Function at 0x140082b46
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
movups xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x58], rcx
mov eax, dword [0x140098b8c]
mov ecx, dword [0x140097cc4]
mov edx, dword [0x140097cc8]
shrd edx, ecx, 0xe
xor edx, eax
xor edx, 0x9b64b1db
imul edx, eax
mov eax, dword [str.sDL:Gd]
mov ecx, dword [0x140097cd0]
shrd ecx, eax, 0x16
xor ecx, 0x3111ccb1
and ecx, edx
mov eax, dword [0x140097cd4]
mov edx, dword [0x140097cd8]
shrd edx, eax, 0x14
imul eax, dword [0x140097cdc], 0x3bf761d0
imul r8d, dword [0x140097ce0], 0xd87e93ea
imul r9d, dword [str._i], 0x2841b506
imul r10d, dword [0x140097ce8], 0x7390be36
xor edx, 0x709dc50
mov r11d, dword [0x140097cec]
mov esi, dword [0x140097cf0]
shrd esi, r11d, 0x1b
xor esi, 0xfd96b8b7
cmp ecx, edx
mov ecx, r8d
lea eax, [rax + rcx - 0x1a0dc196]
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx - 0x2c2cdf3c]
cmove esi, ecx
cmp dword [0x140098b90], eax
cmovl esi, ecx
mov dword [rbp - 0x4c], esi
xorps xmm6, xmm6
mov r14d, 0x34c370a0
mov r10d, r14d
mov esi, r15d
mov ebx, r11d
mov r15, r9
mov r14, r8
mov r12, rdx
mov r11, rcx
cmp r10d, 0x1d34bcbd
jg 0x140082dff
cmp r10d, 0xde4f9f4e
jg 0x140083206
cmp r10d, 0x97e1bf21
jle 0x1400833dd
cmp r10d, 0xaf623093
jg 0x14008370a
cmp r10d, 0x97e1bf22
je 0x140083b87
mov byte [rbp - 0x30], dil
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov rsi, r14
mov r14d, r10d
cmp r10d, 0x9f8bbef9
jne 0x140082c26
mov rax, qword [r12]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [r12]
imul edx, dword [0x140097e70], 0x6b7f46a1
imul r8d, dword [0x140097e74], 0xeb5c9b3d
mov rcx, qword [rax + 0x28]
mov eax, r8d
add edx, eax
add edx, 0xdc9af12a
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
movzx ecx, byte [0x140097e78]
movzx edx, byte [0x140097e79]
mov r8d, ecx
shl ecx, 4
sub r8d, ecx
mov ecx, r8d
imul edx, edx, 0x4b
add dl, r8b
add dl, 0x2d
cmp al, dl
setne r15b
mov eax, dword [0x140098b8c]
imul ecx, dword [0x140097e7c], 0xbc86a6ac
imul edx, dword [0x140097e80], 0xf00d6c7
add ecx, edx
add ecx, 0x132c157
xor ecx, eax
imul edx, dword [0x140097e84], 0x5e2490f2
imul r8d, dword [0x140097e88], 0xd371c7af
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0xe589c7d3
and eax, ecx
imul ecx, dword [0x140097e8c], 0xf1802f3
imul edx, dword [0x140097e90], 0x6fe64d45
mov r8d, dword [0x140097e9c]
mov r9d, dword [0x140097ea0]
shrd r9d, r8d, 0x12
mov r8d, dword [0x140097ea4]
mov r14d, dword [0x140097ea8]
shrd r14d, r8d, 0x1f
imul r8d, dword [0x140097e94], 0x4e999658
add ecx, edx
add ecx, 0x7db28c04
imul edx, dword [0x140097e98], 0x6a7820b6
xor r9d, 0x2fda87e5
xor r14d, 0x2480ccdf
cmp eax, ecx
mov eax, edx
mov ecx, r8d
lea eax, [rcx + rax - 0x34877842]
cmove r14d, r9d
cmp dword [0x140098b90], eax
cmovl r14d, r9d
mov dil, byte [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, rsi
mov r9, qword [rbp - 0x28]
mov r11d, ebx
jmp 0x140082c26
cmp r10d, 0x35e938e1
jg 0x140083333
cmp r10d, 0x2c044a75
jle 0x140083573
cmp r10d, 0x33e7feef
jg 0x140083955
cmp r10d, 0x2c044a76
je 0x140083f31
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, r10d
cmp r10d, 0x313c7f0c
jne 0x140082c26
mov dword [rbp - 0x40], r13d
imul eax, dword [0x140097cf4], 0x8a97b326
imul ecx, dword [0x140097cf8], 0xb9eda8ef
add eax, ecx
add eax, 0x42428f57
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r14, rsp
mov qword [rbp - 0x20], r14
mov eax, dword [0x140097cfc]
mov ecx, dword [0x140097d00]
shrd ecx, eax, 6
xor ecx, 0xc2cee92a
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdi, rsp
mov qword [rbp - 0x28], rdi
imul eax, dword [0x140097d04], 0x784c66a7
imul ecx, dword [0x140097d08], 0x1c59afc3
add eax, ecx
add eax, 0x693abe85
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
mov qword [rbp - 0x38], rdx
mov eax, dword [0x140097d0c]
mov ecx, dword [0x140097d10]
shrd ecx, eax, 0xe
xor ecx, 0xf4da8f33
mov eax, ecx
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x48], rsp
imul eax, dword [0x140097d14], 0x45e6610d
imul ecx, dword [0x140097d18], 0x79751601
add eax, ecx
add eax, 0x5b72f52a
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor r9d, r9d
imul eax, dword [0x140097d1c], 0x9aef6075
mov qword [rdx], r9
imul edx, dword [0x140097d20], 0xce83aaea
add eax, edx
add eax, 0x46e9035a
mov dword [r8], eax
mov eax, dword [0x140097d24]
mov edx, dword [0x140097d28]
shrd edx, eax, 9
mov qword [r8 + 8], r9
mov eax, edx
xor eax, 0xf651dc0e
mov byte [rbp - 0x11], bl
mov r10d, dword [0x140097d2c]
mov edx, dword [0x140097d30]
shrd edx, r10d, 0x19
imul r10d, dword [0x140097d34], 0x3932677d
imul r11d, dword [0x140097d38], 0xf90fe6f
mov dword [r8 + 0x18], eax
mov eax, r11d
mov r11d, dword [0x140097d3c]
mov r12d, dword [0x140097d40]
shrd r12d, r11d, 0x11
imul r11d, dword [0x140097d44], 0x7ff9d30c
imul r15d, dword [0x140097d48], 0x4b2d2fd3
add r10d, eax
add r10d, 0xed37fc23
mov eax, r15d
add r11d, eax
add r11d, 0x5e01fc03
imul eax, dword [0x140097d4c], 0x7f7d2ee7
imul r15d, dword [0x140097d50], 0x2a7cf6f7
imul ecx, dword [0x140097d54], 0x2704f1d2
lea r13d, [rax + r15]
add r13d, 0x5ed3635d
imul eax, dword [0x140097d58], 0xbbef586e
add eax, ecx
add eax, 0x9eaab5f8
mov ecx, dword [0x140097d5c]
mov r15d, dword [0x140097d60]
shrd r15d, ecx, 8
mov ecx, dword [0x140097d64]
mov byte [rbp - 0x30], sil
mov esi, dword [0x140097d68]
shrd esi, ecx, 0xb
mov rbx, r8
mov qword [rdi], r9
mov rcx, qword [rbp - 0x58]
mov qword [r8 + 0x10], rcx
movups xmmword [r8 + 0x20], xmm6
xor edx, 0xdac1e44d
xor r12d, 0x2799bea1
xor r15d, 0x56414466
xor esi, 0x2b6d866b
sub rsp, 0x80
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], r9
mov rcx, rdi
mov r9, qword [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov dword [r14], eax
imul ecx, dword [0x140097d6c], 0x35e87af
imul edx, dword [0x140097d70], 0x7cfc4964
add ecx, edx
add ecx, 0xa72768d3
cmp eax, ecx
setg al
mov ecx, dword [0x140098b8c]
imul edx, dword [0x140097d74], 0xb7ab2615
imul r8d, dword [0x140097d78], 0xd951149d
add edx, r8d
add edx, 0x2a24e042
xor edx, ecx
imul r8d, dword [0x140097d7c], 0xff14f858
imul r9d, dword [0x140097d80], 0x887eefe4
imul edx, ecx
mov ecx, r9d
add ecx, r8d
add ecx, 0x384f1951
and ecx, edx
imul edx, dword [0x140097d84], 0x8a9657ad
imul r8d, dword [0x140097d88], 0xf0892786
imul r9d, dword [0x140097d8c], 0xed4451c8
imul r10d, dword [0x140097d90], 0x69ce798d
imul r11d, dword [0x140097d94], 0xc4e6efa3
imul esi, dword [0x140097d98], 0x1f29851f
imul edi, dword [0x140097d9c], 0x40fa2637
imul r14d, dword [0x140097da0], 0x1d52797b
add edx, r8d
add edx, 0x1ddf9e49
cmp ecx, edx
mov ecx, r10d
mov edx, r9d
lea ecx, [rdx + rcx + 0x3db225d0]
mov edx, esi
mov r8d, r11d
lea edx, [r8 + rdx - 0x4e3d1a4e]
mov r8d, r14d
mov r9d, edi
lea r14d, [r9 + r8 + 0x910a644]
cmove r14d, edx
cmp dword [0x140098b90], ecx
cmovl r14d, edx
mov edi, eax
mov rcx, rbx
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
mov r9, qword [rbp - 0x20]
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x30]
mov r13d, dword [rbp - 0x40]
jmp 0x140082c26
cmp r10d, 0x5bf41a6
jle 0x140083501
cmp r10d, 0xcc6d430
jg 0x1400837ab
cmp r10d, 0x5bf41a7
mov qword [rbp - 0x20], r11
je 0x140083ba4
mov byte [rbp - 0x30], dil
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov qword [rbp - 0x38], r14
mov r14d, r10d
cmp r10d, 0x60b5496
jne 0x140082c26
mov rcx, qword [r12]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x140098b8c]
imul ecx, dword [0x140097f4c], 0x273ba6e2
imul edx, dword [0x140097f50], 0x78e0bd5e
add ecx, edx
add ecx, 0x607109d5
xor ecx, eax
imul edx, dword [0x140097f54], 0x30e47e35
imul r8d, dword [0x140097f58], 0x56fad771
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x2a91b58a
and eax, ecx
mov ecx, dword [0x140097f5c]
mov edx, dword [0x140097f60]
shrd edx, ecx, 0x1c
imul ecx, dword [0x140097f64], 0xe2bf3e15
imul r8d, dword [0x140097f68], 0x6d56d6ae
xor edx, 0x30458c0f
mov r9d, dword [0x140097f6c]
mov r10d, dword [0x140097f70]
shrd r10d, r9d, 6
xor r10d, 0xfdf0e722
imul r9d, dword [0x140097f74], 0xd4b0d2b4
imul r11d, dword [0x140097f78], 0xc954fe8a
cmp eax, edx
mov eax, r8d
lea eax, [rcx + rax + 0x6ffb6123]
mov ecx, r11d
mov edx, r9d
lea r14d, [rdx + rcx + 0x5a17aadf]
jmp 0x1400834ee
cmp r10d, 0x7333bd5b
jg 0x140083683
cmp r10d, 0x632bc528
jg 0x1400839b8
cmp r10d, 0x35e938e2
je 0x140084362
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x40], r12
mov r12, r14
mov r14d, r10d
cmp r10d, 0x3c52648e
jne 0x140082c26
mov esi, r13d
mov rcx, qword [r12]
mov al, byte [0x1400980c4]
mov dl, byte [0x1400980c5]
shr dl, 7
add al, al
or al, dl
mov edx, eax
xor dl, 0x24
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x40]
mov r8, r12
mov r9, qword [rbp - 0x28]
mov r11d, ebx
mov r15b, byte [rbp - 0x30]
mov r14d, 0x2c044a76
jmp 0x140082c26
cmp r10d, 0x878c3a3a
je 0x1400841a0
cmp r10d, 0x90c5cb62
je 0x140083a7a
mov byte [rbp - 0x30], dil
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov qword [rbp - 0x38], r14
mov r14d, r10d
cmp r10d, 0x95de9277
jne 0x140082c26
mov eax, r13d
mov eax, dword [0x140098b8c]
imul ecx, dword [0x140097e40], 0xce3d9b8
imul edx, dword [0x140097e44], 0x565186dc
add ecx, edx
add ecx, 0x52d5ac67
xor ecx, eax
imul edx, dword [0x140097e48], 0xe07af470
imul r8d, dword [0x140097e4c], 0x8aeab977
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x4141d129
and eax, ecx
imul ecx, dword [0x140097e50], 0x91b9e67f
imul edx, dword [0x140097e54], 0xe55e2ea2
imul r8d, dword [0x140097e58], 0xfa227cfe
imul r9d, dword [0x140097e5c], 0x94967677
add ecx, edx
add ecx, 0x327c7567
mov edx, dword [0x140097e60]
mov r10d, dword [0x140097e64]
shrd r10d, edx, 0x1e
xor r10d, 0xd318267e
imul edx, dword [0x140097e68], 0xb74b9bb4
imul r11d, dword [0x140097e6c], 0x413e2eaf
cmp eax, ecx
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax - 0x7a32d0c2]
mov ecx, r11d
lea r14d, [rdx + rcx - 0x488dff5a]
cmove r14d, r10d
cmp dword [0x140098b90], eax
cmovl r14d, r10d
jmp 0x14008367a
cmp r10d, 0xde4f9f4f
je 0x140084298
cmp r10d, 0xe353599f
je 0x140083b48
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x38], r14
mov r14d, r10d
cmp r10d, 0xe877a012
jne 0x140082c26
mov eax, edi
mov esi, r13d
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov r11d, ebx
mov r15b, byte [rbp - 0x30]
mov r14d, 0x90c5cb62
jmp 0x140082c26
cmp r10d, 0x1d34bcbe
je 0x14008439e
cmp r10d, 0x1e9c8c8a
je 0x140083f14
mov byte [rbp - 0x30], dil
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov qword [rbp - 0x38], r14
mov r14d, r10d
cmp r10d, 0x28c09a5d
jne 0x140082c26
mov eax, r13d
mov eax, dword [0x140098b8c]
imul ecx, dword [0x140097fe0], 0x2d604b32
imul edx, dword [0x140097fe4], 0xe1068c9d
add ecx, edx
add ecx, 0xf68c3cc5
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140097fe8]
mov edx, dword [0x140097fec]
shrd edx, eax, 0x15
xor edx, 0x9412b232
and edx, ecx
mov eax, dword [0x140097ff0]
mov ecx, dword [0x140097ff4]
shrd ecx, eax, 0xc
xor ecx, 0x75dbebf6
mov eax, dword [0x140097ff8]
mov r8d, dword [0x140097ffc]
shrd r8d, eax, 0x1e
mov eax, dword [0x140098000]
mov r9d, dword [str.vnUgtR]
shrd r9d, eax, 0x15
xor r8d, 0x1a02c702
imul eax, dword [0x140098008], 0xf01fc523
xor r9d, 0xd410fdca
imul r10d, dword [0x14009800c], 0xdda04e10
cmp edx, ecx
mov ecx, r10d
lea r14d, [rax + rcx - 0x458c16b0]
cmove r14d, r9d
cmp dword [0x140098b90], r8d
cmovl r14d, r9d
mov dil, byte [rbp - 0x30]
jmp 0x140084284
cmp r10d, 0x7333bd5c
je 0x1400843ec
cmp r10d, 0x7ac70cbf
mov qword [rbp - 0x20], r11
je 0x1400840ff
mov eax, ebx
mov byte [rbp - 0x11], bl
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov qword [rbp - 0x38], r14
mov r14d, r10d
cmp r10d, 0x7c9d567f
jne 0x140082c26
mov ebx, edi
mov eax, esi
mov esi, r13d
mov rcx, qword [r12]
sub rsp, 0x20
mov r15d, eax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov r11b, byte [rbp - 0x11]
mov r14d, 0x60b5496
jmp 0x140082c26
cmp r10d, 0xaf623094
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x38], r14
je 0x140083c79
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov byte [rbp - 0x11], bl
mov r14d, r10d
cmp r10d, 0xc82094cb
jne 0x140082c26
mov eax, edi
mov ebx, esi
mov esi, r13d
imul eax, dword [0x140097eac], 0x28b067c1
imul ecx, dword [0x140097eb0], 0xdc94973d
add eax, ecx
add eax, 0xd314d099
imul ecx, dword [0x140097eb4], 0x8664ed59
imul edx, dword [0x140097eb8], 0xd884f963
lea r14d, [rcx + rdx]
add r14d, 0x9fc5473b
test bl, 1
cmovne r14d, eax
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov r11b, byte [rbp - 0x11]
mov r15d, ebx
jmp 0x140082c26
cmp r10d, 0xcc6d431
je 0x140083ea6
mov byte [rbp - 0x30], dil
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov rbx, r14
mov r14d, r10d
cmp r10d, 0x18b3d4b5
jne 0x140082c26
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rcx, qword [rbx]
imul eax, dword [0x140097de4], 0xc92661bb
imul edx, dword [0x140097de8], 0x3edf6c3
add edx, eax
add edx, 0x530aa855
mov al, byte [0x140097dec]
mov r9b, byte [0x140097ded]
shr r9b, 7
add al, al
or al, r9b
mov r9d, eax
imul eax, dword [0x140097df0], 0x9e313cfc
imul r10d, dword [0x140097df4], 0xc7be62ff
xor r9b, 0x6e
add eax, r10d
add eax, 0x5d160eba
sub rsp, 0x40
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov r14, qword [rbp - 0x28]
mov dword [r14], eax
mov ecx, dword [0x140097df8]
mov edx, dword [0x140097dfc]
shrd edx, ecx, 0xe
xor edx, 0xa817f4f4
cmp eax, edx
setg r11b
mov eax, dword [0x140098b8c]
mov ecx, dword [0x140097e00]
mov edx, dword [0x140097e04]
shrd edx, ecx, 0xe
xor edx, eax
xor edx, 0x53d417dd
imul edx, eax
mov eax, dword [0x140097e08]
mov ecx, dword [0x140097e0c]
shrd ecx, eax, 0x10
xor ecx, 0xed4c4ee9
and ecx, edx
imul eax, dword [0x140097e10], 0x7b9e4905
imul edx, dword [0x140097e14], 0xb20d7cd7
add eax, edx
add eax, 0x514b0822
mov edx, dword [0x140097e18]
mov r8d, dword [0x140097e1c]
shrd r8d, edx, 0x1c
mov edx, dword [0x140097e20]
mov r9d, dword [0x140097e24]
shrd r9d, edx, 5
xor r8d, 0x5ec3dfad
xor r9d, 0x85e24e07
mov edx, dword [0x140097e28]
mov r10d, dword [0x140097e2c]
shrd r10d, edx, 0x1e
xor r10d, 0xa7290ad8
cmp ecx, eax
cmove r10d, r9d
cmp dword [0x140098b90], r8d
cmovl r10d, r9d
mov dil, byte [rbp - 0x30]
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, rbx
mov r9, r14
jmp 0x1400840f4
cmp r10d, 0x33e7fef0
je 0x140084023
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov qword [rbp - 0x20], r11
mov r11d, ebx
mov qword [rbp - 0x28], r15
mov r15d, esi
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x38], r14
mov r14d, r10d
cmp r10d, 0x34c370a0
jne 0x140082c26
mov eax, edi
mov esi, r13d
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov r11d, ebx
mov r15b, byte [rbp - 0x30]
mov r14d, dword [rbp - 0x4c]
jmp 0x140082c26
cmp r10d, 0x66c0e4c5
jne 0x140084409
mov eax, dword [0x140098b8c]
mov ecx, dword [0x140097f1c]
mov edx, dword [0x140097f20]
shrd edx, ecx, 0x1b
xor edx, eax
xor edx, 0xd407688f
imul edx, eax
mov eax, dword [0x140097f24]
mov ecx, dword [0x140097f28]
shrd ecx, eax, 0x11
xor ecx, 0x8cb9ec8c
and ecx, edx
mov eax, dword [0x140097f2c]
mov edx, dword [str.Ho_pCRJ4]
shrd edx, eax, 5
xor edx, 0x81e3793a
mov eax, dword [0x140097f34]
mov r8d, dword [0x140097f38]
shrd r8d, eax, 0x19
xor r8d, 0x2921b870
imul eax, dword [0x140097f3c], 0xadccde03
imul r9d, dword [0x140097f40], 0xe05a6410
imul r10d, dword [0x140097f44], 0xbea71c51
mov qword [rbp - 0x20], r11
imul r11d, dword [0x140097f48], 0xbd733700
cmp ecx, edx
mov ecx, r9d
lea eax, [rax + rcx - 0x38c44d85]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx - 0x742d84da]
jmp 0x140084348
mov eax, dword [0x140098b8c]
imul ecx, dword [0x140097f7c], 0x690a8a5a
imul edx, dword [0x140097f80], 0x656333cd
add ecx, edx
add ecx, 0x52828584
xor ecx, eax
imul edx, dword [0x140097f84], 0xea744265
imul r8d, dword [0x140097f88], 0xcec394a3
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0xc8721c22
and eax, ecx
imul ecx, dword [0x140097f8c], 0x7856d803
imul edx, dword [0x140097f90], 0x5cc3d458
mov r8d, dword [0x140097f9c]
mov r9d, dword [0x140097fa0]
shrd r9d, r8d, 0x14
mov r8d, dword [0x140097fa4]
mov r10d, dword [0x140097fa8]
shrd r10d, r8d, 0x17
imul r8d, dword [0x140097f94], 0xf1b8d63e
add ecx, edx
add ecx, 0xb02e1d7b
imul edx, dword [0x140097f98], 0xc5f8cd10
xor r9d, 0x50b5981f
xor r10d, 0xf3c5d6b2
cmp eax, ecx
mov eax, edx
mov ecx, r8d
lea eax, [rcx + rax + 0xceeeba2]
cmove r10d, r9d
cmp dword [0x140098b90], eax
cmovl r10d, r9d
jmp 0x1400840e5
mov eax, dword [0x140097e30]
mov ecx, dword [0x140097e34]
shrd ecx, eax, 7
xor ecx, 0xd4a510bd
imul eax, dword [0x140097e38], 0xea8016a9
imul edx, dword [0x140097e3c], 0xc1ea9d12
add eax, edx
add eax, 0x9379952c
test bl, 1
mov r8, r14
mov r14d, eax
jmp 0x1400843d4
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, 0x66c0e4c5
jmp 0x140082c26
sub rsp, 0x20
mov rcx, r11
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r15], eax
mov eax, dword [0x140098b8c]
imul ecx, dword [0x140097eec], 0xb0b86d9c
imul edx, dword [0x140097ef0], 0xe00f0e2f
add ecx, edx
add ecx, 0x74de5d15
xor ecx, eax
imul edx, dword [0x140097ef4], 0x642983dd
imul r8d, dword [0x140097ef8], 0x48cb6daa
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x307ac4ab
and eax, ecx
imul ecx, dword [0x140097efc], 0xf7c8eee4
imul edx, dword [0x140097f00], 0x4975f067
add ecx, edx
add ecx, 0xdfec315b
mov edx, dword [0x140097f04]
mov r8d, dword [0x140097f08]
shrd r8d, edx, 0x14
mov edx, dword [0x140097f0c]
mov r9d, dword [0x140097f10]
shrd r9d, edx, 0x1a
xor r8d, 0xd6f4666d
xor r9d, 0x87e8dde7
mov edx, dword [0x140097f14]
mov r10d, dword [0x140097f18]
shrd r10d, edx, 0xe
xor r10d, 0x86c705f5
cmp eax, ecx
cmove r10d, r9d
cmp dword [0x140098b90], r8d
jmp 0x140084016
mov eax, dword [0x140098040]
mov ecx, dword [0x140098044]
shrd ecx, eax, 0x11
xor ecx, 0xe1ed2a11
mov eax, ecx
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x48], rcx
imul eax, dword [0x140098048], 0x1dc12370
imul edx, dword [0x14009804c], 0x6bf7a9e6
add eax, edx
add eax, 0xc7dfe59b
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x30], rsp
imul eax, dword [0x140098050], 0x4672e274
imul edx, dword [0x140098054], 0x2e59528b
add eax, edx
add eax, 0x91fe4daf
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor r9d, r9d
mov qword [rcx], r9
mov eax, dword [0x140098058]
mov edx, dword [0x14009805c]
shrd edx, eax, 0x18
xor edx, 0xe4186049
mov dword [r8], edx
mov qword [r8 + 8], r9
mov eax, dword [0x140098060]
mov edx, dword [0x140098064]
shrd edx, eax, 0x17
xor edx, 0x207179f5
mov dword [r8 + 0x18], edx
mov rax, qword [rbp - 0x58]
mov qword [r8 + 0x10], rax
mov eax, dword [0x140098068]
mov edx, dword [0x14009806c]
shrd edx, eax, 0xd
movups xmmword [r8 + 0x20], xmm6
imul eax, dword [0x140098070], 0x8c2ca4db
xor edx, 0x3ba3f4d5
imul r10d, dword [0x140098074], 0x14b75e3c
add eax, r10d
add eax, 0xaa85f2ea
mov dword [rbp - 0x50], eax
mov r10d, dword [0x140098078]
mov r11d, dword [0x14009807c]
shrd r11d, r10d, 0x1d
mov r10d, r11d
imul r11d, dword [0x140098080], 0x528b49f6
imul r14d, dword [0x140098084], 0xb0a842fe
xor r10d, 0x7390bf0f
mov r15d, dword [0x140098088]
mov dword [rbp - 0x40], r13d
mov r13d, dword [0x14009808c]
shrd r13d, r15d, 6
add r11d, r14d
add r11d, 0x5dc71a31
xor r13d, 0xffc6495e
mov r14d, dword [0x140098090]
mov r15d, dword [0x140098094]
shrd r15d, r14d, 2
xor r15d, 0x9004718a
mov r14d, dword [0x140098098]
mov eax, dword [0x14009809c]
shrd eax, r14d, 0x1f
imul r14d, dword [0x1400980a0], 0x17cb2f7d
imul ecx, dword [0x1400980a4], 0x47f08dbd
xor eax, 0x54d8f491
add ecx, r14d
add ecx, 0x5ef92342
sub rsp, 0x80
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x60], r9
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], r10d
mov eax, dword [rbp - 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
mov rcx, qword [rbp - 0x48]
mov r9, qword [rbp - 0x30]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
mov r11d, ebx
mov r15d, esi
mov r13d, dword [rbp - 0x40]
mov r14d, 0x313c7f0c
jmp 0x140082c26
mov rax, qword [r12]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [r12]
imul edx, dword [0x1400980bc], 0x5fd23f2f
imul r8d, dword [0x1400980c0], 0xaf5c07
mov rcx, qword [rax + 0x28]
mov eax, r8d
add edx, eax
add edx, 0xf476445f
sub rsp, 0x20
mov dword [rbp - 0x40], r13d
mov r13, r11
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov rcx, r13
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r13d, dword [rbp - 0x40]
mov r14d, 0x9f8bbef9
jmp 0x140082c26
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, 0x28c09a5d
jmp 0x140082c26
mov rcx, qword [r14]
movzx eax, byte [0x140097fac]
movzx edx, byte [0x140097fad]
imul eax, eax, 0x47
imul edx, edx, 0xffffff8f
add dl, al
add dl, 0xfa
sub rsp, 0x20
mov qword [rbp - 0x20], r11
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, dword [0x140098b8c]
mov ecx, dword [0x140097fb0]
mov edx, dword [0x140097fb4]
shrd edx, ecx, 7
xor edx, eax
xor edx, 0x281a7784
imul ecx, dword [0x140097fb8], 0x8f910542
imul r8d, dword [0x140097fbc], 0x1df9545c
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x6d81a715
and eax, edx
mov ecx, dword [0x140097fc0]
mov edx, dword [0x140097fc4]
shrd edx, ecx, 5
imul ecx, dword [0x140097fc8], 0xba52172
mov r8d, dword [0x140097fd0]
mov r9d, dword [0x140097fd4]
shrd r9d, r8d, 0x17
mov r8d, dword [0x140097fd8]
mov r10d, dword [0x140097fdc]
shrd r10d, r8d, 9
xor edx, 0xc40f9698
imul r8d, dword [0x140097fcc], 0xd7d22465
xor r9d, 0x7a4f0b30
xor r10d, 0xde560f2a
cmp eax, edx
mov eax, r8d
lea eax, [rcx + rax + 0x19d71ec7]
cmove r10d, r9d
cmp dword [0x140098b90], eax
cmovl r10d, r9d
mov rcx, qword [rbp - 0x20]
jmp 0x1400840e8
mov eax, dword [0x140098010]
mov ecx, dword [0x140098014]
shrd ecx, eax, 0x1a
mov eax, dword [0x140098b8c]
xor ecx, eax
xor ecx, 0x51f18bd0
imul edx, dword [0x140098018], 0x2df7e807
imul ecx, eax
imul eax, dword [0x14009801c], 0x20a5bf43
add eax, edx
add eax, 0xb977b2c3
and eax, ecx
imul ecx, dword [0x140098020], 0xc72c8c21
imul edx, dword [0x140098024], 0xcfece8df
add ecx, edx
add ecx, 0xd33e34cf
mov edx, dword [0x140098028]
mov r8d, dword [0x14009802c]
shrd r8d, edx, 8
imul edx, dword [0x140098030], 0xce0b8597
mov r9d, dword [0x140098038]
mov r10d, dword [0x14009803c]
shrd r10d, r9d, 0x15
xor r8d, 0xedf6a166
imul r9d, dword [0x140098034], 0xa852a69c
xor r10d, 0xac1d96c1
cmp eax, ecx
mov eax, r9d
mov ecx, edx
lea eax, [rcx + rax - 0x187099b]
cmove r10d, eax
cmp dword [0x140098b90], r8d
cmovl r10d, eax
mov r13d, dword [r15]
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, r10d
jmp 0x140082c26
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov rcx, qword [r14]
imul eax, dword [0x1400980a8], 0x84fb5344
imul edx, dword [0x1400980ac], 0xa53448b
add edx, eax
add edx, 0x90aa0a82
movzx eax, byte [0x1400980b0]
movzx r9d, byte [0x1400980b1]
imul eax, eax, 0x5d
imul r9d, r9d, 0xffffffba
add r9b, al
add r9b, 7
mov eax, dword [0x1400980b4]
mov r10d, dword [0x1400980b8]
shrd r10d, eax, 0xe
xor r10d, 0x73a32833
sub rsp, 0x40
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [r15], eax
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, 0x18b3d4b5
jmp 0x140082c26
mov eax, dword [0x140098b8c]
mov ecx, dword [0x140097ebc]
mov edx, dword [0x140097ec0]
shrd edx, ecx, 0x1d
xor edx, eax
xor edx, 0xe0f69cf0
imul ecx, dword [0x140097ec4], 0xa105d002
imul r8d, dword [0x140097ec8], 0xb9e5ccdc
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xb43539e7
and eax, edx
imul ecx, dword [0x140097ecc], 0x75bc5add
imul edx, dword [0x140097ed0], 0x6dc9e6f4
imul r8d, dword [0x140097ed4], 0xa6270622
imul r9d, dword [0x140097ed8], 0x87406c69
imul r10d, dword [0x140097edc], 0x1aa83311
mov qword [rbp - 0x20], r11
imul r11d, dword [0x140097ee0], 0xeaa7d693
mov qword [rbp - 0x38], r14
imul r14d, dword [0x140097ee4], 0x393ae5fc
mov qword [rbp - 0x28], r15
imul r15d, dword [0x140097ee8], 0x14b81436
add ecx, edx
add ecx, 0xb3c80361
cmp eax, ecx
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax - 0x78b2bf10]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x23eb9c14]
mov edx, r15d
mov r8d, r14d
lea r14d, [r8 + rdx - 0x33634d68]
cmove r14d, ecx
cmp dword [0x140098b90], eax
cmovl r14d, ecx
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x28]
jmp 0x1400843e1
mov eax, dword [0x140098b8c]
mov ecx, dword [0x140097db4]
mov edx, dword [0x140097db8]
shrd edx, ecx, 8
xor edx, eax
xor edx, 0xd7393fda
imul edx, eax
mov eax, dword [0x140097dbc]
mov ecx, dword [0x140097dc0]
shrd ecx, eax, 0x12
xor ecx, 0x7d988ff6
and ecx, edx
mov eax, dword [0x140097dc4]
mov edx, dword [0x140097dc8]
shrd edx, eax, 7
xor edx, 0x12a30d94
mov eax, dword [0x140097dcc]
mov r8d, dword [0x140097dd0]
shrd r8d, eax, 0x16
xor r8d, 0x9468477a
imul eax, dword [0x140097dd4], 0xbb878e6b
imul r9d, dword [0x140097dd8], 0x636363e5
imul r10d, dword [0x140097ddc], 0xcee0b6ba
mov qword [rbp - 0x20], r11
imul r11d, dword [0x140097de0], 0x3e74d2c5
cmp ecx, edx
mov ecx, r9d
lea eax, [rax + rcx + 0x6305182b]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx - 0x4e47c732]
cmove ecx, eax
cmp dword [0x140098b90], r8d
mov r8, r14
mov r14d, ecx
cmovl r14d, eax
mov rcx, qword [rbp - 0x20]
jmp 0x1400843db
sub rsp, 0x20
mov rcx, r11
mov dword [rbp - 0x40], r13d
mov r13, r11
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [r15], eax
mov rcx, r13
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r13d, dword [rbp - 0x40]
mov r14d, 0x5bf41a7
jmp 0x140082c26
mov eax, dword [0x140097da4]
mov ecx, dword [0x140097da8]
shrd ecx, eax, 0x19
mov eax, dword [0x140097dac]
mov edx, dword [0x140097db0]
shrd edx, eax, 1
xor ecx, 0xf247ad79
xor edx, 0xfee65506
test dil, 1
mov r8, r14
mov r14d, edx
cmovne r14d, ecx
mov rcx, r11
mov rdx, r12
mov r9, r15
mov r11d, ebx
mov r15d, esi
jmp 0x140082c26
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, 0x33e7fef0
jmp 0x140082c26
mov rcx, r11
mov rdx, r12
mov r8, r14
mov r9, r15
mov r11d, ebx
mov r15d, esi
mov r14d, r10d
cmp r10d, 0x632bc529
jne 0x140082c26
mov eax, r13d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret