f3
rol eax, 0xd
popf
pushf
not eax
add eax, 0x4bc3a408
xor eax, 0x5fd4b8f2
rol eax, 0x56
popf
jmp 0x140071d9c
call qword [sym.imp.ntdll.dll_RtlDeleteBoundaryDescriptor]
push rax
pushf
mov eax, 0x388ad2a7
pushf
not eax
add eax, 0xffc181b
xor eax, 0x5b9e1b82
rol eax, 0x60
popf
pushf
not eax
add eax, 0x6ad30bb4
xor eax, 0x567b2a71
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x6c2d180a
xor eax, 0x6552d08f
rol eax, 9
popf
pushf
not eax
add eax, 0x701dfccd
xor eax, 0x2e157d46
rol eax, 0xc7
popf
jmp 0x140071d9c
test r14d, r14d
jne 0x140072e59
push rax
pushf
mov eax, 0xfe65a24c
pushf
not eax
add eax, 0x451a4328
xor eax, 0x3e4d73b7
rol eax, 0x94
popf
pushf
not eax
add eax, 0x1590a0a9
xor eax, 0x77585d3f
rol eax, 0x31
popf
pushf
not eax
add eax, 0x65afe443
xor eax, 0xc148b72
rol eax, 0xad
popf
pushf
not eax
add eax, 0x4cd73202
xor eax, 0x98859d7
rol eax, 0xd2
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x6d93cd37
pushf
not eax
add eax, 0x63ad223e
xor eax, 0x22450225
rol eax, 0xf0
popf
pushf
not eax
add eax, 0x7452f427
xor eax, 0x5eb00d8c
rol eax, 0xae
popf
pushf
not eax
add eax, 0x1d100939
xor eax, 0x587e78f1
rol eax, 0x9d
popf
jmp 0x140071d9c
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x140072edb
push rax
pushf
mov eax, 0x52ff9678
pushf
not eax
add eax, 0x34cd2747
xor eax, 0xd2a4efe
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x4cff48c1
xor eax, 0x4f1c39fb
rol eax, 0xc1
popf
jmp 0x140071d9c
push rax
pushf
mov eax, 0x96cb2ee
pushf
not eax
add eax, 0x14b8bae7
xor eax, 0x45751a35
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x79be24c
xor eax, 0x7863b4e4
rol eax, 0xd4
popf
pushf
not eax
add eax, 0x2cbbea15
xor eax, 0x65b954c8
rol eax, 0x87
popf
pushf
not eax
add eax, 0x191da733
xor eax, 0x10dd96f1
rol eax, 0xa9
popf
jmp 0x140071d9c
call qword [sym.imp.ntdll.dll_NtDeletePrivateNamespace]
mov rcx, qword [rsi + 0x50]
jmp 0x140072f40
call qword [sym.imp.ntdll.dll_NtClose]
push rax
pushf
mov eax, 0x6a8939d6
pushf
not eax
add eax, 0x261f556f
xor eax, 0x12d16304
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x3ef4fea4
xor eax, 0x59aa92df
rol eax, 0x16
popf
jmp 0x140071d9c
mov eax, r14d
add rsp, 0xaf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret