Function at 0x14009a7b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f90]
mov eax, 0x3090
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x2f80], rax
xor ebx, ebx
mov qword [rsp + 0x60], rcx
mov qword [rcx + 8], rbx
mov byte [rcx], 1
lea ecx, [rbx + 0x30]
call fcn.140190b18
mov qword [rsp + 0x28], rax
lea r13, [rsp + 0x59]
mov qword [rsp + 0x58], rbx
xor cl, cl
mov r12d, ebx
mov qword [rax + 4], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x28], rbx
mov byte [rax], 0xdc
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbx
nop
movzx r9d, byte [r13 - 1]
mov eax, 0x80808081
movzx r10d, byte [r13]
movzx r11d, byte [r13 + 1]
movzx ebx, byte [r13 + 2]
movzx edi, byte [r13 + 3]
movzx esi, byte [r13 + 4]
movzx r14d, byte [r13 + 5]
movzx r15d, byte [r13 + 6]
movzx ecx, cl
add ecx, r9d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xfc9215ddfa245
movzx r8d, cl
add r8, rax
movabs rax, 0x8080808080808081
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r9d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xd9103fc58343e
movzx r8d, cl
add r8, rax
movabs rax, 0x8080808080808081
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r9d
movabs r9, 0x8080808080808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xa9422cffde495
movzx ecx, cl
add rcx, rax
mov rax, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xfc9215ddfa245
movzx r8d, cl
add r8, rax
mov rax, r9
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xd9103fc58343e
movzx r8d, cl
add r8, rax
mov rax, r9
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r10d
movabs r10, 0xfc9215ddfa245
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xa9422cffde495
movzx ecx, cl
add rcx, rax
mov rax, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xd9103fc58343e
movzx r8d, cl
add r8, rax
mov rax, r9
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xa9422cffde495
movzx ecx, cl
add rcx, rax
mov rax, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, ebx
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
movzx ecx, r8b
add ecx, ebx
mov eax, 0x80808081
mul ecx
movabs r11, 0xd9103fc58343e
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r11
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, ebx
movabs rbx, 0xa9422cffde495
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx ecx, cl
add rcx, rbx
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, edi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, edi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r11
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, edi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx ecx, cl
add rcx, rbx
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, esi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movzx r8d, cl
add r8, r10
mov rax, r9
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, esi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r11
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, esi
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx ecx, cl
add rcx, rbx
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r14d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r14d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r11
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r14d
mov r14, r9
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx ecx, cl
add rcx, rbx
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
movzx ecx, cl
add ecx, r15d
mov eax, 0x80808081
lea r13, [r13 + 8]
mul ecx
add r12d, 8
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r15d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx r8d, cl
add r8, r11
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r15d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r9
movzx ecx, cl
add rcx, rbx
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
cmp r12d, 8
jb 0x14009a830
mov r12, qword [rsp + 0x28]
lea rdi, [rsp + 0x59]
mov eax, dword [r12 + 4]
mov byte [r12 + 1], cl
xor cl, cl
xor r15d, r15d
mov dword [rsp + 0x58], eax
mov esi, r15d
mov r12, r10
nop dword [rax]
movzx r9d, byte [rdi - 1]
mov eax, 0x80808081
movzx r10d, byte [rdi]
movzx r11d, byte [rdi + 1]
movzx ebx, byte [rdi + 2]
movzx ecx, cl
add ecx, r9d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r9d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xd9103fc58343e
movzx r8d, cl
add r8, rax
mov rax, r14
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r9d
movabs r9, 0xd9103fc58343e
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
movabs rax, 0xa9422cffde495
movzx ecx, cl
add rcx, rax
mov rax, r14
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r9
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
movzx ecx, r8b
inc ecx
xor ecx, r10d
mov eax, 0x80808081
movabs r10, 0xa9422cffde495
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r10
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r9
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r10
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, ebx
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, ebx
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r9
mul r8
shr rdx, 7
lea rdi, [rdi + 4]
imul rax, rdx, 0xff
add esi, 4
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, ebx
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r10
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
cmp esi, 4
jb 0x14009adf0
mov r12, qword [rsp + 0x28]
lea rdi, [rsp + 0x51]
mov dword [rsp + 0x50], r15d
mov esi, r15d
movabs r13, 0xfc9215ddfa245
mov byte [r12 + 2], cl
xor cl, cl
mov r12, r9
nop dword [rax]
movzx r9d, byte [rdi - 1]
mov eax, 0x80808081
movzx r10d, byte [rdi]
movzx r11d, byte [rdi + 1]
movzx ebx, byte [rdi + 2]
movzx ecx, cl
add ecx, r9d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r13
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r9d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r9d
movabs r9, 0xa9422cffde495
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r13
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r10d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r13
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
inc ecx
xor ecx, r11d
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
mov eax, 0x80808081
movzx ecx, cl
add ecx, ebx
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r13
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
mov eax, 0x80808081
movzx ecx, r8b
add ecx, ebx
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx r8d, cl
add r8, r12
mul r8
shr rdx, 7
imul rax, rdx, 0xff
sub r8, rax
movzx ecx, r8b
lea rdi, [rdi + 4]
inc ecx
mov eax, 0x80808081
xor ecx, ebx
add esi, 4
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov rax, r14
movzx ecx, cl
add rcx, r9
mul rcx
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
cmp esi, 4
jb 0x14009b0d0
mov r12, qword [rsp + 0x28]
mov r13, qword [rsp + 0x60]
mov byte [r12 + 3], cl
mov rcx, qword [r12 + 0x10]
test rcx, rcx
je 0x14009b387
call fcn.1401a6090
mov ecx, 0x5d2
call fcn.1401ab860
mov qword [r12 + 0x10], rax
test rax, rax
je 0x14009b3b4
xor edx, edx
mov qword [r12 + 0x28], 0x5d2
mov r8d, 0x5d2
mov rcx, rax
call fcn.1401d1c40
cmp qword [0x140328d30], r15
mov qword [r13 + 8], r12
jne 0x14009b3e2
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x14009b3e2
mov qword [rax], r15
mov qword [rax + 8], 0x19c
mov qword [0x140328d30], rax
lea r8, [rsp + 0x60]
mov edx, 0x2000
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
test eax, eax
je 0x14009b522
mov eax, dword [rsp + 0x60]
cmp eax, 0x2000
jae 0x14009b522
mov r14d, eax
shr r14, 3
test r14, r14
je 0x14009b522
mov rsi, r15
mov rcx, qword [rbp + rsi*8 - 0x80]
lea rdx, [rbp + 0x1f80]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
test eax, eax
je 0x14009b4d8
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x1f80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x14009b460
lea rdx, [rbp + 0x1f80]
lea rcx, [rsp + 0x30]
call fcn.14003ce50
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea rdx, str.kprocesshacker.sys
cmp rdi, 0xf
cmova rcx, rbx
call fcn.1401d2370
test eax, eax
je 0x14009b4e9
cmp rdi, 0xf
jbe 0x14009b4d8
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b4d0
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009baa0
mov rcx, rbx
call fcn.140190a2c
mov rax, rsi
inc rsi
cmp rax, r14
jb 0x14009b420
jmp 0x14009b53d
cmp rdi, 0xf
jbe 0x14009b529
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b518
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009baa0
mov rcx, rbx
call fcn.140190a2c
jmp 0x14009b529
cmp byte [rsp + 0x20], r15b
je 0x14009b53d
mov rcx, qword [r13 + 8]
lea r8, str.kprocesshacker.sys
mov byte [r13], r15b
call fcn.1400f2c60
lea r8, [rsp + 0x60]
mov edx, 0x2000
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
test eax, eax
je 0x14009b682
mov eax, dword [rsp + 0x60]
cmp eax, 0x2000
jae 0x14009b682
mov r14d, eax
shr r14, 3
test r14, r14
je 0x14009b682
mov rsi, r15
nop dword [rax + rax]
mov rcx, qword [rbp + rsi*8 - 0x80]
lea rdx, [rbp + 0x1f80]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
test eax, eax
je 0x14009b638
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x1f80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x14009b5c0
lea rdx, [rbp + 0x1f80]
lea rcx, [rsp + 0x30]
call fcn.14003ce50
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea rdx, str.SystemInformer.sys
cmp rdi, 0xf
cmova rcx, rbx
call fcn.1401d2370
test eax, eax
je 0x14009b649
cmp rdi, 0xf
jbe 0x14009b638
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b630
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009baa6
mov rcx, rbx
call fcn.140190a2c
mov rax, rsi
inc rsi
cmp rax, r14
jb 0x14009b580
jmp 0x14009b69d
cmp rdi, 0xf
jbe 0x14009b689
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b678
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009baa6
mov rcx, rbx
call fcn.140190a2c
jmp 0x14009b689
cmp byte [rsp + 0x20], r15b
je 0x14009b69d
mov rcx, qword [r13 + 8]
lea r8, str.SystemInformer.sys
mov byte [r13], r15b
call fcn.1400f2c60
lea r8, [rsp + 0x60]
mov edx, 0x2000
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
test eax, eax
je 0x14009b7e2
mov eax, dword [rsp + 0x60]
cmp eax, 0x2000
jae 0x14009b7e2
mov r14d, eax
shr r14, 3
test r14, r14
je 0x14009b7e2
mov rsi, r15
nop dword [rax + rax]
mov rcx, qword [rbp + rsi*8 - 0x80]
lea rdx, [rbp + 0x1f80]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
test eax, eax
je 0x14009b798
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x1f80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x14009b720
lea rdx, [rbp + 0x1f80]
lea rcx, [rsp + 0x30]
call fcn.14003ce50
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea rdx, str.kdcom.sys
cmp rdi, 0xf
cmova rcx, rbx
call fcn.1401d2370
test eax, eax
je 0x14009b7a9
cmp rdi, 0xf
jbe 0x14009b798
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b790
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009baac
mov rcx, rbx
call fcn.140190a2c
mov rax, rsi
inc rsi
cmp rax, r14
jb 0x14009b6e0
jmp 0x14009b7fd
cmp rdi, 0xf
jbe 0x14009b7e9
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b7d8
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009baac
mov rcx, rbx
call fcn.140190a2c
jmp 0x14009b7e9
cmp byte [rsp + 0x20], r15b
je 0x14009b7fd
mov rcx, qword [r13 + 8]
lea r8, str.kdcom.sys
mov byte [r13], r15b
call fcn.1400f2c60
lea r8, [rsp + 0x60]
mov edx, 0x2000
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
test eax, eax
je 0x14009b942
mov eax, dword [rsp + 0x60]
cmp eax, 0x2000
jae 0x14009b942
mov r14d, eax
shr r14, 3
test r14, r14
je 0x14009b942
mov rsi, r15
nop dword [rax + rax]
mov rcx, qword [rbp + rsi*8 - 0x80]
lea rdx, [rbp + 0x1f80]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_K32GetDeviceDriverBaseNameA]
test eax, eax
je 0x14009b8f8
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x1f80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x14009b880
lea rdx, [rbp + 0x1f80]
lea rcx, [rsp + 0x30]
call fcn.14003ce50
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea rdx, str.dbk64.sys
cmp rdi, 0xf
cmova rcx, rbx
call fcn.1401d2370
test eax, eax
je 0x14009b909
cmp rdi, 0xf
jbe 0x14009b8f8
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b8f0
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ba94
mov rcx, rbx
call fcn.140190a2c
mov rax, rsi
inc rsi
cmp rax, r14
jb 0x14009b840
jmp 0x14009b95d
cmp rdi, 0xf
jbe 0x14009b949
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14009b938
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ba94
mov rcx, rbx
call fcn.140190a2c
jmp 0x14009b949
cmp byte [rsp + 0x20], r15b
je 0x14009b95d
mov rcx, qword [r13 + 8]
lea r8, str.dbk64.sys
mov byte [r13], r15b
call fcn.1400f2c60
mov r14, qword [0x140328d30]
xor edi, edi
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14009ba41
lea rbx, [r14 + 0x10]
nop word [rax + rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rsp + 0x70], xmm0
test rax, rax
je 0x14009ba2f
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14009ba2f
movzx ecx, byte [rsp + 0x70]
test cl, cl
jne 0x14009b9d0
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14009ba2f
cmp cl, 1
jne 0x14009ba2f
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140040c90
cmp qword [rsp + 0x48], 0xf
lea rax, [rsp + 0x30]
cmova rax, qword [rsp + 0x30]
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009ba2f
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009ba2a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009ba9a
call fcn.140190a2c
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x14009b990
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov rax, r13
mov qword [0x140328d30], 0
mov rcx, qword [rbp + 0x2f80]
xor rcx, rsp
call fcn.140190770
lea r11, [rsp + 0x3090]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3
call fcn.1401ac538
int3