Function at 0x14008353a
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x50], rcx
mov eax, dword [0x140099cf0]
imul ecx, dword [0x140098e2c], 0x4c6bc48e
imul edx, dword [0x140098e30], 0xe701b289
add ecx, edx
add ecx, 0x900d6268
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140098e34]
mov edx, dword [0x140098e38]
shrd edx, eax, 0xf
xor edx, 0xa30f4389
and edx, ecx
imul eax, dword [0x140098e3c], 0x62e2518b
imul ecx, dword [0x140098e40], 0xf6e567b
imul r8d, dword [0x140098e44], 0xcbe643f7
imul r9d, dword [0x140098e48], 0xa92023a3
imul r10d, dword [0x140098e4c], 0x2a12a842
imul r11d, dword [0x140098e50], 0x1fcf89eb
add eax, ecx
add eax, 0x7388b32f
mov ecx, dword [0x140098e54]
mov esi, dword [0x140098e58]
shrd esi, ecx, 0x1b
xor esi, 0xfa80173c
cmp edx, eax
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0x7f06005]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx - 0x50091215]
cmove esi, ecx
cmp dword [0x140099cf4], eax
cmovl esi, ecx
mov dword [rbp - 0x48], esi
xorps xmm6, xmm6
mov esi, 0x4c239524
mov r10d, esi
mov ebx, r15d
mov r15d, r11d
mov r13, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
cmp r10d, 0x17c925e6
jle 0x1400836da
cmp r10d, 0x44a39f91
jg 0x14008382c
cmp r10d, 0x1e092271
jle 0x1400839ab
cmp r10d, 0x28e47d73
jg 0x140083d11
mov byte [rbp - 0x20], bl
cmp r10d, 0x1e092272
je 0x140084694
mov r9, r13
mov qword [rbp - 0x38], r13
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov rbx, r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x11], r15b
mov r15b, byte [rbp - 0x20]
mov rax, rsi
mov esi, r10d
cmp r10d, 0x20c751fc
jne 0x140083626
mov r13d, edi
mov r14d, r12d
mov rcx, rbx
mov rdx, rax
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x20]
mov esi, 0xf0445d81
jmp 0x140083626
cmp r10d, 0xedbbf7ed
jle 0x1400838ea
cmp r10d, 0x14128f4
jle 0x140083b6b
cmp r10d, 0x94225f9
jg 0x140084027
cmp r10d, 0x14128f5
je 0x140084a36
mov eax, ebx
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x11], r15b
mov r15d, ebx
mov dword [rbp - 0x18], r12d
mov r14, rsi
mov esi, r10d
cmp r10d, 0x5c86a6a
jne 0x140083626
mov ebx, edi
mov r13d, eax
mov eax, dword [0x140099cf0]
mov ecx, dword [0x140099024]
mov edx, dword [0x140099028]
shrd edx, ecx, 0x1b
xor edx, eax
xor edx, 0xb1026558
imul ecx, dword [0x14009902c], 0x1a79edd2
imul r8d, dword [0x140099030], 0xbdda7ff7
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x2b35fcae
and eax, edx
imul ecx, dword [0x140099034], 0xb39817d1
imul edx, dword [0x140099038], 0xb9e2eb48
add ecx, edx
add ecx, 0x7abaa5d5
mov edx, dword [0x14009903c]
mov r8d, dword [0x140099040]
shrd r8d, edx, 0x1e
imul edx, dword [0x140099044], 0xee5ab980
mov r9d, dword [0x14009904c]
mov esi, dword [0x140099050]
shrd esi, r9d, 0xc
imul r9d, dword [0x140099048], 0xdddd9b49
xor r8d, 0xc69e168
xor esi, 0x97fd6358
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax + 0x228ae7f4]
cmove esi, eax
cmp dword [0x140099cf4], r8d
cmovl esi, eax
mov rcx, qword [rbp - 0x30]
mov rdx, r14
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15d, r13d
mov r12d, dword [rbp - 0x18]
jmp 0x140083626
cmp r10d, 0x6b13d992
jle 0x140083ad7
cmp r10d, 0x798c8dd8
jg 0x140083e4a
cmp r10d, 0x6b13d993
je 0x140084771
mov r9, r13
mov qword [rbp - 0x38], r13
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x11], r15b
mov r15d, ebx
mov eax, ebx
mov rbx, rsi
mov esi, r10d
cmp r10d, 0x6ea52f9b
jne 0x140083626
mov r13d, edi
mov r14d, r12d
mov r15d, eax
imul eax, dword [0x140098f0c], 0xf91e00e7
imul ecx, dword [0x140098f10], 0xdaf51ab7
add eax, ecx
add eax, 0xef4b9800
imul ecx, dword [0x140098f14], 0x3882a6a3
imul edx, dword [0x140098f18], 0xad066b95
lea esi, [rcx + rdx]
add esi, 0x991dd02f
test dil, 1
cmovne esi, eax
mov rcx, qword [rbp - 0x30]
mov rdx, rbx
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
jmp 0x140083626
cmp r10d, 0xc665b8d7
jle 0x140083c9c
cmp r10d, 0xc7a11a10
jle 0x140084411
mov byte [rbp - 0x20], bl
cmp r10d, 0xc7a11a11
je 0x140084d5e
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x38], r13
mov r13, r14
mov byte [rbp - 0x11], r15b
mov al, byte [rbp - 0x20]
mov r15d, eax
mov dword [rbp - 0x18], r12d
mov r14, rsi
mov esi, r10d
cmp r10d, 0xcbffa318
jne 0x140083626
mov ebx, edi
mov rcx, qword [r13]
mov r15d, eax
movzx eax, byte [0x14009922c]
movzx edx, byte [0x14009922d]
mov r8d, eax
lea r8d, [r8 + r8*2]
shl r8d, 3
sub r8d, eax
imul edx, edx, 0x2a
add dl, r8b
add dl, 0x2c
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov rcx, qword [rbp - 0x30]
mov rdx, r14
mov r8, r13
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r12d, dword [rbp - 0x18]
mov esi, 0x798c8dd9
jmp 0x140083626
cmp r10d, 0x17c925e7
je 0x140084b69
cmp r10d, 0x1908c664
je 0x14008465c
mov byte [rbp - 0x20], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x38], r13
mov r13, r14
mov byte [rbp - 0x11], r15b
mov r15d, ebx
mov r14d, ebx
mov rbx, rsi
mov esi, r10d
cmp r10d, 0x1af30588
jne 0x140083626
mov rcx, qword [rbx]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x140099cf0]
mov ecx, dword [0x1400990b4]
mov edx, dword [0x1400990b8]
shrd edx, ecx, 0x14
xor edx, eax
xor edx, 0x925d0aae
imul edx, eax
mov eax, dword [0x1400990bc]
mov ecx, dword [0x1400990c0]
shrd ecx, eax, 0xe
xor ecx, 0xd8f499b3
and ecx, edx
mov eax, dword [0x1400990c4]
mov edx, dword [0x1400990c8]
shrd edx, eax, 0x12
xor edx, 0xd454c4df
mov eax, dword [0x1400990cc]
mov r8d, dword [0x1400990d0]
shrd r8d, eax, 0xe
mov eax, dword [0x1400990d4]
mov r9d, dword [0x1400990d8]
shrd r9d, eax, 5
xor r8d, 0xf42e0340
xor r9d, 0x59bd6c61
mov eax, dword [0x1400990dc]
mov esi, dword [0x1400990e0]
shrd esi, eax, 0x1a
xor esi, 0x5c68421c
cmp ecx, edx
cmove esi, r9d
cmp dword [0x140099cf4], r8d
cmovl esi, r9d
mov dil, byte [rbp - 0x20]
mov rcx, qword [rbp - 0x30]
mov rdx, rbx
mov r8, r13
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15d, r14d
jmp 0x140083626
cmp r10d, 0x44a39f92
je 0x140084c9a
mov r9, r13
mov qword [rbp - 0x38], r13
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x11], r15b
mov r15d, ebx
mov rax, rsi
mov esi, dword [rbp - 0x48]
cmp r10d, 0x4c239524
je 0x140083626
mov r13d, edi
mov r14d, r12d
mov rcx, qword [rbp - 0x30]
mov rdx, rax
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15d, ebx
mov esi, r10d
cmp r10d, 0x4d0ec6de
jne 0x140083626
mov edi, r13d
mov rcx, qword [rbp - 0x30]
mov rdx, rax
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15d, ebx
mov r12d, r14d
mov esi, 0x44a39f92
jmp 0x140083626
cmp r10d, 0xedbbf7ee
je 0x140084e00
mov byte [rbp - 0x20], bl
cmp r10d, 0xf0445d81
je 0x140084959
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x11], r15b
mov r13b, byte [rbp - 0x20]
mov r15d, r13d
mov r14, rsi
mov esi, r10d
cmp r10d, 0xf594fb25
jne 0x140083626
mov ebx, edi
mov eax, r12d
mov eax, dword [0x140099cf0]
mov ecx, dword [0x1400990e4]
mov edx, dword [0x1400990e8]
shrd edx, ecx, 0x15
xor edx, eax
xor edx, 0x923f4c16
imul edx, eax
mov eax, dword [0x1400990ec]
mov ecx, dword [0x1400990f0]
shrd ecx, eax, 7
xor ecx, 0xca443b4a
and ecx, edx
mov eax, dword [0x1400990f4]
mov edx, dword [0x1400990f8]
shrd edx, eax, 1
imul eax, dword [0x1400990fc], 0xe0fc2307
imul r8d, dword [0x140099100], 0xe78433c8
xor edx, 0xd1e23262
mov r9d, dword [0x140099104]
mov r10d, dword [0x140099108]
shrd r10d, r9d, 0x19
xor r10d, 0xa1deb9b3
imul r9d, dword [0x14009910c], 0x96f4f20b
imul r11d, dword [0x140099110], 0x8540a460
cmp ecx, edx
mov ecx, r8d
lea eax, [rax + rcx - 0x317b77e0]
mov ecx, r11d
mov edx, r9d
lea esi, [rdx + rcx - 0x16003c2d]
cmove esi, r10d
cmp dword [0x140099cf4], eax
cmovl esi, r10d
mov rcx, qword [rbp - 0x30]
mov rdx, r14
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15d, r13d
jmp 0x140083626
cmp r10d, 0x8a4856a0
je 0x140084e57
cmp r10d, 0x9a63ddb6
je 0x140084b31
mov r9, r13
mov qword [rbp - 0x38], r13
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x11], r15b
mov r15d, ebx
mov rax, rsi
mov esi, r10d
cmp r10d, 0x9ca5cf33
jne 0x140083626
mov r13d, edi
mov r14d, r12d
mov rcx, qword [rbp - 0x30]
mov rdx, rax
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x38]
mov r11b, byte [rbp - 0x11]
mov r15d, ebx
mov esi, 0xf594fb25
jmp 0x140083626
cmp r10d, 0x28e47d74
je 0x14008482a
mov eax, ebx
mov byte [rbp - 0x20], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov rbx, r11
mov r11d, r15d
mov qword [rbp - 0x28], r14
mov byte [rbp - 0x11], r15b
mov r15d, eax
mov dword [rbp - 0x18], r12d
mov r14, rsi
mov esi, r10d
cmp r10d, 0x341c1828
jne 0x140083626
sub rsp, 0x20
mov rcx, rbx
mov r15d, eax
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r13], eax
mov eax, dword [0x140099cf0]
mov ecx, dword [0x140099054]
mov edx, dword [0x140099058]
shrd edx, ecx, 0xb
xor edx, eax
xor edx, 0xdb658a24
imul edx, eax
mov eax, dword [str.__a_u]
mov ecx, dword [0x140099060]
shrd ecx, eax, 0x16
xor ecx, 0x84fcb5a8
and ecx, edx
imul eax, dword [0x140099064], 0xe8fcb1ee
imul edx, dword [0x140099068], 0xd9ff8a21
mov r8d, dword [0x140099074]
mov r9d, dword [0x140099078]
shrd r9d, r8d, 0x13
mov r8d, dword [0x14009907c]
mov r10d, dword [0x140099080]
shrd r10d, r8d, 0x1e
imul r8d, dword [0x14009906c], 0x5069afdc
add eax, edx
add eax, 0x2a826d21
imul edx, dword [0x140099070], 0xda71bc05
xor r9d, 0xbadb7efa
xor r10d, 0x75e737b2
cmp ecx, eax
mov eax, edx
mov ecx, r8d
lea eax, [rcx + rax - 0x4066b100]
cmove r10d, r9d
cmp dword [0x140099cf4], eax
cmovl r10d, r9d
mov dil, byte [rbp - 0x20]
mov rcx, rbx
mov rdx, r14
mov r8, qword [rbp - 0x28]
mov r9, r13
mov r11b, byte [rbp - 0x11]
mov r12d, dword [rbp - 0x18]
mov esi, r10d
jmp 0x140083626
cmp r10d, 0x798c8dd9
mov qword [rbp - 0x30], r11
je 0x140084846
mov byte [rbp - 0x20], dil
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15d, ebx
mov qword [rbp - 0x28], rsi
mov esi, r10d
cmp r10d, 0x7f2704f3
jne 0x140083626
mov r10d, ebx
mov rbx, r13
mov r13, r14
mov dword [rbp - 0x18], r12d
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rcx, qword [r14]
mov eax, dword [0x140098f4c]
mov edx, dword [0x140098f50]
shrd edx, eax, 6
xor edx, 0xadb7298
movzx eax, byte [0x140098f54]
movzx r9d, byte [0x140098f55]
add eax, eax
lea eax, [rax + rax*4]
neg eax
imul r9d, r9d, 0xffffffac
add r9b, al
imul eax, dword [0x140098f58], 0xd2f9f070
mov r12d, r10d
imul r10d, dword [0x140098f5c], 0xbe81ae39
add r9b, 0xb6
add eax, r10d
add eax, 0x36c67b2d
sub rsp, 0x40
mov r14, rbx
mov rbx, qword [rbp - 0x28]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [r14], eax
imul ecx, dword [0x140098f60], 0x986ba496
imul edx, dword [0x140098f64], 0xb8432592
add ecx, edx
add ecx, 0x18a2dc5f
cmp eax, ecx
setg r11b
mov eax, dword [0x140099cf0]
imul ecx, dword [0x140098f68], 0x6aab7910
imul edx, dword [0x140098f6c], 0x898324f5
add ecx, edx
add ecx, 0xf4c95993
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140098f70]
mov edx, dword [0x140098f74]
shrd edx, eax, 0xa
xor edx, 0x2dd47a92
and edx, ecx
mov eax, dword [0x140098f78]
mov ecx, dword [0x140098f7c]
shrd ecx, eax, 7
imul eax, dword [0x140098f80], 0xf33da9e6
imul r8d, dword [0x140098f84], 0xbe013ded
imul r9d, dword [0x140098f88], 0xe399bdd8
imul r10d, dword [0x140098f8c], 0xf2eff61f
imul esi, dword [0x140098f90], 0xb8a04259
imul r15d, dword [0x140098f94], 0x8d3a33fb
xor ecx, 0xba087733
cmp edx, ecx
mov ecx, r8d
lea eax, [rax + rcx - 0x16332c2c]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx - 0x6bcaa818]
mov edx, r15d
mov r8d, esi
lea esi, [r8 + rdx + 0x6eedc3a8]
cmove esi, ecx
cmp dword [0x140099cf4], eax
cmovl esi, ecx
mov dil, byte [rbp - 0x20]
mov rcx, qword [rbp - 0x30]
mov rdx, rbx
mov r8, r13
mov r9, r14
mov r15d, r12d
mov r12d, dword [rbp - 0x18]
jmp 0x140083626
cmp r10d, 0x94225fa
je 0x140084af2
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r14d, r15d
mov r15d, ebx
mov esi, r10d
cmp r10d, 0x120cb000
jne 0x140083626
mov dword [rbp - 0x18], r12d
mov eax, dword [0x140098e5c]
mov ecx, dword [0x140098e60]
shrd ecx, eax, 0x10
xor ecx, 0x98309f89
mov eax, ecx
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], rax
imul eax, dword [0x140098e64], 0x3742b6bc
imul ecx, dword [0x140098e68], 0x7b207162
add eax, ecx
add eax, 0x53bd2461
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x38], rcx
mov eax, dword [0x140098e6c]
mov edx, dword [0x140098e70]
shrd edx, eax, 2
xor edx, 0xee20e90f
mov eax, edx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
imul eax, dword [0x140098e74], 0xd163b13b
mov qword [rbp - 0x28], rdx
imul r8d, dword [0x140098e78], 0xe4172cd0
add eax, r8d
add eax, 0xa19f702c
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
imul eax, dword [0x140098e7c], 0xa21b042e
imul r8d, dword [0x140098e80], 0x379be9b1
add eax, r8d
add eax, 0xd19e958b
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor eax, eax
mov byte [rbp - 0x20], bl
imul r10d, dword [0x140098e84], 0x81a1f272
mov qword [rdx], rax
imul edx, dword [0x140098e88], 0x8f778579
add edx, r10d
add edx, 0xb98edf8d
mov dword [r8], edx
mov qword [r8 + 8], rax
imul edx, dword [0x140098e8c], 0x66dda76b
imul r10d, dword [0x140098e90], 0xf55e98bd
add r10d, edx
add r10d, 0xe33e307f
mov r11d, dword [0x140098e94]
mov edx, dword [0x140098e98]
shrd edx, r11d, 0xc
imul r11d, dword [0x140098e9c], 0x7ab3e416
imul r15d, dword [0x140098ea0], 0xc2f03568
mov dword [r8 + 0x18], r10d
mov r10d, r15d
add r10d, r11d
add r10d, 0x7f2f34b8
imul r11d, dword [0x140098ea4], 0xebc10022
imul r15d, dword [0x140098ea8], 0xbaaee0b3
imul r12d, dword [0x140098eac], 0x313f6132
add r11d, r15d
add r11d, 0x2a382085
imul r15d, dword [0x140098eb0], 0x6fbd1bc3
add r12d, r15d
add r12d, 0xc27762e4
imul r15d, dword [0x140098eb4], 0xf9903f24
imul r13d, dword [0x140098eb8], 0xcc9aa504
add r13d, r15d
add r13d, 0x7e1667bc
mov r15d, dword [0x140098ebc]
mov esi, dword [0x140098ec0]
shrd esi, r15d, 0x17
imul r15d, dword [0x140098ec4], 0x815a47fe
imul edi, dword [0x140098ec8], 0xaea5dd5e
add edi, r15d
add edi, 0x5346bef6
mov r15d, dword [0x140098ecc]
mov ebx, dword [0x140098ed0]
shrd ebx, r15d, 0xc
mov r15, r8
mov qword [rcx], rax
mov byte [rbp - 0x11], r14b
mov r14, qword [rbp - 0x50]
mov qword [r8 + 0x10], r14
movups xmmword [r8 + 0x20], xmm6
xor edx, 0x7cc7922a
xor esi, 0xcaae7de3
xor ebx, 0xdd76d704
sub rsp, 0x80
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov rcx, qword [rbp - 0x40]
mov dword [rcx], eax
imul ecx, dword [0x140098ed4], 0xdb34cfa1
imul edx, dword [0x140098ed8], 0xfd35d17f
add ecx, edx
add ecx, 0xb180252c
cmp eax, ecx
setg al
mov ecx, dword [0x140099cf0]
imul edx, dword [0x140098edc], 0xa4676593
imul r8d, dword [0x140098ee0], 0xe72df0db
add edx, r8d
add edx, 0x7f1768cf
xor edx, ecx
imul edx, ecx
mov ecx, dword [0x140098ee4]
mov r8d, dword [0x140098ee8]
shrd r8d, ecx, 0x15
xor r8d, 0x6b8041dc
and r8d, edx
imul ecx, dword [0x140098eec], 0xc7ce3673
imul edx, dword [0x140098ef0], 0x462dc93e
imul r9d, dword [0x140098ef4], 0x2f264502
imul r10d, dword [0x140098ef8], 0xe471087d
imul r11d, dword [0x140098efc], 0x498801ed
imul esi, dword [0x140098f00], 0x440b5091
imul edi, dword [0x140098f04], 0x538b9894
imul ebx, dword [0x140098f08], 0xec1ace57
add ecx, edx
add ecx, 0xdca013f1
cmp r8d, ecx
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx - 0x5849b057]
mov edx, esi
mov r8d, r11d
lea edx, [r8 + rdx - 0x657464a9]
mov r8d, ebx
mov r9d, edi
lea esi, [r9 + r8 + 0x280c0cd5]
cmove esi, edx
cmp dword [0x140099cf4], ecx
cmovl esi, edx
mov edi, eax
mov rcx, r15
mov rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x20]
mov r12d, dword [rbp - 0x18]
jmp 0x140083626
cmp r10d, 0xc78d3476
jne 0x140084ebe
mov eax, dword [0x1400991a8]
mov ecx, dword [0x1400991ac]
shrd ecx, eax, 8
xor ecx, 0x1088581f
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x40], rcx
mov eax, dword [0x1400991b0]
mov edx, dword [0x1400991b4]
shrd edx, eax, 0x1a
xor edx, 0xf618d555
mov eax, edx
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x20], rsp
imul eax, dword [0x1400991b8], 0xdb338893
imul edx, dword [0x1400991bc], 0x7c398fa1
add eax, edx
add eax, 0xa8a343b6
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor r9d, r9d
mov qword [rcx], r9
mov eax, dword [0x1400991c0]
mov edx, dword [0x1400991c4]
shrd edx, eax, 9
xor edx, 0xd4edf21e
mov dword [r8], edx
mov qword [r8 + 8], r9
mov eax, dword [0x1400991c8]
mov edx, dword [0x1400991cc]
shrd edx, eax, 7
xor edx, 0xe9956754
mov dword [r8 + 0x18], edx
mov rax, qword [rbp - 0x50]
mov qword [r8 + 0x10], rax
movups xmmword [r8 + 0x20], xmm6
imul eax, dword [0x1400991d0], 0x3d37dd71
imul edx, dword [0x1400991d4], 0xfe4a69cd
imul r10d, dword [0x1400991d8], 0xa6eebc4a
add eax, edx
add eax, 0xef74fde7
mov dword [rbp - 0x44], eax
imul eax, dword [0x1400991dc], 0x586e7a7c
lea edx, [r10 + rax]
add edx, 0x534f2902
mov r10d, dword [0x1400991e0]
mov qword [rbp - 0x30], r11
mov r11d, dword [0x1400991e4]
shrd r11d, r10d, 0x16
mov r10d, r11d
imul r11d, dword [0x1400991e8], 0x5e6df9d4
mov qword [rbp - 0x28], rsi
imul esi, dword [0x1400991ec], 0xa942165d
xor r10d, 0x3d54122e
mov byte [rbp - 0x11], r15b
mov r15d, dword [0x1400991f0]
mov dword [rbp - 0x18], r12d
mov r12d, dword [0x1400991f4]
shrd r12d, r15d, 0x1a
add r11d, esi
add r11d, 0xf2475c80
imul esi, dword [0x1400991f8], 0xca37bc0c
xor r12d, 0xe355d6a9
imul r15d, dword [0x1400991fc], 0x5bc46dcb
add esi, r15d
add esi, 0x353084d7
mov r15d, dword [0x140099200]
mov eax, dword [0x140099204]
shrd eax, r15d, 0x18
imul r15d, dword [0x140099208], 0x305fc4e9
imul ecx, dword [0x14009920c], 0xb0aac43d
xor eax, 0xc6e3dd69
add ecx, r15d
add ecx, 0xf8ea53bc
sub rsp, 0x80
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
mov rcx, qword [rbp - 0x40]
mov edx, dword [rbp - 0x44]
mov r9, qword [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov r8, r14
mov r9, r13
mov r11b, byte [rbp - 0x11]
mov r15d, ebx
mov r12d, dword [rbp - 0x18]
mov esi, 0x120cb000
jmp 0x140083626
sub rsp, 0x20
mov rcx, r11
mov byte [rbp - 0x20], bl
mov rbx, r11
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r13], eax
mov rcx, rbx
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15b, byte [rbp - 0x20]
mov esi, 0x341c1828
jmp 0x140083626
mov eax, dword [0x140099cf0]
mov ecx, dword [0x140098fa8]
mov edx, dword [0x140098fac]
shrd edx, ecx, 0x15
xor edx, eax
xor edx, 0xb1db8dd0
imul ecx, dword [0x140098fb0], 0xcd6ddf06
imul r8d, dword [0x140098fb4], 0xe7c01619
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xdbd37db9
and eax, edx
mov ecx, dword [0x140098fb8]
mov edx, dword [0x140098fbc]
shrd edx, ecx, 0x12
imul ecx, dword [0x140098fc0], 0xf21c9dd8
imul r8d, dword [0x140098fc4], 0x3adeaec5
imul r9d, dword [0x140098fc8], 0xd927a6e7
imul r10d, dword [0x140098fcc], 0x700fd9f2
mov rbx, r11
imul r11d, dword [0x140098fd0], 0xca28c519
mov qword [rbp - 0x28], rsi
imul esi, dword [0x140098fd4], 0xc7b0d8f8
xor edx, 0x17407393
cmp eax, edx
mov eax, r8d
lea eax, [rcx + rax + 0x3bf728a2]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx + 0x6c3d7979]
mov edx, esi
mov r8d, r11d
lea esi, [r8 + rdx + 0x5957175c]
cmove esi, ecx
cmp dword [0x140099cf4], eax
cmovl esi, ecx
mov rcx, rbx
mov rdx, qword [rbp - 0x28]
jmp 0x140084a24
mov eax, dword [0x140099cf0]
imul ecx, dword [0x140098f1c], 0xa4359cfc
imul edx, dword [0x140098f20], 0xfa3ec42e
add ecx, edx
add ecx, 0xe56963cb
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140098f24]
mov edx, dword [0x140098f28]
shrd edx, eax, 0x1d
xor edx, 0xf52a015d
and edx, ecx
mov eax, dword [0x140098f2c]
mov ecx, dword [0x140098f30]
shrd ecx, eax, 0xd
xor ecx, 0xb5804239
mov eax, dword [0x140098f34]
mov r8d, dword [0x140098f38]
shrd r8d, eax, 0x1e
mov eax, dword [0x140098f3c]
mov r9d, dword [0x140098f40]
shrd r9d, eax, 0xc
xor r8d, 0x15dfd61f
xor r9d, 0xdcc4b30b
mov eax, dword [0x140098f44]
mov r10d, dword [0x140098f48]
shrd r10d, eax, 0x1b
xor r10d, 0x3bb72aa1
cmp edx, ecx
cmove r10d, r9d
cmp dword [0x140099cf4], r8d
cmovl r10d, r9d
mov rcx, r11
jmp 0x140084942
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15d, ebx
mov esi, 0x14128f5
jmp 0x140083626
mov rcx, qword [r14]
mov al, byte [0x140099114]
mov dl, byte [0x140099115]
shr dl, 1
shl al, 7
or al, dl
mov edx, eax
xor dl, 0x9a
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, dword [0x140099cf0]
imul ecx, dword [0x140099118], 0x2e404867
imul edx, dword [0x14009911c], 0xa32805aa
add ecx, edx
add ecx, 0x3cfac8c
xor ecx, eax
imul edx, dword [0x140099120], 0x49f02373
imul r8d, dword [0x140099124], 0x6bda7cbc
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x5903fb04
and eax, ecx
imul ecx, dword [0x140099128], 0x8525a64d
imul edx, dword [0x14009912c], 0x5a4a08fa
imul r8d, dword [0x140099130], 0x724f23f8
imul r9d, dword [0x140099134], 0x2c9b3b86
add ecx, edx
add ecx, 0xab926677
mov edx, dword [0x140099140]
mov r10d, dword [0x140099144]
shrd r10d, edx, 0x1b
imul edx, dword [0x140099138], 0xe330965b
xor r10d, 0xf0277694
imul r11d, dword [0x14009913c], 0xc2cae70f
cmp eax, ecx
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax - 0xe1b15aa]
mov ecx, r11d
lea ecx, [rdx + rcx - 0x2e9939dc]
cmove r10d, ecx
cmp dword [0x140099cf4], eax
cmovl r10d, ecx
mov rcx, qword [rbp - 0x30]
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15d, ebx
mov esi, r10d
jmp 0x140083626
mov eax, dword [0x140099cf0]
mov ecx, dword [0x140099084]
mov edx, dword [0x140099088]
shrd edx, ecx, 0x1f
xor edx, eax
xor edx, 0x11d34e7a
imul edx, eax
mov eax, dword [0x14009908c]
mov ecx, dword [0x140099090]
shrd ecx, eax, 0x14
xor ecx, 0x69697821
and ecx, edx
imul eax, dword [0x140099094], 0x4f93f2f
imul edx, dword [0x140099098], 0x61d1bf5f
add eax, edx
add eax, 0x5cfda129
mov edx, dword [0x14009909c]
mov r8d, dword [0x1400990a0]
shrd r8d, edx, 3
xor r8d, 0x35194df7
imul edx, dword [0x1400990a4], 0x58c2e717
imul r9d, dword [0x1400990a8], 0x8bc7d444
imul r10d, dword [0x1400990ac], 0xe90ef9b4
mov rbx, r11
imul r11d, dword [0x1400990b0], 0xcea58c5
cmp ecx, eax
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax + 0x1283aff8]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x75cd0b4c]
cmove ecx, eax
cmp dword [0x140099cf4], r8d
mov rdx, rsi
mov esi, ecx
cmovl esi, eax
mov rcx, rbx
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15b, byte [rbp - 0x20]
jmp 0x140083626
mov r12d, dword [r13]
mov eax, dword [0x140099cf0]
mov ecx, dword [0x140099178]
mov edx, dword [0x14009917c]
shrd edx, ecx, 0x10
xor edx, eax
xor edx, 0xaa877553
imul ecx, dword [0x140099180], 0xf3874840
imul r8d, dword [0x140099184], 0x86f2af18
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x217afc91
and eax, edx
imul ecx, dword [0x140099188], 0x2d28b908
imul edx, dword [0x14009918c], 0xbbffbd29
add ecx, edx
add ecx, 0xf3ef8a68
mov edx, dword [0x140099190]
mov r8d, dword [0x140099194]
shrd r8d, edx, 8
mov edx, dword [0x140099198]
mov r9d, dword [0x14009919c]
shrd r9d, edx, 0xe
xor r8d, 0x1ee64931
imul edx, dword [0x1400991a0], 0xd92948dd
xor r9d, 0x3366ebec
imul r10d, dword [0x1400991a4], 0xccbdcd4b
cmp eax, ecx
mov eax, r10d
mov ecx, edx
lea eax, [rcx + rax - 0x17b2748d]
jmp 0x140084d45
imul eax, dword [0x140099014], 0xeb5243b7
imul ecx, dword [0x140099018], 0xfcf96598
add eax, ecx
add eax, 0x701d15bf
imul ecx, dword [0x14009901c], 0x58c194c2
imul edx, dword [0x140099020], 0xcb9c48e4
add ecx, edx
add ecx, 0xc895a0c5
test bl, 1
jmp 0x140084e3b
mov rcx, qword [rsi]
sub rsp, 0x20
mov dword [rbp - 0x18], r12d
mov r12, r11
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov rcx, r12
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15d, ebx
mov r12d, dword [rbp - 0x18]
mov esi, 0x1af30588
jmp 0x140083626
mov rax, qword [rsi]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsi]
imul edx, dword [0x140098fd8], 0x20d0380c
imul r8d, dword [0x140098fdc], 0x8659b5b8
mov rcx, qword [rax + 0x28]
mov eax, r8d
add edx, eax
add edx, 0x2656655c
sub rsp, 0x20
mov rbx, r11
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov cl, byte [0x140098fe0]
mov dl, byte [0x140098fe1]
shr dl, 2
shl cl, 6
or cl, dl
xor cl, 0x56
cmp al, cl
mov r11d, r15d
setne r15b
mov eax, dword [0x140099cf0]
imul ecx, dword [0x140098fe4], 0x15d59930
imul edx, dword [0x140098fe8], 0x31394632
add ecx, edx
add ecx, 0x12462209
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140098fec]
mov edx, dword [0x140098ff0]
shrd edx, eax, 0x1a
xor edx, 0x3df2ec3c
and edx, ecx
mov eax, dword [0x140098ff4]
mov ecx, dword [0x140098ff8]
shrd ecx, eax, 6
xor ecx, 0x9bf796ea
mov eax, dword [0x140098ffc]
mov r8d, dword [0x140099000]
shrd r8d, eax, 0x14
mov eax, dword [0x140099004]
mov r9d, dword [0x140099008]
shrd r9d, eax, 0x10
xor r8d, 0x46f43fb7
imul eax, dword [0x14009900c], 0x66228e60
xor r9d, 0xb001c121
imul r10d, dword [0x140099010], 0xcdd10bb9
cmp edx, ecx
mov ecx, r10d
lea eax, [rax + rcx - 0x34a614a6]
cmove eax, r9d
cmp dword [0x140099cf4], r8d
mov rdx, rsi
mov esi, eax
cmovl esi, r9d
mov rcx, rbx
mov r8, r14
mov r9, r13
jmp 0x140083626
mov eax, dword [0x140099cf0]
mov ecx, dword [0x140099148]
mov edx, dword [0x14009914c]
shrd edx, ecx, 0x19
xor edx, eax
xor edx, 0x23b4d53d
imul ecx, dword [0x140099150], 0x3ad70cc
imul r8d, dword [str.m_L_], 0x6092f9ac
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x2a6709f9
and eax, edx
mov ecx, dword [0x140099158]
mov edx, dword [0x14009915c]
shrd edx, ecx, 0x18
xor edx, 0x2af55d18
mov ecx, dword [0x140099160]
mov r8d, dword [0x140099164]
shrd r8d, ecx, 2
mov ecx, dword [0x140099168]
mov r9d, dword [0x14009916c]
shrd r9d, ecx, 0xb
xor r8d, 0x6de551d4
imul ecx, dword [0x140099170], 0x6422661f
xor r9d, 0x8054825a
imul r10d, dword [str.mZxU:], 0xd6eb27ad
cmp eax, edx
mov eax, r10d
lea eax, [rcx + rax + 0x3ae3cd91]
cmove eax, r9d
cmp dword [0x140099cf4], r8d
mov rdx, rsi
mov esi, eax
cmovl esi, r9d
jmp 0x140084e43
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov eax, dword [str.p__Ij]
mov edx, dword [0x140099214]
shrd edx, eax, 0x11
mov rcx, qword [r14]
xor edx, 0x1fa90a64
mov al, byte [0x140099218]
mov r9b, byte [0x140099219]
shr r9b, 3
shl al, 5
or al, r9b
mov r9d, eax
imul eax, dword [0x14009921c], 0x2b23661d
imul r10d, dword [str.7_O.e_], 0xe4158b3c
xor r9b, 0x91
add eax, r10d
add eax, 0x8a4f900b
sub rsp, 0x40
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
mov rbx, r11
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [r13], eax
mov rcx, rbx
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15b, byte [rbp - 0x20]
mov esi, 0x7f2704f3
jmp 0x140083626
imul eax, dword [0x140098f98], 0x7a875bff
imul ecx, dword [0x140098f9c], 0xe2667111
add eax, ecx
add eax, 0x2aeb7300
imul ecx, dword [0x140098fa0], 0x2583d694
imul edx, dword [0x140098fa4], 0xd223f6e9
add ecx, edx
add ecx, 0x32248eb7
test r15b, 1
mov rdx, rsi
mov esi, ecx
cmovne esi, eax
mov rcx, r11
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15d, ebx
jmp 0x140083626
mov rax, qword [rsi]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rsi]
imul edx, dword [0x140099224], 0x984dad69
imul r8d, dword [0x140099228], 0x4b474dae
mov rcx, qword [rax + 0x28]
mov eax, r8d
add edx, eax
add edx, 0x6078eb47
sub rsp, 0x20
mov byte [rbp - 0x20], bl
mov rbx, r11
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov rcx, rbx
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15b, byte [rbp - 0x20]
mov esi, 0x17c925e7
jmp 0x140083626
mov rcx, r11
mov rdx, rsi
mov r8, r14
mov r9, r13
mov r11d, r15d
mov r15d, ebx
mov esi, r10d
cmp r10d, 0xc665b8d8
jne 0x140083626
mov eax, r12d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret