Function at 0x14004b280
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check if file exists
Check os version
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Get number of processors
Hash data using crc32b
Inspect section memory permissions
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
mov rax, qword [0x14006e010]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov rax, qword gs:[0x60]
xor ebx, ebx
mov edi, ebx
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
add rdx, 0x20
cmp rax, rdx
je 0x14004b2e4
cmp qword [rax + 0x50], rbx
jne 0x14004b2e0
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004b2d0
jmp 0x14004b2e4
lea rdi, [rax - 0x10]
mov rdi, qword [rdi + 0x30]
lea r15, [0x14009f69c]
mov qword [rbp - 0x50], rdi
mov r13, rbx
mov dword [rbp - 0x70], ebx
mov qword [rsp + 0x6e0], r12
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
mov qword [rsp + 0x60], rcx
movzx r14d, word [rcx + 0x14]
add r14, rcx
mov ecx, ebx
mov qword [rbp - 0x68], r14
nop dword [rax + rax]
mov eax, dword [r14 + r13 + 0x3c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x14004b885
mov edx, dword [r14 + r13 + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x14004b731
mov rcx, qword gs:[0x60]
mov r14, rbx
mov rsi, qword [rcx + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b39c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b38e
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004b398
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b374
jmp 0x14004b39c
lea r14, [rdi - 0x10]
mov rdi, qword [r14 + 0x30]
test rdi, rdi
je 0x14004b450
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14004b450
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14004b450
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14004b450
mov r10d, dword [rax + 0x20]
xor ecx, ecx
mov ebx, dword [rax + 0x24]
add r10, rdi
mov esi, dword [rax + 0x1c]
add rbx, rdi
mov r11d, dword [rax + 0x14]
add rsi, rdi
mov r9d, ecx
mov r8d, ecx
test r11d, r11d
je 0x14004b450
lea r14, str.NtReadVirtualMemory
nop
mov ecx, dword [r10 + r8*4]
mov rax, r14
add rcx, rdi
je 0x14004b445
movzx edx, byte [rcx]
cmp dl, 0x4e
jne 0x14004b437
sub rcx, r14
test dl, dl
je 0x14004b42e
cmp byte [rax], 0
je 0x14004b437
movzx edx, byte [rax + rcx + 1]
inc rax
cmp dl, byte [rax]
je 0x14004b417
jmp 0x14004b437
cmp byte [rax], 0
je 0x14004b5bc
movsx ecx, byte [rax]
movsx eax, dl
cmp eax, ecx
je 0x14004b5bc
inc r9d
inc r8
cmp r9d, r11d
jb 0x14004b400
mov r14, qword [rbp - 0x68]
mov edx, 0x20
mov ecx, 0x4c11db7
mov edi, 0xffffffff
mov esi, dword [r14 + r13 + 0x24]
add rsi, qword [rbp - 0x50]
mov qword [r15 - 0xc], rsi
mov eax, dword [r14 + r13 + 0x20]
mov dword [r15 - 4], eax
mov ebx, dword [r14 + r13 + 0x20]
call fcn.140057d80
mov r8d, eax
test rbx, rbx
je 0x14004b51c
nop
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
xor edi, ecx
mov edx, r8d
mov ecx, edi
shr ecx, 1
xor edx, ecx
test dil, 1
mov edi, r8d
cmove edx, ecx
mov ecx, r8d
mov eax, edx
shr eax, 1
xor ecx, eax
test dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
test cl, 1
mov ecx, r8d
cmove edx, eax
mov eax, edx
shr eax, 1
xor ecx, eax
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
test dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
xor edi, eax
test dl, 1
cmove edi, eax
sub rbx, 1
jne 0x14004b490
mov rdx, qword [r15 - 0xc]
not edi
mov dword [r15], edi
mov edi, 0xffff
mov r9d, dword [r14 + r13 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004b580
mov r14d, 0x167
nop dword [rax]
cmp r9, r14
mov ecx, r9d
cmova ecx, r14d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004b550
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004b540
mov r14, qword [rbp - 0x68]
mov ecx, edi
movzx eax, di
mov rdi, qword [rbp - 0x50]
mov edx, r8d
and edx, 0xffff0000
shr ecx, 0x10
shl r8d, 0x10
add ecx, eax
add edx, r8d
or edx, ecx
xor ebx, ebx
mov dword [r15 + 4], edx
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004b882
movzx eax, word [rbx + r8*2]
mov r10d, dword [rsi + rax*4]
add r10, rdi
je 0x14004b450
mov r14, qword [rbp - 0x68]
xor ebx, ebx
mov rdi, qword [rbp - 0x50]
mov r8, r12
mov qword [rsp + 0x20], rbx
mov edx, dword [r14 + r13 + 0x24]
lea rcx, [rbx - 1]
mov r9d, dword [r14 + r13 + 0x20]
add rdx, rdi
call r10
test eax, eax
js 0x14004b5a6
mov eax, dword [r14 + r13 + 0x24]
mov edx, 0x20
add rax, rdi
mov ecx, 0x4c11db7
mov qword [r15 - 0xc], rax
mov edi, 0xffffffff
mov eax, dword [r14 + r13 + 0x20]
mov rsi, r12
mov dword [r15 - 4], eax
mov ebx, dword [r14 + r13 + 0x20]
call fcn.140057d80
mov r8d, eax
test rbx, rbx
je 0x14004b6cc
nop word [rax + rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
xor edi, ecx
mov edx, r8d
mov ecx, edi
shr ecx, 1
xor edx, ecx
test dil, 1
mov edi, r8d
cmove edx, ecx
mov ecx, r8d
mov eax, edx
shr eax, 1
xor ecx, eax
test dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
test cl, 1
mov ecx, r8d
cmove edx, eax
mov eax, edx
shr eax, 1
xor ecx, eax
test dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
xor edi, eax
test dl, 1
cmove edi, eax
sub rbx, 1
jne 0x14004b640
not edi
mov rdx, r12
mov dword [r15], edi
mov edi, 0xffff
mov r9d, dword [r14 + r13 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004b580
mov r14d, 0x167
cmp r9, r14
mov ecx, r9d
cmova ecx, r14d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004b700
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004b6f0
jmp 0x14004b57c
mov esi, dword [r14 + r13 + 0x24]
mov edx, 0x20
add rsi, rdi
mov ecx, 0x4c11db7
mov qword [r15 - 0xc], rsi
mov edi, 0xffffffff
mov eax, dword [r14 + r13 + 0x20]
mov dword [r15 - 4], eax
mov ebx, dword [r14 + r13 + 0x20]
call fcn.140057d80
mov r8d, eax
test rbx, rbx
je 0x14004b7fc
nop dword [rax + rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
xor edi, ecx
mov edx, r8d
mov ecx, edi
shr ecx, 1
xor edx, ecx
test dil, 1
mov edi, r8d
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, r8d
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, r8d
test dl, 1
mov edx, r8d
cmove ecx, eax
mov eax, ecx
shr eax, 1
xor edx, eax
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
xor edi, eax
test dl, 1
cmove edi, eax
sub rbx, 1
jne 0x14004b770
mov rdx, qword [r15 - 0xc]
not edi
mov dword [r15], edi
mov edi, 0xffff
mov r9d, dword [r14 + r13 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004b85c
mov r10d, 0x167
nop dword [rax]
cmp r9, r10
mov ecx, r9d
cmova ecx, r10d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004b830
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004b820
mov edx, r8d
movzx eax, di
and edx, 0xffff0000
shl r8d, 0x10
mov ecx, edi
add edx, r8d
mov rdi, qword [rbp - 0x50]
shr ecx, 0x10
add ecx, eax
or edx, ecx
mov dword [r15 + 4], edx
xor ebx, ebx
mov ecx, dword [rbp - 0x70]
mov rax, qword [rsp + 0x60]
inc ecx
add r13, 0x28
mov dword [rbp - 0x70], ecx
add r15, 0x18
movzx eax, word [rax + 6]
cmp ecx, eax
jle 0x14004b320
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rax]
cmp rsi, rax
je 0x14004b935
nop dword [rax]
cmp qword [rsi + 0x50], 0
je 0x14004b920
mov rax, qword [rsi + 0x20]
mov edi, ebx
movsxd r14, dword [rax + 0x3c]
add r14, rax
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
mov ecx, dword [rbx]
lea rdx, [rbp - 0x20]
add rcx, qword [rsi + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14004b911
cmp dword [rbp], 0x1000
jne 0x14004b911
test dword [rbp + 4], 0x100
jne 0x14004dcf5
movzx eax, word [r14 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jle 0x14004b8e0
mov rax, qword [r15 + 0x18]
mov ebx, 0
mov rsi, qword [rsi]
add rax, 0x20
cmp rsi, rax
jne 0x14004b8c0
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004b97c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004b96e
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004b978
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004b954
jmp 0x14004b97c
lea r14, [rdi - 0x10]
mov rdx, qword [r14 + 0x30]
mov r12d, 0x5a4d
test rdx, rdx
je 0x14004ba42
cmp word [rdx], r12w
jne 0x14004ba42
mov eax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14004ba42
mov eax, dword [rax + rdx + 0x88]
add rax, rdx
je 0x14004ba42
mov edi, dword [rax + 0x20]
mov r9d, r15d
mov r8d, dword [rax + 0x24]
add rdi, rdx
mov r10d, dword [rax + 0x1c]
add r8, rdx
mov r11d, dword [rax + 0x14]
add r10, rdx
test r11d, r11d
je 0x14004ba42
nop dword [rax]
mov eax, dword [rdi]
cmp byte [rax + rdx], 0x4e
jne 0x14004ba32
cmp byte [rax + rdx + 1], 0x74
jne 0x14004ba32
movzx eax, word [r8]
mov ecx, dword [r10 + rax*4]
cmp byte [rcx + rdx], 0x4c
jne 0x14004ba20
cmp byte [rcx + rdx + 1], 0x8b
jne 0x14004ba20
cmp byte [rcx + rdx + 2], 0xd1
jne 0x14004ba20
cmp byte [rcx + rdx + 3], 0xb8
jne 0x14004ba20
cmp byte [rcx + rdx + 0x12], 0xf
jne 0x14004ba32
cmp byte [rcx + rdx + 0x13], 5
je 0x14004ba32
cmp byte [rcx + rdx + 0x12], 0xf
jne 0x14004ba32
cmp byte [rcx + rdx + 0x13], 5
je 0x14004dcf8
inc r9d
add rdi, 4
add r8, 2
cmp r9d, r11d
jb 0x14004b9e0
mov rax, qword gs:[0x60]
mov r11, r15
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
add rdx, 0x20
cmp rax, rdx
je 0x14004ba74
nop
cmp qword [rax + 0x50], r15
jne 0x14004ba70
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004ba60
jmp 0x14004ba74
lea r11, [rax - 0x10]
mov r11, qword [r11 + 0x30]
mov r10, r15
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
movzx ebx, word [rcx + 0x14]
movzx r14d, word [rcx + 6]
add rbx, rcx
lea rsi, [rbx + 0x3c]
mov r8, rsi
nop word [rax + rax]
mov edi, dword [r8 - 0x18]
mov eax, dword [r8]
add rdi, r11
and eax, 0xe0000000
cmp eax, 0x60000000
jne 0x14004baf7
mov rax, rbx
lea rcx, [rdi + 2]
sub rax, rsi
mov rdx, 0xfffffffffffffffe
sub rdx, rdi
mov r9d, dword [rax + r8 + 0x20]
nop
cmp byte [rcx - 2], 0xf
jne 0x14004baeb
cmp byte [rcx - 1], 0xb
jne 0x14004baeb
cmp byte [rcx], r15b
je 0x14004baeb
cmp byte [rcx + 1], r15b
jne 0x14004dcf8
inc rcx
lea rax, [rdx + rcx]
cmp rax, r9
jbe 0x14004bad0
inc r10
add r8, 0x28
cmp r10, r14
jle 0x14004baa0
xor eax, eax
mov qword [rsp + 0x70], r15
lea rdi, [rbp + 0x70]
mov dword [rbp + 0x38], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x3c], 0xd18b4c00
rep stosb byte [rdi], al
lea rax, [rbp + 0x70]
mov word [rbp + 0x40], 0x50f
mov byte [rbp + 0x42], 0xc3
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
cmp word [rbp + 0x70], r15w
je 0x14004bb5a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004bb50
mov r13d, 0x5c
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004bb70
mov word [rax], r15w
lea rax, [rbp + 0x70]
cmp word [rbp + 0x70], r15w
je 0x14004bb9a
nop
add rax, 2
cmp word [rax], r15w
jne 0x14004bb90
lea rdx, [0x140061ec0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004bbb0
mov word [rax], r15w
lea rcx, [rbp + 0x70]
mov eax, r15d
cmp word [rbp + 0x70], r15w
je 0x14004bbde
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004bbd2
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rsp + 0x60], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rsp + 0x62], ax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004bc68
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004bc5a
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004bc64
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004bc40
jmp 0x14004bc68
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
test r9, r9
je 0x14004bd07
cmp word [r9], r12w
jne 0x14004bd07
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004bd07
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004bd07
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004bd07
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004bcfb
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004bcf1
sub rax, rsi
test dl, dl
je 0x14004bcec
cmp byte [rcx], r15b
je 0x14004bcf1
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004bcd5
jmp 0x14004bcf1
cmp byte [rcx], r15b
je 0x14004bd4a
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004bd4a
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004bcc0
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004bd5f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004bd40
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004bd5b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004bd26
jmp 0x14004bd5f
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004bd0a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x14004be07
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004be07
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004be07
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004be07
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004be07
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004bdfb
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004bdf1
sub rax, rsi
test dl, dl
je 0x14004bdec
cmp byte [rcx], r15b
je 0x14004bdf1
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004bdd5
jmp 0x14004bdf1
cmp byte [rcx], r15b
je 0x14004be47
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004be47
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004bdc0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004be5c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004be3d
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004be58
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004be23
jmp 0x14004be5c
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14004be0a
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x14004bf92
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004bf92
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004bf92
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004bf92
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x14004bf95
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004bf0b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004bf01
sub rax, rsi
test dl, dl
je 0x14004befc
cmp byte [rcx], r15b
je 0x14004bf01
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004bee5
jmp 0x14004bf01
cmp byte [rcx], r15b
je 0x14004bf19
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004bf19
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004bed0
jmp 0x14004bf95
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004bf95
test r14, r14
je 0x14004bf95
test r12, r12
je 0x14004bf95
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp - 0x68]
call r12
test eax, eax
js 0x14004bf95
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x50]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x14004bf95
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14004bf95
call rdi
jmp 0x14004bf95
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004bfd9
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004bfcb
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004bfd5
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004bfb1
jmp 0x14004bfd9
lea r14, [rdi - 0x10]
mov r10, qword [rbp - 0x50]
lea r12, str.NtQueryInformationProcess
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
test r10, r10
je 0x14004c190
mov rbx, qword [r14 + 0x30]
test rbx, rbx
je 0x14004c18b
mov r14d, 0x5a4d
cmp word [r10], r14w
jne 0x14004c09f
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14004c09f
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14004c09f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add r11, r10
mov r9d, dword [rax + 0x14]
add rsi, r10
test r9d, r9d
je 0x14004c09f
nop
mov eax, dword [rdi]
mov rcx, r12
add rax, r10
je 0x14004c093
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004c085
sub rax, r12
test dl, dl
je 0x14004c07c
cmp byte [rcx], 0
je 0x14004c085
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004c065
jmp 0x14004c085
cmp byte [rcx], 0
je 0x14004c11e
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004c11e
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x14004c050
mov r9, r15
cmp word [rbx], r14w
jne 0x14004c14d
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x14004c14d
mov eax, dword [rax + rbx + 0x88]
add rax, rbx
je 0x14004c14d
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, rbx
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r11d, dword [rax + 0x14]
add r14, rbx
test r11d, r11d
je 0x14004c14d
lea r12, str.ZwUnmapViewOfSection
mov eax, dword [rdi]
mov rcx, r12
add rax, rbx
je 0x14004c141
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004c137
sub rax, r12
test dl, dl
je 0x14004c132
cmp byte [rcx], 0
je 0x14004c137
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004c107
jmp 0x14004c137
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r9d, dword [rsi + rcx*4]
add r9, r10
jmp 0x14004c0a2
cmp byte [rcx], 0
je 0x14004c163
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004c163
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004c0f2
mov rax, r15
mov rdx, r10
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x14004c173
call rax
jmp 0x14004c183
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
jmp 0x14004c150
movzx ebx, word [r9 + 4]
call rax
mov word [rbp - 0x70], bx
test bx, bx
jne 0x14004c1d3
mov esi, 0x16
lea edi, [rsi + 1]
mov ebx, 0x19
lea rcx, str.____Cant_get_syscall_auto__n
call fcn.140047110
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004c1cf
cmp al, 6
jne 0x14004c1cc
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004c1cc
sub ecx, 1
je 0x14004c1c7
cmp ecx, 1
jne 0x14004c1cf
lea ebx, [rcx + 0x17]
jmp 0x14004c1cf
movzx ebx, di
jmp 0x14004c1cf
movzx ebx, si
mov word [rbp - 0x70], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14d, 0xb
mov rdi, rax
mov qword [rsp + 0x60], r14
test rax, rax
je 0x14004c2f0
lea rcx, [rbp + 0x39]
lea rax, [rbp - 0x70]
cmp rcx, rax
jbe 0x14004c220
lea rcx, [rbp + 0x39]
lea rax, [rbp - 0x6e]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], al
mov byte [rbp + 0x39], bl
cmp rdi, rcx
jbe 0x14004c240
lea rcx, [rbp + 0x43]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rsp + 0x70]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 8
mov byte [rdi + 2], al
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
lea edx, [r9 - 1]
mov qword [rsp + 0x20], r15
call rdi
lea rbx, [rbp + 0x38]
mov esi, eax
sub rbx, rdi
mov r11, r14
mov r9, rdi
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea ecx, [r8 - 0x61]
cmp ecx, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x14004c2c6
inc r9
sub r11, 1
jne 0x14004c290
jmp 0x14004c2cf
cmp r8d, r10d
jne 0x14004dcf8
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x14004c2f0
cmp qword [rsp + 0x70], 0
jne 0x14004dcf8
xor eax, eax
mov dword [rbp - 0x6c], r15d
lea rdi, [rbp + 0x70]
mov dword [rbp + 0x48], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x4c], 0xd18b4c00
rep stosb byte [rdi], al
cmp word [rbp + 0x70], 0
lea rax, [rbp + 0x70]
mov word [rbp + 0x50], 0x50f
mov byte [rbp + 0x52], 0xc3
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
je 0x14004c34a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x14004c340
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004c360
mov word [rax], r15w
lea rax, [rbp + 0x70]
cmp word [rbp + 0x70], cx
je 0x14004c38a
nop
add rax, 2
cmp word [rax], 0
jne 0x14004c380
lea rdx, [0x140061ec0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004c3a0
mov word [rax], r15w
lea rcx, [rbp + 0x70]
cmp word [rbp + 0x70], 0
mov eax, r15d
je 0x14004c3ce
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14004c3c2
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rbp - 0x50], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rbp - 0x4e], ax
lea rax, [rbp + 0x70]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c458
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c44a
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004c454
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c430
jmp 0x14004c458
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004c506
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004c506
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004c506
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004c506
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004c506
lea rsi, str.ZwOpenSection
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004c4fa
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004c4f0
sub rcx, rsi
test al, al
je 0x14004c4eb
cmp byte [rdx], 0
je 0x14004c4f0
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004c4d4
jmp 0x14004c4f0
cmp byte [rdx], 0
je 0x14004c549
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004c549
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004c4c0
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c55e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c53f
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004c55a
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c525
jmp 0x14004c55e
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004c509
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004c61b
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004c61b
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004c61b
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004c61b
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004c61b
lea rsi, str.ZwMapViewOfSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004c5fe
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004c5f4
sub rax, rsi
test dl, dl
je 0x14004c5ef
cmp byte [rcx], 0
je 0x14004c5f4
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004c5d8
jmp 0x14004c5f4
cmp byte [rcx], 0
je 0x14004c60c
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004c60c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004c5c3
jmp 0x14004c61b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c65f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c651
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004c65b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c637
jmp 0x14004c65f
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004c78f
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004c78f
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004c78f
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004c78f
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x14004c78f
lea r14, str.NtClose
nop word [rax + rax]
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x14004c70a
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14004c700
sub rcx, r14
test al, al
je 0x14004c6fb
cmp byte [rdx], sil
je 0x14004c700
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004c6e4
jmp 0x14004c700
cmp byte [rdx], sil
je 0x14004c718
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004c718
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004c6d0
jmp 0x14004c78f
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004c78f
test r15, r15
je 0x14004c78f
test r12, r12
je 0x14004c78f
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp - 0x68]
call r12
test eax, eax
js 0x14004c78f
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x14004c78f
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14004c78f
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004c7d8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004c7ca
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004c7d4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004c7b0
jmp 0x14004c7d8
lea r14, [rdi - 0x10]
mov r10, qword [rsp + 0x70]
test r10, r10
je 0x14004c982
mov rbx, qword [r14 + 0x30]
test rbx, rbx
je 0x14004c982
mov r12d, 0x5a4d
cmp word [r10], r12w
jne 0x14004c89e
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14004c89e
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14004c89e
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add r11, r10
mov r9d, dword [rax + 0x14]
add rsi, r10
test r9d, r9d
je 0x14004c89e
lea r14, str.NtQueryInformationProcess
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r10
je 0x14004c892
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14004c884
sub rcx, r14
test al, al
je 0x14004c87b
cmp byte [rdx], r15b
je 0x14004c884
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004c864
jmp 0x14004c884
cmp byte [rdx], r15b
je 0x14004c91d
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004c91d
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x14004c850
mov r9, r15
cmp word [rbx], r12w
jne 0x14004c94c
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x14004c94c
mov eax, dword [rax + rbx + 0x88]
add rax, rbx
je 0x14004c94c
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, rbx
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r11d, dword [rax + 0x14]
add r14, rbx
test r11d, r11d
je 0x14004c94c
lea r12, str.ZwUnmapViewOfSection
mov eax, dword [rdi]
mov rcx, r12
add rax, rbx
je 0x14004c940
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004c936
sub rax, r12
test dl, dl
je 0x14004c931
cmp byte [rcx], r15b
je 0x14004c936
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004c906
jmp 0x14004c936
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r9d, dword [rsi + rcx*4]
add r9, r10
jmp 0x14004c8a1
cmp byte [rcx], r15b
je 0x14004c962
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004c962
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004c8f1
mov rax, r15
mov rdx, r10
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x14004c972
call rax
jmp 0x14004c982
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
jmp 0x14004c94f
movzx ebx, word [r9 + 4]
call rax
mov word [rbp - 0x70], bx
test bx, bx
jne 0x14004c9c4
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004c9bb
cmp al, 6
jne 0x14004c9b4
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004c9b4
sub ecx, 1
je 0x14004c9ad
cmp ecx, 1
jne 0x14004c9bb
lea ebx, [rcx + 0x17]
jmp 0x14004c9c0
mov ebx, 0x17
jmp 0x14004c9c0
mov ebx, 0x16
jmp 0x14004c9c0
mov ebx, 0x19
mov word [rbp - 0x70], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14004cace
lea rcx, [rbp + 0x49]
lea rax, [rbp - 0x70]
cmp rcx, rax
jbe 0x14004ca00
lea rcx, [rbp + 0x49]
lea rax, [rbp - 0x6e]
nop word [rax + rax]
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
mov byte [rbp + 0x49], bl
cmp rdi, rcx
jbe 0x14004ca20
lea rcx, [rbp + 0x53]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x6c]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rdi + 2], al
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
lea edx, [r9 + 0x1b]
mov qword [rsp + 0x20], r15
call rdi
lea rbx, [rbp + 0x48]
mov esi, eax
sub rbx, rdi
mov r11d, 0xb
mov r9, rdi
nop word [rax + rax]
movzx r10d, byte [rbx + r9]
movzx r8d, byte [r9]
lea ecx, [r10 - 0x61]
cmp ecx, 0x19
lea edx, [r10 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r10d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14004caa6
inc r9
sub r11, 1
jne 0x14004ca70
jmp 0x14004caaf
cmp r8d, r10d
jne 0x14004dcf8
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x14004cace
cmp dword [rbp - 0x6c], r15d
je 0x14004dcf8
xor eax, eax
mov qword [rbp - 0x50], r15
lea rdi, [rbp + 0x70]
mov dword [rbp + 0x58], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x5c], 0xd18b4c00
rep stosb byte [rdi], al
lea rax, [rbp + 0x70]
mov word [rbp + 0x60], 0x50f
mov byte [rbp + 0x62], 0xc3
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
cmp word [rbp + 0x70], r15w
je 0x14004cb2a
nop word [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004cb20
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rax + rcx]
test r13w, r13w
jne 0x14004cb40
mov word [rax], r15w
lea rax, [rbp + 0x70]
cmp word [rbp + 0x70], r15w
je 0x14004cb6c
add rax, 2
cmp word [rax], r15w
jne 0x14004cb62
lea rcx, [0x140061ec0]
mov edx, 0x6e
sub rcx, rax
nop dword [rax + rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x14004cb80
mov word [rax], r15w
lea rcx, [rbp + 0x70]
mov eax, r15d
cmp word [rbp + 0x70], r15w
je 0x14004cbae
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004cba2
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rbp - 0x30], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x70]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004cc38
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004cc2a
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004cc34
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004cc10
jmp 0x14004cc38
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
mov r13d, 0x5a4d
test r9, r9
je 0x14004cce2
cmp word [r9], r13w
jne 0x14004cce2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004cce2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004cce2
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004cce2
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004ccd6
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004cccc
sub rax, rsi
nop dword [rax + rax]
test dl, dl
je 0x14004ccc7
cmp byte [rcx], r15b
je 0x14004cccc
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004ccb0
jmp 0x14004cccc
cmp byte [rcx], r15b
je 0x14004cd25
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004cd25
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004cc96
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004cd3a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004cd1b
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004cd36
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004cd01
jmp 0x14004cd3a
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004cce5
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004cdd8
cmp word [r9], r13w
jne 0x14004cdd8
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004cdd8
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004cdd8
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004cdd8
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004cdcc
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004cdc2
sub rcx, rsi
test al, al
je 0x14004cdbd
cmp byte [rdx], r15b
je 0x14004cdc2
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004cda6
jmp 0x14004cdc2
cmp byte [rdx], r15b
je 0x14004ce18
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004ce18
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004cd92
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004ce2d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004ce0e
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004ce29
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004cdf4
jmp 0x14004ce2d
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14004cddb
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
test r9, r9
je 0x14004cf5e
cmp word [r9], r13w
jne 0x14004cf5e
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004cf5e
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004cf5e
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x14004cf61
lea rsi, str.NtClose
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004ced6
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004cecc
sub rax, rsi
nop dword [rax]
test dl, dl
je 0x14004cec7
cmp byte [rcx], r15b
je 0x14004cecc
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004ceb0
jmp 0x14004cecc
cmp byte [rcx], r15b
je 0x14004cee4
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004cee4
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004ce94
jmp 0x14004cf61
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004cf61
test r14, r14
je 0x14004cf61
test r12, r12
je 0x14004cf61
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp - 0x68]
call r12
test eax, eax
js 0x14004cf61
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x40]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x14004cf61
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14004cf61
call rdi
jmp 0x14004cf61
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004cfa8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004cf9a
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004cfa4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004cf80
jmp 0x14004cfa8
lea r14, [rdi - 0x10]
mov r9, qword [rsp + 0x70]
test r9, r9
je 0x14004d142
mov r11, qword [r14 + 0x30]
test r11, r11
je 0x14004d142
cmp word [r9], r13w
jne 0x14004d05f
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004d05f
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004d05f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x14004d05f
lea r14, str.NtQueryInformationProcess
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x14004d053
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x14004d045
sub rcx, r14
test al, al
je 0x14004d03c
cmp byte [rdx], 0
je 0x14004d045
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004d025
jmp 0x14004d045
cmp byte [rdx], 0
je 0x14004d0de
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004d0de
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004d011
mov r10, r15
cmp word [r11], r13w
jne 0x14004d10c
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x14004d10c
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x14004d10c
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rsi, r11
mov ebx, dword [rax + 0x14]
add r14, r11
test ebx, ebx
je 0x14004d10c
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r11
je 0x14004d100
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004d0f6
sub rcx, r12
test al, al
je 0x14004d0f1
cmp byte [rdx], 0
je 0x14004d0f6
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004d0c7
jmp 0x14004d0f6
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r10d, dword [rsi + rcx*4]
add r10, r9
jmp 0x14004d062
cmp byte [rdx], 0
je 0x14004d122
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004d122
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x14004d0b3
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r10, r10
jne 0x14004d132
call rax
jmp 0x14004d142
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x14004d10f
movzx ebx, word [r10 + 4]
call rax
mov word [rbp - 0x70], bx
test bx, bx
jne 0x14004d18d
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004d181
cmp al, 6
jne 0x14004d17a
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004d17a
sub ecx, 1
je 0x14004d173
cmp ecx, 1
jne 0x14004d181
mov ebx, 0x18
mov word [rbp - 0x70], bx
jmp 0x14004d18d
mov eax, 0x17
jmp 0x14004d186
mov eax, 0x16
jmp 0x14004d186
mov eax, 0x19
movzx ebx, ax
mov word [rbp - 0x70], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14004d291
lea rcx, [rbp + 0x59]
lea rax, [rbp - 0x70]
cmp rcx, rax
jbe 0x14004d1d0
lea rcx, [rbp + 0x59]
lea rax, [rbp - 0x6e]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x6f]
lea rcx, [rbp + 0x58]
mov byte [rbp + 0x5a], al
mov byte [rbp + 0x59], bl
cmp rdi, rcx
jbe 0x14004d1f0
lea rcx, [rbp + 0x63]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x50]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 8
mov byte [rdi + 2], al
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
lea edx, [r9 + 0x16]
mov qword [rsp + 0x20], r15
call rdi
lea r11, [rbp + 0x58]
mov ebx, eax
sub r11, rdi
mov r9, rdi
nop
movzx r8d, byte [r9]
movzx r10d, byte [r11 + r9]
lea ecx, [r8 - 0x61]
cmp ecx, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x14004d268
inc r9
sub qword [rsp + 0x60], 1
jne 0x14004d230
jmp 0x14004d271
cmp r8d, r10d
jne 0x14004dcf8
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x14004d291
cmp qword [rbp - 0x50], 0
jne 0x14004dcf8
call fcn.1400471c0
test al, al
jne 0x14004dcf8
call fcn.1400486c0
test al, al
jne 0x14004dcf8
mov dword [rbp - 0x70], r15d
xor edx, edx
mov rax, qword gs:[0x60]
xor r13b, r13b
mov r14d, edx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004d2fa
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004d2ea
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004d2f4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004d2d0
jmp 0x14004d2f8
lea r14, [rdi - 0x10]
xor edx, edx
mov r9, qword [r14 + 0x30]
lea r12, str.NtQuerySystemInformation
test r9, r9
je 0x14004d52e
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004d52e
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004d52e
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004d52e
mov edi, dword [rax + 0x20]
mov r8d, edx
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004d52e
mov eax, dword [rdi]
mov rcx, r12
add rax, r9
je 0x14004d39e
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004d394
sub rax, r12
test dl, dl
je 0x14004d38f
cmp byte [rcx], r13b
je 0x14004d394
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004d378
jmp 0x14004d394
cmp byte [rcx], r13b
je 0x14004d3af
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004d3af
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004d363
jmp 0x14004d52e
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004d52e
mov ebx, 0x16
lea r9, [rbp - 0x70]
mov ecx, ebx
xor r8d, r8d
xor edx, edx
call rdi
cmp eax, 0xc0000004
jne 0x14004d424
nop dword [rax]
test r15, r15
je 0x14004d3f6
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x70]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x70]
lea r9, [rbp - 0x70]
mov rdx, rax
mov ecx, ebx
mov r15, rax
call rdi
cmp eax, 0xc0000004
je 0x14004d3e0
test eax, eax
jns 0x14004d447
test r15, r15
je 0x14004d52e
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004d52e
mov eax, dword [r15]
lea r11, [r15 + 8]
test eax, eax
je 0x14004d514
mov r12d, eax
lea rax, str.Hyhd
mov r8, rax
test r11, r11
je 0x14004d4ff
mov r14, r11
sub r14, rax
nop dword [rax]
nop word [rax + rax]
movsx r9d, byte [r8]
movsx r10d, byte [r14 + r8]
mov edi, r9d
mov edx, r10d
lea esi, [r9 - 0x41]
cmp esi, 0x19
lea ecx, [r9 + 0x20]
lea ebx, [r10 - 0x41]
cmova ecx, r9d
lea eax, [r10 + 0x20]
cmp ebx, 0x19
cmova eax, r10d
cmp eax, ecx
jne 0x14004d4c5
test r10b, r10b
je 0x14004d4c0
test r9b, r9b
je 0x14004d4c5
inc r8
jmp 0x14004d480
test r9b, r9b
je 0x14004d4d9
cmp ebx, 0x19
ja 0x14004d4cd
add edx, 0x20
cmp esi, 0x19
ja 0x14004d4d5
add edi, 0x20
cmp edx, edi
jne 0x14004d4f8
cmp dword [r11 + 4], 0
jne 0x14004d4e7
cmp dword [r11 + 0x18], 0
je 0x14004d4f8
cmp qword [r11 + 0x20], 0xa
ja 0x14004d4f5
cmp qword [r11 + 0x10], 0xa
jbe 0x14004d4f8
mov r13b, 1
lea rax, str.Hyhd
add r11, 0x28
sub r12, 1
jne 0x14004d460
lea r12, str.NtQuerySystemInformation
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13b, r13b
jne 0x14004dcf5
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004d578
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004d56a
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004d574
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004d550
jmp 0x14004d578
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
mov rax, r9
test r8, r8
je 0x14004d5c9
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x14004d5c4
mov rdi, r8
mov ecx, 0x46
sub rdi, r9
test cx, cx
je 0x14004d5be
cmp word [rax], r15w
je 0x14004d5c4
movzx edx, word [rdi + rax + 2]
add rax, 2
movzx ecx, dx
cmp dx, word [rax]
je 0x14004d5a0
jmp 0x14004d5c4
cmp word [rax], r15w
je 0x14004d5cf
cmp cx, word [rax]
je 0x14004d5cf
add r8, 2
jmp 0x14004d583
mov rdi, r15
mov r9d, r15d
add r8, 0x24
je 0x14004d628
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x14004d5ed
mov r9d, 1
jmp 0x14004d5f3
cmp ax, 0x2b
jne 0x14004d600
add r8, 2
nop word [rax + rax]
movzx edx, word [r8]
mov rcx, rdi
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14004d61e
lea rdi, [rdi + rdi*4]
lea rdi, [rdi - 0x18]
lea rdi, [rdx + rdi*2]
jmp 0x14004d5f3
neg rdi
test r9d, r9d
cmove rdi, rcx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x14004d7c0
cmp dl, 6
jne 0x14004d677
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004d677
sub ecx, 1
je 0x14004d677
cmp ecx, 1
je 0x14004d677
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004d66f
sub ecx, 1
je 0x14004d66f
cmp ecx, 1
jne 0x14004d7c0
mov ecx, r15d
jmp 0x14004d7c7
mov dword [rbp + 0x70], 0x114
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rbx, qword [r14]
cmp rbx, r14
je 0x14004d6bf
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x14004d6b1
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004d6bb
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x14004d697
jmp 0x14004d6bf
lea r15, [rbx - 0x10]
mov r9, qword [r15 + 0x30]
mov r13d, 0x5a4d
test r9, r9
je 0x14004d86b
cmp word [r9], r13w
jne 0x14004d86b
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004d86b
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004d86b
mov r8d, dword [rax + 0x20]
xor r15d, r15d
mov ebx, dword [rax + 0x24]
add r8, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
mov r10d, r15d
test r11d, r11d
je 0x14004d820
lea r14, str.RtlGetVersion
nop dword [rax]
mov ecx, dword [r8]
mov rdx, r14
add rcx, r9
je 0x14004d76b
movzx eax, byte [rcx]
cmp al, 0x52
jne 0x14004d761
sub rcx, r14
test al, al
je 0x14004d75c
cmp byte [rdx], r15b
je 0x14004d761
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x14004d745
jmp 0x14004d761
cmp byte [rdx], r15b
je 0x14004d77c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004d77c
inc r10d
add r8, 4
cmp r10d, r11d
jb 0x14004d730
jmp 0x14004d820
movsxd rax, r10d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r9
je 0x14004d820
lea rcx, [rbp + 0x70]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0x7c]
cmp ecx, dword [rax + 0x120]
jne 0x14004dcf8
mov eax, ecx
sub rax, rdi
cmp rax, 0x7d0
ja 0x14004dcf8
jmp 0x14004d820
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
jne 0x14004dcf8
cmp dl, 0xa
je 0x14004d802
cmp dl, 6
jne 0x14004d7fd
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004d7fd
sub ecx, 1
je 0x14004d7fd
cmp ecx, 1
jne 0x14004d802
mov eax, r15d
jmp 0x14004d809
mov eax, dword [0x7ffe0260]
cdqe
sub rax, rdi
cmp rax, 0x7d0
ja 0x14004dcf8
mov r13d, 0x5a4d
mov qword [rbp - 0x68], r15
mov r14, r15
mov dword [rbp - 0x68], 8
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004d874
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004d861
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004d870
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004d847
jmp 0x14004d874
xor r15d, r15d
jmp 0x14004d820
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004d947
cmp word [r9], r13w
jne 0x14004d947
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004d947
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004d947
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004d947
nop dword [rax]
mov eax, dword [rdi]
mov rcx, r12
add rax, r9
je 0x14004d90b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004d901
sub rax, r12
test dl, dl
je 0x14004d8fc
cmp byte [rcx], 0
je 0x14004d901
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004d8e5
jmp 0x14004d901
cmp byte [rcx], 0
je 0x14004d919
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004d919
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004d8d0
jmp 0x14004d947
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x14004d947
xor r9d, r9d
lea rdx, [rbp - 0x68]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call rax
mov eax, dword [rbp - 0x64]
shr eax, 1
test al, 1
jne 0x14004dcf8
mov r12d, 1
mov dword [rbp - 0x6c], 0x104
lea rax, [rbp - 0x80]
mov dword [rbp - 0x70], r12d
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004da5b
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x70]
lea rax, [rbp + 0x280]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004da48
lea r11, [rbp + 0x280]
cmp byte [rbp + 0x280], sil
je 0x14004da48
lea rbx, str.TESTSIGNING
mov r10, rbx
lea rax, [rbp + 0x280]
sub r10, rax
nop
test r11, r11
je 0x14004da48
mov rdi, r11
mov al, 0x54
nop word [rax + rax]
movsx edx, byte [rdi]
mov r9, rdi
movsx ecx, al
inc rdi
lea eax, [rcx - 0x41]
cmp eax, 0x19
lea r8d, [rcx + 0x20]
lea eax, [rdx - 0x41]
cmova r8d, ecx
cmp eax, 0x19
ja 0x14004da15
add edx, 0x20
cmp edx, r8d
jne 0x14004dd9b
movzx eax, byte [r9 + r10 + 1]
test al, al
jne 0x14004d9f0
mov eax, r15d
nop dword [rax + rax]
inc eax
lea rbx, [rbx + 1]
cmp byte [rbx], sil
jne 0x14004da30
cdqe
cmp rdi, rax
movzx esi, sil
cmovne esi, r12d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
jne 0x14004dcf8
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BCD00000000Objects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004dd68
mov edx, 0x4096
mov dword [rbp + 0x10], 0x104
xor ecx, ecx
mov dword [rbp - 0x60], r15d
lea r9d, [rax + 4]
mov r8d, 0x1000
xor sil, sil
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x78]
lea r8, [rbp + 0x10]
mov r15, rax
mov dword [rbp - 0x5c], 0x4096
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x490]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x1c]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp - 0x60]
test eax, eax
je 0x14004dcd4
xor ecx, ecx
mov r14d, ecx
test eax, eax
je 0x14004dcd4
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp + 0x30]
mov dword [rbp + 0x14], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x14]
mov qword [rsp + 0x30], rcx
lea r8, [rbp + 0x390]
mov qword [rsp + 0x28], rcx
mov edx, r14d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x14004dcc2
mov edx, 0x4096
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4096
mov rdx, rbx
rep stosb byte [rdi], al
test rbx, rbx
je 0x14004dc50
cmp byte [rbx], al
je 0x14004dbbd
inc rdx
cmp byte [rdx], al
jne 0x14004dbb6
lea rcx, str.BCD00000000Objects_
mov al, 0x42
sub rcx, rdx
nop dword [rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
movzx eax, byte [rcx + rdx]
test al, al
jne 0x14004dbd0
mov byte [rdx], al
mov rax, rbx
cmp byte [rbx], 0
je 0x14004dbf0
inc rax
cmp byte [rax], 0
jne 0x14004dbe8
movzx ecx, byte [rbp + 0x390]
test cl, cl
je 0x14004dc1d
lea rdx, [rbp + 0x390]
sub rdx, rax
nop word [rax + rax]
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x14004dc10
mov byte [rax], 0
mov rax, rbx
cmp byte [rbx], 0
je 0x14004dc30
inc rax
cmp byte [rax], 0
jne 0x14004dc28
lea rdx, str.Elements16000049
mov cl, 0x5c
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
lea rax, [rax + 1]
movzx ecx, byte [rax + rdx]
test cl, cl
jne 0x14004dc40
mov byte [rax], cl
lea rax, [rbp - 0x78]
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004dcb1
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
lea rdx, str.Element
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14004dca7
cmp dword [r15], r12d
movzx esi, sil
cmove esi, r12d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14d
mov ecx, 0
cmp r14d, dword [rbp - 0x60]
jb 0x14004db40
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x14004dd68
xor r15d, r15d
lea rcx, str.C:Your_cheat_name
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004dd11
shr eax, 4
test al, 1
jne 0x14004dd68
xor r8d, r8d
mov byte [rbp - 0x70], 0
lea r9, [rbp - 0x70]
mov dword [rbp - 0x5c], r15d
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rcx, str.Crashing...
call fcn.140046610
lea rax, [rbp - 0x5c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000055
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
lea rcx, str.Crash_failed_
call fcn.140046610
mov r12, qword [rsp + 0x6e0]
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.140057e20
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
inc r11
dec r10
cmp byte [r11], sil
jne 0x14004d9e0
jmp 0x14004da48