Function at 0x14000d4f3
Capabilities:
Access pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov rax, qword [0x1400160c0]
xor rax, rbp
mov qword [rbp + 0x60], rax
mov eax, dword [0x14001612c]
mov ebx, dword [0x140016128]
lea edi, [rax - 1]
imul edi, eax
test dil, 1
sete byte [rbp + 0x5e]
cmp ebx, 0xa
setl byte [rbp + 0x5d]
mov qword [rbp - 0x50], r9
mov byte [rbp + 0x5f], r8b
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rcx
mov eax, 0x48a1a76d
mov rdi, qword [sym.imp.ntoskrnl.exe_RtlCompareString]
mov rbx, qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
cmp eax, 0xcafe203
jle 0x14000d5d8
cmp eax, 0x3aa8f00d
jg 0x14000d632
cmp eax, 0x2466e304
jg 0x14000d6dc
cmp eax, 0x137c5a01
jle 0x14000d7f4
cmp eax, 0x1f7c2f21
jg 0x14000da35
cmp eax, 0x137c5a02
je 0x14000ddd9
cmp eax, 0x19730270
je 0x14000de53
cmp eax, 0x1b6e5664
jne 0x14000d560
mov eax, dword [rbp + 4]
mov dword [rbp - 0x34], eax
mov rax, qword [rbp - 0x58]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa5fd08af
mov ecx, 0x11d7114e
jmp 0x14000e502
cmp eax, 0xc004879b
jg 0x14000d67e
cmp eax, 0xa5fd08ae
jg 0x14000d71d
cmp eax, 0x8b12ae9b
jle 0x14000d82a
cmp eax, 0x92a8d0dc
jg 0x14000da8f
cmp eax, 0x8b12ae9c
je 0x14000de5d
cmp eax, 0x8d0bce03
je 0x14000de6b
cmp eax, 0x8dde99ab
jne 0x14000d560
mov eax, dword [rbp + 0x34]
mov eax, 0x1f7c2f22
jmp 0x14000d560
cmp eax, 0x662931f5
jg 0x14000d75e
cmp eax, 0x585637bd
jle 0x14000d893
cmp eax, 0x5a7e7507
jg 0x14000dac5
cmp eax, 0x585637be
je 0x14000de9a
cmp eax, 0x59374812
je 0x14000deef
cmp eax, 0x5a0bca2b
jne 0x14000d560
mov eax, 0x759b2702
jmp 0x14000d560
cmp eax, 0xf316ce04
jg 0x14000d79f
cmp eax, 0xe08445db
jle 0x14000d8d5
cmp eax, 0xe9f86606
jg 0x14000daf6
cmp eax, 0xe08445dc
je 0x14000df05
cmp eax, 0xe34f6c30
je 0x14000df23
cmp eax, 0xe9333319
jne 0x14000d560
cmp byte [rbp + 0x55], 0
mov eax, 0x3aa8f00e
mov ecx, 0x6844ed05
cmovne eax, ecx
mov ecx, dword [rbp - 0x28]
mov dword [rbp + 0xc], ecx
jmp 0x14000d560
cmp eax, 0x316817fc
jle 0x14000d92b
cmp eax, 0x346180ce
jg 0x14000db6b
cmp eax, 0x316817fd
je 0x14000df38
cmp eax, 0x316e1a29
je 0x14000df58
cmp eax, 0x33edd420
jne 0x14000d560
mov eax, 0x390c67de
jmp 0x14000d560
cmp eax, 0xb056281e
jle 0x14000d96b
cmp eax, 0xba8e4297
jg 0x14000dbaa
cmp eax, 0xb056281f
je 0x14000df76
cmp eax, 0xb2ac637e
je 0x14000df94
cmp eax, 0xb64c6b62
jne 0x14000d560
mov eax, 0xb056281f
jmp 0x14000d560
cmp eax, 0x6f665bb1
jle 0x14000d9a1
cmp eax, 0x755ed7e2
jg 0x14000dbe9
cmp eax, 0x6f665bb2
je 0x14000dfa4
cmp eax, 0x702fcbdc
je 0x14000dfae
cmp eax, 0x745fc1d7
jne 0x14000d560
mov eax, 0x6bcf94d8
jmp 0x14000d560
cmp eax, 0xf97c8dc2
jg 0x14000d9eb
cmp eax, 0xf5cb75c1
jle 0x14000dc25
cmp eax, 0xf5cb75c2
je 0x14000dfc4
cmp eax, 0xf79e9af8
je 0x14000dfd5
cmp eax, 0xf8a76265
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1285b2c3
mov ecx, 0xbc2f7f2e
jmp 0x14000e502
cmp eax, 0x11884a87
jle 0x14000dc63
cmp eax, 0x11884a88
je 0x14000dff3
cmp eax, 0x11d7114e
je 0x14000e023
cmp eax, 0x1285b2c3
jne 0x14000d560
mov eax, 0xf8a76265
jmp 0x14000d560
cmp eax, 0x846c917e
jle 0x14000dc87
cmp eax, 0x846c917f
je 0x14000e041
cmp eax, 0x8746ddb1
je 0x14000e05f
cmp eax, 0x88a158c0
jne 0x14000d560
mov rax, qword [rbp + 0x18]
movzx eax, word [rax + 6]
lea rax, [rax + rax*4]
shl rax, 3
add rax, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x40]
cmp rcx, rax
setb byte [rbp + 0x59]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa7103d92
mov ecx, 0x4ef238dd
jmp 0x14000e502
cmp eax, 0x48a1a76c
jle 0x14000dcbf
cmp eax, 0x48a1a76d
je 0x14000e07d
cmp eax, 0x4d1ab832
je 0x14000e09b
cmp eax, 0x4ef238dd
jne 0x14000d560
cmp byte [rbp + 0x59], 0
mov eax, 0xe08445dc
mov ecx, 0x846c917f
cmovne eax, ecx
jmp 0x14000d560
cmp eax, 0xc6c749de
jle 0x14000dceb
cmp eax, 0xc6c749df
je 0x14000e0a9
cmp eax, 0xd09034bd
je 0x14000e0d1
cmp eax, 0xd0babf2e
jne 0x14000d560
mov rax, qword [rbp + 0x40]
add rax, 0x28
mov qword [rbp - 0x78], rax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4d1ab832
mov ecx, 0x30f3d260
jmp 0x14000e502
cmp eax, 0x2ee5520a
jle 0x14000dd17
cmp eax, 0x2ee5520b
je 0x14000e0f5
cmp eax, 0x2eff307a
je 0x14000e10b
cmp eax, 0x30f3d260
jne 0x14000d560
mov r12, qword [rbp - 0x78]
mov eax, 0xf4474781
mov ecx, dword [rbp - 8]
mov dword [rbp - 0x24], ecx
jmp 0x14000d560
cmp eax, 0xa918df4d
jle 0x14000dd45
cmp eax, 0xa918df4e
je 0x14000e129
cmp eax, 0xa9fda855
je 0x14000e133
cmp eax, 0xac6e89a6
jne 0x14000d560
mov eax, 0x6e6be0b2
jmp 0x14000d560
cmp eax, 0x69c01890
jle 0x14000dd71
cmp eax, 0x69c01891
je 0x14000e194
cmp eax, 0x6bcf94d8
je 0x14000e1b2
cmp eax, 0x6e6be0b2
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xac6e89a6
mov ecx, 0xe34f6c30
jmp 0x14000e502
cmp eax, 0x14f543f
jle 0x14000dda5
cmp eax, 0x14f5440
je 0x14000e1d0
cmp eax, 0x7bd0bb0
je 0x14000e1ee
cmp eax, 0x9d66042
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xac6e89a6
mov ecx, 0x6e6be0b2
jmp 0x14000e502
cmp eax, 0x1f7c2f22
je 0x14000e1fb
cmp eax, 0x204e5de0
je 0x14000e221
cmp eax, 0x20de12d9
jne 0x14000d560
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
setne byte [rbp + 0x5a]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x29b2029a
mov ecx, 0x2ee5520b
jmp 0x14000e502
cmp eax, 0x92a8d0dd
je 0x14000e22e
cmp eax, 0x936f60f1
je 0x14000e263
cmp eax, 0xa5619348
jne 0x14000d560
mov eax, 0xc6c749df
mov dword [rbp + 0x10], 2
mov r14d, dword [rbp - 4]
jmp 0x14000d560
cmp eax, 0x5a7e7508
je 0x14000e284
cmp eax, 0x5b02b49b
je 0x14000e28e
cmp eax, 0x5ea5b794
jne 0x14000d560
mov eax, 0x1b6e5664
mov ecx, dword [rbp - 0x30]
mov dword [rbp + 4], ecx
jmp 0x14000d560
cmp eax, 0xe9f86607
je 0x14000e2b6
cmp eax, 0xec146c09
je 0x14000e2c7
cmp eax, 0xf1c9fd68
jne 0x14000d560
mov rax, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
mov rdx, qword [rbp - 0x40]
mov r13, qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
call r13
add rsp, 0x20
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call r13
add rsp, 0x20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
sub rsp, 0x20
mov r8b, 1
call rdi
add rsp, 0x20
mov eax, 0x755ed7e3
jmp 0x14000d560
cmp eax, 0x346180cf
je 0x14000e2e5
cmp eax, 0x371234b3
je 0x14000e303
cmp eax, 0x390c67de
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x33edd420
mov ecx, 0xf5cb75c2
jmp 0x14000e502
cmp eax, 0xba8e4298
je 0x14000e314
cmp eax, 0xbc2f7f2e
je 0x14000e390
cmp eax, 0xbf25370b
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x92a8d0dd
mov ecx, 0xa9fda855
jmp 0x14000e502
cmp eax, 0x755ed7e3
je 0x14000e3a5
cmp eax, 0x759b2702
je 0x14000e423
cmp eax, 0x7b457555
jne 0x14000d560
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xd0]
mov qword [rcx], rax
mov eax, 0x8d0bce03
jmp 0x14000d560
cmp eax, 0xf316ce05
je 0x14000e441
cmp eax, 0xf4474781
jne 0x14000e51e
mov eax, dword [rbp - 0x24]
mov dword [rbp - 4], eax
mov qword [rbp + 0x40], r12
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa7103d92
mov ecx, 0x88a158c0
jmp 0x14000e502
cmp eax, 0xcafe204
je 0x14000e45f
cmp eax, 0xfda1c60
jne 0x14000d560
mov eax, 0xf4474781
mov r12, qword [rbp - 0x20]
jmp 0x14000d560
cmp eax, 0x80e6af44
je 0x14000e46e
cmp eax, 0x8152985d
jne 0x14000d560
mov rax, qword [rbp - 0x70]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1285b2c3
mov ecx, 0xf8a76265
jmp 0x14000e502
cmp eax, 0x3aa8f00e
je 0x14000e489
cmp eax, 0x3c23e155
jne 0x14000d560
cmp byte [rbp + 0x57], 0
mov eax, 0x8152985d
mov ecx, 0x69c01891
cmovne eax, ecx
jmp 0x14000d560
cmp eax, 0xc004879c
je 0x14000e4aa
cmp eax, 0xc2d9b4bb
jne 0x14000d560
cmp byte [rbp + 0x5c], 0
mov eax, 0xbf25370b
mov ecx, 0x346180cf
cmovne eax, ecx
jmp 0x14000d560
cmp eax, 0x2466e305
je 0x14000e4c5
cmp eax, 0x29b2029a
jne 0x14000d560
mov rcx, qword [rbp - 0x18]
sub rsp, 0x20
call rbx
add rsp, 0x20
mov eax, 0x20de12d9
jmp 0x14000d560
cmp eax, 0xa5fd08af
je 0x14000e4cf
cmp eax, 0xa7103d92
jne 0x14000d560
mov rax, qword [rbp + 0x18]
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp + 0x40]
mov eax, 0x88a158c0
jmp 0x14000d560
cmp eax, 0x662931f6
je 0x14000e4d9
cmp eax, 0x6844ed05
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2466e305
mov ecx, 0xf79e9af8
jmp 0x14000e502
cmp eax, 0xf97c8dc3
je 0x14000e514
cmp eax, 0xffbb96ca
jne 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x19730270
mov ecx, 0xcafe204
jmp 0x14000e502
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x48], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x28], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x20], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
cmp qword [rbp + 0xd0], 0
sete byte [rbp + 0x5c]
mov qword [rbp + 0x38], rax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf97c8dc3
mov ecx, 0xc2d9b4bb
jmp 0x14000e502
mov eax, 0xffbb96ca
jmp 0x14000d560
mov rax, qword [rbp + 0x18]
mov eax, 0x662931f6
jmp 0x14000d560
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rbp + 0xd0]
mov qword [rcx], rax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7b457555
mov ecx, 0x5a7e7508
jmp 0x14000e502
mov rax, qword [rbp + 0x38]
mov rax, qword [rbp + 0x38]
mov qword [rax], 0
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
mov r9d, dword [rdx + 0xc]
add r9, qword [rcx]
mov rcx, qword [rbp + 0x38]
sub rsp, 0x30
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp - 0x48]
mov dl, byte [rbp + 0x5f]
mov r8, qword [rbp - 0x50]
call fcn.14000c55b
add rsp, 0x30
mov eax, 0xba8e4298
jmp 0x14000d560
cmp byte [rbp + 0x5b], 0
mov eax, 0x8746ddb1
mov ecx, 0xf316ce05
cmovne eax, ecx
jmp 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa918df4e
mov ecx, 0x2eff307a
jmp 0x14000e502
mov eax, 0x11884a88
mov dword [rbp + 0x14], 0
mov r15d, dword [rbp - 4]
jmp 0x14000d560
cmp byte [rbp + 0x56], 0
mov eax, 0xc6c749df
mov ecx, 0x80e6af44
cmovne eax, ecx
mov ecx, dword [rbp + 0x34]
mov dword [rbp + 0x10], ecx
mov r14d, dword [rbp - 8]
jmp 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8b12ae9c
mov ecx, 0x662931f6
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb64c6b62
mov ecx, 0xf37d7694
jmp 0x14000e502
mov eax, 0xd09034bd
mov ecx, dword [rbp - 0x2c]
mov dword [rbp + 8], ecx
jmp 0x14000d560
mov eax, 0x14f5440
jmp 0x14000d560
cmp byte [rbp + 0x58], 0
mov eax, 0x9d66042
mov ecx, 0xc004879c
cmovne eax, ecx
jmp 0x14000d560
mov eax, 0x1b6e5664
mov dword [rbp + 4], 0xc0000225
jmp 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2466e305
mov ecx, 0x371234b3
jmp 0x14000e502
mov dword [rbp - 8], r15d
mov eax, dword [rbp + 0x14]
mov dword [rbp + 0x34], eax
mov rax, qword [rbp - 0x68]
mov rax, qword [rbp - 0x60]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8dde99ab
mov ecx, 0x1f7c2f22
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa5fd08af
mov ecx, 0x204e5de0
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf1c9fd68
mov ecx, 0x755ed7e3
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x33edd420
mov ecx, 0x390c67de
jmp 0x14000e502
mov cl, byte [rbp + 0x5e]
cmp byte [rbp + 0x5d], 0
mov eax, 0xf97c8dc3
mov edx, 0x137c5a02
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14000d560
mov rax, qword [rbp + 0x40]
mov eax, 0xd0babf2e
jmp 0x14000d560
mov dword [rbp - 0x28], r14d
mov eax, dword [rbp + 0x10]
mov dword [rbp - 0xc], eax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7bd0bb0
mov ecx, 0x5b02b49b
jmp 0x14000e502
mov eax, dword [rbp + 8]
mov dword [rbp - 0x30], eax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6f665bb2
mov ecx, 0x14f5440
jmp 0x14000e502
cmp byte [rbp + 0x5a], 0
mov eax, 0xec146c09
mov ecx, 0x316e1a29
cmovne eax, ecx
jmp 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa918df4e
mov ecx, 0xa5619348
jmp 0x14000e502
mov eax, 0x2eff307a
jmp 0x14000d560
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rax, qword [rbp + 0x48]
mov qword [rax], 0
mov rdx, qword [rbp + 0x48]
sub rsp, 0x20
lea rcx, str.ntoskrnl.exe
call fcn.14000b1e4
add rsp, 0x20
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
setne byte [rbp + 0x5b]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x92a8d0dd
mov ecx, 0x59374812
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7b457555
mov ecx, 0x8d0bce03
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x745fc1d7
mov ecx, 0xe9f86607
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6f665bb2
mov ecx, 0x5ea5b794
jmp 0x14000e502
mov eax, dword [rbp - 0xc]
mov eax, 0x5b02b49b
jmp 0x14000d560
cmp dword [rbp + 0x34], 0
sete byte [rbp + 0x56]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8dde99ab
mov ecx, 0x316817fd
jmp 0x14000e502
mov eax, 0x936f60f1
mov esi, dword [rbp - 0x34]
jmp 0x14000d560
mov rax, qword [rbp + 0x48]
mov rax, qword [rbp + 0x48]
mov qword [rax], 0
mov rdx, qword [rbp + 0x48]
sub rsp, 0x20
lea rcx, str.ntoskrnl.exe
call fcn.14000b1e4
add rsp, 0x20
mov rax, qword [rbp + 0x48]
mov eax, 0xa9fda855
jmp 0x14000d560
mov dword [rbp - 0x38], esi
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb64c6b62
mov ecx, 0xb056281f
jmp 0x14000e502
mov eax, 0x8152985d
jmp 0x14000d560
mov eax, dword [rbp - 0xc]
cmp eax, 2
sete byte [rbp + 0x55]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7bd0bb0
mov ecx, 0xe9333319
jmp 0x14000e502
mov eax, 0xd09034bd
mov dword [rbp + 8], 0xc000007b
jmp 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x745fc1d7
mov ecx, 0x6bcf94d8
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x19730270
mov ecx, 0xffbb96ca
jmp 0x14000e502
mov eax, 0x3aa8f00e
mov dword [rbp + 0xc], 0xc0000225
jmp 0x14000d560
mov rax, qword [rbp + 0x38]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov rax, qword [rbp + 0x38]
mov qword [rax], 0
mov rax, qword [rbp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x40]
mov r9d, dword [rdx + 0xc]
add r9, qword [rcx]
mov rcx, qword [rbp + 0x38]
sub rsp, 0x30
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp - 0x48]
mov dl, byte [rbp + 0x5f]
mov r8, qword [rbp - 0x50]
call fcn.14000c55b
add rsp, 0x30
mov dword [rbp], eax
cmp dword [rbp], 0
setns byte [rbp + 0x57]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x585637be
mov ecx, 0x3c23e155
jmp 0x14000e502
mov eax, 0x11884a88
mov dword [rbp + 0x14], 1
mov r15d, dword [rbp]
jmp 0x14000d560
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x60]
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x28]
sub rsp, 0x20
mov rdx, qword [rbp - 0x40]
mov r13, qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
call r13
add rsp, 0x20
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call r13
add rsp, 0x20
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
sub rsp, 0x20
mov r8b, 1
call rdi
add rsp, 0x20
test eax, eax
sete byte [rbp + 0x58]
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf1c9fd68
mov ecx, 0x702fcbdc
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5a0bca2b
mov ecx, 0xb2ac637e
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x29b2029a
mov ecx, 0x20de12d9
jmp 0x14000e502
mov eax, 0x936f60f1
mov esi, 0xc000000d
jmp 0x14000d560
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4d1ab832
mov ecx, 0xd0babf2e
jmp 0x14000e502
mov eax, dword [rbp + 0xc]
mov dword [rbp - 0x2c], eax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5a0bca2b
mov ecx, 0x759b2702
jmp 0x14000e502
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x585637be
mov ecx, 0xba8e4298
jmp 0x14000e502
mov eax, 0xf79e9af8
jmp 0x14000d560
mov eax, 0x11d7114e
jmp 0x14000d560
mov rax, qword [rbp + 0x18]
mov ecx, 0x108
add rax, rcx
mov qword [rbp - 0x20], rax
mov eax, dword [0x14001612c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8b12ae9c
mov ecx, 0xfda1c60
cmove eax, ecx
cmp dword [0x140016128], 0xa
cmovl eax, ecx
jmp 0x14000d560
mov eax, 0x137c5a02
jmp 0x14000d560
cmp eax, 0xf37d7694
jne 0x14000d560
mov esi, dword [rbp - 0x38]
mov rcx, qword [rbp + 0x60]
xor rcx, rbp
sub rsp, 0x20
call fcn.140013f90
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 0x68]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret