Function at 0x140083577
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
movups xmmword [rbp - 0x10], xmm6
mov eax, dword [0x140099c3c]
imul edx, dword [0x140098d7c], 0x90a69514
imul r8d, dword [0x140098d80], 0xf23edb11
add edx, r8d
add edx, 0xecc86b46
xor edx, eax
imul r8d, dword [0x140098d84], 0x30a32450
imul edx, eax
imul eax, dword [0x140098d88], 0xde0a6a4e
add eax, r8d
add eax, 0x9c438f4f
and eax, edx
imul edx, dword [0x140098d8c], 0xb6fb8203
imul r8d, dword [0x140098d90], 0xc727d9bc
add edx, r8d
add edx, 0xe832a6ab
mov r8d, dword [0x140098d94]
mov r9d, dword [0x140098d98]
shrd r9d, r8d, 0x1e
xor r9d, 0xc72bc380
mov r8d, dword [0x140098d9c]
mov r10d, dword [0x140098da0]
shrd r10d, r8d, 0xa
imul r8d, dword [0x140098da4], 0x7eca3718
imul r11d, dword [0x140098da8], 0x915e13f9
xor r10d, 0xe16d46f4
cmp eax, edx
mov eax, r11d
mov edx, r8d
lea eax, [rdx + rax + 0x2db9321c]
cmove eax, r10d
mov qword [rbp - 0x58], rcx
cmp dword [0x140099c40], r9d
cmovl eax, r10d
mov dword [rbp - 0x4c], eax
xorps xmm6, xmm6
mov esi, 0x5b67a2e9
mov r10d, esi
mov r14d, r15d
mov r15d, r11d
mov rbx, r9
mov r13, r8
mov rdi, rdx
mov r11, qword [rbp - 0x28]
mov r8b, byte [rbp - 0x20]
cmp esi, 0xbb49358
jg 0x1400837d8
cmp r10d, 0xd4defc58
jg 0x140083906
cmp r10d, 0x9f35bf7f
jle 0x140083cc7
cmp r10d, 0xc501750e
jg 0x14008439d
cmp r10d, 0x9f35bf80
mov qword [rbp - 0x30], r11
je 0x14008486e
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov byte [rbp - 0x38], r8b
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov ecx, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x9fad31a4
jne 0x14008366d
mov eax, r12d
mov eax, dword [0x140099c3c]
mov esi, ecx
mov ecx, dword [0x140099098]
mov edx, dword [0x14009909c]
shrd edx, ecx, 0x1b
xor edx, eax
xor edx, 0x597e8f3d
imul edx, eax
mov eax, dword [0x1400990a0]
mov ecx, dword [0x1400990a4]
shrd ecx, eax, 0x18
xor ecx, 0xd7f6e17
and ecx, edx
mov eax, dword [str.YM_fG]
mov edx, dword [0x1400990ac]
shrd edx, eax, 0x1d
imul eax, dword [0x1400990b0], 0x6abc7a34
imul r8d, dword [0x1400990b4], 0x9261292f
xor edx, 0x31426ace
mov r9d, dword [0x1400990c0]
mov r10d, dword [0x1400990c4]
shrd r10d, r9d, 0x1e
imul r9d, dword [0x1400990b8], 0x52aa643
xor r10d, 0x53daa3af
imul r11d, dword [0x1400990bc], 0x5977dc16
cmp ecx, edx
mov ecx, r8d
lea eax, [rax + rcx - 0x74ad2910]
mov ecx, r11d
mov edx, r9d
lea ecx, [rdx + rcx + 0x504a985e]
cmove r10d, ecx
cmp dword [0x140099c40], eax
cmovl r10d, ecx
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, esi
jmp 0x1400849c6
cmp r10d, 0x5b67a2e8
jle 0x140083bc7
cmp r10d, 0x73ecd71b
jle 0x140084119
cmp r10d, 0x796fdf79
jg 0x1400844a2
cmp r10d, 0x73ecd71c
je 0x140084a60
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov byte [rbp - 0x38], r8b
mov r8, r13
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov ecx, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x77900919
jne 0x14008366d
mov eax, r12d
mov eax, dword [0x140099c3c]
mov r11d, ecx
imul ecx, dword [0x140098f74], 0x1c277ef2
imul edx, dword [0x140098f78], 0x5c2d33fb
add ecx, edx
add ecx, 0xacdb11f1
xor ecx, eax
imul edx, dword [0x140098f7c], 0x132bcd4c
imul r8d, dword [0x140098f80], 0x3ba3dc33
imul ecx, eax
mov eax, r8d
add eax, edx
add eax, 0x9fbf213a
and eax, ecx
mov ecx, dword [0x140098f84]
mov edx, dword [0x140098f88]
shrd edx, ecx, 0x12
xor edx, 0xecef6b09
mov ecx, dword [str.A__]
mov r8d, dword [0x140098f90]
shrd r8d, ecx, 0xc
imul ecx, dword [0x140098f94], 0xbf350cd1
mov r9d, dword [0x140098f9c]
mov esi, dword [0x140098fa0]
shrd esi, r9d, 0x18
imul r9d, dword [0x140098f98], 0x9ee181e8
xor r8d, 0xc4119663
xor esi, 0x86ba6539
cmp eax, edx
mov eax, r9d
lea eax, [rcx + rax + 0x30f53277]
cmove esi, eax
cmp dword [0x140099c40], r8d
cmovl esi, eax
jmp 0x14008438a
cmp r10d, 0xf0dcaa35
jle 0x140083d3b
cmp r10d, 0x7ea0b67
jg 0x140084404
cmp r10d, 0xf0dcaa36
mov qword [rbp - 0x30], r11
je 0x1400848a7
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov byte [rbp - 0x38], r8b
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov ecx, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x249ef00
jne 0x14008366d
mov dword [rbp - 0x40], r12d
imul eax, dword [0x1400990f8], 0xfbe0aa64
mov byte [rbp - 0x3c], r14b
mov byte [rbp - 0x11], cl
imul ecx, dword [0x1400990fc], 0x49e1c574
add eax, ecx
add eax, 0xe9b42161
lea rax, [rax*8 + 0xf]
movabs rcx, 0x7fffffff0
and rax, rcx
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r14, rbx
mov rbx, rsp
imul eax, dword [0x140099100], 0x4438e13f
imul edx, dword [0x140099104], 0x102444e5
add eax, edx
add eax, 0x789f9d6a
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x20], rsp
imul eax, dword [0x140099108], 0x8bc0f58b
imul edx, dword [0x14009910c], 0x14b322e9
add eax, edx
add eax, 0x7d628531
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
xor eax, eax
imul edx, dword [0x140099110], 0x476f575a
imul r10d, dword [0x140099114], 0xbd50f09e
mov qword [rbx], rax
add edx, r10d
add edx, 0xfcbbf5a0
mov dword [r8], edx
mov qword [r8 + 8], rax
imul edx, dword [0x140099118], 0x407f36d9
imul r10d, dword [0x14009911c], 0xa6ada510
add edx, r10d
add edx, 0x63e4ad62
mov dword [r8 + 0x18], edx
mov rcx, qword [rbp - 0x58]
mov qword [r8 + 0x10], rcx
mov edx, dword [0x140099120]
mov r10d, dword [0x140099124]
shrd r10d, edx, 0x1d
movups xmmword [r8 + 0x20], xmm6
mov edx, r10d
xor edx, 0xa8819565
mov r10d, dword [0x140099128]
mov r11d, dword [0x14009912c]
shrd r11d, r10d, 0xf
mov r10d, r11d
xor r10d, 0xf152f4d2
imul r11d, dword [0x140099130], 0xaecac629
imul esi, dword [0x140099134], 0x6d3f9459
imul r15d, dword [0x140099138], 0x4c7d172
imul r12d, dword [0x14009913c], 0xdde7dfe4
lea ecx, [r11 + rsi]
add ecx, 0xa7cb84c0
mov dword [rbp - 0x28], ecx
mov esi, r12d
mov r12d, dword [0x140099140]
mov r11d, dword [0x140099144]
shrd r11d, r12d, 3
add esi, r15d
add esi, 0xa44d9799
imul r15d, dword [0x140099148], 0x58846dcc
xor r11d, 0x533dbbfa
imul r12d, dword [0x14009914c], 0x5c730c1c
add r15d, r12d
add r15d, 0xdf2ccbd0
imul r12d, dword [0x140099150], 0xf6c82e29
imul r9d, dword [0x140099154], 0x6ab258ff
add r9d, r12d
add r9d, 0x6ba375a7
mov r12d, dword [0x140099158]
mov ecx, dword [0x14009915c]
shrd ecx, r12d, 0x1b
xor ecx, 0x265b8acb
sub rsp, 0x80
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x58], r9d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], esi
mov ecx, dword [rbp - 0x28]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov r9, qword [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, r14
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x3c]
mov r12d, dword [rbp - 0x40]
mov esi, 0xe0bd097f
jmp 0x14008366d
cmp r10d, 0x4895ddaa
jg 0x140084285
cmp r10d, 0x1c85ba02
jle 0x140084628
cmp r10d, 0x1c85ba03
mov byte [rbp - 0x38], r8b
je 0x140084d72
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov ecx, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x43d0c55d
jne 0x14008366d
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov r8, qword [rax]
mov eax, dword [0x140099160]
mov esi, ecx
mov edx, dword [0x140099164]
shrd edx, eax, 0x10
mov rcx, qword [r13]
xor edx, 0x8530f935
mov al, byte [0x140099168]
mov r9b, byte [0x140099169]
shr r9b, 4
shl al, 4
or al, r9b
mov r9d, eax
xor r9b, 0x66
mov eax, dword [0x14009916c]
mov r10d, dword [0x140099170]
shrd r10d, eax, 1
xor r10d, 0x64ee6f4e
sub rsp, 0x40
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x30], 0
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [rbx], eax
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, esi
mov r15d, r14d
mov esi, 0x87800e82
jmp 0x14008366d
cmp r10d, 0x87800e82
je 0x140084bcd
cmp r10d, 0x9412ab11
je 0x140084672
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov eax, r8d
mov r8, r13
mov r9, rbx
mov rcx, r11
mov r11d, r15d
mov byte [rbp - 0x11], r15b
mov r15d, r14d
mov byte [rbp - 0x3c], r14b
mov esi, r10d
cmp r10d, 0x96c8e191
jne 0x14008366d
mov r14d, r12d
mov byte [rbp - 0x20], al
mov qword [rbp - 0x28], rcx
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x3c]
mov esi, 0x9412ab11
jmp 0x14008366d
cmp r10d, 0xd4defc59
je 0x140084d51
cmp r10d, 0xd668a91a
mov byte [rbp - 0x11], r15b
je 0x140084743
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0xe0bd097f
jne 0x14008366d
mov dword [rbp - 0x40], r12d
imul eax, dword [0x140098dac], 0xd357caca
imul ecx, dword [0x140098db0], 0xd533ae98
add eax, ecx
add eax, 0xaa185b05
lea rax, [rax*4 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov byte [rbp - 0x3c], r14b
mov r14, rsp
imul eax, dword [0x140098db4], 0xc9272864
imul ecx, dword [0x140098db8], 0xe3c90af0
mov qword [rbp - 0x30], r14
add eax, ecx
add eax, 0x88a2c829
lea rax, [rax*8 + 0xf]
movabs rcx, 0x7fffffff0
and rax, rcx
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov qword [rbp - 0x38], r9
imul eax, dword [0x140098dbc], 0xdd306f66
imul edx, dword [0x140098dc0], 0xc9a71fa2
add eax, edx
add eax, 0x1f38d087
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, rsp
imul eax, dword [0x140098dc4], 0x9d78b1ae
mov qword [rbp - 0x48], rdx
imul r8d, dword [0x140098dc8], 0xeffa7873
add eax, r8d
add eax, 0x47e9f04
shl rax, 4
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov qword [rbp - 0x20], rsp
imul eax, dword [0x140098dcc], 0xa3221cbd
imul r8d, dword [0x140098dd0], 0x2e5ff01
add eax, r8d
add eax, 0xc5c80013
shl rax, 4
lea rax, [rax + rax*2]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r8, rsp
imul eax, dword [0x140098dd4], 0xcd93f8d9
xor ecx, ecx
mov qword [rdx], rcx
imul edx, dword [0x140098dd8], 0x50df227b
add eax, edx
add eax, 0xf4cc59e1
mov dword [r8], eax
mov eax, dword [0x140098ddc]
mov edx, dword [0x140098de0]
shrd edx, eax, 0x10
mov qword [r8 + 8], rcx
xor edx, 0xf0f04e62
mov dword [r8 + 0x18], edx
imul eax, dword [0x140098de4], 0xc6fc9518
imul edx, dword [0x140098de8], 0xdd61cf5b
add edx, eax
add edx, 0xc7f940d8
mov eax, dword [0x140098dec]
mov r10d, dword [0x140098df0]
shrd r10d, eax, 0x11
imul eax, dword [0x140098df4], 0x98271363
imul r11d, dword [0x140098df8], 0xc71cee62
imul r15d, dword [str.OgZN_a], 0xa0a02fff
add eax, r11d
add eax, 0xd0d64301
imul r11d, dword [0x140098e00], 0x20ac3add
mov r12d, dword [0x140098e04]
mov r13d, dword [0x140098e08]
shrd r13d, r12d, 0x11
mov r12d, dword [0x140098e0c]
mov esi, dword [0x140098e10]
shrd esi, r12d, 0x1a
mov r12d, dword [str.E4S]
mov edi, dword [0x140098e18]
shrd edi, r12d, 0xc
add r11d, r15d
add r11d, 0xf922d945
mov r15d, dword [0x140098e1c]
mov r12d, dword [0x140098e20]
shrd r12d, r15d, 0x11
mov r15, r8
mov qword [r9], rcx
mov rbx, qword [rbp - 0x58]
mov qword [r8 + 0x10], rbx
movups xmmword [r8 + 0x20], xmm6
xor r10d, 0xaedbfb34
xor r13d, 0x934c2cc0
xor esi, 0x33e1fe06
xor edi, 0x2c6aa95f
xor r12d, 0xc1c6e0f6
sub rsp, 0x80
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x68], r12d
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], rcx
mov rcx, r9
mov r9, qword [rbp - 0x20]
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
add rsp, 0x80
mov ecx, dword [0x140098e24]
mov edx, dword [0x140098e28]
shrd edx, ecx, 0x1b
mov dword [r14], eax
xor edx, 0x334237f3
cmp eax, edx
setg al
mov ecx, dword [0x140099c3c]
mov edx, dword [0x140098e2c]
mov r8d, dword [0x140098e30]
shrd r8d, edx, 0x18
xor r8d, ecx
xor r8d, 0xd5283f8e
imul edx, dword [0x140098e34], 0x7c1c6be9
imul r9d, dword [0x140098e38], 0x23f484ff
imul r8d, ecx
mov ecx, r9d
add ecx, edx
add ecx, 0x7f41afec
and ecx, r8d
mov edx, dword [0x140098e3c]
mov r8d, dword [0x140098e40]
shrd r8d, edx, 0x1b
imul edx, dword [0x140098e44], 0xaee6b75f
imul r9d, dword [0x140098e48], 0xa30cbf40
xor r8d, 0x6de6da7e
mov r10d, dword [0x140098e4c]
mov r11d, dword [0x140098e50]
shrd r11d, r10d, 0xb
xor r11d, 0xc70e0d
imul r10d, dword [0x140098e54], 0x8b677cd3
imul esi, dword [0x140098e58], 0x8b808641
cmp ecx, r8d
mov ecx, r9d
lea ecx, [rdx + rcx - 0x1b736366]
mov edx, esi
mov r8d, r10d
lea esi, [r8 + rdx + 0x5bebe548]
cmove esi, r11d
cmp dword [0x140099c40], ecx
cmovl esi, r11d
mov byte [rbp - 0x20], al
mov qword [rbp - 0x28], r15
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
mov r9, qword [rbp - 0x30]
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x3c]
mov r12d, dword [rbp - 0x40]
jmp 0x14008366d
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov byte [rbp - 0x38], r8b
mov r8, r13
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov rcx, rdi
mov rdi, r13
mov r13, rbx
mov ebx, r15d
mov r15d, r14d
mov esi, dword [rbp - 0x4c]
cmp r10d, 0x5b67a2e9
je 0x14008366d
mov eax, r12d
mov r15b, byte [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov r12, rcx
mov r8, rdi
mov edi, eax
cmp r10d, 0x5d5e3c3a
je 0x140084a0d
mov byte [rbp - 0x20], r15b
mov qword [rbp - 0x28], rsi
mov rax, r12
mov rdx, r12
mov r9, r13
mov r11d, ebx
mov r15d, r14d
mov r12d, edi
mov esi, r10d
cmp r10d, 0x706c6b9c
jne 0x14008366d
mov rcx, r8
mov r15, rax
mov eax, dword [0x140099c3c]
mov r12, r8
mov ecx, dword [0x140099034]
mov edx, dword [0x140099038]
shrd edx, ecx, 0xe
xor edx, eax
xor edx, 0x3db6bc20
imul edx, eax
mov eax, dword [0x14009903c]
mov ecx, dword [0x140099040]
shrd ecx, eax, 0x1d
xor ecx, 0x8c431c8c
and ecx, edx
mov eax, dword [0x140099044]
mov edx, dword [0x140099048]
shrd edx, eax, 0x1d
xor edx, 0x7d6a3d85
mov eax, dword [0x14009904c]
mov r8d, dword [0x140099050]
shrd r8d, eax, 0xb
xor r8d, 0x9b9a7e50
imul eax, dword [0x140099054], 0x1fd92426
imul r9d, dword [0x140099058], 0x7fdacea7
imul r10d, dword [0x14009905c], 0xd804ca07
imul r11d, dword [0x140099060], 0xddb38d81
cmp ecx, edx
mov ecx, r9d
lea eax, [rax + rcx + 0x52fa28d]
mov ecx, r11d
mov edx, r10d
lea esi, [rdx + rcx - 0x35a30e40]
cmove esi, eax
cmp dword [0x140099c40], r8d
cmovl esi, eax
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, r15
mov r8, r12
mov r9, r13
mov r11d, ebx
mov r15d, r14d
mov r12d, edi
jmp 0x14008366d
cmp r10d, 0x4895ddab
je 0x140084e48
cmp r10d, 0x4db5af8a
mov qword [rbp - 0x30], r11
je 0x140084b6b
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov byte [rbp - 0x38], r8b
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov ecx, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x56818a3a
jne 0x14008366d
mov eax, r12d
mov eax, dword [0x140099c3c]
mov r11d, ecx
imul ecx, dword [0x140098e6c], 0xbc0eb071
imul edx, dword [0x140098e70], 0x3cdd34e2
add ecx, edx
add ecx, 0x27e3d9b4
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140098e74]
mov edx, dword [0x140098e78]
shrd edx, eax, 0x1b
xor edx, 0x3490a31c
and edx, ecx
imul eax, dword [0x140098e7c], 0xaf147cab
imul ecx, dword [0x140098e80], 0xe3b8e00f
add eax, ecx
add eax, 0xd8b0ed16
mov ecx, dword [0x140098e84]
mov r8d, dword [0x140098e88]
shrd r8d, ecx, 0xa
mov ecx, dword [0x140098e8c]
mov r9d, dword [0x140098e90]
shrd r9d, ecx, 0x17
xor r8d, 0xb793bc4d
xor r9d, 0x5d62ff2a
mov ecx, dword [0x140098e94]
mov esi, dword [0x140098e98]
shrd esi, ecx, 0xd
xor esi, 0x9c87547b
cmp edx, eax
cmove esi, r9d
cmp dword [0x140099c40], r8d
cmovl esi, r9d
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
jmp 0x140084d40
cmp r10d, 0xc501750f
je 0x1400848e2
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov eax, r8d
mov r8, r13
mov r9, rbx
mov rcx, r11
mov r11d, r15d
mov byte [rbp - 0x11], r15b
mov r15d, r14d
mov byte [rbp - 0x3c], r14b
mov esi, r10d
cmp r10d, 0xc9551be7
jne 0x14008366d
mov r14d, r12d
mov byte [rbp - 0x20], al
mov qword [rbp - 0x28], rcx
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11b, byte [rbp - 0x11]
mov r15b, byte [rbp - 0x3c]
mov esi, 0x706c6b9c
jmp 0x14008366d
cmp r10d, 0x7ea0b68
je 0x1400849d1
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov byte [rbp - 0x38], r8b
mov r8, r13
mov r9, rbx
mov qword [rbp - 0x30], r11
mov r11d, r15d
mov ecx, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x87a1572
jne 0x14008366d
mov eax, r14d
mov r14d, r12d
mov r15d, eax
imul eax, dword [0x140098e5c], 0x2ec715d0
mov r11d, ecx
mov ecx, dword [0x140098e64]
mov esi, dword [0x140098e68]
shrd esi, ecx, 0x19
imul ecx, dword [0x140098e60], 0x4f8b688b
add eax, ecx
add eax, 0x2d0ddc0c
xor esi, 0x8026ceac
mov cl, byte [rbp - 0x38]
test cl, 1
cmovne esi, eax
mov byte [rbp - 0x20], cl
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
jmp 0x14008366d
cmp r10d, 0x796fdf7a
mov qword [rbp - 0x30], r11
je 0x140084a81
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov ecx, r8d
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov eax, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x7dc0e789
jne 0x14008366d
mov r14d, r12d
mov byte [rbp - 0x11], al
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rdi]
mov r12, rbx
mov ebx, ecx
mov rcx, qword [rax + 0x28]
mov eax, dword [0x140098f28]
mov edx, dword [0x140098f2c]
shrd edx, eax, 0x1c
xor edx, 0xda812542
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
movzx ecx, byte [0x140098f30]
movzx edx, byte [0x140098f31]
imul ecx, ecx, 0x46
imul edx, edx, 0xffffffcb
add dl, cl
add dl, 0xb8
cmp al, dl
setne r15b
mov eax, dword [0x140099c3c]
imul ecx, dword [0x140098f34], 0xee9389d5
imul edx, dword [0x140098f38], 0xb2782750
add ecx, edx
add ecx, 0x6466b63a
xor ecx, eax
imul ecx, eax
mov eax, dword [0x140098f3c]
mov edx, dword [0x140098f40]
shrd edx, eax, 0x1a
xor edx, 0xa2369586
and edx, ecx
imul eax, dword [0x140098f44], 0x93729304
imul ecx, dword [0x140098f48], 0x895cc019
add eax, ecx
add eax, 0x964927b9
mov ecx, dword [0x140098f4c]
mov r8d, dword [0x140098f50]
shrd r8d, ecx, 0xb
xor r8d, 0xac6d5666
imul ecx, dword [0x140098f54], 0x48a41538
imul r9d, dword [0x140098f58], 0xdcc0c51d
imul r10d, dword [0x140098f5c], 0xdadd8f7
imul r11d, dword [0x140098f60], 0xf71c5c61
cmp edx, eax
mov eax, r9d
lea eax, [rcx + rax + 0x5b8b2c45]
mov ecx, r11d
mov edx, r10d
lea esi, [rdx + rcx - 0x58a8e055]
cmove esi, eax
cmp dword [0x140099c40], r8d
cmovl esi, eax
mov byte [rbp - 0x20], bl
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, r12
mov r11b, byte [rbp - 0x11]
mov r12d, r14d
jmp 0x14008366d
cmp r10d, 0xbb49359
jne 0x140084f21
imul eax, dword [0x140098f64], 0xa0cdea21
mov ecx, dword [0x140098f6c]
mov esi, dword [0x140098f70]
shrd esi, ecx, 0x1e
imul ecx, dword [0x140098f68], 0xefeaf3ce
add eax, ecx
add eax, 0x937d2b1
xor esi, 0xf09e8b45
test r14b, 1
cmovne esi, eax
jmp 0x140084a04
mov eax, dword [0x140099c3c]
mov ecx, dword [0x140098fd4]
mov edx, dword [0x140098fd8]
shrd edx, ecx, 4
xor edx, eax
xor edx, 0x996002e7
imul ecx, dword [0x140098fdc], 0xfd2f3625
mov byte [rbp - 0x38], r8b
imul r8d, dword [0x140098fe0], 0xf74c85dc
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xda630b15
and eax, edx
mov ecx, dword [0x140098fe4]
mov edx, dword [0x140098fe8]
shrd edx, ecx, 0x10
imul ecx, dword [0x140098fec], 0xb7c8afc
imul r8d, dword [0x140098ff0], 0x39fb90e2
xor edx, 0x18f36393
mov r9d, dword [0x140098ff4]
mov r10d, dword [0x140098ff8]
shrd r10d, r9d, 0x1d
xor r10d, 0xb4b7d9cd
imul r9d, dword [str.f_fP__B], 0x54dc9f9a
mov qword [rbp - 0x30], r11
imul r11d, dword [0x140099000], 0x3586f3a0
cmp eax, edx
mov eax, r8d
lea eax, [rcx + rax - 0x51cd4744]
mov ecx, r11d
mov edx, r9d
lea esi, [rdx + rcx - 0x1d8e2f5c]
cmove esi, r10d
cmp dword [0x140099c40], eax
cmovl esi, r10d
jmp 0x140084b58
mov rcx, qword [r13]
mov al, byte [0x140099064]
mov dl, byte [0x140099065]
shr dl, 4
shl al, 4
or al, dl
mov edx, eax
xor dl, 0x78
sub rsp, 0x20
mov qword [rbp - 0x30], r11
mov byte [rbp - 0x38], r8b
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov eax, dword [0x140099c3c]
mov ecx, dword [0x140099068]
mov edx, dword [0x14009906c]
shrd edx, ecx, 2
xor edx, eax
xor edx, 0x9a150f34
imul ecx, dword [0x140099070], 0x58512904
imul r8d, dword [0x140099074], 0x76a38d88
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xbf9e081d
and eax, edx
imul ecx, dword [0x140099078], 0xa48734f1
imul edx, dword [0x14009907c], 0x240a5516
imul r8d, dword [0x140099080], 0xdbeb777a
imul r9d, dword [0x140099084], 0x2a3e4529
imul r10d, dword [0x140099088], 0xfca2dae8
imul r11d, dword [0x14009908c], 0x3969d0df
imul esi, dword [0x140099090], 0xed9500b5
imul r15d, dword [0x140099094], 0x63dc52e2
add ecx, edx
add ecx, 0xa3354b36
cmp eax, ecx
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax + 0xa2d2086]
mov ecx, r11d
mov edx, r10d
lea ecx, [rdx + rcx + 0x37e463c7]
mov edx, r15d
mov r8d, esi
lea esi, [r8 + rdx - 0x7bb26d4a]
cmove esi, ecx
cmp dword [0x140099c40], eax
cmovl esi, ecx
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11b, byte [rbp - 0x11]
mov r15d, r14d
jmp 0x14008366d
mov rcx, qword [rdi]
sub rsp, 0x20
mov esi, r8d
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov byte [rbp - 0x20], sil
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, 0x796fdf7a
jmp 0x14008366d
sub rsp, 0x20
mov rcx, r11
mov esi, r8d
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [rbx], eax
mov byte [rbp - 0x20], sil
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, 0xc501750f
jmp 0x14008366d
sub rsp, 0x20
mov rcx, r11
mov qword [rbp - 0x30], r11
mov esi, r8d
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
add rsp, 0x20
mov dword [rbx], eax
mov eax, dword [0x140099c3c]
mov ecx, dword [0x140098fa4]
mov edx, dword [0x140098fa8]
shrd edx, ecx, 0x1f
xor edx, eax
xor edx, 0xb2712702
imul edx, eax
mov eax, dword [0x140098fac]
mov ecx, dword [0x140098fb0]
shrd ecx, eax, 8
xor ecx, 0x7a55a781
and ecx, edx
mov eax, dword [0x140098fb4]
mov edx, dword [0x140098fb8]
shrd edx, eax, 2
xor edx, 0xa5ead3c9
mov eax, dword [0x140098fbc]
mov r8d, dword [0x140098fc0]
shrd r8d, eax, 9
imul eax, dword [0x140098fc4], 0x47666568
mov r9d, dword [0x140098fcc]
mov r10d, dword [0x140098fd0]
shrd r10d, r9d, 7
imul r9d, dword [0x140098fc8], 0x33724a3c
xor r8d, 0xd97bd110
xor r10d, 0xdf7140c5
cmp ecx, edx
mov ecx, r9d
lea eax, [rax + rcx + 0x4fa106a1]
cmove r10d, eax
cmp dword [0x140099c40], r8d
cmovl r10d, eax
mov byte [rbp - 0x20], sil
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, r10d
jmp 0x14008366d
mov eax, dword [0x140098ee8]
mov ecx, dword [0x140098eec]
shrd ecx, eax, 0x14
mov eax, dword [0x140098ef0]
mov esi, dword [0x140098ef4]
shrd esi, eax, 2
xor ecx, 0x6d7b1981
xor esi, 0x54f228d5
test r15b, 1
cmovne esi, ecx
mov byte [rbp - 0x20], r8b
jmp 0x140084e30
mov qword [rbp - 0x48], r8
mov rcx, qword [r8]
mov al, byte [0x14009917c]
mov dl, byte [0x14009917d]
shr dl, 2
shl al, 6
or al, dl
mov edx, eax
xor dl, 0x7b
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov byte [rbp - 0x20], r15b
mov qword [rbp - 0x28], rsi
mov rdx, r12
mov r8, qword [rbp - 0x48]
mov r9, r13
mov r11d, ebx
mov r15d, r14d
mov r12d, edi
mov esi, 0xd668a91a
jmp 0x14008366d
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, 0x4895ddab
jmp 0x14008366d
mov rcx, qword [rdi]
sub rsp, 0x20
mov byte [rbp - 0x38], r8b
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x140099c3c]
mov ecx, dword [0x140099004]
mov edx, dword [0x140099008]
shrd edx, ecx, 0x18
xor edx, eax
xor edx, 0x6abbb1b2
imul ecx, dword [0x14009900c], 0x68cb7134
imul r8d, dword [0x140099010], 0xe51dedf5
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0xbf3dcdbb
and eax, edx
imul ecx, dword [0x140099014], 0x2c1ce214
imul edx, dword [0x140099018], 0x64e46fe8
add ecx, edx
add ecx, 0xdff05f30
mov edx, dword [0x14009901c]
mov r8d, dword [0x140099020]
shrd r8d, edx, 0x19
mov edx, dword [0x140099024]
mov r9d, dword [0x140099028]
shrd r9d, edx, 0xa
xor r8d, 0xf349a34c
imul edx, dword [0x14009902c], 0xf1d2603c
xor r9d, 0xdb3a9ae4
imul r10d, dword [0x140099030], 0x32812d59
cmp eax, ecx
mov eax, r10d
mov ecx, edx
lea esi, [rcx + rax - 0x22248bfa]
cmove esi, r9d
cmp dword [0x140099c40], r8d
cmovl esi, r9d
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
jmp 0x140084e34
mov rax, qword [rdi]
mov rax, qword [rax + 0x28]
mov qword [rax + 0x10], 0
mov rax, qword [rdi]
mov rcx, qword [rax + 0x28]
mov eax, dword [0x140099174]
mov edx, dword [0x140099178]
shrd edx, eax, 0x1b
xor edx, 0x3ffe2c5d
sub rsp, 0x20
mov esi, r8d
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
add rsp, 0x20
mov byte [rbp - 0x20], sil
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, 0x7dc0e789
jmp 0x14008366d
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
mov byte [rbp - 0x38], r8b
mov r8, qword [rax]
mov eax, dword [0x140098e9c]
mov edx, dword [0x140098ea0]
shrd edx, eax, 7
mov rcx, qword [r13]
xor edx, 0x4efd14f1
mov al, byte [0x140098ea4]
mov r9b, byte [0x140098ea5]
shr r9b, 5
shl al, 3
or al, r9b
mov r9d, eax
xor r9b, 0x67
mov eax, dword [0x140098ea8]
mov r10d, dword [0x140098eac]
shrd r10d, eax, 0xd
xor r10d, 0xe02df08a
sub rsp, 0x40
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r10d
mov qword [rsp + 0x30], 0
mov r15, r11
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
add rsp, 0x40
mov dword [rbx], eax
mov ecx, dword [0x140098eb0]
mov edx, dword [0x140098eb4]
shrd edx, ecx, 2
xor edx, 0x9e8bfcb
cmp eax, edx
setg r11b
mov eax, dword [0x140099c3c]
mov ecx, dword [str.Bed]
mov edx, dword [0x140098ebc]
shrd edx, ecx, 8
xor edx, eax
xor edx, 0xbde13f69
imul ecx, dword [0x140098ec0], 0x42d318cf
imul r8d, dword [0x140098ec4], 0xc60b0cc5
imul edx, eax
mov eax, r8d
add eax, ecx
add eax, 0x44ac58a6
and eax, edx
imul ecx, dword [0x140098ec8], 0x26f46ac2
imul edx, dword [0x140098ecc], 0x735df05b
imul r8d, dword [0x140098ed0], 0x97185ba7
imul r9d, dword [0x140098ed4], 0x7b04cd36
add ecx, edx
add ecx, 0xa258f97d
mov edx, dword [0x140098ee0]
mov r10d, dword [0x140098ee4]
shrd r10d, edx, 8
imul edx, dword [0x140098ed8], 0x8fd3ee32
xor r10d, 0x23d91963
imul esi, dword [0x140098edc], 0x25722d8e
cmp eax, ecx
mov eax, r9d
mov ecx, r8d
lea eax, [rcx + rax - 0x2ef69860]
mov ecx, esi
lea ecx, [rdx + rcx - 0x168afcce]
mov esi, r10d
cmove esi, ecx
cmp dword [0x140099c40], eax
cmovl esi, ecx
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov qword [rbp - 0x28], r15
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r15d, r14d
jmp 0x14008366d
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, 0x9fad31a4
jmp 0x14008366d
mov eax, dword [0x140099c3c]
mov ecx, dword [0x140098ef8]
mov edx, dword [0x140098efc]
shrd edx, ecx, 0x10
xor edx, eax
xor edx, 0x2e7cff2d
imul edx, eax
mov eax, dword [0x140098f00]
mov ecx, dword [0x140098f04]
shrd ecx, eax, 0x1c
xor ecx, 0x4b5fa6e9
and ecx, edx
imul eax, dword [0x140098f08], 0x37e7d164
imul edx, dword [0x140098f0c], 0xc10d6a4d
add eax, edx
add eax, 0xedc12606
mov edx, dword [0x140098f10]
mov r8d, dword [0x140098f14]
shrd r8d, edx, 0x15
mov edx, dword [0x140098f18]
mov r9d, dword [0x140098f1c]
shrd r9d, edx, 0x11
xor r8d, 0x9efa0da2
imul edx, dword [0x140098f20], 0x5848b683
xor r9d, 0xe0b6630d
imul r10d, dword [0x140098f24], 0x2e82f0ef
cmp ecx, eax
mov eax, r10d
mov ecx, edx
lea esi, [rcx + rax + 0x4d2fa28e]
cmove esi, r9d
cmp dword [0x140099c40], r8d
cmovl esi, r9d
mov al, byte [rbp - 0x38]
mov byte [rbp - 0x20], al
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
jmp 0x14008366d
mov eax, dword [rbx]
mov dword [rbp - 0x3c], eax
mov eax, dword [0x140099c3c]
mov ecx, dword [0x1400990c8]
mov edx, dword [0x1400990cc]
shrd edx, ecx, 0x18
xor edx, eax
xor edx, 0x46ad8995
imul edx, eax
mov eax, dword [0x1400990d0]
mov ecx, dword [0x1400990d4]
shrd ecx, eax, 0xb
xor ecx, 0xad1ded53
and ecx, edx
mov eax, dword [0x1400990d8]
mov edx, dword [0x1400990dc]
shrd edx, eax, 0x10
xor edx, 0xd36440af
mov eax, dword [0x1400990e0]
mov r12d, r8d
mov r8d, dword [0x1400990e4]
shrd r8d, eax, 0x12
mov eax, dword [0x1400990e8]
mov r9d, dword [0x1400990ec]
shrd r9d, eax, 3
xor r8d, 0xf4bdf93a
imul eax, dword [0x1400990f0], 0x5752fa1d
xor r9d, 0x258a9bf6
imul r10d, dword [0x1400990f4], 0x98be7223
cmp ecx, edx
mov ecx, r10d
lea esi, [rax + rcx - 0x1150471d]
cmove esi, r9d
cmp dword [0x140099c40], r8d
cmovl esi, r9d
mov byte [rbp - 0x20], r12b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov r12d, dword [rbp - 0x3c]
jmp 0x14008366d
mov byte [rbp - 0x20], r8b
mov qword [rbp - 0x28], r11
mov rdx, rdi
mov r8, r13
mov r9, rbx
mov r11d, r15d
mov r15d, r14d
mov esi, r10d
cmp r10d, 0x12ffa478
jne 0x14008366d
mov eax, r12d
movups xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret