Function at 0x140090eb0
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x14012d228]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rdi, rdx
mov r15d, ecx
xor esi, esi
mov dword [rsp + 0x30], esi
mov rbx, qword [0x140133f18]
mov qword [rbp + 0xf0], rsi
lea rax, [0x140100238]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rsi
mov rax, qword [rbx]
cmp dword [rax], esi
je 0x140090f6b
mov qword [rbp + 0x260], rsi
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x260]
mov qword [rbp + 0xf0], rax
lea r8, [0x1400f51e8]
mov qword [rsp + 0x28], r8
lea rax, str._DLLPROTECT__::_DllProtectStart___
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.14009ce00
nop
lea rcx, [rbp + 0x50]
call fcn.140096200
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x30], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140090fa9
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.options:__d__proc_name:__s
lea rdx, [0x1401002c0]
xor ecx, ecx
call fcn.14009cf90
lea rax, str.bddllp_77C5D6EB_2669_4344_BA08_BAD4BF895666
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov dword [0x140133be0], r15d
mov ecx, r15d
and ecx, 0x30
mov dword [0x140133ff4], ecx
mov eax, r15d
shr eax, 1
and al, 1
mov byte [0x140133ff2], al
mov eax, r15d
shr eax, 3
and al, 1
mov byte [0x140133ffb], al
mov eax, r15d
shr eax, 2
and al, 1
mov byte [0x140133ff3], al
mov eax, r15d
shr eax, 6
and al, 1
mov byte [0x140133ff8], al
mov eax, r15d
shr eax, 7
and al, 1
mov byte [0x140133ff9], al
mov eax, r15d
shr eax, 8
and al, 1
mov byte [0x140133ffa], al
cmp ecx, 0x30
jne 0x140091108
lea rcx, [rbp + 0x50]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400910b6
mov dword [rbp + 0x270], esi
mov qword [rbp - 0x60], rsi
lea rax, [rbp + 0x270]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_activate_dllprotect_in_report_mode_and_block_mode_at_the_same_time
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x288], 0x49
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x50]
call fcn.1400b54c0
nop
mov ebx, 0x201
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
jmp 0x1400910ba
mov ebx, dword [rsp + 0x30]
test bl, 1
je 0x140091fcb
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140091fcb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400916db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009200a
jmp 0x1400916db
mov rcx, rdi
call fcn.1400a69f0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
mov r14, qword [0x14012e3f0]
lea rdi, [0x14012e3e0]
cmp qword [0x14012e3f8], 8
cmovae rdi, qword [0x14012e3e0]
cmp r14, 8
jae 0x14009114e
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x20], xmm0
mov ebx, 7
jmp 0x14009118a
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x20]
call fcn.140004520
mov qword [rbp + 0x20], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1400bac40
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], rbx
lea rcx, [rbp + 0x20]
call fcn.1400a6bd0
call fcn.1400a3e50
call fcn.1400a1170
test r15b, 0x50
je 0x14009151e
cmp qword [0x140134040], 0
je 0x14009151e
lea rdx, [0x1400fc0f8]
mov ecx, 0x18
call fcn.14005b130
mov rcx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14009143d
lea rax, vtable.EventsCbkDumper.0
mov qword [rcx], rax
mov rax, qword [0x140134040]
mov qword [rcx + 8], rax
mov rax, qword [0x140134048]
mov qword [rcx + 0x10], rax
mov qword [0x140134050], rcx
test rcx, rcx
je 0x140091444
lea rdx, [0x1400fc0f8]
mov ecx, 0xe8
call fcn.14005b130
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140091317
mov rbx, qword [0x140134050]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov ecx, 0x10
call fcn.14005af10
mov qword [rax + 8], rsi
mov qword [r14], rax
mov qword [rax], r14
lea rcx, [r14 + 0x28]
mov edx, 2
call fcn.14005c350
lea rcx, [r14 + 0x78]
call fcn.1400e6670
nop
lea r12, [r14 + 0xc0]
mov qword [rsp + 0x30], r12
mov qword [r12], r14
mov qword [r12 + 8], rbx
xor eax, eax
mov byte [r12 + 0x10], al
xorps xmm0, xmm0
movups xmmword [r12 + 0x18], xmm0
mov eax, 1
xchg byte [r12 + 0x10], al
mov ecx, 0x10
call fcn.14005af10
test rax, rax
je 0x1400912c3
mov qword [rax], r12
lea rcx, [0x1400906f0]
mov qword [rax + 8], rcx
jmp 0x1400912c6
mov rax, rsi
mov qword [rbp + 0x280], rax
mov edi, 0x800
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140086860]
xor edx, edx
xor ecx, ecx
call fcn.1400d4d60
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140092022
cmp dword [r12 + 0x20], 0
jne 0x14009201c
movaps xmm0, xmmword [rbp - 0x60]
movups xmmword [r12 + 0x18], xmm0
jmp 0x14009131e
mov r14, rsi
mov edi, dword [rsp + 0x30]
mov qword [0x140134058], r14
test r14, r14
jne 0x140091522
lea rcx, [rbp + 0x50]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], r14d
je 0x1400913be
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x70], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_queue
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x1c
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x290]
call fcn.1400b54c0
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0x10
cmovae r9, qword [rbp + 0x290]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
test dil, 4
je 0x14009141e
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x140091405
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091400
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092030
call fcn.14005a920
mov qword [rbp + 0x2a0], rsi
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
mov rcx, qword [0x140134050]
test rcx, rcx
je 0x140091fcb
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x140091fcb
mov qword [0x140134050], rsi
lea rcx, [rbp + 0x50]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400914cc
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_consumer
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400b54c0
nop
mov ebx, 0x402
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
jmp 0x1400914d0
mov ebx, dword [rsp + 0x30]
test bl, 2
je 0x140091fcb
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140091fcb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400916db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092010
jmp 0x1400916db
mov edi, dword [rsp + 0x30]
test r15b, 1
jne 0x140091533
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140133bd8], rax
test rax, rax
je 0x1400915f0
lea rdx, [0x1400fff40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140133dc8]
test rax, rax
cmovne rcx, rax
mov qword [0x140133dc8], rcx
lea rdx, [0x1400fffa0]
mov rcx, qword [0x140133bd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140133be8]
test rax, rax
cmovne rcx, rax
mov qword [0x140133be8], rcx
lea rdx, [0x140100060]
mov rcx, qword [0x140133bd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140133fb8]
test rax, rax
cmovne rcx, rax
mov qword [0x140133fb8], rcx
lea rdx, [0x140100000]
mov rcx, qword [0x140133bd8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140133f30]
test rax, rax
cmovne rcx, rax
mov qword [0x140133f30], rcx
lea rcx, [0x1400f2ad0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140133bb8], rax
test rax, rax
jne 0x1400916e5
lea rcx, [rbp + 0x50]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140091695
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_ntdll.dll_module_handle
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x22
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400b54c0
bts edi, 0xd
or edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
test dil, 8
je 0x140091fcb
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140091fcb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400916db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092036
call fcn.14005a920
jmp 0x140091fcb
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140133bb0], rax
test rax, rax
jne 0x1400917dc
lea rcx, [rbp + 0x50]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14009178d
mov dword [rbp + 0x270], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x270]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_NtCreateSection_proc_address
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x27
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400b54c0
bts edi, 0xe
or edi, 0x10
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
test dil, 0x10
je 0x140091fcb
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140091fcb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400916db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092016
jmp 0x1400916db
call fcn.1400b67e0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1400b6e60
lea rdx, [0x140096ae0]
lea rcx, [0x140133be8]
call fcn.1400b6050
test eax, eax
jne 0x140091862
lea rdx, [0x1400969d0]
lea rcx, [0x140133dc8]
call fcn.1400b6050
test eax, eax
jne 0x140091862
lea rdx, [0x1400966f0]
lea rcx, [0x140133f30]
call fcn.1400b6050
test eax, eax
jne 0x140091862
lea rdx, [0x140096840]
lea rcx, [0x140133fb8]
call fcn.1400b6050
test eax, eax
jne 0x140091862
lea rdx, [0x14009a460]
lea rcx, str.PB_b_
call fcn.1400b6050
test eax, eax
je 0x140091876
call fcn.1400b6690
mov ecx, 1
call fcn.14009c130
jmp 0x140091fcb
cmp byte [0x140133ff9], 0
je 0x140091987
lea rcx, [rbp + 0x1d0]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x14009191c
mov dword [rbp + 0x2b0], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, str.activating_NtCreateSection_Hook
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x110]
call fcn.1400b54c0
bts edi, 0xf
or edi, 0x20
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae r9, qword [rbp + 0x110]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
test dil, 0x20
je 0x140091966
and edi, 0xffffffdf
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140091966
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091961
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009203c
call fcn.14005a920
lea rdx, [0x140096d50]
lea rcx, [0x140133bb0]
call fcn.1400b6050
test eax, eax
je 0x140091987
call fcn.1400b6690
jmp 0x140091fcb
call fcn.1400b68c0
lea rdx, [0x14012e320]
lea rcx, [rbp + 0x170]
call fcn.1400068e0
nop
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 7
mov word [rbp - 0x20], si
mov r8d, 0xd
lea rdx, str.cryptbase.dll
lea rcx, [rbp - 0x20]
call fcn.140004260
or edi, 0x30000
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x170]
call fcn.1400107e0
mov rbx, rax
lea rcx, [rbp - 0x20]
call fcn.1400040a0
mov rdx, rbx
lea rcx, [rbp + 0x360]
call fcn.1400068e0
nop
lea rcx, [rbp + 0x170]
call fcn.1400040a0
lea rcx, [rbp + 0x360]
cmp qword [rbp + 0x378], 8
cmovae rcx, qword [rbp + 0x360]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140133bc0], rax
test rax, rax
jne 0x140091b2e
lea rcx, [rbp + 0x200]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140091ae4
mov dword [rbp + 0x2c0], esi
mov qword [rbp + 0x80], rsi
lea rax, [rbp + 0x2c0]
mov qword [rbp + 0x88], rax
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x2b0], xmm0
lea rax, str.cannot_load_cryptbase.dll
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], 0x19
lea r8, [rbp + 0x2b0]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xb0]
call fcn.1400b54c0
bts edi, 0x12
or edi, 0x40
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae r9, qword [rbp + 0xb0]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
test dil, 0x40
je 0x140091b2e
and edi, 0xffffffbf
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140091b2e
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092042
call fcn.14005a920
lea rdx, [0x14012e320]
lea rcx, [rbp + 0x50]
call fcn.1400068e0
nop
mov qword [rbp], rsi
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], 7
mov word [rbp], si
mov r8d, 0xb
lea rdx, str.profapi.dll
lea rcx, [rbp]
call fcn.140004260
or edi, 0x180000
lea rdx, [rbp]
lea rcx, [rbp + 0x50]
call fcn.1400107e0
mov rbx, rax
lea rcx, [rbp]
call fcn.1400040a0
mov rdx, rbx
lea rcx, [rbp + 0x340]
call fcn.1400068e0
nop
lea rcx, [rbp + 0x50]
call fcn.1400040a0
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rcx, qword [rbp + 0x340]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140133bc8], rax
test rax, rax
jne 0x140091cbf
lea rcx, [rbp + 0x230]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140091c75
mov dword [rbp + 0x310], esi
mov qword [rbp + 0xa0], rsi
lea rax, [rbp + 0x310]
mov qword [rbp + 0xa8], rax
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x2c0], xmm0
lea rax, str.cannot_load_profapi.dll
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0x17
lea r8, [rbp + 0x2c0]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xd0]
call fcn.1400b54c0
bts edi, 0x15
bts edi, 7
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae r9, qword [rbp + 0xd0]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
test dil, dil
jns 0x140091cbf
btr edi, 7
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x140091cbf
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091cba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092048
call fcn.14005a920
lea rdx, [0x14012e320]
lea rcx, [rbp - 0x50]
call fcn.1400068e0
nop
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov r8d, 0xc
lea rdx, str.wintrust.dll
lea rcx, [rsp + 0x50]
call fcn.140004260
or edi, 0xc00000
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.1400107e0
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.1400040a0
mov rdx, rbx
lea rcx, [rbp + 0x320]
call fcn.1400068e0
nop
lea rcx, [rbp - 0x50]
call fcn.1400040a0
lea rcx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rcx, qword [rbp + 0x320]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x140133bd0], rax
test rax, rax
jne 0x140091e6a
lea rcx, [rbp + 0x1a0]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140091e16
mov dword [rbp + 0x290], esi
mov qword [rbp + 0x260], rsi
lea rax, [rbp + 0x290]
mov qword [rbp + 0x268], rax
movaps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x310], xmm0
lea rax, str.cannot_load_wintrust.dll
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], 0x18
lea r8, [rbp + 0x310]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x140]
call fcn.1400b54c0
bts edi, 0x18
bts edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x140]
cmp qword [rbp + 0x158], 0x10
cmovae r9, qword [rbp + 0x140]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.14009cc70
nop
bt edi, 8
jae 0x140091fa4
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x140091fa4
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091e60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092004
call fcn.14005a920
jmp 0x140091fa4
mov qword [rbp + 0x260], rsi
lea rdi, [0x14012f050]
mov qword [rbp + 0x268], rdi
lea r8, [rbp + 0x260]
mov rdx, qword [0x140133bb8]
lea rcx, [rbp + 0x2f0]
call fcn.1400a04d0
nop
lea rcx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 8
cmovae rcx, qword [rbp + 0x2f0]
xor edx, edx
call fcn.14009a260
mov ebx, eax
lea rcx, [rbp + 0x1a0]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140091efe
lea r9, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 8
cmovae r9, qword [rbp + 0x2f0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x1401002c0]
xor ecx, ecx
call fcn.14009cf90
mov dword [rbp + 0x260], esi
mov qword [rbp + 0x268], rdi
lea r8, [rbp + 0x260]
xor edx, edx
lea rcx, [rbp + 0x2d0]
call fcn.1400a04d0
nop
lea rcx, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 8
cmovae rcx, qword [rbp + 0x2d0]
xor edx, edx
call fcn.14009a260
mov ebx, eax
lea rcx, [rbp + 0x140]
call fcn.140096200
mov rax, qword [rax]
cmp dword [rax], 0
je 0x140091f85
lea r9, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 8
cmovae r9, qword [rbp + 0x2d0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x1401002c0]
xor ecx, ecx
call fcn.14009cf90
mov esi, 1
lea rcx, [rbp + 0x2d0]
call fcn.1400040a0
nop
lea rcx, [rbp + 0x2f0]
call fcn.1400040a0
nop
lea rcx, [rbp + 0x320]
call fcn.1400040a0
nop
lea rcx, [rbp + 0x340]
call fcn.1400040a0
nop
lea rcx, [rbp + 0x360]
call fcn.1400040a0
nop
lea rcx, [rbp + 0xf0]
call fcn.14008f9f0
mov eax, esi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.14005aef0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
int3
call fcn.1400bf5d0
int3
call fcn.1400bf5d0
nop
call fcn.1400cca70
nop
mov dword [rbp - 0x58], esi
mov ecx, 6
call fcn.14005c6c0
nop
call fcn.1400bf5d0
int3
call fcn.1400bf5d0
int3
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
nop
call fcn.1400bf5d0
int3