Function at 0x14007e2f0
Capabilities:
Check for software breakpoints
Generate random numbers using a mersenne twister
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x55d60]
mov eax, 0x55e60
call fcn.140191300
sub rsp, rax
mov rax, qword [0x140221880]
xor rax, rsp
mov qword [rbp + 0x55d50], rax
xor edi, edi
mov qword [rbp + 0x58], rcx
cmp qword [0x140328f28], rdi
jne 0x14007e35e
mov ecx, 0x26b0
call fcn.1401ab860
test rax, rax
je 0x14007e35e
mov qword [rax], rdi
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2784], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1400]
call fcn.1400be1b0
lea rcx, [rbp + 0x1400]
call fcn.1400b7000
movzx ecx, ax
inc ecx
imul eax, ecx, 0xa51958c
lea rcx, [rbp + 0x1400]
mov dword [rbp - 0x48], eax
call fcn.1400b7000
shr eax, 0x10
lea rdx, [0x140322de0]
inc eax
lea rcx, [rbp + 0x628]
imul eax, eax, 0xcffd938
mov dword [rbp - 0x44], eax
call fcn.140040c90
lea rcx, [rbp + 0x3c8]
mov rbx, rax
call fcn.14003cdd0
mov rsi, 0xffffffffffffffff
lea rax, [0x1403293e8]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x14007e3f0
mov rdx, rax
lea rcx, [rbp + 0x3c8]
call fcn.14003ce50
lea rcx, [rbp + 0x3e8]
call fcn.14003cdd0
mov r8d, 7
lea rdx, str.Uni_NTG
lea rcx, [rbp + 0x3e8]
call fcn.14003ce50
mov r9, rbx
mov byte [rsp + 0x20], dil
lea r8, [rbp + 0x3c8]
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x1080]
call fcn.140052050
cmp byte [rbp + 0x1080], dil
jne 0x14007e4b5
lea rcx, [rbp + 0x408]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x408]
call fcn.14003ce50
lea rcx, [rbp + 0x428]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x0
lea rcx, [rbp + 0x428]
call fcn.14003ce50
lea rdx, [rbp + 0x408]
lea rcx, [rbp + 0x428]
call fcn.14003cf90
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp + 0x1088]
mov r12, rax
lea rcx, [rbp + 0x608]
call fcn.140040c90
lea rcx, [rbp + 0x108]
mov r15, rax
call fcn.14003cdd0
lea rcx, [rbp + 0x108]
call fcn.14003cdf0
mov rcx, r15
call fcn.140040db0
mov rcx, r15
mov rbx, rax
call fcn.1400b8590
mov r14, rax
cmp rbx, rax
je 0x14007e542
nop
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x14007e52e
test edi, edi
je 0x14007e542
inc edi
lea rcx, [rbp + 0x108]
xor edx, edx
call fcn.1400bca40
jmp 0x14007e53a
lea rcx, [rbp + 0x108]
call fcn.1400b8550
inc rbx
cmp rbx, r14
jne 0x14007e510
mov rcx, r15
call fcn.1400b87b0
lea rcx, [rbp + 0x108]
call fcn.140040db0
mov rdx, rax
mov r8d, 1
mov rcx, r12
call fcn.14005fa30
mov r13, qword [rbp - 0x48]
lea rcx, [rbp + 0x108]
xor rax, r13
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x40], rax
call fcn.1400b87b0
lea rdx, [rbp + 0x1088]
lea rcx, [rbp + 0x5e8]
call fcn.140040c90
mov r15, rax
lea rcx, [rbp + 0x148]
xor eax, eax
mov edi, eax
call fcn.14003cdd0
lea rcx, [rbp + 0x148]
call fcn.14003cdf0
mov rcx, r15
call fcn.140040db0
mov rcx, r15
mov rbx, rax
call fcn.1400b8590
mov r14, rax
cmp rbx, rax
je 0x14007e603
nop
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x14007e5ef
cmp edi, 1
je 0x14007e603
inc edi
lea rcx, [rbp + 0x148]
xor edx, edx
call fcn.1400bca40
jmp 0x14007e5fb
lea rcx, [rbp + 0x148]
call fcn.1400b8550
inc rbx
cmp rbx, r14
jne 0x14007e5d0
mov rcx, r15
call fcn.1400b87b0
lea rcx, [rbp + 0x148]
call fcn.140040db0
mov rdx, rax
mov r8d, 1
mov rcx, r12
call fcn.14005fa30
xor rax, r13
lea rcx, [rbp + 0x148]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x38], rax
call fcn.1400b87b0
lea rdx, [rbp + 0x1088]
lea rcx, [rbp + 0x5c8]
call fcn.140040c90
mov r15, rax
lea rcx, [rbp + 0x68]
xor eax, eax
mov edi, eax
call fcn.14003cdd0
lea rcx, [rbp + 0x68]
call fcn.14003cdf0
mov rcx, r15
call fcn.140040db0
mov rcx, r15
mov rbx, rax
call fcn.1400b8590
mov r14, rax
cmp rbx, rax
je 0x14007e6b3
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x14007e6a2
cmp edi, 2
je 0x14007e6b3
inc edi
lea rcx, [rbp + 0x68]
xor edx, edx
call fcn.1400bca40
jmp 0x14007e6ab
lea rcx, [rbp + 0x68]
call fcn.1400b8550
inc rbx
cmp rbx, r14
jne 0x14007e686
mov rcx, r15
call fcn.1400b87b0
lea rcx, [rbp + 0x68]
call fcn.140040db0
mov rdx, rax
mov r8d, 1
mov rcx, r12
call fcn.14005fa30
mov r13, rax
lea rcx, [rbp + 0x68]
xor r13, qword [rbp - 0x48]
mov qword [rsp + 0x58], r13
mov qword [rbp - 0x30], r13
call fcn.1400b87b0
lea rdx, [rbp + 0x1088]
lea rcx, [rbp + 0x648]
call fcn.140040c90
mov r15, rax
lea rcx, [rbp + 0xe8]
xor eax, eax
mov edi, eax
call fcn.14003cdd0
lea rcx, [rbp + 0xe8]
call fcn.14003cdf0
mov rcx, r15
call fcn.140040db0
mov rcx, r15
mov rbx, rax
call fcn.1400b8590
mov r14, rax
cmp rbx, rax
je 0x14007e773
nop dword [rax + rax]
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x14007e75f
cmp edi, 3
je 0x14007e773
inc edi
lea rcx, [rbp + 0xe8]
xor edx, edx
call fcn.1400bca40
jmp 0x14007e76b
lea rcx, [rbp + 0xe8]
call fcn.1400b8550
inc rbx
cmp rbx, r14
jne 0x14007e740
mov rcx, r15
call fcn.1400b87b0
lea rcx, [rbp + 0xe8]
call fcn.140040db0
mov rdx, rax
mov r8d, 1
mov rcx, r12
call fcn.14005fa30
mov rdi, qword [rbp - 0x48]
lea rcx, [rbp + 0xe8]
mov rbx, rax
xor rbx, rdi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x28], rbx
call fcn.1400b87b0
xor edx, edx
lea rcx, [rbp + 0x1088]
call fcn.1400bca40
mov r14, qword [rbp - 0x58]
cmp r14, rdi
je 0x14007e7dd
cmp qword [rbp - 0x18], rdi
je 0x14007e7dd
cmp r13, rdi
je 0x14007e7dd
cmp rbx, rdi
jne 0x14007e83a
lea rcx, [rbp + 0x288]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x288]
call fcn.14003ce50
lea rcx, [rbp + 0x468]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x1
lea rcx, [rbp + 0x468]
call fcn.14003ce50
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x468]
call fcn.14003cf90
mov r9d, 0xfffffffe
mov dword [rbp + 0xe88], reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rbp + 0x1400]
mov dword [rbp + 0xe8c], 0xfffffffe
lea rcx, [rbp + 0xe88]
xor r12b, r12b
lea r8d, [r9 + 0x22]
call fcn.140104c10
mov r8, r14
mov dword [rbp - 0x68], eax
xor r8, rdi
mov edx, 0x1000
mov ecx, 0x200
call r8
mov qword [rbp - 0x20], rax
mov rdx, rax
test rax, 0xffffff
je 0x14007e8e8
mov r9d, 2
mov qword [rbp + 0xe90], 0xaaaa
mov rax, r13
mov qword [rsp + 0x20], rdx
xor rax, rdi
lea rcx, [rbp + 0xe90]
lea r8d, [r9 + 6]
call rax
xor edx, edx
lea rcx, str.Internal_Data_Valid
call fcn.140041bd0
cmp qword [rbp + 0xe90], 0xaaaa
je 0x14007e8e8
xor edx, edx
lea rcx, str.Internals_Successfully_Mapped
mov r12b, 1
call fcn.140041bd0
xor edx, edx
lea rcx, str.Mapping_Internal_Data
call fcn.140041bd0
mov r15, qword [0x140328f28]
mov rax, qword [r15 + 8]
mov r14, qword [r15]
lea rcx, [rax + rax*2]
xor eax, eax
lea r13, [rcx*8 + 0x10]
mov edi, eax
test r14, r14
jle 0x14007e996
lea rbx, [r15 + 0x10]
nop dword [rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp], xmm0
test rax, rax
je 0x14007e988
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14007e988
movzx ecx, byte [rbp]
test cl, cl
jne 0x14007e95a
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14007e988
cmp cl, 1
jne 0x14007e988
mov rdx, rax
lea rcx, [rbp + 0x1180]
call fcn.140040c90
xor edx, edx
lea rcx, [rbp + 0x1180]
call fcn.1400bca40
lea rcx, [rbp + 0x1180]
call fcn.1400b87b0
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, r14
jl 0x14007e920
mov r8, r13
xor edx, edx
mov rcx, r15
call fcn.1401d1c40
mov rcx, r15
call fcn.1401a6090
xor eax, eax
mov qword [0x140328f28], rax
test r12b, r12b
jne 0x140089eac
mov ecx, 0x26b0
call fcn.1401ab860
xor r12d, r12d
test rax, rax
je 0x14007e9e1
mov qword [rax], r12
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
lea rdx, [0x140322de0]
lea rcx, [rbp + 0x5a8]
call fcn.140040c90
lea rcx, [rbp + 0x508]
mov rbx, rax
call fcn.14003cdd0
lea rdx, [0x1403293e8]
nop word [rax + rax]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x14007ea10
mov r8, rsi
lea rcx, [rbp + 0x508]
call fcn.14003ce50
lea rcx, [rbp + 0x1e8]
call fcn.14003cdd0
mov r8d, 7
lea rdx, str.Uni_RPH
lea rcx, [rbp + 0x1e8]
call fcn.14003ce50
mov r9, rbx
mov byte [rsp + 0x20], 0
lea r8, [rbp + 0x508]
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0x10d0]
call fcn.140052050
cmp byte [rbp + 0x10d0], 0
jne 0x14007ead5
lea rcx, [rbp + 0x3a8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x3a8]
call fcn.14003ce50
lea rcx, [rbp + 0x228]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x4
lea rcx, [rbp + 0x228]
call fcn.14003ce50
lea rdx, [rbp + 0x3a8]
lea rcx, [rbp + 0x228]
call fcn.14003cf90
mov r14, qword [0x140328f28]
mov edi, r12d
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x14007eb76
lea rbx, [r14 + 0x10]
nop dword [rax + rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp], xmm0
test rax, rax
je 0x14007eb68
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x14007eb68
movzx ecx, byte [rbp]
test cl, cl
jne 0x14007eb3a
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x14007eb68
cmp cl, 1
jne 0x14007eb68
mov rdx, rax
lea rcx, [rbp + 0x1160]
call fcn.140040c90
xor edx, edx
lea rcx, [rbp + 0x1160]
call fcn.1400bca40
lea rcx, [rbp + 0x1160]
call fcn.1400b87b0
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x14007eb00
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
mov ecx, 0x26b0
mov qword [0x140328f28], r12
call fcn.1401ab860
test rax, rax
je 0x14007ebb3
mov qword [rax], r12
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
lea rcx, str.explorer.exe
call fcn.14003c550
mov r14d, eax
test eax, eax
jne 0x14007ec23
lea rcx, [rbp + 0x488]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x488]
call fcn.14003ce50
lea rcx, [rbp + 0x348]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x5
lea rcx, [rbp + 0x348]
call fcn.14003ce50
lea rdx, [rbp + 0x488]
lea rcx, [rbp + 0x348]
call fcn.14003cf90
lea rax, str.ntoskrnl.exe
lea rdx, [rbp + 0x670]
mov qword [rbp + 0x670], rax
lea rcx, str.GetSystemModule:
call fcn.1400c03a0
mov r8d, r12d
mov dword [rbp + 0x66c], r12d
nop
xor edx, edx
lea r9, [rbp + 0x66c]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14007ec72
mov r8d, dword [rbp + 0x66c]
jmp 0x14007ec50
lea rdx, [rbp + 0x66c]
lea rcx, str.NtQuerySystemInformation:
call fcn.1400c0590
mov rbx, r12
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x66c]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x66c]
lea r9, [rbp + 0x66c]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14007ec90
mov rdx, rbx
lea rcx, str.Module_Count:
call fcn.1400c0770
cmp qword [rbx], 0
mov rsi, r12
jbe 0x14007ee69
lea rdi, [rbx + 8]
nop
mov rax, rdi
lea rcx, [rbp + 0xc60]
mov edx, 2
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14007ed10
movups xmm0, xmmword [rax]
lea r9, [rbp + 0x60]
lea r8, [0x1401f8e80]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 8]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x20], rax
lea rcx, [rbp + 0xc88]
mov rax, qword [rbp + 0xc70]
mov qword [rbp + 0x60], rax
movzx eax, word [rbp + 0xc86]
add rcx, rax
mov qword [rbp + 8], rcx
lea rcx, [0x1401ff2b0]
call fcn.1400c0960
movzx eax, word [rbp + 0xc86]
lea rcx, [rbp + 0xc88]
mov rdx, qword [rbp + 0x670]
add rcx, rax
call fcn.1401af250
test eax, eax
je 0x14007edea
inc rsi
add rdi, 0x128
cmp rsi, qword [rbx]
jb 0x14007ed00
jmp 0x14007ee69
lea rcx, [rbp + 0x12d0]
mov edx, 2
lea rax, [rbp + 0xc60]
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14007ee00
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, str.win32k.sys
lea rdx, [rbp + 0x678]
mov qword [rbp + 0x678], rax
lea rcx, str.GetSystemModule:
call fcn.1400c03a0
mov r8d, r12d
mov dword [rbp + 0x668], r12d
nop word [rax + rax]
xor edx, edx
lea r9, [rbp + 0x668]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14007eed2
mov r8d, dword [rbp + 0x668]
jmp 0x14007eeb0
lea rdx, [rbp + 0x668]
lea rcx, str.NtQuerySystemInformation:
call fcn.1400c0590
mov rbx, r12
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x668]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x668]
lea r9, [rbp + 0x668]
mov rdx, rax
mov ecx, ntohs
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14007eef0
mov rdx, rbx
lea rcx, str.Module_Count:
call fcn.1400c0770
cmp qword [rbx], 0
mov rsi, r12
jbe 0x14007f0c9
lea rdi, [rbx + 8]
nop
mov rax, rdi
lea rcx, [rbp + 0xb30]
mov edx, 2
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14007ef70
movups xmm0, xmmword [rax]
lea r9, [rbp + 0x10]
lea r8, [0x1401f8e80]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x18]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov rax, qword [rax + 0x20]
mov qword [rcx + 0x20], rax
lea rcx, [rbp + 0xb58]
mov rax, qword [rbp + 0xb40]
mov qword [rbp + 0x10], rax
movzx eax, word [rbp + 0xb56]
add rcx, rax
mov qword [rbp + 0x18], rcx
lea rcx, [0x1401ff2b0]
call fcn.1400c0960
movzx eax, word [rbp + 0xb56]
lea rcx, [rbp + 0xb58]
mov rdx, qword [rbp + 0x678]
add rcx, rax
call fcn.1401af250
test eax, eax
je 0x14007f04d
inc rsi
add rdi, 0x128
cmp rsi, qword [rbx]
jb 0x14007ef60
jmp 0x14007f0c9
lea rcx, [rbp + 0x11a0]
mov edx, 2
lea rax, [rbp + 0xb30]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14007f060
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp qword [rbp + 0x11b0], 0
je 0x14007f0ee
cmp qword [rbp + 0x12e0], 0
jne 0x14007f14b
lea rcx, [rbp + 0x328]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x328]
call fcn.14003ce50
lea rcx, [rbp + 0x308]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x6
lea rcx, [rbp + 0x308]
call fcn.14003ce50
lea rdx, [rbp + 0x328]
lea rcx, [rbp + 0x308]
call fcn.14003cf90
call fcn.140076d50
mov rbx, rax
mov qword [rsp + 0x70], rax
movabs rax, 0xffffff0000000fff
test rax, rbx
jne 0x14007f16c
test rbx, rbx
jne 0x14007f1c9
lea rcx, [rbp + 0x2e8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x2e8]
call fcn.14003ce50
lea rcx, [rbp + 0x268]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x7
lea rcx, [rbp + 0x268]
call fcn.14003ce50
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x268]
call fcn.14003cf90
lea r9, [rbp + 0x20]
mov qword [rbp + 0x20], rbx
lea r8, [0x1401f8e80]
mov qword [rbp + 0x28], r14
lea rdx, [rbp + 0x28]
lea rcx, str.GetProcessCR3:
call fcn.1400c1910
mov edx, r14d
mov rcx, rbx
call fcn.1400618a0
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x78], rax
lea rcx, str.Queried_EProcess:
mov qword [rbp + 0x30], rax
mov rdi, rax
call fcn.1400c24f0
mov qword [rbp + 0xd90], r12
movabs rdx, 0xfffffffff000
mov r14d, 0x5a4d
test rdi, rdi
je 0x14008133f
mov rax, r12
mov qword [rbp - 0x78], 8
mov qword [rbp - 0x70], rax
add rax, 0x28
add rax, rdi
mov qword [rsp + 0x60], rax
mov r13d, dword [0x140322b68]
xorps xmm0, xmm0
shr rax, 0x27
mov rcx, rbx
and rcx, rdx
mov qword [rbp + 0x708], r12
and eax, 0x1ff
mov qword [rbp - 0x80], rcx
xor edx, edx
mov qword [rbp + 0x710], r12
mov qword [rbp + 0x718], r12
movups xmmword [rbp + 0xea8], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x6f8], 8
mov qword [rbp + 0x700], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
lea rcx, [0x1401fded8]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14007f32d
cmp word [rax], r14w
jne 0x14007f32d
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007f32d
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007f32d
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007f324
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007f4da
inc rbx
cmp rbx, r14
jb 0x14007f302
xor r12d, r12d
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x710]
test rbx, rbx
je 0x14007f68d
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007f3d6
cmp word [rax], r14w
jne 0x14007f3d6
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007f3d6
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007f3d6
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007f3d3
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007f7ac
inc rdi
cmp rdi, r15
jb 0x14007f3b0
xor r12d, r12d
test bl, 1
je 0x14007f68d
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x6e0], r12
xor edx, edx
mov qword [rbp + 0x6e8], r12
xorps xmm0, xmm0
mov qword [rbp + 0x6f0], r12
movups xmmword [rbp + 0xe98], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x6d0], 8
mov qword [rbp + 0x6d8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x14007fb22
cmp word [rax], bx
jne 0x14007fb22
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14007fb22
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14007fb22
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007f4d2
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007f969
inc rbx
cmp rbx, r14
jb 0x14007f4b0
xor r12d, r12d
jmp 0x14007fb1d
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007f324
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007f324
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xfeb4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xeb30]
call fcn.1400be1b0
lea rcx, [rbp + 0xeb30]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop
lea rcx, [rbp + 0xeb30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x54d50], rax
inc rbx
cmp rbx, 0x200
jl 0x14007f570
mov r8d, 0x1000
lea rdx, [rbp + 0x54d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe78]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe78], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6f8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x6f8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xea8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe78]
lea r9, [rbp + 0xe78]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
jns 0x14007f327
mov rcx, qword [rbp - 0x80]
mov qword [rbp - 0x80], rcx
mov rdx, qword [rsp + 0x78]
xor r15d, r15d
mov eax, r15d
mov qword [rbp + 0xd90], r15
add rdx, 0x388
mov qword [rbp - 0x70], rax
mov rax, rdx
mov qword [rbp - 0x78], 8
mov qword [rsp + 0x60], rax
mov r13d, dword [0x140322b68]
xor edx, edx
shr rax, 0x27
xorps xmm0, xmm0
and eax, 0x1ff
mov qword [rbp + 0x7a8], r15
mov qword [rbp + 0x7b0], r15
lea r8d, [rdx + 1]
mov qword [rbp + 0x7b8], r15
movups xmmword [rbp + 0x1028], xmm0
lea rax, [rcx + rax*8]
mov qword [rbp + 0x798], 8
mov qword [rbp + 0x7a0], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140080fb4
cmp word [rax], r14w
jne 0x140080fb4
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140080fb4
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140080fb4
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007f7a4
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140080dfd
inc rbx
cmp rbx, r14
jb 0x14007f782
xor r15d, r15d
jmp 0x140080fae
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007f3d3
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007f3d3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x11244], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xfec0]
call fcn.1400be1b0
lea rcx, [rbp + 0xfec0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
lea rcx, [rbp + 0xfec0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4bd50], rax
inc rdi
cmp rdi, 0x200
jl 0x14007f843
mov r8d, 0x1000
lea rdx, [rbp + 0x4bd50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe80]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe80], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6f8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x6f8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xea8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe80]
lea r9, [rbp + 0xe80]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14007f68d
jmp 0x14007f3d6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007f4d2
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007f4d2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x125d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x11250]
call fcn.1400be1b0
lea rcx, [rbp + 0x11250]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x11250]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4cd50], rax
inc rbx
cmp rbx, 0x200
jl 0x14007fa00
mov r8d, 0x1000
lea rdx, [rbp + 0x4cd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe84]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe84], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6d0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xe98]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe84]
lea r9, [rbp + 0xe84]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14007f68d
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x6e8]
test rdi, rdi
je 0x14007f68d
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14007fbd2
cmp word [rax], bx
jne 0x14007fbd2
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14007fbd2
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14007fbd2
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14007fbcf
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14007fc0a
inc rbx
cmp rbx, r15
jb 0x14007fbb0
xor r12d, r12d
test dil, 1
je 0x14007f68d
movzx eax, dil
shr al, 7
test al, 1
je 0x14007fdc6
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140080875
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14007fbcf
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14007fbcf
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x13964], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x125e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x125e0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x125e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4dd50], rax
inc rbx
cmp rbx, 0x200
jl 0x14007fca0
mov r8d, 0x1000
lea rdx, [rbp + 0x4dd50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd98]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd98], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x6d0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x6d0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xe98]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd98]
lea r9, [rbp + 0xd98]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14007f68d
jmp 0x14007fbd2
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x730], r12
xor edx, edx
mov qword [rbp + 0x738], r12
xorps xmm0, xmm0
mov qword [rbp + 0x740], r12
movups xmmword [rbp + 0x1048], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x720], 8
mov qword [rbp + 0x728], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140080074
cmp word [rax], bx
jne 0x140080074
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140080074
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140080074
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14007febe
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14007fec6
inc rbx
cmp rbx, r14
jb 0x14007fea0
xor r12d, r12d
jmp 0x14008006f
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007febe
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007febe
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x14cf4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x13970]
call fcn.1400be1b0
lea rcx, [rbp + 0x13970]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
lea rcx, [rbp + 0x13970]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4ed50], rax
inc rbx
cmp rbx, 0x200
jl 0x14007ff52
mov r8d, 0x1000
lea rdx, [rbp + 0x4ed50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xd9c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xd9c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x720]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x720]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1048]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xd9c]
lea r9, [rbp + 0xd9c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14007f68d
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x738]
test rdi, rdi
je 0x14007f68d
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140080122
cmp word [rax], bx
jne 0x140080122
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140080122
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140080122
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008011f
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008015a
inc rbx
cmp rbx, r15
jb 0x140080100
xor r12d, r12d
test dil, 1
je 0x14007f68d
movzx eax, dil
shr al, 7
test al, 1
je 0x140080316
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x140080875
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008011f
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008011f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xc404], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xb080]
call fcn.1400be1b0
lea rcx, [rbp + 0xb080]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0xb080]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4fd50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400801f0
mov r8d, 0x1000
lea rdx, [rbp + 0x4fd50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xda0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xda0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x720]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x720]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1048]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xda0]
lea r9, [rbp + 0xda0]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14007f68d
jmp 0x140080122
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x758], r12
xor edx, edx
mov qword [rbp + 0x760], r12
xorps xmm0, xmm0
mov qword [rbp + 0x768], r12
movups xmmword [rbp + 0x1058], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x748], 8
mov qword [rbp + 0x750], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400805d3
cmp word [rax], r14w
jne 0x1400805d3
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400805d3
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400805d3
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400805cd
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140080413
inc rbx
cmp rbx, r14
jb 0x1400803f0
jmp 0x1400805cd
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400805cd
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400805cd
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x17414], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x16090]
call fcn.1400be1b0
lea rcx, [rbp + 0x16090]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
lea rcx, [rbp + 0x16090]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x50d50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400804b0
mov r8d, 0x1000
lea rdx, [rbp + 0x50d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xda4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xda4], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x748]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x748]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1058]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xda4]
lea r9, [rbp + 0xda4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x14007f68d
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x760]
test rbx, rbx
je 0x14007f68d
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x68], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140080851
cmp word [rax], r14w
jne 0x140080851
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140080851
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140080851
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140080851
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140080694
inc rdi
cmp rdi, r15
jb 0x140080670
jmp 0x140080851
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140080851
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140080851
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x187a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x17420]
call fcn.1400be1b0
lea rcx, [rbp + 0x17420]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x17420]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x53d50], rax
inc rdi
cmp rdi, 0x200
jl 0x140080730
mov r8d, 0x1000
lea rdx, [rbp + 0x53d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xda8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xda8], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 0x748]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x748]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1058]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xda8]
lea r9, [rbp + 0xda8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x14007f68d
test bl, 1
je 0x14007f68d
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x14007f68d
mov r13d, dword [0x140322b68]
mov rax, rdi
and eax, 0xfff
mov qword [rbp + 0x778], rdi
xorps xmm0, xmm0
mov ecx, 0x1000
sub rcx, rax
mov rax, qword [rbp - 0x78]
cmp rcx, rax
movups xmmword [rbp + 0x1038], xmm0
cmovb rax, rcx
xor ebx, ebx
mov qword [rsp + 0x68], rax
lea rcx, [0x1401fded8]
mov qword [rbp + 0x770], rax
xor edx, edx
mov rax, qword [0x140329cf0]
lea r8d, [rbx + 1]
mov qword [rbp + 0x780], rbx
mov qword [rbp + 0x788], rbx
mov qword [rbp + 0x790], rbx
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov esi, 0x5a4d
test rax, rax
je 0x140080b34
cmp word [rax], si
jne 0x140080b34
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140080b34
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140080b34
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140080b2f
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140080973
inc rbx
cmp rbx, r14
jb 0x140080950
jmp 0x140080b2d
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140080b2d
mov esi, dword [rcx + 4]
test esi, esi
js 0x140080b2d
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x19b34], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x187b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x187b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x187b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x51d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140080a10
mov r8d, 0x1000
lea rdx, [rbp + 0x51d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdac]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdac], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x770]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x770]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1038]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdac]
lea r9, [rbp + 0xdac]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140080ddd
xor ebx, ebx
mov esi, 0x5a4d
mov rdx, qword [rbp + 0x788]
test rdx, rdx
je 0x140080ddd
mov r8, qword [rsp + 0x68]
lea rcx, [rbp + 0xd90]
add rcx, qword [rbp - 0x70]
call fcn.1401d15a0
mov rax, qword [0x140329cf0]
lea rcx, [0x1401fded8]
mov r13d, dword [0x140322768]
xor edx, edx
mov qword [rsp + 0x60], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140080be0
cmp word [rax], si
jne 0x140080be0
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140080be0
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140080be0
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140080be0
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140080c34
inc rbx
cmp rbx, r14
jb 0x140080bc2
xor r12d, r12d
mov rsi, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
sub rsi, qword [rsp + 0x68]
add rcx, qword [rsp + 0x68]
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rcx
test rsi, rsi
je 0x140080ddd
mov rbx, qword [rsp + 0x78]
movabs rdx, 0xfffffffff000
add rbx, 0x28
mov r14d, 0x5a4d
add rbx, rcx
mov qword [rsp + 0x60], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x70]
jmp 0x14007f24e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140080be0
mov esi, dword [rcx + 4]
test esi, esi
js 0x140080be0
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1aec4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x19b40]
call fcn.1400be1b0
lea rcx, [rbp + 0x19b40]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
lea rcx, [rbp + 0x19b40]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x52d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140080cc0
mov r8d, 0x1000
lea rdx, [rbp + 0x52d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdb0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdb0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x770]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x770]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1038]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdb0]
lea r9, [rbp + 0xdb0]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
jns 0x140080be3
mov rbx, qword [rbp + 0xd90]
mov qword [rbp + 0xd90], rbx
test rbx, rbx
jne 0x14008288d
mov rcx, qword [rbp - 0x80]
jmp 0x14007f695
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14007f7a4
mov esi, dword [rcx + 4]
test esi, esi
js 0x14007f7a4
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1c254], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1aed0]
call fcn.1400be1b0
lea rcx, [rbp + 0x1aed0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x1aed0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x52d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140080e91
mov r8d, 0x1000
lea rdx, [rbp + 0x52d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdb4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdb4], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x798]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x798]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1028]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdb4]
lea r9, [rbp + 0xdb4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140081322
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x7b0]
test rbx, rbx
je 0x140081322
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140081063
cmp word [rax], r14w
jne 0x140081063
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140081063
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140081063
mov r12d, dword [rax + 0x1c]
mov rdi, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140081063
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008116a
inc rdi
cmp rdi, r15
jb 0x140081040
xor r12d, r12d
test bl, 1
je 0x140081322
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x7d0], r12
xor edx, edx
mov qword [rbp + 0x7d8], r12
xorps xmm0, xmm0
mov qword [rbp + 0x7e0], r12
movups xmmword [rbp + 0x1018], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x7c0], 8
mov qword [rbp + 0x7c8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x1400815d2
cmp word [rax], bx
jne 0x1400815d2
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400815d2
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400815d2
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400815cd
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140081419
inc rbx
cmp rbx, r14
jb 0x140081143
jmp 0x1400815cd
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140081063
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140081063
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1d5e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1c260]
call fcn.1400be1b0
lea rcx, [rbp + 0x1c260]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
lea rcx, [rbp + 0x1c260]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x51d50], rax
inc rdi
cmp rdi, 0x200
jl 0x140081201
mov r8d, 0x1000
lea rdx, [rbp + 0x51d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdb8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdb8], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x798]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x798]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1028]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdb8]
lea r9, [rbp + 0xdb8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
jns 0x140081066
xor ebx, ebx
lea rdx, [rbp - 0x60]
lea rcx, str.Queried_CR3:
mov qword [rbp - 0x60], rbx
call fcn.1400c1130
mov qword [rbp + 0xd90], rbx
lea rcx, [rbp + 0x388]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x388]
call fcn.14003ce50
lea rcx, [rbp + 0x368]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x8
lea rcx, [rbp + 0x368]
call fcn.14003ce50
lea rdx, [rbp + 0x388]
lea rcx, [rbp + 0x368]
call fcn.14003cf90
mov r14, qword [0x140328f28]
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
xor eax, eax
lea r15, [rcx*8 + 0x10]
mov edi, eax
test rsi, rsi
jle 0x1400828ef
lea rbx, [r14 + 0x10]
nop word [rax + rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp], xmm0
test rax, rax
je 0x1400828dd
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x1400828dd
movzx ecx, byte [rbp]
test cl, cl
jne 0x1400828af
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x1400828dd
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400815cd
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400815cd
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1e974], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1d5f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x1d5f0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x1d5f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x53d50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400814b0
mov r8d, 0x1000
lea rdx, [rbp + 0x53d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdbc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdbc], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x7c0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1018]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdbc]
lea r9, [rbp + 0xdbc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140081322
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x7d8]
test rdi, rdi
je 0x140081322
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008167f
cmp word [rax], bx
jne 0x14008167f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008167f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008167f
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x14008167f
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400816ba
inc rbx
cmp rbx, r15
jb 0x140081660
xor r12d, r12d
test dil, 1
je 0x140081322
movzx eax, dil
shr al, 7
test al, 1
je 0x140081876
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140082325
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008167f
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008167f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x1fd04], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1e980]
call fcn.1400be1b0
lea rcx, [rbp + 0x1e980]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x1e980]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x50d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140081750
mov r8d, 0x1000
lea rdx, [rbp + 0x50d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdc0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdc0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x7c0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x7c0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1018]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdc0]
lea r9, [rbp + 0xdc0]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140081322
jmp 0x140081682
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x7f8], r12
xor edx, edx
mov qword [rbp + 0x800], r12
xorps xmm0, xmm0
mov qword [rbp + 0x808], r12
movups xmmword [rbp + 0x1008], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x7e8], 8
mov qword [rbp + 0x7f0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140081b33
cmp word [rax], r14w
jne 0x140081b33
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140081b33
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140081b33
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140081b2d
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140081973
inc rbx
cmp rbx, r14
jb 0x140081950
jmp 0x140081b2d
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140081b2d
mov esi, dword [rcx + 4]
test esi, esi
js 0x140081b2d
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x21094], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x1fd10]
call fcn.1400be1b0
lea rcx, [rbp + 0x1fd10]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
lea rcx, [rbp + 0x1fd10]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4fd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140081a10
mov r8d, 0x1000
lea rdx, [rbp + 0x4fd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdc4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdc4], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x7e8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x7e8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1008]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdc4]
lea r9, [rbp + 0xdc4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140081322
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x800]
test rbx, rbx
je 0x140081322
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140081bdf
cmp word [rax], r14w
jne 0x140081bdf
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140081bdf
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140081bdf
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140081bdf
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140081c13
inc rdi
cmp rdi, r15
jb 0x140081bc0
xor r12d, r12d
test bl, 1
je 0x140081322
movzx eax, bl
shr al, 7
test al, 1
je 0x140081dc8
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3ffffffe00000
and edi, 0x1fffff
jmp 0x14008231f
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140081bdf
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140081bdf
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x22424], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x210a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x210a0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
lea rcx, [rbp + 0x210a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4ed50], rax
inc rdi
cmp rdi, 0x200
jl 0x140081ca2
mov r8d, 0x1000
lea rdx, [rbp + 0x4ed50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdc8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdc8], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x7e8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x7e8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1008]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdc8]
lea r9, [rbp + 0xdc8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140081322
jmp 0x140081be2
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x820], r12
xor edx, edx
mov qword [rbp + 0x828], r12
xorps xmm0, xmm0
mov qword [rbp + 0x830], r12
movups xmmword [rbp + 0xff8], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x810], 8
mov qword [rbp + 0x818], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140082083
cmp word [rax], r14w
jne 0x140082083
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140082083
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140082083
mov r15d, dword [rax + 0x1c]
xor ebx, ebx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008207d
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140081ec3
inc rbx
cmp rbx, r14
jb 0x140081ea0
jmp 0x14008207d
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008207d
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008207d
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x237b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x22430]
call fcn.1400be1b0
lea rcx, [rbp + 0x22430]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
lea rcx, [rbp + 0x22430]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4dd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140081f60
mov r8d, 0x1000
lea rdx, [rbp + 0x4dd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdcc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdcc], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x810]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x810]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xff8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdcc]
lea r9, [rbp + 0xdcc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140081322
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x828]
test rbx, rbx
je 0x140081322
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140082301
cmp word [rax], r14w
jne 0x140082301
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140082301
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140082301
mov r12d, dword [rax + 0x1c]
xor edi, edi
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140082301
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140082144
inc rdi
cmp rdi, r15
jb 0x140082120
jmp 0x140082301
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140082301
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140082301
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x24b44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x237c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x237c0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x237c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4cd50], rax
inc rdi
cmp rdi, 0x200
jl 0x1400821e0
mov r8d, 0x1000
lea rdx, [rbp + 0x4cd50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdd0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdd0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x810]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x810]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xff8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdd0]
lea r9, [rbp + 0xdd0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140081322
test bl, 1
je 0x140081322
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x140081322
mov r13d, dword [0x140322b68]
mov rax, rdi
and eax, 0xfff
mov qword [rbp + 0x840], rdi
xorps xmm0, xmm0
mov ecx, 0x1000
sub rcx, rax
mov rax, qword [rbp - 0x78]
cmp rcx, rax
movups xmmword [rbp + 0xfe8], xmm0
cmovb rax, rcx
xor ebx, ebx
mov qword [rsp + 0x68], rax
lea rcx, [0x1401fded8]
mov qword [rbp + 0x838], rax
xor edx, edx
mov rax, qword [0x140329cf0]
lea r8d, [rbx + 1]
mov qword [rbp + 0x848], rbx
mov qword [rbp + 0x850], rbx
mov qword [rbp + 0x858], rbx
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov esi, 0x5a4d
test rax, rax
je 0x1400825e4
cmp word [rax], si
jne 0x1400825e4
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400825e4
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400825e4
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400825df
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140082423
inc rbx
cmp rbx, r14
jb 0x140082400
jmp 0x1400825dd
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400825dd
mov esi, dword [rcx + 4]
test esi, esi
js 0x1400825dd
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x25ed4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x24b50]
call fcn.1400be1b0
lea rcx, [rbp + 0x24b50]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x24b50]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4bd50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400824c0
mov r8d, 0x1000
lea rdx, [rbp + 0x4bd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdd4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdd4], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x838]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x838]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfe8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdd4]
lea r9, [rbp + 0xdd4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x14008287f
xor ebx, ebx
mov esi, 0x5a4d
mov rdx, qword [rbp + 0x850]
test rdx, rdx
je 0x14008287f
mov r8, qword [rsp + 0x68]
lea rcx, [rbp + 0xd90]
add rcx, qword [rbp - 0x70]
call fcn.1401d15a0
mov rax, qword [0x140329cf0]
lea rcx, [0x1401fded8]
mov r13d, dword [0x140322768]
xor edx, edx
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140082690
cmp word [rax], si
jne 0x140082690
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140082690
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140082690
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140082690
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400826d6
inc rbx
cmp rbx, r14
jb 0x140082672
xor r15d, r15d
mov rsi, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
sub rsi, qword [rsp + 0x68]
add rcx, qword [rsp + 0x68]
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rcx
test rsi, rsi
je 0x14008287f
mov rbx, qword [rsp + 0x78]
add rbx, 0x388
add rbx, rcx
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x60], rbx
mov rax, rbx
jmp 0x14007f6c2
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140082690
mov esi, dword [rcx + 4]
test esi, esi
js 0x140082690
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x27264], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x25ee0]
call fcn.1400be1b0
lea rcx, [rbp + 0x25ee0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x25ee0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x54d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140082762
mov r8d, 0x1000
lea rdx, [rbp + 0x54d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdd8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdd8], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x70]
lea rax, [rbp + 0x838]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x838]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfe8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdd8]
lea r9, [rbp + 0xdd8]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
jns 0x140082693
mov rbx, qword [rbp + 0xd90]
mov qword [rbp + 0xd90], rbx
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], rbx
lea rcx, str.Queried_CR3:
call fcn.1400c1130
test rbx, rbx
jne 0x14008139c
jmp 0x14008133f
cmp cl, 1
jne 0x1400828dd
mov rdx, rax
lea rcx, [rbp + 0x1140]
call fcn.140040c90
xor edx, edx
lea rcx, [rbp + 0x1140]
call fcn.1400bca40
lea rcx, [rbp + 0x1140]
call fcn.1400b87b0
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x1400813d0
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
xor edi, edi
mov ecx, 0x26b0
mov qword [0x140328f28], rdi
call fcn.1401ab860
test rax, rax
je 0x14008292e
mov qword [rax], rdi
mov qword [rax + 8], 0x19c
mov qword [0x140328f28], rax
xor edx, edx
mov qword [rsp + 0x70], rdi
lea rcx, str.win32k.sys
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x78], rdi
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1400829b9
lea rcx, [rbp + 0x448]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x448]
call fcn.14003ce50
lea rcx, [rbp + 0x4a8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Code:_0x2_:_0x9
lea rcx, [rbp + 0x4a8]
call fcn.14003ce50
lea rdx, [rbp + 0x448]
lea rcx, [rbp + 0x4a8]
call fcn.14003cf90
xor edx, edx
lea rcx, str.win32k.sys
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r15, rax
test rax, rax
je 0x140082aae
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140082a52
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140082a52
movsxd rax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140082a52
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140082a52
mov r12d, dword [rax + 0x1c]
xor ebx, ebx
mov r13d, dword [rax + 0x24]
add r12, rdi
mov esi, dword [rax + 0x20]
add r13, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140082a52
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDCompositionRegisterThumbnailVisual
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140082b59
inc rbx
cmp rbx, r14
jb 0x140082a30
mov esi, 0xffffefff
movsxd r14, dword [r15 + 0x3c]
xor eax, eax
add r14, r15
mov edi, eax
movzx ebx, word [r14 + 0x14]
add rbx, 0x18
add rbx, r14
cmp ax, word [r14 + 6]
jae 0x140082aac
nop word [rax + rax]
mov r8d, 8
lea rdx, str.TABLERO
mov rcx, rbx
call fcn.1401d22e0
test eax, eax
je 0x140082b8b
movzx eax, word [r14 + 6]
add rbx, 0x28
inc edi
cmp edi, eax
jl 0x140082a80
xor edi, edi
mov r14, rdi
lea rcx, [rbp + 0x4c8]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x4c8]
call fcn.14003ce50
lea rcx, [rbp + 0x4e8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Code:_0x2_:_0x10
lea rcx, [rbp + 0x4e8]
call fcn.14003ce50
lea rdx, [rbp + 0x4c8]
lea rcx, [rbp + 0x4e8]
call fcn.14003cf90
mov r15, qword [rbp - 0x58]
mov ebx, edi
mov rdx, qword [rbp - 0x48]
mov r12, qword [rsp + 0x70]
xor r15, rdx
mov r13, qword [rsp + 0x68]
mov ecx, ebx
test ebx, ebx
je 0x140082c23
sub ecx, 1
je 0x140082c17
sub ecx, 1
je 0x140082c0a
cmp ecx, 1
jne 0x140082c8e
mov rax, qword [rbp - 0x50]
xor rax, rdx
mov ecx, dword [rax + 4]
jmp 0x140082c27
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rdi
je 0x140082a52
mov esi, dword [rcx + 4]
test esi, esi
js 0x140082a52
add esi, 0xfffff000
cmp esi, 0xffffffff
jne 0x140082a57
jmp 0x140082aac
cmp dword [rbx + 0x14], 0
je 0x140082aac
cmp dword [rbx + 0x10], 0
je 0x140082aac
mov r8d, dword [rbx + 8]
lea eax, [rsi*4]
xor edi, edi
mov ecx, edi
sub r8d, eax
je 0x140082bf8
mov r9d, dword [rbx + 0xc]
movsxd rax, esi
lea r10, [rax*4]
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + r9]
mov r14d, eax
add rax, r15
mov edx, dword [rax + r10]
test edx, edx
je 0x140082bf1
cmp byte [rdx + r15], 0xcc
je 0x140082bf1
cmp byte [rdx + r15 - 1], 0xcc
je 0x140082bfc
inc ecx
cmp ecx, r8d
jb 0x140082bd0
mov r14d, dword [rbx + 0xc]
test r14, r14
jne 0x140082b0e
jmp 0x140082ab1
mov rax, qword [rsp + 0x58]
xor rax, rdx
mov ecx, dword [rax + 4]
jmp 0x140082c27
mov rax, qword [rbp - 0x18]
xor rax, rdx
mov ecx, dword [rax + 4]
jmp 0x140082c27
mov ecx, dword [r15 + 4]
lea edi, [rcx - 0x1000]
test edi, edi
jns 0x140082c8e
lea rcx, [rbp + 0x188]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x188]
call fcn.14003ce50
lea rcx, [rbp + 0x1a8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Code:_0x2_:_0x11
lea rcx, [rbp + 0x1a8]
call fcn.14003ce50
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x1a8]
call fcn.14003cf90
lea eax, [rdi*4]
movsxd rcx, eax
add rcx, r14
mov esi, dword [rcx + r13]
test esi, esi
jne 0x140082cfc
lea rcx, [rbp + 0x208]
call fcn.14003cdd0
lea r8d, [rsi + 0xe]
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x208]
call fcn.14003ce50
lea rcx, [rbp + 0x1c8]
call fcn.14003cdd0
lea r8d, [rsi + 0x10]
lea rdx, str.Code:_0x2_:_0x12
lea rcx, [rbp + 0x1c8]
call fcn.14003ce50
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x1c8]
call fcn.14003cf90
movzx ecx, byte [rsi + r13]
xor eax, eax
mov edi, eax
mov r8d, eax
lea rax, [rsi + r13]
cmp cl, 0xcc
je 0x140082d46
mov rdx, rax
cmp cl, 0x48
jne 0x140082d25
cmp byte [rax + 1], 0x8b
jne 0x140082d25
cmp byte [rax + 2], 5
je 0x140082d39
movzx ecx, byte [rdx + 1]
inc rdx
inc r8d
mov rax, rdx
cmp cl, 0xcc
jne 0x140082d14
jmp 0x140082d46
mov edi, dword [rax + 3]
add edi, 7
add edi, r8d
add edi, esi
jne 0x140082da3
lea rcx, [rbp + 0x248]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x248]
call fcn.14003ce50
lea rcx, [rbp + 0x2c8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Code:_0x2_:_0x13
lea rcx, [rbp + 0x2c8]
call fcn.14003ce50
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x2c8]
call fcn.14003cf90
mov ecx, ebx
test ebx, ebx
je 0x140082e04
sub ecx, 1
je 0x140082df3
sub ecx, 1
je 0x140082de2
cmp ecx, 1
je 0x140082e14
mov rdx, qword [rbp - 0x80]
inc ebx
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x80], rdx
mov rdx, qword [rbp - 0x70]
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x78], rax
cmp ebx, 4
jge 0x140082e18
mov rdx, qword [rbp - 0x48]
xor edi, edi
jmp 0x140082b25
mov rdx, qword [rbp - 0x48]
inc ebx
mov qword [rbp - 0x70], rdi
xor edi, edi
jmp 0x140082b25
mov rdx, qword [rbp - 0x48]
inc ebx
mov qword [rbp - 0x80], rdi
xor edi, edi
jmp 0x140082b25
mov rdx, qword [rbp - 0x48]
inc ebx
mov r12, rdi
xor edi, edi
jmp 0x140082b25
mov qword [rbp - 0x78], rdi
lea rdx, [rbp + 0x10d8]
lea rcx, [rbp + 0x588]
call fcn.140040c90
xor r15d, r15d
lea rcx, [rbp + 0xa8]
mov edi, r15d
mov r14, rax
call fcn.14003cdd0
lea rcx, [rbp + 0xa8]
call fcn.14003cdf0
mov rcx, r14
call fcn.140040db0
mov rcx, r14
mov rbx, rax
call fcn.1400b8590
mov rsi, rax
cmp rbx, rax
je 0x140082e99
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x140082e85
test edi, edi
je 0x140082e99
inc edi
lea rcx, [rbp + 0xa8]
xor edx, edx
call fcn.1400bca40
jmp 0x140082e91
lea rcx, [rbp + 0xa8]
call fcn.1400b8550
inc rbx
cmp rbx, rsi
jne 0x140082e67
mov rcx, r14
call fcn.1400b87b0
lea rcx, [rbp + 0xa8]
call fcn.140040db0
mov r9, qword [rbp + 0x12e0]
lea rcx, str.ntoskrnl.exe
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
call fcn.1400607a0
mov rcx, qword [rbp + 0x11b0]
add rcx, r12
mov qword [rbp + 0x38], rax
mov rax, r15
mov qword [rbp - 0x50], rcx
mov qword [rsp + 0x68], rax
add rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, rax
mov qword [rsp + 0x78], 8
mov rax, qword [rbp + 0xd90]
movabs rdx, 0xfffffffff000
mov r13d, dword [0x140322b68]
and rax, rdx
shr rcx, 0x27
xor edx, edx
and ecx, 0x1ff
mov qword [rbp + 0x870], r15
xorps xmm0, xmm0
mov qword [rbp + 0x878], r15
mov qword [rbp + 0x880], r15
lea r8d, [rdx + 1]
mov qword [rbp + 0x860], 8
lea rax, [rax + rcx*8]
mov qword [rbp + 0x868], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
movups xmmword [rbp + 0xfd8], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400831a5
cmp word [rax], r14w
jne 0x1400831a5
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400831a5
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400831a5
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140082fee
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140082ff6
inc rbx
cmp rbx, r14
jb 0x140082fd0
xor r15d, r15d
jmp 0x14008319f
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140082fee
mov esi, dword [rcx + 4]
test esi, esi
js 0x140082fee
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x285f4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x27270]
call fcn.1400be1b0
lea rcx, [rbp + 0x27270]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x27270]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x52d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140083082
mov r8d, 0x1000
lea rdx, [rbp + 0x52d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xddc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xddc], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x860]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x860]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfd8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xddc]
lea r9, [rbp + 0xddc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140083521
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x878]
test rbx, rbx
je 0x140083521
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140083253
cmp word [rax], r14w
jne 0x140083253
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140083253
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140083253
mov r12d, dword [rax + 0x1c]
mov rdi, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140083253
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140083367
inc rdi
cmp rdi, r15
jb 0x140083230
xor r12d, r12d
test bl, 1
je 0x140083521
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x898], r12
xor edx, edx
mov qword [rbp + 0x8a0], r12
xorps xmm0, xmm0
mov qword [rbp + 0x8a8], r12
movups xmmword [rbp + 0xeb8], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x888], 8
mov qword [rbp + 0x890], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140083762
cmp word [rax], bx
jne 0x140083762
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140083762
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140083762
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x14008375d
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400835aa
inc rbx
cmp rbx, r14
jb 0x140083340
jmp 0x14008375d
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140083253
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140083253
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x29984], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x28600]
call fcn.1400be1b0
lea rcx, [rbp + 0x28600]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop
lea rcx, [rbp + 0x28600]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x51d50], rax
inc rdi
cmp rdi, 0x200
jl 0x140083400
mov r8d, 0x1000
lea rdx, [rbp + 0x51d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xde0]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xde0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x860]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x860]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfd8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xde0]
lea r9, [rbp + 0xde0]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
jns 0x140083256
lea rcx, [rbp + 0xa8]
call fcn.1400b87b0
lea rdx, [rbp + 0x10d8]
lea rcx, [rbp + 0x568]
call fcn.140040c90
xor r15d, r15d
lea rcx, [rbp + 0xc8]
mov edi, r15d
mov r14, rax
call fcn.14003cdd0
lea rcx, [rbp + 0xc8]
call fcn.14003cdf0
mov rcx, r14
call fcn.140040db0
mov rcx, r14
mov rbx, rax
call fcn.1400b8590
mov rsi, rax
cmp rbx, rax
je 0x140084a41
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x140084a29
cmp edi, 1
je 0x140084a41
inc edi
lea rcx, [rbp + 0xc8]
xor edx, edx
call fcn.1400bca40
jmp 0x140084a35
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008375d
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008375d
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2ad14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x29990]
call fcn.1400be1b0
lea rcx, [rbp + 0x29990]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop
lea rcx, [rbp + 0x29990]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x53d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140083640
mov r8d, 0x1000
lea rdx, [rbp + 0x53d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xde4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xde4], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x888]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x888]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xeb8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xde4]
lea r9, [rbp + 0xde4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140083521
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x8a0]
test rdi, rdi
je 0x140083521
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008380f
cmp word [rax], bx
jne 0x14008380f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008380f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008380f
mov r12d, dword [rax + 0x1c]
xor ecx, ecx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
mov ebx, ecx
test r15, r15
je 0x14008380f
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008384a
inc rbx
cmp rbx, r15
jb 0x1400837f0
xor r12d, r12d
test dil, 1
je 0x140083521
movzx eax, dil
shr al, 7
test al, 1
je 0x140083a06
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x1400844c5
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008380f
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008380f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2c0a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2ad20]
call fcn.1400be1b0
lea rcx, [rbp + 0x2ad20]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x2ad20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x50d50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400838e0
mov r8d, 0x1000
lea rdx, [rbp + 0x50d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xde8]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xde8], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x888]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x888]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xeb8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xde8]
lea r9, [rbp + 0xde8]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140083521
jmp 0x140083812
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x8c0], r12
xor edx, edx
mov qword [rbp + 0x8c8], r12
xorps xmm0, xmm0
mov qword [rbp + 0x8d0], r12
movups xmmword [rbp + 0xf48], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x8b0], 8
mov qword [rbp + 0x8b8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140083cc2
cmp word [rax], bx
jne 0x140083cc2
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140083cc2
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140083cc2
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140083cbd
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140083b03
inc rbx
cmp rbx, r14
jb 0x140083ae0
jmp 0x140083cbd
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140083cbd
mov esi, dword [rcx + 4]
test esi, esi
js 0x140083cbd
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3b14], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2790]
call fcn.1400be1b0
lea rcx, [rbp + 0x2790]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
lea rcx, [rbp + 0x2790]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4fd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140083ba0
mov r8d, 0x1000
lea rdx, [rbp + 0x4fd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdec]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdec], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x8b0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x8b0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf48]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdec]
lea r9, [rbp + 0xdec]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140083521
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x8c8]
test rdi, rdi
je 0x140083521
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140083d6f
cmp word [rax], bx
jne 0x140083d6f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140083d6f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140083d6f
mov r12d, dword [rax + 0x1c]
xor ecx, ecx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
mov ebx, ecx
test r15, r15
je 0x140083d6f
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140083daa
inc rbx
cmp rbx, r15
jb 0x140083d50
xor r12d, r12d
test dil, 1
je 0x140083521
movzx eax, dil
shr al, 7
test al, 1
je 0x140083f66
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x1400844c5
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140083d6f
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140083d6f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2e7c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2d440]
call fcn.1400be1b0
lea rcx, [rbp + 0x2d440]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x2d440]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4ed50], rax
inc rbx
cmp rbx, 0x200
jl 0x140083e40
mov r8d, 0x1000
lea rdx, [rbp + 0x4ed50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdf0]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdf0], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x8b0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8b0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf48]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdf0]
lea r9, [rbp + 0xdf0]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140083521
jmp 0x140083d72
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x8e8], r12
xor edx, edx
mov qword [rbp + 0x8f0], r12
xorps xmm0, xmm0
mov qword [rbp + 0x8f8], r12
movups xmmword [rbp + 0xed8], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x8d8], 8
mov qword [rbp + 0x8e0], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140084223
cmp word [rax], r14w
jne 0x140084223
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140084223
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140084223
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x14008421d
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140084063
inc rbx
cmp rbx, r14
jb 0x140084040
jmp 0x14008421d
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008421d
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008421d
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2fb54], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2e7d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x2e7d0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop word [rax + rax]
lea rcx, [rbp + 0x2e7d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4dd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140084100
mov r8d, 0x1000
lea rdx, [rbp + 0x4dd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdf4]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdf4], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x8d8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x8d8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xed8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdf4]
lea r9, [rbp + 0xdf4]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x140083521
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x8f0]
test rbx, rbx
je 0x140083521
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400844a1
cmp word [rax], r14w
jne 0x1400844a1
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400844a1
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400844a1
mov r12d, dword [rax + 0x1c]
xor ecx, ecx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
mov edi, ecx
test r15, r15
je 0x1400844a1
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400842e4
inc rdi
cmp rdi, r15
jb 0x1400842c0
jmp 0x1400844a1
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400844a1
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400844a1
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x30ee4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2fb60]
call fcn.1400be1b0
lea rcx, [rbp + 0x2fb60]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax + rax]
lea rcx, [rbp + 0x2fb60]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4cd50], rax
inc rdi
cmp rdi, 0x200
jl 0x140084380
mov r8d, 0x1000
lea rdx, [rbp + 0x4cd50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdf8]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xdf8], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x8d8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x8d8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xed8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xdf8]
lea r9, [rbp + 0xdf8]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140083521
test bl, 1
je 0x140083521
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x140083521
mov r13, qword [rsp + 0x78]
mov rax, rdi
and eax, 0xfff
mov qword [rbp + 0x908], rdi
xorps xmm0, xmm0
mov ecx, 0x1000
sub rcx, rax
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov qword [rbp + 0x900], r13
xor edx, edx
mov qword [rbp + 0x910], rbx
lea rcx, [0x1401fded8]
mov qword [rbp + 0x918], rbx
mov qword [rbp + 0x920], rbx
lea r8d, [rbx + 1]
movups xmmword [rbp + 0xec8], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov esi, 0x5a4d
test rax, rax
je 0x140084787
cmp word [rax], si
jne 0x140084787
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140084787
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140084787
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140084782
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400845c3
inc rbx
cmp rbx, r14
jb 0x1400845a0
jmp 0x140084780
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140084780
mov esi, dword [rcx + 4]
test esi, esi
js 0x140084780
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x32274], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x30ef0]
call fcn.1400be1b0
lea rcx, [rbp + 0x30ef0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x30ef0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4bd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140084660
mov r8d, 0x1000
lea rdx, [rbp + 0x4bd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xdfc]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xdfc], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x900]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x900]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xec8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xdfc]
lea r9, [rbp + 0xdfc]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140083521
xor ebx, ebx
mov esi, 0x5a4d
mov rcx, qword [rbp + 0x918]
test rcx, rcx
je 0x140083521
lea rdx, [rbp + 0x38]
mov r8, r13
add rdx, qword [rsp + 0x68]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x14008483e
cmp word [rax], si
jne 0x14008483e
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14008483e
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14008483e
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x14008483e
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140084878
inc rbx
cmp rbx, r14
jb 0x140084820
xor r15d, r15d
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
sub rsi, r13
add rax, r13
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x68], rax
test rsi, rsi
je 0x140083521
mov rbx, qword [rbp - 0x50]
add rbx, rax
mov qword [rsp + 0x60], rbx
mov rcx, rbx
jmp 0x140082ef9
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008483e
mov esi, dword [rcx + 4]
test esi, esi
js 0x14008483e
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x33604], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x32280]
call fcn.1400be1b0
lea rcx, [rbp + 0x32280]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x32280]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x54d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140084904
mov r8d, 0x1000
lea rdx, [rbp + 0x54d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], esi
lea rbx, [rdi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe00]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe00], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x900]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x900]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xec8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe00]
lea r9, [rbp + 0xe00]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140083521
jmp 0x140084841
lea rcx, [rbp + 0xc8]
call fcn.1400b8550
inc rbx
cmp rbx, rsi
jne 0x140083580
mov rcx, r14
call fcn.1400b87b0
lea rcx, [rbp + 0xc8]
call fcn.140040db0
mov r9, qword [rbp + 0x12e0]
lea rcx, str.ntoskrnl.exe
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
call fcn.1400607a0
mov rcx, qword [rbp + 0x11b0]
add rcx, qword [rbp - 0x80]
mov qword [rbp + 0x40], rax
mov rax, r15
mov qword [rsp + 0x78], rax
add rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, rax
mov qword [rsp + 0x68], 8
mov rax, qword [rbp + 0xd90]
movabs rdx, 0xfffffffff000
mov r13d, dword [0x140322b68]
and rax, rdx
shr rcx, 0x27
xor edx, edx
and ecx, 0x1ff
mov qword [rbp + 0x938], r15
xorps xmm0, xmm0
mov qword [rbp + 0x940], r15
mov qword [rbp + 0x948], r15
lea r8d, [rdx + 1]
mov qword [rbp + 0x928], 8
lea rax, [rax + rcx*8]
mov qword [rbp + 0x930], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
movups xmmword [rbp + 0x1068], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140084d58
cmp word [rax], r14w
jne 0x140084d58
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140084d58
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140084d58
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140084b9e
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140084ba6
inc rbx
cmp rbx, r14
jb 0x140084b80
xor r15d, r15d
jmp 0x140084d52
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140084b9e
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140084b9e
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x34994], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x33610]
call fcn.1400be1b0
lea rcx, [rbp + 0x33610]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x33610]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x52d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140084c34
mov r8d, 0x1000
lea rdx, [rbp + 0x52d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe04]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe04], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x928]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x928]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0x1068]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe04]
lea r9, [rbp + 0xe04]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x1400850d1
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x940]
test rbx, rbx
je 0x1400850d1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140084e03
cmp word [rax], r14w
jne 0x140084e03
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140084e03
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140084e03
mov r12d, dword [rax + 0x1c]
mov rdi, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140084e03
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140084f17
inc rdi
cmp rdi, r15
jb 0x140084de0
xor r12d, r12d
test bl, 1
je 0x1400850d1
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x960], r12
xor edx, edx
mov qword [rbp + 0x968], r12
xorps xmm0, xmm0
mov qword [rbp + 0x970], r12
movups xmmword [rbp + 0xfb8], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0x950], 8
mov qword [rbp + 0x958], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140085313
cmp word [rax], bx
jne 0x140085313
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140085313
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140085313
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x14008530e
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008515a
inc rbx
cmp rbx, r14
jb 0x140084ef0
jmp 0x14008530e
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140084e03
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140084e03
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x35d24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x349a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x349a0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop
lea rcx, [rbp + 0x349a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x51d50], rax
inc rdi
cmp rdi, 0x200
jl 0x140084fb0
mov r8d, 0x1000
lea rdx, [rbp + 0x51d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe08]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe08], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x928]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x928]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1068]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe08]
lea r9, [rbp + 0xe08]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
jns 0x140084e06
lea rcx, [rbp + 0xc8]
call fcn.1400b87b0
lea rdx, [rbp + 0x10d8]
lea rcx, [rbp + 0x548]
call fcn.140040c90
xor r15d, r15d
lea rcx, [rbp + 0x88]
mov edi, r15d
mov r14, rax
call fcn.14003cdd0
lea rcx, [rbp + 0x88]
call fcn.14003cdf0
mov rcx, r14
call fcn.140040db0
mov rcx, r14
mov rbx, rax
call fcn.1400b8590
mov rsi, rax
cmp rbx, rax
je 0x1400865fe
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x1400865e6
cmp edi, 2
je 0x1400865fe
inc edi
lea rcx, [rbp + 0x88]
xor edx, edx
call fcn.1400bca40
jmp 0x1400865f2
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008530e
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008530e
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x370b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x35d30]
call fcn.1400be1b0
lea rcx, [rbp + 0x35d30]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
lea rcx, [rbp + 0x35d30]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x53d50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400851f0
mov r8d, 0x1000
lea rdx, [rbp + 0x53d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe0c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe0c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x950]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x950]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfb8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe0c]
lea r9, [rbp + 0xe0c]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x1400850d1
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x968]
test rdi, rdi
je 0x1400850d1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400853bf
cmp word [rax], bx
jne 0x1400853bf
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400853bf
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400853bf
mov r12d, dword [rax + 0x1c]
xor ecx, ecx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
mov ebx, ecx
test r15, r15
je 0x1400853bf
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400853fa
inc rbx
cmp rbx, r15
jb 0x1400853a0
xor r12d, r12d
test dil, 1
je 0x1400850d1
movzx eax, dil
shr al, 7
test al, 1
je 0x1400855b6
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140086075
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400853bf
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400853bf
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x38444], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x370c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x370c0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x370c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x50d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140085490
mov r8d, 0x1000
lea rdx, [rbp + 0x50d50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe7c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe7c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x950]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x950]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfb8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe7c]
lea r9, [rbp + 0xe7c]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x1400850d1
jmp 0x1400853c2
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x988], r12
xor edx, edx
mov qword [rbp + 0x990], r12
xorps xmm0, xmm0
mov qword [rbp + 0x998], r12
movups xmmword [rbp + 0xfa8], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x978], 8
mov qword [rbp + 0x980], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140085873
cmp word [rax], bx
jne 0x140085873
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140085873
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140085873
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x14008586e
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400856b3
inc rbx
cmp rbx, r14
jb 0x140085690
jmp 0x14008586e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x14008586e
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008586e
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x397d4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x38450]
call fcn.1400be1b0
lea rcx, [rbp + 0x38450]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x38450]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4fd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140085750
mov r8d, 0x1000
lea rdx, [rbp + 0x4fd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + rdi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe10]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe10], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x978]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x978]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfa8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe10]
lea r9, [rbp + 0xe10]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x1400850d1
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0x990]
test rdi, rdi
je 0x1400850d1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x14008591f
cmp word [rax], bx
jne 0x14008591f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14008591f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14008591f
mov r12d, dword [rax + 0x1c]
xor ecx, ecx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
mov ebx, ecx
test r15, r15
je 0x14008591f
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008595a
inc rbx
cmp rbx, r15
jb 0x140085900
xor r12d, r12d
test dil, 1
je 0x1400850d1
movzx eax, dil
shr al, 7
test al, 1
je 0x140085b16
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x140086075
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x14008591f
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x14008591f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3ab64], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x397e0]
call fcn.1400be1b0
lea rcx, [rbp + 0x397e0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x397e0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4ed50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400859f0
mov r8d, 0x1000
lea rdx, [rbp + 0x4ed50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe14]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe14], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x978]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x978]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfa8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe14]
lea r9, [rbp + 0xe14]
mov edx, 0x1000
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x1400850d1
jmp 0x140085922
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x9b0], r12
xor edx, edx
mov qword [rbp + 0x9b8], r12
xorps xmm0, xmm0
mov qword [rbp + 0x9c0], r12
movups xmmword [rbp + 0xf98], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x9a0], 8
mov qword [rbp + 0x9a8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140085dd4
cmp word [rax], r14w
jne 0x140085dd4
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140085dd4
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140085dd4
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140085dce
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140085c17
inc rbx
cmp rbx, r14
jb 0x140085bf0
jmp 0x140085dce
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140085dce
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140085dce
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3bef4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3ab70]
call fcn.1400be1b0
lea rcx, [rbp + 0x3ab70]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x3ab70]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4dd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140085cb0
mov r8d, 0x1000
lea rdx, [rbp + 0x4dd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe18]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe18], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x9a0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x9a0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf98]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe18]
lea r9, [rbp + 0xe18]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x1400850d1
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x9b8]
test rbx, rbx
je 0x1400850d1
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140086051
cmp word [rax], r14w
jne 0x140086051
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140086051
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140086051
mov r12d, dword [rax + 0x1c]
xor ecx, ecx
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
mov edi, ecx
test r15, r15
je 0x140086051
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140085e98
inc rdi
cmp rdi, r15
jb 0x140085e70
jmp 0x140086051
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140086051
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140086051
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3d284], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3bf00]
call fcn.1400be1b0
lea rcx, [rbp + 0x3bf00]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop
lea rcx, [rbp + 0x3bf00]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4cd50], rax
inc rdi
cmp rdi, 0x200
jl 0x140085f30
mov r8d, 0x1000
lea rdx, [rbp + 0x4cd50]
mov rcx, r15
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rdi, [rsi + r15]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe1c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r15
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe1c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x9a0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x9a0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf98]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe1c]
lea r9, [rbp + 0xe1c]
mov edx, 0x1000
mov rcx, r15
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r15
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x1400850d1
test bl, 1
je 0x1400850d1
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x1400850d1
mov r13, qword [rsp + 0x68]
mov rax, rdi
and eax, 0xfff
mov qword [rbp + 0x9d0], rdi
xorps xmm0, xmm0
mov ecx, 0x1000
sub rcx, rax
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov qword [rbp + 0x9c8], r13
xor edx, edx
mov qword [rbp + 0x9d8], r14
lea rcx, [0x1401fded8]
mov qword [rbp + 0x9e0], r14
mov qword [rbp + 0x9e8], r14
lea r8d, [r14 + 1]
movups xmmword [rbp + 0xf88], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140086336
cmp word [rax], bx
jne 0x140086336
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140086336
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140086336
mov r15d, dword [rax + 0x1c]
mov ebx, r14d
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140086172
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008617a
inc rbx
cmp rbx, r14
jb 0x140086150
xor r14d, r14d
jmp 0x140086331
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140086172
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140086172
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3e614], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3d290]
call fcn.1400be1b0
lea rcx, [rbp + 0x3d290]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop word [rax + rax]
lea rcx, [rbp + 0x3d290]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4bd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140086210
mov r8d, 0x1000
lea rdx, [rbp + 0x4bd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe20]
movsd qword [rbx], xmm0
xor r14d, r14d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [r14 + 0x20]
mov dword [rbp + 0xe20], r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x9c8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x9c8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf88]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe20]
lea r9, [rbp + 0xe20]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [r14 + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r14d
test ebx, ebx
js 0x1400850d1
mov ebx, 0x5a4d
mov rcx, qword [rbp + 0x9e0]
test rcx, rcx
je 0x1400850d1
lea rdx, [rbp + 0x40]
mov r8, r13
add rdx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x1400863ee
cmp word [rax], bx
jne 0x1400863ee
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400863ee
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400863ee
mov r15d, dword [rax + 0x1c]
mov rbx, r14
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400863ee
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008642f
inc rbx
cmp rbx, r14
jb 0x1400863d0
xor r15d, r15d
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
sub rsi, r13
add rax, r13
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rax
test rsi, rsi
je 0x1400850d1
mov rbx, qword [rbp - 0x80]
add rbx, qword [rbp + 0x11b0]
add rbx, rax
mov qword [rsp + 0x60], rbx
mov rcx, rbx
jmp 0x140084a9e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400863ee
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400863ee
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x3f9a4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3e620]
call fcn.1400be1b0
lea rcx, [rbp + 0x3e620]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop dword [rax]
lea rcx, [rbp + 0x3e620]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x54d50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400864c0
mov r8d, 0x1000
lea rdx, [rbp + 0x54d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe24]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe24], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x9c8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x9c8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf88]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe24]
lea r9, [rbp + 0xe24]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x1400850d1
jmp 0x1400863f1
lea rcx, [rbp + 0x88]
call fcn.1400b8550
inc rbx
cmp rbx, rsi
jne 0x140085130
mov rcx, r14
call fcn.1400b87b0
lea rcx, [rbp + 0x88]
call fcn.140040db0
mov r9, qword [rbp + 0x12e0]
lea rcx, str.ntoskrnl.exe
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
call fcn.1400607a0
mov rcx, qword [rbp + 0x11b0]
add rcx, qword [rbp - 0x70]
mov qword [rbp + 0x48], rax
mov rax, r15
mov qword [rsp + 0x78], rax
add rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, rax
mov qword [rsp + 0x68], 8
mov rax, qword [rbp + 0xd90]
movabs rdx, 0xfffffffff000
mov r13d, dword [0x140322b68]
and rax, rdx
shr rcx, 0x27
xor edx, edx
and ecx, 0x1ff
mov qword [rbp + 0xa00], r15
xorps xmm0, xmm0
mov qword [rbp + 0xa08], r15
mov qword [rbp + 0xa10], r15
lea r8d, [rdx + 1]
mov qword [rbp + 0x9f0], 8
lea rax, [rax + rcx*8]
mov qword [rbp + 0x9f8], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
movups xmmword [rbp + 0xf78], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140086914
cmp word [rax], r14w
jne 0x140086914
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140086914
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140086914
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140086754
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008675c
inc rbx
cmp rbx, r14
jb 0x140086732
xor r15d, r15d
jmp 0x14008690e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140086754
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140086754
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x40d34], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3f9b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x3f9b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
lea rcx, [rbp + 0x3f9b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x52d50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400867f0
mov r8d, 0x1000
lea rdx, [rbp + 0x52d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe28]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe28], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x9f0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x9f0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf78]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe28]
lea r9, [rbp + 0xe28]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0xa08]
test rbx, rbx
je 0x140086c91
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400869c3
cmp word [rax], r14w
jne 0x1400869c3
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400869c3
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400869c3
mov r12d, dword [rax + 0x1c]
mov rdi, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400869c3
nop dword [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140086ada
inc rdi
cmp rdi, r15
jb 0x1400869a0
xor r15d, r15d
test bl, 1
je 0x140086c91
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xa28], r15
xor edx, edx
mov qword [rbp + 0xa30], r15
xorps xmm0, xmm0
mov qword [rbp + 0xa38], r15
movups xmmword [rbp + 0xf68], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0xa18], 8
mov qword [rbp + 0xa20], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140086ed3
cmp word [rax], bx
jne 0x140086ed3
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140086ed3
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140086ed3
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140086ad2
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140086d1a
inc rbx
cmp rbx, r14
jb 0x140086ab0
xor r15d, r15d
jmp 0x140086ece
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400869c3
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x1400869c3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x420c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x40d40]
call fcn.1400be1b0
lea rcx, [rbp + 0x40d40]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor eax, eax
mov edi, eax
nop
lea rcx, [rbp + 0x40d40]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x51d50], rax
inc rdi
cmp rdi, 0x200
jl 0x140086b70
mov r8d, 0x1000
lea rdx, [rbp + 0x51d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe2c]
movsd qword [rdi], xmm0
xor r15d, r15d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
lea r8d, [r15 + 0x20]
mov dword [rbp + 0xe2c], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x9f0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x9f0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf78]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe2c]
lea r9, [rbp + 0xe2c]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
lea edx, [r15 + 0xb]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test edi, edi
jns 0x1400869c6
lea rcx, [rbp + 0x88]
call fcn.1400b87b0
lea rdx, [rbp + 0x10d8]
lea rcx, [rbp + 0x528]
call fcn.140040c90
mov r14, rax
lea rcx, [rbp + 0x128]
xor eax, eax
mov edi, eax
call fcn.14003cdd0
lea rcx, [rbp + 0x128]
call fcn.14003cdf0
mov rcx, r14
call fcn.140040db0
mov rcx, r14
mov rbx, rax
call fcn.1400b8590
mov rsi, rax
cmp rbx, rax
je 0x1400881c1
nop
movzx edx, byte [rbx]
cmp dl, 0x3a
jne 0x1400881a9
cmp edi, 3
je 0x1400881c1
inc edi
lea rcx, [rbp + 0x128]
xor edx, edx
call fcn.1400bca40
jmp 0x1400881b5
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140086ad2
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140086ad2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x43454], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x420d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x420d0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x420d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x53d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140086db0
mov r8d, 0x1000
lea rdx, [rbp + 0x53d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe30]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe30], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa18]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xa18]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf68]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe30]
lea r9, [rbp + 0xe30]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0xa30]
test rdi, rdi
je 0x140086c91
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140086f7f
cmp word [rax], bx
jne 0x140086f7f
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140086f7f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140086f7f
mov r12d, dword [rax + 0x1c]
mov rbx, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140086f7f
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140086fba
inc rbx
cmp rbx, r15
jb 0x140086f60
xor r15d, r15d
test dil, 1
je 0x140086c91
movzx eax, dil
shr al, 7
test al, 1
je 0x140087176
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x140087c35
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140086f7f
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140086f7f
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x447e4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x43460]
call fcn.1400be1b0
lea rcx, [rbp + 0x43460]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor eax, eax
mov ebx, eax
nop word [rax + rax]
lea rcx, [rbp + 0x43460]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x50d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140087050
mov r8d, 0x1000
lea rdx, [rbp + 0x50d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe34]
movsd qword [rbx], xmm0
xor r15d, r15d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [r15 + 0x20]
mov dword [rbp + 0xe34], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa18]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa18]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf68]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe34]
lea r9, [rbp + 0xe34]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
lea edx, [r15 + 0xb]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
jmp 0x140086f82
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xa50], r15
xor edx, edx
mov qword [rbp + 0xa58], r15
xorps xmm0, xmm0
mov qword [rbp + 0xa60], r15
movups xmmword [rbp + 0xf58], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0xa40], 8
mov qword [rbp + 0xa48], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140087433
cmp word [rax], bx
jne 0x140087433
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140087433
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140087433
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140087272
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x14008727a
inc rbx
cmp rbx, r14
jb 0x140087250
xor r15d, r15d
jmp 0x14008742e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140087272
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140087272
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x45b74], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x447f0]
call fcn.1400be1b0
lea rcx, [rbp + 0x447f0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop dword [rax + rax]
lea rcx, [rbp + 0x447f0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4fd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140087310
mov r8d, 0x1000
lea rdx, [rbp + 0x4fd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe38]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe38], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa40]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xa40]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf58]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe38]
lea r9, [rbp + 0xe38]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0xa58]
test rdi, rdi
je 0x140086c91
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400874e3
cmp word [rax], bx
jne 0x1400874e3
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400874e3
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400874e3
mov r12d, dword [rax + 0x1c]
mov rbx, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400874e3
nop word [rax + rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008751e
inc rbx
cmp rbx, r15
jb 0x1400874c0
xor r15d, r15d
test dil, 1
je 0x140086c91
movzx eax, dil
shr al, 7
test al, 1
je 0x1400876d6
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x140087c35
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400874e3
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x1400874e3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x46f04], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x45b80]
call fcn.1400be1b0
lea rcx, [rbp + 0x45b80]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor eax, eax
mov ebx, eax
nop dword [rax + rax]
lea rcx, [rbp + 0x45b80]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4ed50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400875b0
mov r8d, 0x1000
lea rdx, [rbp + 0x4ed50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe3c]
movsd qword [rbx], xmm0
xor r15d, r15d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [r15 + 0x20]
mov dword [rbp + 0xe3c], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa40]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa40]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf58]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe3c]
lea r9, [rbp + 0xe3c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
lea edx, [r15 + 0xb]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
jmp 0x1400874e6
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xa78], r15
xor edx, edx
mov qword [rbp + 0xa80], r15
xorps xmm0, xmm0
mov qword [rbp + 0xa88], r15
movups xmmword [rbp + 0xf38], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0xa68], 8
mov qword [rbp + 0xa70], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x140087994
cmp word [rax], r14w
jne 0x140087994
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140087994
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140087994
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x1400877d2
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400877da
inc rbx
cmp rbx, r14
jb 0x1400877b0
xor r15d, r15d
jmp 0x14008798e
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400877d2
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400877d2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x48294], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x46f10]
call fcn.1400be1b0
lea rcx, [rbp + 0x46f10]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop dword [rax + rax]
lea rcx, [rbp + 0x46f10]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4dd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140087870
mov r8d, 0x1000
lea rdx, [rbp + 0x4dd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe40]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe40], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa68]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xa68]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf38]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe40]
lea r9, [rbp + 0xe40]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0xa80]
test rbx, rbx
je 0x140086c91
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140087c11
cmp word [rax], r14w
jne 0x140087c11
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140087c11
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140087c11
mov r12d, dword [rax + 0x1c]
mov rdi, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140087c11
nop dword [rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140087a58
inc rdi
cmp rdi, r15
jb 0x140087a30
jmp 0x140087c11
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140087c11
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140087c11
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x49624], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x482a0]
call fcn.1400be1b0
lea rcx, [rbp + 0x482a0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop
lea rcx, [rbp + 0x482a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4cd50], rax
inc rdi
cmp rdi, 0x200
jl 0x140087af0
mov r8d, 0x1000
lea rdx, [rbp + 0x4cd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe44]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe44], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa68]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa68]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf38]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe44]
lea r9, [rbp + 0xe44]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x140086c91
test bl, 1
je 0x140086c91
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x140086c91
mov r13, qword [rsp + 0x68]
mov rax, rdi
and eax, 0xfff
mov qword [rbp + 0xa98], rdi
xorps xmm0, xmm0
mov ecx, 0x1000
sub rcx, rax
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
mov qword [rsp + 0x58], rax
xor r14d, r14d
mov qword [rbp + 0xa90], r13
xor edx, edx
mov qword [rbp + 0xaa0], r14
lea rcx, [0x1401fded8]
mov qword [rbp + 0xaa8], r14
mov qword [rbp + 0xab0], r14
lea r8d, [r14 + 1]
movups xmmword [rbp + 0xf28], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140087ef6
cmp word [rax], bx
jne 0x140087ef6
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140087ef6
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140087ef6
mov r15d, dword [rax + 0x1c]
mov ebx, r14d
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140087d34
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140087d3c
inc rbx
cmp rbx, r14
jb 0x140087d12
xor r14d, r14d
jmp 0x140087ef1
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140087d34
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140087d34
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4a9b4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x49630]
call fcn.1400be1b0
lea rcx, [rbp + 0x49630]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop dword [rax + rax]
lea rcx, [rbp + 0x49630]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4bd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140087dd0
mov r8d, 0x1000
lea rdx, [rbp + 0x4bd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe48]
movsd qword [rbx], xmm0
xor r14d, r14d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [r14 + 0x20]
mov dword [rbp + 0xe48], r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa90]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa90]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf28]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe48]
lea r9, [rbp + 0xe48]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [r14 + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r14d
test ebx, ebx
js 0x140086c91
mov ebx, 0x5a4d
mov rcx, qword [rbp + 0xaa8]
test rcx, rcx
je 0x140086c91
lea rdx, [rbp + 0x48]
mov r8, r13
add rdx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140087fb4
cmp word [rax], bx
jne 0x140087fb4
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140087fb4
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140087fb4
mov r15d, dword [rax + 0x1c]
mov rbx, r14
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x140087fb4
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140087ff5
inc rbx
cmp rbx, r14
jb 0x140087f92
xor r15d, r15d
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
sub rsi, r13
add rax, r13
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rax
test rsi, rsi
je 0x140086c91
mov rbx, qword [rbp - 0x70]
add rbx, qword [rbp + 0x11b0]
add rbx, rax
mov qword [rsp + 0x60], rbx
mov rcx, rbx
jmp 0x14008665b
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140087fb4
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140087fb4
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4bd44], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4a9c0]
call fcn.1400be1b0
lea rcx, [rbp + 0x4a9c0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
lea rcx, [rbp + 0x4a9c0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x54d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140088083
mov r8d, 0x1000
lea rdx, [rbp + 0x54d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe4c]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe4c], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xa90]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xa90]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf28]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe4c]
lea r9, [rbp + 0xe4c]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x140086c91
jmp 0x140087fb7
lea rcx, [rbp + 0x128]
call fcn.1400b8550
inc rbx
cmp rbx, rsi
jne 0x140086cf0
mov rcx, r14
call fcn.1400b87b0
lea rcx, [rbp + 0x128]
call fcn.140040db0
mov r9, qword [rbp + 0x12e0]
lea rcx, str.ntoskrnl.exe
mov rdx, rax
mov byte [rsp + 0x20], 1
xor r8d, r8d
call fcn.1400607a0
mov rcx, qword [rbp + 0x11b0]
xor edi, edi
add rcx, qword [rbp - 0x78]
mov qword [rbp + 0x50], rax
mov eax, edi
mov qword [rsp + 0x78], rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rcx, rax
mov qword [rsp + 0x68], 8
mov rax, qword [rbp + 0xd90]
movabs rdx, 0xfffffffff000
mov r13d, dword [0x140322b68]
and rax, rdx
shr rcx, 0x27
xor edx, edx
and ecx, 0x1ff
mov qword [rbp + 0xac8], rdi
xorps xmm0, xmm0
mov qword [rbp + 0xad0], rdi
mov qword [rbp + 0xad8], rdi
lea r8d, [rdx + 1]
mov qword [rbp + 0xab8], 8
lea rax, [rax + rcx*8]
mov qword [rbp + 0xac0], rax
lea rcx, [0x1401fded8]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
movups xmmword [rbp + 0xf18], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400887c9
cmp word [rax], r14w
jne 0x1400887c9
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400887c9
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400887c9
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140088322
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x1400884f7
inc rbx
cmp rbx, r14
jb 0x140088300
xor r15d, r15d
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0xad0]
test rbx, rbx
je 0x1400886ae
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x1400883e3
cmp word [rax], r14w
jne 0x1400883e3
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400883e3
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400883e3
mov r12d, dword [rax + 0x1c]
mov rdi, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x1400883e3
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400887d1
inc rdi
cmp rdi, r15
jb 0x1400883c0
xor r15d, r15d
test bl, 1
je 0x1400886ae
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rbx, rcx
shr rax, 0x1e
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xaf0], r15
xor edx, edx
mov qword [rbp + 0xaf8], r15
xorps xmm0, xmm0
mov qword [rbp + 0xb00], r15
movups xmmword [rbp + 0xfc8], xmm0
lea rax, [rbx + rax*8]
mov qword [rbp + 0xae0], 8
mov qword [rbp + 0xae8], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x140088b52
cmp word [rax], bx
jne 0x140088b52
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140088b52
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140088b52
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140088b4a
nop word [rax + rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140088996
inc rbx
cmp rbx, r14
jb 0x1400884d0
jmp 0x140088b4a
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140088322
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140088322
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x4ea4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x3b20]
call fcn.1400be1b0
lea rcx, [rbp + 0x3b20]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor r15d, r15d
mov ebx, r15d
nop dword [rax]
lea rcx, [rbp + 0x3b20]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x52d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140088590
mov r8d, 0x1000
lea rdx, [rbp + 0x52d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe50]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe50], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xab8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xab8]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf18]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe50]
lea r9, [rbp + 0xe50]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
jns 0x140088325
xor edi, edi
lea rcx, [rbp + 0x128]
call fcn.1400b87b0
mov rcx, qword [0x140329cf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 0x58]
mov edx, 2
xor rax, qword [rbp - 0x48]
mov ecx, 0x200
mov r8d, dword [rbp - 0x68]
call rax
mov qword [rbp - 0x20], rax
test rax, rax
jne 0x140088747
lea rcx, [rbp + 0x168]
call fcn.14003cdd0
mov r8d, send
lea rdx, str.Bypass_Failure
lea rcx, [rbp + 0x168]
call fcn.14003ce50
lea rcx, [rbp + 0x2a8]
call fcn.14003cdd0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.Code:_0x2_:_0x14
lea rcx, [rbp + 0x2a8]
call fcn.14003ce50
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x2a8]
call fcn.14003cf90
xor edx, edx
lea rcx, str.Internals_Initialized
call fcn.140041bd0
mov r14, qword [0x140328f28]
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
lea rcx, [rax + rax*2]
lea r15, [rcx*8 + 0x10]
test rsi, rsi
jle 0x140089e76
lea rbx, [r14 + 0x10]
nop dword [rax]
movups xmm1, xmmword [rbx]
movsd xmm0, qword [rbx + 0x10]
movq rax, xmm1
movsd qword [rbp], xmm0
test rax, rax
je 0x140089e64
psrldq xmm1, 8
movq r8, xmm1
test r8, r8
je 0x140089e64
movzx ecx, byte [rbp]
test cl, cl
jne 0x140089e32
xor edx, edx
mov rcx, rax
call fcn.1401d1c40
jmp 0x140089e64
xor r15d, r15d
jmp 0x14008832b
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x1400883e3
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x1400883e3
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x6234], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x4eb0]
call fcn.1400be1b0
lea rcx, [rbp + 0x4eb0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor eax, eax
mov edi, eax
nop word [rax + rax]
lea rcx, [rbp + 0x4eb0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x51d50], rax
inc rdi
cmp rdi, 0x200
jl 0x140088870
mov r8d, 0x1000
lea rdx, [rbp + 0x51d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe54]
movsd qword [rdi], xmm0
xor r15d, r15d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
lea r8d, [r15 + 0x20]
mov dword [rbp + 0xe54], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xab8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xab8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf18]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe54]
lea r9, [rbp + 0xe54]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
lea edx, [r15 + 0xb]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test edi, edi
js 0x1400886ae
jmp 0x1400883e6
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140088b4a
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140088b4a
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x75c4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x6240]
call fcn.1400be1b0
lea rcx, [rbp + 0x6240]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop word [rax + rax]
lea rcx, [rbp + 0x6240]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x53d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140088a30
mov r8d, 0x1000
lea rdx, [rbp + 0x53d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe58]
movsd qword [rbx], xmm0
xor edi, edi
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [rdi + 0x20]
mov dword [rbp + 0xe58], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xae0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xae0]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xfc8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe58]
lea r9, [rbp + 0xe58]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [rdi + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], edi
test ebx, ebx
js 0x1400886b0
xor r15d, r15d
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0xaf8]
test rdi, rdi
je 0x1400886ae
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140088c03
cmp word [rax], bx
jne 0x140088c03
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140088c03
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140088c03
mov r12d, dword [rax + 0x1c]
mov rbx, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140088c03
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x140088c3e
inc rbx
cmp rbx, r15
jb 0x140088be0
xor r15d, r15d
test dil, 1
je 0x1400886ae
movzx eax, dil
shr al, 7
test al, 1
je 0x140088df6
movabs rax, 0xfffffc0000000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x3fffffff
add rdi, rax
jmp 0x1400898b5
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140088c03
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140088c03
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x8954], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x75d0]
call fcn.1400be1b0
lea rcx, [rbp + 0x75d0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor eax, eax
mov ebx, eax
nop dword [rax + rax]
lea rcx, [rbp + 0x75d0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x50d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140088cd0
mov r8d, 0x1000
lea rdx, [rbp + 0x50d50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe5c]
movsd qword [rbx], xmm0
xor r15d, r15d
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [r15 + 0x20]
mov dword [rbp + 0xe5c], r15d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xae0]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xae0]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xfc8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe5c]
lea r9, [rbp + 0xe5c]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
lea edx, [r15 + 0xb]
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r15d
test ebx, ebx
js 0x1400886ae
jmp 0x140088c06
mov rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0x15
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0xb18], r15
xor edx, edx
mov qword [rbp + 0xb20], r15
xorps xmm0, xmm0
mov qword [rbp + 0xb28], r15
movups xmmword [rbp + 0xf08], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0xb08], 8
mov qword [rbp + 0xb10], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov ebx, 0x5a4d
test rax, rax
je 0x1400890b2
cmp word [rax], bx
jne 0x1400890b2
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400890b2
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400890b2
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x1400890aa
nop dword [rax]
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140088ef7
inc rbx
cmp rbx, r14
jb 0x140088ed0
jmp 0x1400890aa
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400890aa
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400890aa
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x9ce4], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x8960]
call fcn.1400be1b0
lea rcx, [rbp + 0x8960]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop dword [rax + rax]
lea rcx, [rbp + 0x8960]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4fd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140088f90
mov r8d, 0x1000
lea rdx, [rbp + 0x4fd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe60]
movsd qword [rbx], xmm0
xor edi, edi
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [rdi + 0x20]
mov dword [rbp + 0xe60], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xb08]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0xb08]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xf08]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe60]
lea r9, [rbp + 0xe60]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [rdi + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], edi
test ebx, ebx
js 0x1400886b0
xor r15d, r15d
mov ebx, 0x5a4d
mov rdi, qword [rbp + 0xb20]
test rdi, rdi
je 0x1400886ae
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rdi, qword [rdi]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140089163
cmp word [rax], bx
jne 0x140089163
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140089163
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140089163
mov r12d, dword [rax + 0x1c]
mov rbx, r15
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140089163
nop dword [rax]
mov ecx, dword [r14 + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x14008919e
inc rbx
cmp rbx, r15
jb 0x140089140
xor r12d, r12d
test dil, 1
je 0x1400886ae
movzx eax, dil
shr al, 7
test al, 1
je 0x140089356
movabs rax, 0x3ffffffe00000
and rdi, rax
mov rax, qword [rsp + 0x60]
and eax, 0x1fffff
add rdi, rax
jmp 0x1400898b5
movzx eax, word [r13 + rbx*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140089163
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140089163
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xb074], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x9cf0]
call fcn.1400be1b0
lea rcx, [rbp + 0x9cf0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov ebx, r12d
nop dword [rax]
lea rcx, [rbp + 0x9cf0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4ed50], rax
inc rbx
cmp rbx, 0x200
jl 0x140089230
mov r8d, 0x1000
lea rdx, [rbp + 0x4ed50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rbx, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe64]
movsd qword [rbx], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rbx + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
mov dword [rbp + 0xe64], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xb08]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0xb08]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf08]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe64]
lea r9, [rbp + 0xe64]
mov edx, 0x1000
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test ebx, ebx
js 0x1400886ae
jmp 0x140089166
mov rax, qword [rsp + 0x60]
movabs rcx, 0x3fffffffff000
mov r13d, dword [0x140322b68]
and rdi, rcx
shr rax, 0xc
lea rcx, [0x1401fded8]
and eax, 0x1ff
mov qword [rbp + 0x690], r12
xor edx, edx
mov qword [rbp + 0x698], r12
xorps xmm0, xmm0
mov qword [rbp + 0x6a0], r12
movups xmmword [rbp + 0xef8], xmm0
lea rax, [rdi + rax*8]
mov qword [rbp + 0x680], 8
mov qword [rbp + 0x688], rax
lea r8d, [rdx + 1]
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov r14d, 0x5a4d
test rax, rax
je 0x1400896cf
cmp word [rax], r14w
jne 0x1400896cf
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x1400896cf
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x1400896cf
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140089452
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140089518
inc rbx
cmp rbx, r14
jb 0x140089430
xor edi, edi
mov r14d, 0x5a4d
mov rbx, qword [rbp + 0x698]
test rbx, rbx
je 0x1400886b0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
mov rbx, qword [rbx]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
test rax, rax
je 0x140089891
cmp word [rax], r14w
jne 0x140089891
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140089891
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140089891
mov r12d, dword [rax + 0x1c]
mov r13d, dword [rax + 0x24]
add r12, rsi
mov r14d, dword [rax + 0x20]
add r13, rsi
mov r15d, dword [rax + 0x18]
add r14, rsi
test r15, r15
je 0x140089891
nop
mov ecx, dword [r14 + rdi*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rsi
call fcn.1401d2370
test eax, eax
je 0x1400896d6
inc rdi
cmp rdi, r15
jb 0x1400894f0
jmp 0x140089891
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140089452
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140089452
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xd794], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xc410]
call fcn.1400be1b0
lea rcx, [rbp + 0xc410]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop dword [rax]
lea rcx, [rbp + 0xc410]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4dd50], rax
inc rbx
cmp rbx, 0x200
jl 0x1400895b0
mov r8d, 0x1000
lea rdx, [rbp + 0x4dd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe68]
movsd qword [rbx], xmm0
xor edi, edi
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [rdi + 0x20]
mov dword [rbp + 0xe68], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x680]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], Ordinal_46
lea rax, [rbp + 0x680]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp + 0xef8]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe68]
lea r9, [rbp + 0xe68]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [rdi + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], edi
test ebx, ebx
js 0x1400886b0
jmp 0x140089454
xor edi, edi
jmp 0x14008945a
movzx eax, word [r13 + rdi*2]
mov ecx, dword [r12 + rax*4]
add rcx, rsi
je 0x140089891
mov r15d, dword [rcx + 4]
test r15d, r15d
js 0x140089891
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0xeb24], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0xd7a0]
call fcn.1400be1b0
lea rcx, [rbp + 0xd7a0]
call fcn.1400b7000
mov esi, eax
movabs rax, 0xc0906c513cedb3
mul rsi
mov ecx, esi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rsi, rax
xor r12d, r12d
mov edi, r12d
nop dword [rax]
lea rcx, [rbp + 0xd7a0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rdi*8 + 0x4cd50], rax
inc rdi
cmp rdi, 0x200
jl 0x140089770
mov r8d, 0x1000
lea rdx, [rbp + 0x4cd50]
mov rcx, r14
call fcn.1401d15a0
mov dword [0x140322d74], r15d
lea rdi, [rsi + r14]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe6c]
movsd qword [rdi], xmm0
mov edx, 0x1000
movzx eax, word [0x140322d78]
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov word [rdi + 8], ax
mov rcx, r14
movzx eax, byte [0x140322d7a]
mov byte [rdi + 0xa], al
mov dword [rbp + 0xe6c], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x680]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x680]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xef8]
mov qword [rsp + 0x20], rax
call rdi
mov r8d, dword [rbp + 0xe6c]
lea r9, [rbp + 0xe6c]
mov edx, 0x1000
mov rcx, r14
mov edi, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, r14
call fcn.1401d1c40
mov edx, ntohs
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], r12d
test edi, edi
js 0x1400886ae
test bl, 1
je 0x1400886ae
mov rdi, qword [rsp + 0x60]
movabs rax, 0x3fffffffff000
and edi, 0xfff
and rbx, rax
add rdi, rbx
test rdi, rdi
je 0x1400886ae
mov r13, qword [rsp + 0x68]
mov rax, rdi
and eax, 0xfff
mov qword [rbp + 0x6b0], rdi
xorps xmm0, xmm0
mov ecx, 0x1000
sub rcx, rax
mov eax, dword [0x140322b68]
cmp rcx, r13
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
cmovb r13, rcx
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov qword [rbp + 0x6a8], r13
xor edx, edx
mov qword [rbp + 0x6b8], rbx
lea rcx, [0x1401fded8]
mov qword [rbp + 0x6c0], rbx
mov qword [rbp + 0x6c8], rbx
lea r8d, [rbx + 1]
movups xmmword [rbp + 0xee8], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
mov esi, 0x5a4d
test rax, rax
je 0x140089c72
cmp word [rax], si
jne 0x140089c72
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140089c72
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140089c72
mov r15d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
test r14, r14
je 0x1400899b2
nop
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140089ab4
inc rbx
cmp rbx, r14
jb 0x140089990
xor edi, edi
mov esi, 0x5a4d
mov rcx, qword [rbp + 0x6c0]
test rcx, rcx
je 0x1400886b0
lea rdx, [rbp + 0x50]
mov r8, r13
add rdx, qword [rsp + 0x78]
call fcn.1401d15a0
mov eax, dword [0x140322768]
lea rcx, [0x1401fded8]
xor edx, edx
mov dword [rsp + 0x50], eax
mov rax, qword [0x140329cf0]
mov qword [rsp + 0x58], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rdi, rax
test rax, rax
je 0x140089a74
cmp word [rax], si
jne 0x140089a74
movsxd rax, dword [rax + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x140089a74
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x140089a74
mov r15d, dword [rax + 0x1c]
xor ecx, ecx
mov r12d, dword [rax + 0x24]
add r15, rdi
mov esi, dword [rax + 0x20]
add r12, rdi
mov r14d, dword [rax + 0x18]
add rsi, rdi
mov ebx, ecx
test r14, r14
je 0x140089a74
mov ecx, dword [rsi + rbx*4]
lea rdx, str.NtDeviceIoControlFile
add rcx, rdi
call fcn.1401d2370
test eax, eax
je 0x140089c79
inc rbx
cmp rbx, r14
jb 0x140089a52
xor edi, edi
mov rsi, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
sub rsi, r13
add rax, r13
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rax
test rsi, rsi
je 0x1400886b0
mov rbx, qword [rbp - 0x78]
add rbx, qword [rbp + 0x11b0]
add rbx, rax
mov qword [rsp + 0x60], rbx
mov rcx, rbx
jmp 0x14008821f
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x1400899b2
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x1400899b2
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x16084], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x14d00]
call fcn.1400be1b0
lea rcx, [rbp + 0x14d00]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop dword [rax + rax]
lea rcx, [rbp + 0x14d00]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x4bd50], rax
inc rbx
cmp rbx, 0x200
jl 0x140089b50
mov r8d, 0x1000
lea rdx, [rbp + 0x4bd50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe70]
movsd qword [rbx], xmm0
xor edi, edi
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [rdi + 0x20]
mov dword [rbp + 0xe70], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x6a8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x6a8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xee8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe70]
lea r9, [rbp + 0xe70]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [rdi + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], edi
test ebx, ebx
js 0x1400886b0
jmp 0x1400899b4
xor edi, edi
jmp 0x1400899b9
movzx eax, word [r12 + rbx*2]
mov ecx, dword [r15 + rax*4]
add rcx, rdi
je 0x140089a74
mov r14d, dword [rcx + 4]
test r14d, r14d
js 0x140089a74
xor ecx, ecx
mov edx, 0x1000
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
call fcn.1401921e4
mov r8d, 0x6c078965
mov dword [rbp + 0x2d434], 0xffffffff
mov edx, eax
lea rcx, [rbp + 0x2c0b0]
call fcn.1400be1b0
lea rcx, [rbp + 0x2c0b0]
call fcn.1400b7000
mov edi, eax
movabs rax, 0xc0906c513cedb3
mul rdi
mov ecx, edi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xb
imul rax, rcx, 0xff4
sub rdi, rax
xor eax, eax
mov ebx, eax
nop dword [rax]
lea rcx, [rbp + 0x2c0b0]
call fcn.1400b7000
mov eax, eax
mov qword [rbp + rbx*8 + 0x54d50], rax
inc rbx
cmp rbx, 0x200
jl 0x140089d10
mov r8d, 0x1000
lea rdx, [rbp + 0x54d50]
mov rcx, rsi
call fcn.1401d15a0
mov dword [0x140322d74], r14d
lea rbx, [rdi + rsi]
movsd xmm0, qword [0x140322d70]
lea r9, [rbp + 0xe74]
movsd qword [rbx], xmm0
xor edi, edi
movzx eax, word [0x140322d78]
mov edx, 0x1000
mov word [rbx + 8], ax
mov rcx, rsi
movzx eax, byte [0x140322d7a]
mov byte [rbx + 0xa], al
lea r8d, [rdi + 0x20]
mov dword [rbp + 0xe74], edi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x6a8]
mov dword [rsp + 0x48], Ordinal_46
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rbp + 0x6a8]
mov dword [rsp + 0x38], Ordinal_46
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xee8]
mov qword [rsp + 0x20], rax
call rbx
mov r8d, dword [rbp + 0xe74]
lea r9, [rbp + 0xe74]
mov edx, 0x1000
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rsi
call fcn.1401d1c40
lea edx, [rdi + 0xb]
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x140322d74], edi
test ebx, ebx
js 0x1400886b0
jmp 0x140089a76
cmp cl, 1
jne 0x140089e64
mov rdx, rax
lea rcx, [rbp + 0x1120]
call fcn.140040c90
xor edx, edx
lea rcx, [rbp + 0x1120]
call fcn.1400bca40
lea rcx, [rbp + 0x1120]
call fcn.1400b87b0
inc edi
add rbx, 0x18
movsxd rax, edi
cmp rax, rsi
jl 0x140088780
mov r8, r15
xor edx, edx
mov rcx, r14
call fcn.1401d1c40
mov rcx, r14
call fcn.1401a6090
xor eax, eax
lea rcx, [rbp + 0x10f8]
mov qword [0x140328f28], rax
call fcn.1400b87b0
lea rcx, [rbp + 0x10d8]
call fcn.1400b87b0
mov rbx, qword [rbp + 0x58]
lea rcx, [rbp + 0x10a8]
movups xmm0, xmmword [rbp - 0x48]
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
call fcn.1400b87b0
lea rcx, [rbp + 0x1088]
call fcn.1400b87b0
mov rax, rbx
mov rcx, qword [rbp + 0x55d50]
xor rcx, rsp
call fcn.140190770
lea r11, [rsp + 0x55e60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret