Function at 0x14004f070
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check if file exists
Check os version
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Get number of processors
Hash data using crc32b
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x140071040]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
xor r8d, r8d
mov edi, r8d
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x20
mov rax, qword [rdx]
cmp rax, rdx
je 0x14004f0db
cmp qword [rax + 0x50], r8
jne 0x14004f0d7
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004f0c7
jmp 0x14004f0db
lea rdi, [rax - 0x10]
mov rdi, qword [rdi + 0x30]
mov qword [rbp - 0x50], rdi
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rsp + 0x70], rbx
movzx r12d, word [rbx + 0x14]
add r12, rbx
mov qword [rbp - 0x40], r12
mov r13d, r8d
mov dword [rbp - 0x48], r8d
mov rbx, r8
lea rsi, [0x1400a2510]
nop dword [rax]
lea r14, [rbx + rbx*4]
mov eax, dword [r12 + r14*8 + 0x3c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x14004f723
mov edx, dword [r12 + r14*8 + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14004f5ba
xor r8d, r8d
mov r13d, r8d
mov rcx, qword gs:[0x60]
mov r15, qword [rcx + 0x18]
add r15, 0x20
mov rdi, qword [r15]
cmp rdi, r15
je 0x14004f19b
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004f18a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14004f194
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x14004f170
jmp 0x14004f198
lea r13, [rdi - 0x10]
xor r8d, r8d
mov rdi, qword [r13 + 0x30]
test rdi, rdi
je 0x14004f24f
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14004f24f
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14004f24f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14004f24f
mov r10d, dword [rax + 0x20]
add r10, rdi
mov esi, dword [rax + 0x24]
add rsi, rdi
mov r15d, dword [rax + 0x1c]
add r15, rdi
mov r9d, r8d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14004f24f
lea r13, str.NtReadVirtualMemory
nop dword [rax]
mov edx, dword [r10 + r8*4]
add rdx, rdi
mov rax, r13
je 0x14004f244
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x14004f236
sub rdx, r13
test cl, cl
je 0x14004f22d
cmp byte [rax], 0
je 0x14004f236
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x14004f217
jmp 0x14004f236
cmp byte [rax], 0
je 0x14004f3d0
movsx edx, cl
movsx ecx, byte [rax]
cmp edx, ecx
je 0x14004f3d0
inc r9d
inc r8
cmp r9d, r11d
jb 0x14004f200
mov r15d, dword [r12 + r14*8 + 0x24]
add r15, qword [rbp - 0x50]
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
lea rdx, [0x1400a2510]
mov qword [rcx + rdx], r15
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rdx + 8], eax
mov esi, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov edx, 0x20
mov ecx, 0x4c11db7
call fcn.14005b2e0
mov r8d, eax
test rsi, rsi
je 0x14004f32d
nop dword [rax]
movzx ecx, byte [r15]
xor edi, ecx
lea r15, [r15 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f2a0
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400a2510]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r14*8 + 0x20]
lea rax, [rbx + rbx*2]
mov rdx, qword [rsi + rax*8]
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14004f3a0
mov r12d, 0x167
nop
mov ecx, r9d
cmp r9, r12
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f370
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f360
mov r12, qword [rbp - 0x40]
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov r13, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x50]
jmp 0x14004f5a0
movzx eax, word [rsi + r8*2]
mov r10d, dword [r15 + rax*4]
add r10, rdi
je 0x14004f24f
mov edx, dword [r12 + r14*8 + 0x24]
mov rdi, qword [rbp - 0x50]
add rdx, rdi
xor r9d, r9d
mov qword [rsp + 0x20], r9
mov r9d, dword [r12 + r14*8 + 0x20]
mov r13, qword [rbp - 0x80]
mov r8, r13
mov rcx, 0xffffffffffffffff
call r10
test eax, eax
js 0x14004f599
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov eax, dword [r12 + r14*8 + 0x24]
add rax, rdi
lea rdx, [0x1400a2510]
mov qword [rcx + rdx], rax
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rdx + 8], eax
mov esi, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov r15, r13
mov edx, 0x20
mov ecx, 0x4c11db7
call fcn.14005b2e0
mov r8d, eax
test rsi, rsi
je 0x14004f4fd
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r15]
xor edi, ecx
lea r15, [r15 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f470
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400a2510]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r14*8 + 0x20]
mov rdx, r13
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14004f570
mov r12d, 0x167
nop dword [rax]
mov ecx, r9d
cmp r9, r12
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f540
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f530
mov r12, qword [rbp - 0x40]
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov rdi, qword [rbp - 0x50]
jmp 0x14004f5a0
lea rsi, [0x1400a2510]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r13d, dword [rbp - 0x48]
jmp 0x14004f723
mov r15d, dword [r12 + r14*8 + 0x24]
add r15, rdi
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov qword [rcx + rsi], r15
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rsi + 8], eax
mov esi, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov edx, 0x20
mov ecx, 0x4c11db7
call fcn.14005b2e0
mov r8d, eax
test rsi, rsi
je 0x14004f68d
movzx ecx, byte [r15]
xor edi, ecx
lea r15, [r15 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f600
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400a2510]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r14*8 + 0x20]
lea rax, [rbx + rbx*2]
mov rdx, qword [rsi + rax*8]
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14004f6fc
mov r10d, 0x167
nop
mov ecx, r9d
cmp r9, r10
cmova ecx, r10d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f6d0
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f6c0
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov rdi, qword [rbp - 0x50]
inc r13d
mov dword [rbp - 0x48], r13d
inc rbx
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 6]
cmp r13d, eax
jle 0x14004f110
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor r8d, r8d
mov qword [rbp - 0x10], r8
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], r8b
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rax]
cmp rsi, rax
je 0x14004f807
cmp qword [rsi + 0x50], 0
je 0x14004f7df
mov rax, qword [rsi + 0x20]
movsxd r14, dword [rax + 0x3c]
add r14, rax
mov edi, r8d
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, qword [rsi + 0x20]
mov r8d, 0x30
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14004f7cd
cmp dword [rbp + 0x20], 0x1000
jne 0x14004f7cd
test dword [rbp + 0x24], 0x100
jne 0x14004f7f1
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jle 0x14004f7a0
xor r8d, r8d
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rsi]
cmp rsi, rax
jne 0x14004f776
jmp 0x14004f807
mov r8d, 0x15
lea rdx, str.Guard_hook_detected._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov dword [rbp + 0x60], 0xb8
mov dword [rbp + 0x64], 0xd18b4c00
mov word [rbp + 0x68], 0x50f
mov byte [rbp + 0x6a], 0xc3
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov dword [rbp + 4], r15d
mov dword [rbp + 0x1c], r15d
lea rdi, [rbp + 0x90]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], r15w
je 0x14004f86a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004f860
mov r13d, 0x5c
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004f880
mov word [rax], r15w
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], r15w
je 0x14004f8af
add rax, 2
cmp word [rax], r15w
jne 0x14004f8a5
mov ecx, 0x6e
lea rdx, [0x140065630]
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004f8c0
mov word [rax], r15w
lea rcx, [rbp + 0x90]
mov eax, r15d
cmp word [rbp + 0x90], r15w
je 0x14004f8fc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004f8f0
add ax, ax
mov word [rsp + 0x70], ax
add ax, 2
mov word [rsp + 0x72], ax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp], 0x30
mov qword [rbp + 8], r15
mov dword [rbp + 0x18], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004f989
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004f97b
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14004f985
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004f961
jmp 0x14004f989
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
test r8, r8
je 0x14004fa22
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14004fa22
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14004fa22
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14004fa22
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14004fa22
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x14004fa16
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x14004fa12
sub rdx, rsi
test cl, cl
je 0x14004fa0d
cmp byte [rax], r15b
je 0x14004fa12
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x14004f9f7
jmp 0x14004fa12
cmp byte [rax], r15b
je 0x14004fa65
cmp cl, byte [rax]
je 0x14004fa65
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x14004f9e2
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004fa7a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004fa5b
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14004fa76
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004fa41
jmp 0x14004fa7a
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x14004fa25
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r8, r8
je 0x14004fb13
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14004fb13
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14004fb13
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14004fb13
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14004fb13
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x14004fb07
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x14004fb03
sub rdx, rsi
test cl, cl
je 0x14004fafe
cmp byte [rax], r15b
je 0x14004fb03
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x14004fae8
jmp 0x14004fb03
cmp byte [rax], r15b
je 0x14004fb54
cmp cl, byte [rax]
je 0x14004fb54
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x14004fad3
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004fb69
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004fb4a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14004fb65
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004fb30
jmp 0x14004fb69
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r8
jmp 0x14004fb16
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
lea rsi, str.NtClose
test r8, r8
je 0x14004fc96
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14004fc96
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14004fc96
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14004fc96
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor r15d, r15d
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14004fc99
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x14004fc0f
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x14004fc0b
sub rdx, rsi
nop word [rax + rax]
test cl, cl
je 0x14004fc06
cmp byte [rax], r15b
je 0x14004fc0b
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x14004fbf0
jmp 0x14004fc0b
cmp byte [rax], r15b
je 0x14004fc1d
cmp cl, byte [rax]
je 0x14004fc1d
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x14004fbd5
jmp 0x14004fc99
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x14004fc99
test r14, r14
je 0x14004fc99
test r12, r12
je 0x14004fc99
lea r8, [rbp]
mov edx, 4
lea rcx, [rbp - 0x50]
call r12
test eax, eax
js 0x14004fc99
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x50]
call r14
test eax, eax
js 0x14004fc99
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14004fc99
call rdi
jmp 0x14004fc99
xor r15d, r15d
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004fcdd
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004fccf
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14004fcd9
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004fcb5
jmp 0x14004fcdd
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
lea r14, str.NtQueryInformationProcess
lea r12, str.ZwUnmapViewOfSection
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x14004fe92
test r10, r10
je 0x14004fe92
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004fda8
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004fda8
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004fda8
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14004fda8
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r9
mov rax, r14
je 0x14004fd9c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x14004fd94
sub rdx, r14
test cl, cl
je 0x14004fd8b
cmp byte [rax], 0
je 0x14004fd94
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x14004fd75
jmp 0x14004fd94
cmp byte [rax], 0
je 0x14004fe2b
cmp cl, byte [rax]
je 0x14004fe2b
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004fd60
mov rbx, r15
mov ecx, 0x5a4d
cmp word [r10], cx
jne 0x14004fe52
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14004fe52
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14004fe52
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14004fe52
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r10
mov rax, r12
je 0x14004fe46
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x14004fe42
sub rdx, r12
test cl, cl
je 0x14004fe3d
cmp byte [rax], 0
je 0x14004fe42
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x14004fe15
jmp 0x14004fe42
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14004fdab
cmp byte [rax], 0
je 0x14004fe68
cmp cl, byte [rax]
je 0x14004fe68
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004fe00
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x14004fe78
call rax
jmp 0x14004fe87
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x14004fe55
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x5c], bx
test bx, bx
jne 0x14004fed5
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
lea rcx, str.____Cant_get_syscall_auto__n
call fcn.140047730
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004fed1
cmp al, 6
jne 0x14004fece
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004fece
sub ecx, 1
je 0x14004fec9
cmp ecx, 1
jne 0x14004fed1
lea ebx, [rcx + 0x17]
jmp 0x14004fed1
movzx ebx, di
jmp 0x14004fed1
movzx ebx, si
mov word [rbp - 0x5c], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r14d, 0xb
mov qword [rsp + 0x70], r14
test rax, rax
je 0x14004ffef
lea rcx, [rbp + 0x61]
lea rax, [rbp - 0x5c]
cmp rcx, rax
jbe 0x14004ff20
lea rcx, [rbp + 0x61]
lea rax, [rbp - 0x5a]
nop word [rax + rax]
movzx eax, byte [rbp - 0x5b]
mov byte [rbp + 0x62], al
mov byte [rbp + 0x61], bl
lea rcx, [rbp + 0x60]
cmp rdi, rcx
jbe 0x14004ff40
lea rcx, [rbp + 0x6b]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp - 0x40]
lea edx, [r9 - 1]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11, r14
mov r9, rdi
lea rbx, [rbp + 0x60]
sub rbx, rdi
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r8 - 0x61]
lea edx, [r8 - 0x20]
cmp eax, 0x19
cmova edx, r8d
lea eax, [r10 - 0x61]
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x14004ffb8
inc r9
sub r11, 1
jne 0x14004ff82
jmp 0x14004ffbd
cmp r8d, r10d
jne 0x14004ffd9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x14004ffef
cmp qword [rbp - 0x40], 0
je 0x14004ffef
mov r8d, 0x15
lea rdx, str.Debug_port_detected._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
mov dword [rbp - 0x48], r15d
mov dword [rbp + 0x70], 0xb8
mov dword [rbp + 0x74], 0xd18b4c00
mov word [rbp + 0x78], 0x50f
mov byte [rbp + 0x7a], 0xc3
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov dword [rbp + 4], r15d
mov dword [rbp + 0x1c], r15d
lea rdi, [rbp + 0x90]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], 0
je 0x14005004a
add rax, 2
cmp word [rax], 0
jne 0x140050040
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140050060
mov word [rax], r15w
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], cx
je 0x14005008e
add rax, 2
cmp word [rax], 0
jne 0x140050084
mov ecx, 0x6e
lea rdx, [0x140065630]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400500a0
mov word [rax], r15w
lea rcx, [rbp + 0x90]
mov eax, r15d
cmp word [rbp + 0x90], 0
je 0x1400500dc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400500d0
add ax, ax
mov word [rbp - 0x30], ax
add ax, 2
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x90]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp], 0x30
mov qword [rbp + 8], r15
mov dword [rbp + 0x18], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050168
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005015a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140050164
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050140
jmp 0x140050168
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x14005020b
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14005020b
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14005020b
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14005020b
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14005020b
lea rsi, str.ZwOpenSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400501ff
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400501fb
sub rdx, rsi
nop word [rax + rax]
test cl, cl
je 0x1400501f6
cmp byte [rax], 0
je 0x1400501fb
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400501e0
jmp 0x1400501fb
cmp byte [rax], 0
je 0x140050254
cmp cl, byte [rax]
je 0x140050254
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400501c5
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050269
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005024a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140050265
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050230
jmp 0x140050269
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x14005020e
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x14005030b
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14005030b
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14005030b
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14005030b
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14005030b
lea rsi, str.ZwMapViewOfSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400502ff
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400502fb
sub rdx, rsi
nop dword [rax + rax]
test cl, cl
je 0x1400502f6
cmp byte [rax], 0
je 0x1400502fb
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400502e0
jmp 0x1400502fb
cmp byte [rax], 0
je 0x14005034b
cmp cl, byte [rax]
je 0x14005034b
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400502c6
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050360
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050341
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14005035c
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050327
jmp 0x140050360
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r8
jmp 0x14005030e
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
test r8, r8
je 0x14005048b
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14005048b
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14005048b
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14005048b
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor r15d, r15d
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14005048e
lea rsi, str.NtClose
nop dword [rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x140050404
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140050400
sub rdx, rsi
test cl, cl
je 0x1400503fb
cmp byte [rax], r15b
je 0x140050400
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400503e5
jmp 0x140050400
cmp byte [rax], r15b
je 0x140050412
cmp cl, byte [rax]
je 0x140050412
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400503d0
jmp 0x14005048e
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x14005048e
test r14, r14
je 0x14005048e
test r12, r12
je 0x14005048e
lea r8, [rbp]
mov edx, 4
lea rcx, [rbp - 0x50]
call r12
test eax, eax
js 0x14005048e
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x50]
call r14
test eax, eax
js 0x14005048e
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14005048e
call rdi
jmp 0x14005048e
xor r15d, r15d
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400504d8
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400504ca
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400504d4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400504b0
jmp 0x1400504d8
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x140050667
test r10, r10
je 0x140050667
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x14005058a
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14005058a
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14005058a
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14005058a
lea r14, str.NtQueryInformationProcess
mov edx, dword [rdi]
add rdx, r9
mov rax, r14
je 0x14005057e
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140050576
sub rdx, r14
test cl, cl
je 0x14005056d
cmp byte [rax], 0
je 0x140050576
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050557
jmp 0x140050576
cmp byte [rax], 0
je 0x14005060b
cmp cl, byte [rax]
je 0x14005060b
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050542
mov rbx, r15
cmp word [r10], r12w
jne 0x140050632
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140050632
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140050632
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050632
lea r12, str.ZwUnmapViewOfSection
mov edx, dword [rdi]
add rdx, r10
mov rax, r12
je 0x140050626
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050622
sub rdx, r12
test cl, cl
je 0x14005061d
cmp byte [rax], 0
je 0x140050622
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400505f5
jmp 0x140050622
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14005058d
cmp byte [rax], 0
je 0x140050648
cmp cl, byte [rax]
je 0x140050648
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400505e0
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x140050658
call rax
jmp 0x140050667
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140050635
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x58], bx
test bx, bx
jne 0x1400506a9
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400506a0
cmp al, 6
jne 0x140050699
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140050699
sub ecx, 1
je 0x140050692
cmp ecx, 1
jne 0x1400506a0
lea ebx, [rcx + 0x17]
jmp 0x1400506a5
mov ebx, 0x17
jmp 0x1400506a5
mov ebx, 0x16
jmp 0x1400506a5
mov ebx, 0x19
mov word [rbp - 0x58], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400507bb
lea rcx, [rbp + 0x71]
lea rax, [rbp - 0x58]
cmp rcx, rax
jbe 0x1400506e0
lea rcx, [rbp + 0x71]
lea rax, [rbp - 0x56]
nop
movzx eax, byte [rbp - 0x57]
mov byte [rbp + 0x72], al
mov byte [rbp + 0x71], bl
lea rcx, [rbp + 0x70]
cmp rdi, rcx
jbe 0x140050700
lea rcx, [rbp + 0x7b]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x48]
lea edx, [r9 + 0x1b]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11d, 0xb
mov r9, rdi
lea rbx, [rbp + 0x70]
sub rbx, rdi
nop word [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [rbx + r9]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140050786
inc r9
sub r11, 1
jne 0x140050750
jmp 0x14005078b
cmp r8d, r10d
jne 0x1400507a5
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x1400507bb
cmp dword [rbp - 0x48], esi
jne 0x1400507bb
mov r8d, 0x15
lea rdx, str.Debug_flag_detected._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
mov qword [rbp - 0x40], r15
mov dword [rbp + 0x80], 0xb8
mov dword [rbp + 0x84], 0xd18b4c00
mov word [rbp + 0x88], 0x50f
mov byte [rbp + 0x8a], 0xc3
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov dword [rbp + 4], r15d
mov dword [rbp + 0x1c], r15d
lea rdi, [rbp + 0x90]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], 0
je 0x14005082a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140050820
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rcx + rax]
test r13w, r13w
jne 0x140050840
xor r13d, r13d
mov word [rax], r13w
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], r13w
je 0x14005087a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x140050870
lea rcx, [0x140065630]
sub rcx, rax
mov edx, 0x6e
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140050890
mov word [rax], r13w
lea rcx, [rbp + 0x90]
mov eax, r13d
cmp word [rbp + 0x90], r13w
je 0x1400508cc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x1400508c0
add ax, ax
mov word [rbp - 0x30], ax
add ax, 2
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x90]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp], 0x30
mov qword [rbp + 8], r13
mov dword [rbp + 0x18], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050958
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005094a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140050954
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050930
jmp 0x140050958
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
mov r15d, 0x5a4d
test r8, r8
je 0x1400509fb
cmp word [r8], r15w
jne 0x1400509fb
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400509fb
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400509fb
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400509fb
lea rsi, str.ZwOpenSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400509ef
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400509eb
sub rdx, rsi
nop dword [rax + rax]
test cl, cl
je 0x1400509e6
cmp byte [rax], r13b
je 0x1400509eb
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400509d0
jmp 0x1400509eb
cmp byte [rax], r13b
je 0x140050a44
cmp cl, byte [rax]
je 0x140050a44
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400509b6
mov r12, r13
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050a59
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050a3a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140050a55
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050a20
jmp 0x140050a59
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x1400509fe
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x140050af1
cmp word [r8], r15w
jne 0x140050af1
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050af1
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050af1
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050af1
lea rsi, str.ZwMapViewOfSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x140050ae5
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050ae1
sub rdx, rsi
test cl, cl
je 0x140050adc
cmp byte [rax], r13b
je 0x140050ae1
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050ac6
jmp 0x140050ae1
cmp byte [rax], r13b
je 0x140050b34
cmp cl, byte [rax]
je 0x140050b34
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140050ab1
mov r14, r13
mov r15, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050b49
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050b2a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140050b45
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050b10
jmp 0x140050b49
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r8
jmp 0x140050af4
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
mov r15d, 0x5a4d
test r8, r8
je 0x140050c6c
cmp word [r8], r15w
jne 0x140050c6c
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050c6c
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050c6c
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050c6c
lea rsi, str.NtClose
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x140050be7
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140050be3
sub rdx, rsi
test cl, cl
je 0x140050bde
cmp byte [rax], r13b
je 0x140050be3
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050bc8
jmp 0x140050be3
cmp byte [rax], r13b
je 0x140050bf5
cmp cl, byte [rax]
je 0x140050bf5
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140050bb3
jmp 0x140050c6c
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x140050c6c
test r14, r14
je 0x140050c6c
test r12, r12
je 0x140050c6c
lea r8, [rbp]
mov edx, 4
lea rcx, [rbp - 0x50]
call r12
test eax, eax
js 0x140050c6c
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x50]
call r14
test eax, eax
js 0x140050c6c
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140050c6c
call rdi
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050cb8
nop dword [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050caa
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140050cb4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050c90
jmp 0x140050cb8
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x140050e47
test r10, r10
je 0x140050e47
cmp word [r9], r15w
jne 0x140050d68
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050d68
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050d68
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r13d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050d68
lea r14, str.NtQueryInformationProcess
nop dword [rax]
mov edx, dword [rdi]
add rdx, r9
mov rax, r14
je 0x140050d5c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140050d54
sub rdx, r14
test cl, cl
je 0x140050d4b
cmp byte [rax], r13b
je 0x140050d54
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050d35
jmp 0x140050d54
cmp byte [rax], r13b
je 0x140050deb
cmp cl, byte [rax]
je 0x140050deb
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050d20
mov rbx, r13
cmp word [r10], r15w
jne 0x140050e12
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140050e12
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140050e12
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r13d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050e12
lea r15, str.ZwUnmapViewOfSection
nop word [rax + rax]
mov edx, dword [rdi]
add rdx, r10
mov rax, r15
je 0x140050e06
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050e02
sub rdx, r15
test cl, cl
je 0x140050dfd
cmp byte [rax], r13b
je 0x140050e02
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050dd5
jmp 0x140050e02
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x140050d6b
cmp byte [rax], r13b
je 0x140050e28
cmp cl, byte [rax]
je 0x140050e28
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050dc0
mov rax, r13
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x140050e38
call rax
jmp 0x140050e47
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140050e15
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x54], bx
test bx, bx
jne 0x140050e92
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140050e86
cmp al, 6
jne 0x140050e7f
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140050e7f
sub ecx, 1
je 0x140050e78
cmp ecx, 1
jne 0x140050e86
mov ebx, 0x18
mov word [rbp - 0x54], bx
jmp 0x140050e92
mov eax, 0x17
jmp 0x140050e8b
mov eax, 0x16
jmp 0x140050e8b
mov eax, 0x19
movzx ebx, ax
mov word [rbp - 0x54], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140050fb0
lea rcx, [rbp + 0x81]
lea rax, [rbp - 0x54]
cmp rcx, rax
jbe 0x140050ed0
lea rcx, [rbp + 0x81]
lea rax, [rbp - 0x52]
nop
movzx eax, byte [rbp - 0x53]
mov byte [rbp + 0x82], al
mov byte [rbp + 0x81], bl
lea rcx, [rbp + 0x80]
cmp rdi, rcx
jbe 0x140050f00
lea rcx, [rbp + 0x8b]
nop dword [rax]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x40]
lea edx, [r9 + 0x16]
mov rcx, 0xffffffffffffffff
call rdi
mov ebx, eax
mov r9, rdi
lea r11, [rbp + 0x80]
sub r11, rdi
movzx r8d, byte [r9]
movzx r10d, byte [r9 + r11]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140050f7a
inc r9
sub qword [rsp + 0x70], 1
jne 0x140050f42
jmp 0x140050f7f
cmp r8d, r10d
jne 0x140050f9a
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x140050fb0
cmp qword [rbp - 0x40], r13
je 0x140050fb0
mov r8d, 0x1e
lea rdx, str.Debug_object_handle_detected._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
call fcn.1400477e0
test al, al
je 0x140050fcf
mov r8d, 0x13
lea rdx, str.Debug_flag_hooked._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
call fcn.140048dd0
test al, al
je 0x140050fee
mov r8d, 0x1a
lea rdx, str.Bad_hide_thread_detected._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
xor r12b, r12b
mov dword [rbp - 0x48], r13d
mov rsi, r13
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x14005103c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005102e
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140051038
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140051014
jmp 0x14005103c
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
lea r13, str.NtQuerySystemInformation
test r8, r8
je 0x14005127a
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x14005127a
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14005127a
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14005127a
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor r9d, r9d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14005127a
mov edx, dword [rdi]
add rdx, r8
mov rax, r13
je 0x1400510df
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400510db
sub rdx, r13
nop word [rax + rax]
test cl, cl
je 0x1400510d6
cmp byte [rax], sil
je 0x1400510db
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400510c0
jmp 0x1400510db
cmp byte [rax], sil
je 0x1400510f0
cmp cl, byte [rax]
je 0x1400510f0
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400510a5
jmp 0x14005127a
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x14005127a
lea r9, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
mov ebx, 0x16
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
jne 0x140051164
nop dword [rax]
test rsi, rsi
je 0x140051136
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x48]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x48]
mov r8d, dword [rbp - 0x48]
mov rdx, rax
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
je 0x140051120
test eax, eax
jns 0x140051187
test rsi, rsi
je 0x14005127a
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14005127a
lea r11, [rsi + 8]
mov eax, dword [rsi]
test eax, eax
je 0x14005124e
mov r14d, eax
nop dword [rax + rax]
mov r8, r11
test r11, r11
je 0x140051240
lea rbx, str.Hyhd
sub rbx, r11
nop word [rax + rax]
movsx r10d, byte [r8]
movsx r9d, byte [r8 + rbx]
lea eax, [r10 - 0x41]
lea edx, [r10 + 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r9 - 0x41]
lea ecx, [r9 + 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edx, ecx
jne 0x1400511ff
test r10b, r10b
je 0x1400511fa
test r9b, r9b
je 0x1400511ff
inc r8
jmp 0x1400511c0
test r9b, r9b
je 0x140051221
lea eax, [r10 - 0x41]
lea edi, [r10 + 0x20]
cmp eax, 0x19
cmova edi, r10d
lea eax, [r9 - 0x41]
lea ecx, [r9 + 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edi, ecx
jne 0x140051240
cmp dword [r11 + 4], 0
jne 0x14005122f
cmp dword [r11 + 0x18], 0
je 0x140051240
cmp qword [r11 + 0x20], 0xa
ja 0x14005123d
cmp qword [r11 + 0x10], 0xa
jbe 0x140051240
mov r12b, 1
add r11, 0x28
sub r14, 1
jne 0x1400511a0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12b, r12b
je 0x14005127a
mov r8d, 0x26
lea rdx, str.HyperHide_debugging_process_detected._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
xor r12d, r12d
mov r14d, r12d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400512c8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400512ba
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400512c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400512a0
jmp 0x1400512c8
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
mov rax, r9
test r8, r8
je 0x140051318
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x140051313
mov ecx, 0x46
mov rdi, r8
sub rdi, r9
test cx, cx
je 0x14005130d
cmp word [rax], r12w
je 0x140051313
add rax, 2
movzx edx, word [rax + rdi]
movzx ecx, dx
cmp dx, word [rax]
je 0x1400512f0
jmp 0x140051313
cmp word [rax], r12w
je 0x14005131e
cmp cx, word [rax]
je 0x14005131e
add r8, 2
jmp 0x1400512d3
add r8, 0x24
mov rbx, r12
mov edi, r12d
je 0x140051372
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x14005133b
mov edi, 1
jmp 0x140051341
cmp ax, 0x2b
jne 0x140051350
add r8, 2
nop word [rax + rax]
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14005136b
lea rbx, [rbx + rbx*4]
lea rbx, [rbx - 0x18]
lea rbx, [rdx + rbx*2]
jmp 0x140051341
test edi, edi
je 0x140051372
neg rbx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x1400514fd
cmp dl, 6
jne 0x1400513c1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400513c1
sub ecx, 1
je 0x1400513c1
cmp ecx, 1
je 0x1400513c1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400513b9
sub ecx, 1
je 0x1400513b9
cmp ecx, 1
jne 0x1400514fd
mov ecx, r12d
jmp 0x140051504
mov dword [rbp + 0x90], 0x114
mov r15, r12
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x14005140f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140051401
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14005140b
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x1400513e7
jmp 0x14005140f
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
test r8, r8
je 0x140051565
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140051565
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140051565
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140051565
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov esi, dword [rax + 0x1c]
add rsi, r8
mov r9d, r12d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140051565
lea r14, str.RtlGetVersion
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, r14
je 0x1400514b4
movzx ecx, byte [rdx]
cmp cl, 0x52
jne 0x1400514b0
sub rdx, r14
test cl, cl
je 0x1400514ab
cmp byte [rax], r12b
je 0x1400514b0
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140051495
jmp 0x1400514b0
cmp byte [rax], r12b
je 0x1400514c5
cmp cl, byte [rax]
je 0x1400514c5
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140051480
jmp 0x140051565
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r8
je 0x140051565
lea rcx, [rbp + 0x90]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0x9c]
cmp ecx, dword [rax + 0x120]
jne 0x14005154f
mov eax, ecx
jmp 0x140051544
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
jne 0x14005154f
cmp dl, 0xa
je 0x14005153b
cmp dl, 6
jne 0x140051536
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140051536
sub ecx, 1
je 0x140051536
cmp ecx, 1
jne 0x14005153b
mov eax, r12d
jmp 0x140051542
mov eax, dword [0x7ffe0260]
cdqe
sub rax, rbx
cmp rax, 0x7d0
jbe 0x140051565
mov r8d, 0x15
lea rdx, str.Build_number_hooked._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
mov qword [rbp - 0x50], r12
mov dword [rbp - 0x50], 8
mov r14, r12
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400515b8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400515aa
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400515b4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051590
jmp 0x1400515b8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400516a2
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400516a2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400516a2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400516a2
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r12d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400516a2
nop word [rax + rax]
mov edx, dword [rdi]
add rdx, r9
mov rax, r13
je 0x140051654
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140051650
sub rdx, r13
test cl, cl
je 0x14005164b
cmp byte [rax], r12b
je 0x140051650
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x140051635
jmp 0x140051650
cmp byte [rax], r12b
je 0x140051662
cmp cl, byte [rax]
je 0x140051662
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140051620
jmp 0x1400516a2
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x1400516a2
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp - 0x50]
lea ecx, [r9 + 0x67]
call rax
mov eax, dword [rbp - 0x4c]
shr eax, 1
test al, 1
je 0x1400516a2
mov r8d, 0x1d
lea rdx, str.Code_integrity_check_failed._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
mov dword [rbp - 0x48], 0x104
mov r13d, 1
mov dword [rbp - 0x60], r13d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400517ce
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400517c4
lea r10, [rbp + 0x3a0]
cmp byte [rbp + 0x3a0], r12b
je 0x1400517c4
lea r11, str.TESTSIGNING
movzx ebx, byte [str.TESTSIGNING]
test r10, r10
je 0x1400517c4
mov r8, r10
mov r9, r11
movzx eax, bl
nop word [rax + rax]
movsx edx, byte [r8]
inc r8
movsx ecx, al
lea r9, [r9 + 1]
lea eax, [rcx - 0x41]
lea edi, [rcx + 0x20]
cmp eax, 0x19
cmova edi, ecx
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x140051775
add edx, 0x20
cmp edx, edi
jne 0x1400517b8
movzx eax, byte [r9]
test al, al
jne 0x140051750
mov eax, r12d
inc eax
lea r11, [r11 + 1]
cmp byte [r11], r12b
jne 0x140051784
cdqe
cmp r8, rax
je 0x1400517c4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x1b
lea rdx, str.Started_with_DSE_disabled._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
jmp 0x1400517ce
inc r10
cmp byte [r10], r12b
jne 0x140051735
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.BCD00000000Objects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140051a66
mov dword [rbp + 0x30], 0x104
mov dword [rbp - 0x38], r12d
xor sil, sil
mov edx, 0x4096
xor ecx, ecx
lea r9d, [rax + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov dword [rbp + 0x38], 0x4096
lea rax, [rbp + 0x58]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x140051a30
mov r14d, r12d
nop dword [rax]
mov dword [rbp + 0x34], 0xff
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x34]
lea r8, [rbp + 0x2a0]
mov edx, r14d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140051a23
mov edx, 0x4096
xor ecx, ecx
lea r9d, [rax + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4096
rep stosb byte [rdi], al
mov rdx, rbx
test rbx, rbx
je 0x1400519b1
cmp byte [rbx], al
je 0x14005191c
inc rdx
cmp byte [rdx], al
jne 0x140051915
mov al, 0x42
lea rcx, str.BCD00000000Objects_
sub rcx, rdx
nop dword [rax + rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
movzx eax, byte [rcx + rdx]
test al, al
jne 0x140051930
mov byte [rdx], r12b
mov rax, rbx
cmp byte [rbx], r12b
je 0x140051958
nop dword [rax]
inc rax
cmp byte [rax], r12b
jne 0x140051950
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
je 0x14005197d
lea rdx, [rbp + 0x2a0]
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
inc rax
movzx ecx, byte [rax + rdx]
test cl, cl
jne 0x140051970
mov byte [rax], r12b
mov rax, rbx
cmp byte [rbx], r12b
je 0x140051990
inc rax
cmp byte [rax], r12b
jne 0x140051988
mov cl, 0x5c
lea rdx, str.Elements16000049
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
lea rax, [rax + 1]
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x1400519a0
mov byte [rax], r12b
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140051a12
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Element
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140051a08
movzx esi, sil
cmp dword [r15], r13d
cmove esi, r13d
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14d
cmp r14d, dword [rbp - 0x38]
jb 0x1400518a0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x140051a66
mov r8d, 0x2a
lea rdx, str.BCD_library_allows_prerelease_signatures._n
lea rcx, [rbp - 0x20]
call fcn.140058f50
cmp qword [rbp - 0x10], r12
je 0x140051ab6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor r9d, r9d
lea r8, str.dana56
mov rcx, rax
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.C:loader
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140051aad
shr eax, 4
test r13b, al
jne 0x140051ab6
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140051af4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051aef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051aef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005b774
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.14005b360
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret