Function at 0x14000e120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push r13
push r14
push r15
lea rbp, [rsp - 0x9d0]
sub rsp, 0xb90
mov r13, rdx
mov r14, rcx
mov edx, 0x32
mov r8d, 0x4d525356
mov rsi, r9
lea ecx, [rdx - 0x31]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp + 0x30], rax
mov r15, rax
test rax, rax
je 0x14000f6bf
mov rdx, qword [rbp + 0xa10]
xor eax, eax
mov qword [rsp + 0xb88], rbx
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [rsp + 0xb80], rdi
movabs rdi, 0xfffff78000000320
movups xmmword [r15 + 0x10], xmm0
mov qword [rsp + 0xb78], r12
xor r12d, r12d
movups xmmword [r15 + 0x20], xmm0
mov word [r15 + 0x30], ax
xor bl, bl
mov byte [r15], 1
mov r10d, 0xff
mov rdi, qword [rdi]
movzx eax, byte [r13]
mov r8d, dword [rdx]
add eax, 0xffffffe3
cmp eax, 0x92
ja case.0x14000e1fe.31
lea r9, [0x140000000]
cdqe
movzx eax, byte [r9 + rax + 0xf718]
mov ecx, dword [r9 + rax*4 + 0xf6d0]
add rcx, r9
jmp rcx
movzx eax, word [r13 + 1]
mov word [r14 + 0xc], ax
mov word [r14 + 0xe], 0xa0cb
mov byte [r14 + 3], r14b
mov byte [r14 + 1], 1
mov byte [r15], bl
mov ebx, 0xa
mov word [r15 + 2], 0xa02
movzx eax, byte [r14 + 0x45a]
sub al, 3
test al, 0xfd
mov eax, 0x1a
cmovne eax, ebx
mov byte [r15 + 3], al
movzx eax, byte [r14 + 0x43a]
cmp al, 5
cmova ebx, eax
movzx eax, r14w
mov byte [r15 + 3], bl
mov bl, 1
shr ax, 8
mov byte [r15 + 4], r12b
mov r12d, 5
mov byte [r15 + 6], al
mov byte [r15 + 5], r14b
jmp 0x14000f5e9
mov r8, r14
lea rcx, [r13 + 1]
mov edx, 4
call fcn.14000e000
mov eax, dword [r14 + 0x43c]
cmp dword [r13 + 1], eax
jne 0x14000f5e9
cmp byte [r14 + 1], 1
jne 0x14000f5e9
mov rcx, r14
mov byte [r15], bl
call fcn.140010ad0
mov rcx, r14
mov byte [r15 + 2], al
call fcn.140010ad0
sar eax, 8
mov bl, 1
mov byte [r15 + 3], al
mov r12d, 3
mov byte [r15 + 4], 0x10
mov eax, dword [r14 + 0x43c]
mov dword [0x140007500], eax
mov byte [r14 + 2], bl
jmp 0x14000f5e9
lea rcx, [r13 + 1]
mov r8, r14
mov edx, 2
call fcn.14000e000
cmp byte [r14 + 2], bl
je 0x14000f5e9
cmp word [r13 + 1], 7
ja 0x14000f5e9
mov byte [r15], bl
mov r12d, 6
movzx eax, word [r13 + 1]
mov bl, 1
lea rcx, [r14 + rax*2]
mov eax, dword [rcx + 0x456]
mov dword [r15 + 2], eax
movzx eax, word [rcx + 0x45a]
mov word [r15 + 6], ax
jmp 0x14000f5e9
lea rcx, [r13 + 1]
mov r8, r14
mov edx, 2
call fcn.14000e000
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov rcx, r14
call fcn.140010ad0
movzx ecx, word [r13 + 1]
add ecx, ecx
cmp ecx, eax
jge 0x14000f5e9
mov byte [r15], bl
mov r12d, 6
movzx eax, word [r13 + 1]
mov bl, 1
lea rcx, [r14 + rax*2]
mov eax, dword [rcx + 0x4a6]
mov dword [r15 + 2], eax
movzx eax, word [rcx + 0x4aa]
mov word [r15 + 6], ax
jmp 0x14000f5e9
mov r8, r14
lea rcx, [r13 + 1]
mov edx, 4
call fcn.14000e000
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov rcx, r14
call fcn.140010ad0
movzx ecx, word [r13 + 1]
add ecx, ecx
cmp ecx, eax
jge 0x14000f5e9
mov byte [r15], bl
movzx ecx, word [r13 + 1]
movzx eax, word [r13 + 3]
mov word [r14 + rcx*2 + 0x4a6], ax
mov rcx, r14
call fcn.140010ad0
mov r8d, eax
lea rdx, [r14 + 0x4a6]
lea rcx, [0x1400010e8]
mov r9, r14
call fcn.140010b10
test eax, eax
jne 0x14000f5e9
mov byte [r15], bl
jmp 0x14000f5e9
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov byte [r15], bl
mov r12d, 8
movzx eax, byte [r14 + 0x455]
mov bl, 1
mov byte [r15 + 2], al
movzx eax, byte [r14 + 0x454]
mov byte [r15 + 3], al
movzx eax, byte [r14 + 0x453]
mov byte [r15 + 4], al
movzx eax, byte [r14 + 0x452]
mov byte [r15 + 5], al
movzx eax, byte [r14 + 0x451]
mov byte [r15 + 6], al
movzx eax, byte [r14 + 0x450]
mov byte [r15 + 7], al
movzx eax, byte [r14 + 0x44f]
mov byte [r15 + 8], al
movzx eax, byte [r14 + 0x44e]
mov byte [r15 + 9], al
jmp 0x14000f5e9
lea rcx, [r13 + 1]
mov r8, r14
mov edx, 4
call fcn.14000e000
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov byte [r15], bl
lea rcx, [r15 + 2]
mov eax, dword [r13 + 1]
lea rdx, [r14 + 0x14a6]
mov dword [rcx], eax
call fcn.140003af0
mov r12d, 4
mov bl, 1
jmp 0x14000f5e9
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov r8, r14
mov byte [r15], bl
mov edx, 4
lea rcx, [r13 + 1]
call fcn.14000e000
movabs rbx, 0xfffff78000000014
lea rdx, [rbp + 0x20]
mov rcx, qword [rbx]
add rcx, qword [r14 + 0x49e]
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
movzx ecx, word [r13 + 1]
mov edx, 0xff
movzx eax, cx
and ax, dx
jne 0x14000e555
movzx ecx, byte [rbp + 0x26]
call fcn.140003e00
movzx ecx, byte [rbp + 0x28]
mov byte [r15 + 4], al
call fcn.140003e00
movzx ecx, byte [rbp + 0x2a]
mov byte [r15 + 3], al
call fcn.140003e00
mov byte [r15 + 2], al
mov bl, 1
movzx r12d, byte [r13 + 2]
jmp 0x14000f5e9
cmp ax, 3
jne 0x14000e5b1
movsx ecx, word [rbp + 0x20]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x64
sub ecx, eax
call fcn.140003e00
movzx ecx, byte [rbp + 0x2e]
mov byte [r15 + 5], al
call fcn.140003e00
movzx ecx, byte [rbp + 0x22]
mov byte [r15 + 4], al
call fcn.140003e00
movzx ecx, byte [rbp + 0x24]
mov byte [r15 + 3], al
call fcn.140003e00
mov byte [r15 + 2], al
mov bl, 1
movzx r12d, byte [r13 + 2]
jmp 0x14000f5e9
movzx edx, cl
mov r8, rcx
add rdx, 0x466
shr r8, 8
add rdx, r14
lea rcx, [r15 + 2]
call fcn.140001820
movzx r12d, byte [r13 + 2]
mov bl, 1
jmp 0x14000f5e9
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov r8, r14
mov byte [r15], bl
mov edx, 4
lea rcx, [r13 + 1]
call fcn.14000e000
movzx edi, byte [r13 + 4]
mov rdx, rsi
movzx eax, word [r13 + 1]
mov r8d, edi
movzx ecx, al
mov dword [0x140007508], ecx
mov dword [0x140007504], edi
lea rbx, [rcx + r14]
lea rcx, [rbx + 0x466]
call fcn.140001820
mov r8, r14
lea rcx, [rbx + 0x466]
mov edx, edi
call fcn.14000e000
mov r9, qword [rbp + 0xa10]
mov dword [r9], r12d
jmp 0x14000f699
cmp byte [r14 + 2], bl
je 0x14000f5e9
cmp dword [0x140007508], 7
jl 0x14000e673
lea rdx, [r14 + 0x466]
mov r8d, 0x38
lea rcx, [0x1400010f8]
jmp 0x14000e3f9
movabs rbx, 0xfffff78000000014
lea rdx, [rbp + 0x20]
mov rbx, qword [rbx]
mov rcx, qword [r14 + 0x49e]
add rcx, rbx
mov qword [rbp + 0x30], rcx
lea rcx, [rbp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
cmp dword [0x140007508], r12d
jne 0x14000e6f1
and byte [r14 + 0x466], 0x7f
movzx ecx, byte [r14 + 0x466]
call fcn.140003de0
movzx ecx, byte [r14 + 0x467]
movzx r8d, al
mov word [rbp + 0x2a], r8w
call fcn.140003de0
movzx ecx, byte [r14 + 0x468]
movzx r8d, al
mov word [rbp + 0x28], r8w
call fcn.140003de0
movzx r8d, al
mov word [rbp + 0x26], r8w
jmp 0x14000e747
movzx ecx, byte [r14 + 0x469]
call fcn.140003de0
movzx ecx, byte [r14 + 0x46a]
movzx r8d, al
mov word [rbp + 0x24], r8w
call fcn.140003de0
movzx ecx, byte [r14 + 0x46c]
movzx r8d, al
mov word [rbp + 0x22], r8w
call fcn.140003de0
movzx r8d, al
mov eax, 0x7d0
cmp r8b, 0x5a
jb 0x14000e73e
mov eax, 0x76c
add r8w, ax
mov word [rbp + 0x20], r8w
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov rax, qword [rbp + 0x40]
lea rdx, [r14 + 0x49e]
sub rax, rbx
lea rcx, [0x140001118]
mov r9, r14
mov qword [r14 + 0x49e], rax
mov r8d, 8
call fcn.140010b10
xor bl, bl
test eax, eax
jne 0x14000f5e9
mov byte [r15], r12b
jmp 0x14000f5e9
cmp byte [r14 + 2], bl
je 0x14000f5e9
mov eax, dword [rdx]
lea rcx, [r13 + 1]
mov edx, 4
mov dword [r14 + 0x14c2], eax
mov r8, r14
call fcn.14000e000
mov eax, dword [r14 + 0x14c2]
mov r11, rsi
cmp eax, 1
jb 0x14000e8c1
mov ebx, eax
lea r10, [r14 + 0xe]
mov edi, 0x8000
movzx eax, word [r14 + 0xc]
test al, 1
je 0x14000e7ea
xor ax, word [r10]
mov cl, 2
shr ax, 1
or ax, di
jmp 0x14000e7ef
shr ax, 1
xor cl, cl
movzx r8d, cl
movzx ecx, r8b
mov word [r14 + 0xc], ax
or cl, 1
test al, 0x80
movzx r9d, cl
cmove r9d, r8d
add r9b, r9b
test al, 1
je 0x14000e820
xor ax, word [r10]
or r9b, 1
shr ax, 1
or ax, di
jmp 0x14000e823
shr ax, 1
add r9b, r9b
mov word [r14 + 0xc], ax
movzx r8d, r9b
movzx ecx, r8b
or cl, 1
test al, 0x80
movzx r9d, cl
cmove r9d, r8d
add r9b, r9b
test al, 1
je 0x14000e857
xor ax, word [r10]
or r9b, 1
shr ax, 1
or ax, di
jmp 0x14000e85a
shr ax, 1
add r9b, r9b
mov word [r14 + 0xc], ax
movzx r8d, r9b
movzx ecx, r8b
or cl, 1
test al, 0x80
movzx r9d, cl
cmove r9d, r8d
add r9b, r9b
test al, 1
je 0x14000e88e
xor ax, word [r10]
or r9b, 1
shr ax, 1
or ax, di
jmp 0x14000e895
shr ax, 1
lea r10, [r14 + 0xe]
add r9b, r9b
mov word [r14 + 0xc], ax
movzx r8d, r9b
movzx ecx, r8b
or cl, 1
test al, 0x80
movzx edx, cl
cmove edx, r8d
xor byte [r11], dl
inc r11
sub rbx, 1
jne 0x14000e7d3
cmp word [r13 + 1], 3
xorps xmm0, xmm0
mov edx, 8
mov r8d, 0x30
seta al
mov byte [r14 + 0x14c6], al
movzx ecx, word [r13 + 1]
cmp ecx, 7
movzx eax, cl
lea rcx, [r14 + 0x14c8]
cmovb edx, eax
mov byte [r14 + 0x14c7], dl
mov rdx, rsi
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movsxd rax, dword [r14 + 0x14c2]
cmp rax, r8
cmovb r8, rax
call fcn.140001820
mov byte [r15], r12b
jmp 0x14000f699
cmp byte [r14 + 2], bl
je 0x14000f5e9
movsxd rsi, dword [r14 + 0x14c2]
lea rdx, [r14 + 0x14c8]
xorps xmm1, xmm1
lea rcx, [rbp - 0x80]
mov r8d, 0x30
cmp rsi, r8
movups xmmword [rbp + 0x58], xmm0
cmovb r8, rsi
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
call fcn.140001820
mov r8d, 0x30
lea rdx, [r14 + 0x14c8]
cmp rsi, r8
lea rcx, [rbp + 0x58]
cmovb r8, rsi
call fcn.140001820
xor edx, edx
lea rcx, [rbp + 0xe0]
mov r8d, 0x100
call fcn.140001b70
lea rcx, [0x140001130]
cmp byte [r14 + 0x14c6], bl
je 0x14000e9b5
lea rcx, [0x140001158]
mov qword [rsp + 0x40], rcx
lea rax, [r14 + 0x14f8]
mov qword [rsp + 0x38], rax
lea rcx, [rbp + 0xe0]
lea rax, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [0x140001140]
mov edx, 0x100
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.140003570
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rbp + 0xa0]
mov dword [rbp + 0xb0], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0xc0], rax
lea r8, [rbp + 0xb0]
mov qword [rbp + 0xb8], r12
mov edx, 0x20019
mov dword [rbp + 0xc8], 0x40
lea rcx, [rbp + 0x50]
movdqu xmmword [rbp + 0xd0], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x14000eeaa
xor edx, edx
lea rcx, [rbp + 0xe0]
mov r8d, 0x100
call fcn.140001b70
mov eax, dword [r14 + 0x14c2]
cmp eax, 0x10
je 0x14000ed8b
cmp eax, 0x20
je 0x14000ec2a
cmp eax, 0x30
jne 0x14000ee7c
movzx eax, byte [rbp - 0x61]
mov dword [rsp + 0x130], eax
movzx eax, byte [rbp - 0x6e]
movzx ecx, byte [rbp - 0x62]
movzx edx, byte [rbp - 0x63]
movzx r8d, byte [rbp - 0x64]
movzx r9d, byte [rbp - 0x65]
movzx r10d, byte [rbp - 0x66]
movzx r11d, byte [rbp - 0x67]
movzx ebx, byte [rbp - 0x68]
movzx esi, byte [rbp - 0x69]
movzx r14d, byte [rbp - 0x6a]
movzx r15d, byte [rbp - 0x6b]
movzx r12d, byte [rbp - 0x6c]
movzx r13d, byte [rbp - 0x6d]
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], r8d
mov dword [rsp + 0x110], r9d
mov dword [rsp + 0x108], r10d
mov dword [rsp + 0x100], r11d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], r14d
mov dword [rsp + 0xe0], r15d
mov dword [rsp + 0xd8], r12d
mov dword [rsp + 0xd0], r13d
mov dword [rsp + 0xc8], eax
movzx eax, byte [rbp - 0x6f]
mov dword [rsp + 0xc0], eax
movzx eax, byte [rbp - 0x70]
mov dword [rsp + 0xb8], eax
movzx eax, byte [rbp - 0x71]
mov dword [rsp + 0xb0], eax
movzx eax, byte [rbp - 0x72]
mov dword [rsp + 0xa8], eax
movzx eax, byte [rbp - 0x73]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rbp - 0x74]
mov dword [rsp + 0x98], eax
movzx eax, byte [rbp - 0x75]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp - 0x76]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp - 0x77]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x78]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbp - 0x79]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbp - 0x7a]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbp - 0x7b]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbp - 0x7c]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbp - 0x7d]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbp - 0x7e]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x7f]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x80]
mov dword [rsp + 0x38], eax
lea rax, [0x140001308]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0xe0]
lea rax, [0x140001200]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, 0x100
mov dword [rsp + 0x20], 0x800
call fcn.140003570
jmp 0x14000ee67
movzx eax, byte [rbp - 0x61]
mov dword [rsp + 0x130], eax
movzx eax, byte [rbp - 0x6e]
movzx ecx, byte [rbp - 0x62]
movzx edx, byte [rbp - 0x63]
movzx r8d, byte [rbp - 0x64]
movzx r9d, byte [rbp - 0x65]
movzx r10d, byte [rbp - 0x66]
movzx r11d, byte [rbp - 0x67]
movzx ebx, byte [rbp - 0x68]
movzx esi, byte [rbp - 0x69]
movzx r14d, byte [rbp - 0x6a]
movzx r15d, byte [rbp - 0x6b]
movzx r12d, byte [rbp - 0x6c]
movzx r13d, byte [rbp - 0x6d]
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], r8d
mov dword [rsp + 0x110], r9d
mov dword [rsp + 0x108], r10d
mov dword [rsp + 0x100], r11d
mov dword [rsp + 0xf8], ebx
mov dword [rsp + 0xf0], esi
mov dword [rsp + 0xe8], r14d
mov dword [rsp + 0xe0], r15d
mov dword [rsp + 0xd8], r12d
mov dword [rsp + 0xd0], r13d
mov dword [rsp + 0xc8], eax
movzx eax, byte [rbp - 0x6f]
mov dword [rsp + 0xc0], eax
movzx eax, byte [rbp - 0x70]
mov dword [rsp + 0xb8], eax
movzx eax, byte [rbp - 0x71]
mov dword [rsp + 0xb0], eax
movzx eax, byte [rbp - 0x72]
mov dword [rsp + 0xa8], eax
movzx eax, byte [rbp - 0x73]
mov dword [rsp + 0xa0], eax
movzx eax, byte [rbp - 0x74]
mov dword [rsp + 0x98], eax
movzx eax, byte [rbp - 0x75]
mov dword [rsp + 0x90], eax
movzx eax, byte [rbp - 0x76]
mov dword [rsp + 0x88], eax
movzx eax, byte [rbp - 0x77]
mov dword [rsp + 0x80], eax
movzx eax, byte [rbp - 0x78]
mov dword [rsp + 0x78], eax
movzx eax, byte [rbp - 0x79]
mov dword [rsp + 0x70], eax
movzx eax, byte [rbp - 0x7a]
mov dword [rsp + 0x68], eax
movzx eax, byte [rbp - 0x7b]
mov dword [rsp + 0x60], eax
movzx eax, byte [rbp - 0x7c]
mov dword [rsp + 0x58], eax
movzx eax, byte [rbp - 0x7d]
mov dword [rsp + 0x50], eax
movzx eax, byte [rbp - 0x7e]
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x7f]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x80]
mov dword [rsp + 0x38], eax
lea rax, [0x1400011f8]
jmp 0x14000ebf5
movzx eax, byte [rbp - 0x71]
movzx ecx, byte [rbp - 0x72]
movzx edx, byte [rbp - 0x73]
movzx r8d, byte [rbp - 0x74]
movzx r9d, byte [rbp - 0x75]
movzx r10d, byte [rbp - 0x76]
movzx r11d, byte [rbp - 0x77]
movzx ebx, byte [rbp - 0x78]
movzx esi, byte [rbp - 0x79]
movzx r14d, byte [rbp - 0x7a]
movzx r15d, byte [rbp - 0x7b]
movzx r12d, byte [rbp - 0x7c]
movzx r13d, byte [rbp - 0x7d]
mov dword [rsp + 0xb0], eax
movzx eax, byte [rbp - 0x7e]
mov dword [rsp + 0xa8], ecx
lea rcx, [rbp + 0xe0]
mov dword [rsp + 0xa0], edx
mov edx, 0x100
mov dword [rsp + 0x98], r8d
xor r8d, r8d
mov dword [rsp + 0x90], r9d
xor r9d, r9d
mov dword [rsp + 0x88], r10d
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], esi
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x48], eax
movzx eax, byte [rbp - 0x7f]
mov dword [rsp + 0x40], eax
movzx eax, byte [rbp - 0x80]
mov dword [rsp + 0x38], eax
lea rax, [0x140001168]
mov qword [rsp + 0x30], rax
lea rax, [0x140001170]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
call fcn.140003570
mov r14, qword [rbp + 0xa00]
xor r12d, r12d
mov r15, qword [rbp + 0x30]
mov r13, qword [rbp + 0xa08]
mov rcx, qword [rbp + 0x50]
lea r8, [rbp - 0x80]
mov r9d, 0x10
lea rdx, [rbp + 0xe0]
call fcn.1400041c0
mov rcx, qword [rbp + 0x50]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
jns case.0x14000eecc.3
movzx eax, byte [r14 + 0x14c7]
cmp eax, 6
ja case.0x14000eecc.3
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0xf7ac]
add rcx, rdx
jmp rcx
lea rdx, [r14 + 0x1520]
mov r8d, 0x80
lea rcx, [rbp + 0x1e0]
call fcn.140002ce0
jmp 0x14000f049
lea rdx, [r14 + 0x1520]
mov r8d, 0x80
lea rcx, [rbp + 0x1e0]
call fcn.140002ce0
lea r9, [rbp - 0x80]
mov edx, 0xa
lea r8, [rbp + 0x58]
lea rcx, [rbp + 0x1e0]
call fcn.140001c60
mov ecx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + r12 + 0x68]
xor byte [rbp + r12 - 0x80], al
lea r12, [r12 + 1]
sub rcx, 1
jne 0x14000ef30
jmp case.0x14000eecc.3
lea rdx, [r14 + 0x1520]
mov r8d, 0x80
lea rcx, [rbp + 0x1e0]
call fcn.140002ce0
lea r9, [rbp - 0x80]
mov edx, 0xa
lea r8, [rbp + 0x58]
lea rcx, [rbp + 0x1e0]
call fcn.140001c60
mov rcx, r12
mov edx, 0x10
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x68]
xor byte [rbp + rcx - 0x80], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14000ef90
mov ecx, 0x10
nop dword [rax + rax]
movzx eax, byte [rbp + r12 + 0x78]
xor byte [rbp + r12 - 0x80], al
lea r12, [r12 + 1]
sub rcx, 1
jne 0x14000efb0
jmp case.0x14000eecc.3
mov ecx, 0x10
movzx eax, byte [rbp + r12 + 0x68]
xor byte [rbp + r12 - 0x80], al
lea r12, [r12 + 1]
sub rcx, 1
jne 0x14000efd0
jmp case.0x14000eecc.3
lea rcx, [rbp + 0x58]
mov edx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x10]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14000f000
lea rcx, [rbp + 0x58]
mov edx, 0x10
nop dword [rax]
movzx eax, byte [rcx + 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14000f020
lea rdx, [r14 + 0x1520]
mov r8d, 0x80
lea rcx, [rbp + 0x1e0]
call fcn.140002a40
lea r9, [rbp - 0x80]
mov edx, 0xa
lea r8, [rbp + 0x58]
lea rcx, [rbp + 0x1e0]
call fcn.140001c60
mov byte [r15], 0
lea rcx, [r15 + 2]
movsxd r8, dword [r14 + 0x14c2]
lea rdx, [rbp - 0x80]
call fcn.140001820
mov rsi, qword [rbp + 0xa18]
mov r12d, 0x10
mov bl, 1
jmp 0x14000f5e9
mov byte [r15], bl
mov byte [r15 + 4], bl
mov dword [rdx], 1
movzx eax, byte [r15 + 2]
mov byte [rsi], al
jmp 0x14000f699
movzx ecx, word [r13 + 1]
test ecx, ecx
je 0x14000f1c0
sub ecx, 1
je 0x14000f120
sub ecx, 1
je 0x14000f0db
cmp ecx, 1
jne 0x14000f699
mov qword [rbp + 0x30], 0x80000
mov rax, qword [rbp + 0x30]
mov qword [rsi], rax
jmp 0x14000f699
movzx eax, byte [r14 + 0x459]
movzx ecx, byte [r14 + 0x458]
movzx edx, byte [r14 + 0x457]
movzx r8d, byte [r14 + 0x456]
mov byte [rsi], al
mov byte [rsi + 1], cl
mov byte [rsi + 2], dl
mov byte [rsi + 3], r8b
mov dword [rsi + 4], 0x10000
mov dword [rsi + 8], 0x2101
mov word [rsi + 0xc], 1
jmp 0x14000f699
movzx eax, byte [r14 + 0x459]
mov byte [rbp - 0x80], al
movzx eax, byte [r14 + 0x458]
mov byte [rbp - 0x7f], al
movzx eax, byte [r14 + 0x457]
mov byte [rbp - 0x7e], al
movzx eax, byte [r14 + 0x456]
mov byte [rbp - 0x7d], al
mov qword [rbp - 0x64], 0x7b
mov dword [rbp - 0x7c], 0x106
mov dword [rbp - 0x78], 0xe00ca02
mov dword [rbp - 0x74], 0x37390000
movups xmm0, xmmword [rbp - 0x80]
mov dword [rbp - 0x70], 0x2002402
mov dword [rbp - 0x6c], 0x200
movups xmmword [rsi], xmm0
mov dword [rbp - 0x68], 0xc3221903
movups xmm1, xmmword [rbp - 0x70]
mov dword [rbp - 0x5c], 0x7e0300f8
movsd xmm0, qword [rbp - 0x60]
movups xmmword [rsi + 0x10], xmm1
mov dword [rbp - 0x58], 0x8b920000
mov eax, dword [rbp - 0x58]
movsd qword [rsi + 0x20], xmm0
mov dword [rsi + 0x28], eax
movzx eax, r12w
mov word [rsi + 0x2c], ax
mov byte [rsi + 0x2e], bl
mov word [rbp - 0x54], r12w
jmp 0x14000f699
mov word [rsi], 1
mov byte [rsi + 2], bl
jmp 0x14000f699
xor eax, eax
mov byte [r15], bl
mov qword [r14 + 4], rax
lea rcx, [r14 + 8]
mov eax, dword [r13 + 1]
mov dword [r14 + 4], eax
mov eax, dword [rdx]
mov edx, 8
cmp eax, edx
cmova eax, edx
mov rdx, rsi
mov r8d, eax
jmp 0x14000f694
mov r8d, dword [rdx]
mov rcx, rsi
xor edx, edx
mov dword [rbp + 0x40], 0x88e14c79
mov dword [rbp + 0x44], 0x5378c1cb
mov dword [rbp + 0x48], 0xb2e06911
mov dword [rbp + 0x4c], 0x76c997ca
call fcn.140001b70
movzx eax, byte [r14 + 4]
lea rdx, [rbp + 0x40]
xorps xmm0, xmm0
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x20], xmm0
mov r8d, 0x80
mov byte [rbp + 0x20], al
call fcn.140002ce0
mov ebx, 0xa
lea r9, [rbp + 0x30]
mov edx, ebx
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0x1e0]
call fcn.140001c60
xor eax, eax
lea r8d, [rbx + 0x76]
mov dword [rbp + 0x98], eax
lea rdx, [rbp + 0x30]
mov rax, qword [r14 + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov rcx, rax
mov qword [rbp + 0x28], rax
shr rcx, 8
xor cl, al
and cl, 0x1f
mov byte [rbp + 0x22], cl
mov byte [rbp + 0x9a], cl
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x88], xmm0
call fcn.140002ce0
lea r9, [rbp + 0x88]
mov edx, ebx
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0x1e0]
call fcn.140001c60
mov r9, qword [rbp + 0xa10]
lea rdx, [rbp + 0x88]
mov byte [r15], r12b
mov r8d, dword [r9]
jmp 0x14000f691
mov byte [r15], bl
cmp word [r13 + 1], r12w
jne 0x14000f699
cmp dword [rdx], 0x7c1
jne 0x14000f42f
mov r8d, 0x750
mov dword [rbp - 0x50], 0xc0ff
mov edx, r10d
mov dword [rbp - 0x4c], 0x40400
lea rcx, [rbp + 0x250]
mov dword [rbp - 0x48], 0x400c1ff
mov dword [rbp - 0x44], 0x1000100
mov dword [rbp - 0x40], 0x500c2ff
mov dword [rbp - 0x3c], 0x200fd00
mov dword [rbp - 0x38], 0x201c8ff
mov dword [rbp - 0x34], 0x3040800
mov dword [rbp - 0x30], 0x8902c9ff
mov dword [rbp - 0x2c], 0x7000200
mov dword [rbp - 0x28], 0x8b02ccff
mov dword [rbp - 0x24], 0xd040600
mov dword [rbp - 0x20], 0xa01f4ff
mov dword [rbp - 0x1c], 0x400fc00
mov dword [rbp - 0x18], 0x602f5ff
mov dword [rbp - 0x14], 0x5008000
mov dword [rbp - 0x10], 0x8602caff
mov dword [rbp - 0xc], 0x6000300
mov dword [rbp - 8], 0x9102cdff
mov dword [rbp - 4], 0x9000100
mov dword [rbp], 0x9202cbff
mov dword [rbp + 4], 0xb000100
mov qword [rbp + 8], 0xffffffffffffffff
mov qword [rbp + 0x10], 0xffffffffffffffff
mov qword [rbp + 0x18], 0xffffffffffffffff
call fcn.140001b70
movaps xmm0, xmmword [rbp - 0x50]
lea rdx, [rbp + 0x1e0]
movaps xmm1, xmmword [rbp - 0x40]
mov r8d, 0x7c1
mov r9, qword [rbp + 0xa10]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x200], xmm0
movaps xmm0, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x1f0], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x220], xmm0
movaps xmm0, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x210], xmm1
movaps xmm1, xmmword [rbp]
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x230], xmm1
mov byte [rbp + 0x9a0], bl
mov dword [r9], 0x7c1
jmp 0x14000f691
cmp r8d, 0x1a1
jne 0x14000f699
mov r8d, 0x130
mov dword [rbp - 0x50], 0xc0ff
mov edx, r10d
mov dword [rbp - 0x4c], 0x40400
lea rcx, [rbp + 0x250]
mov dword [rbp - 0x48], 0x400c1ff
mov dword [rbp - 0x44], 0x1000100
mov dword [rbp - 0x40], 0x500c2ff
mov dword [rbp - 0x3c], 0x200fd00
mov dword [rbp - 0x38], 0x201c8ff
mov dword [rbp - 0x34], 0x3040800
mov dword [rbp - 0x30], 0x8902c9ff
mov dword [rbp - 0x2c], 0x7000200
mov dword [rbp - 0x28], 0x8b02ccff
mov dword [rbp - 0x24], 0xd040600
mov dword [rbp - 0x20], 0xa01f4ff
mov dword [rbp - 0x1c], 0x400fc00
mov dword [rbp - 0x18], 0x602f5ff
mov dword [rbp - 0x14], 0x5008000
mov dword [rbp - 0x10], 0x8602caff
mov dword [rbp - 0xc], 0x6000300
mov dword [rbp - 8], 0x9102cdff
mov dword [rbp - 4], 0x9000100
mov dword [rbp], 0x9202cbff
mov dword [rbp + 4], 0xb000100
mov qword [rbp + 8], 0xffffffffffffffff
mov qword [rbp + 0x10], 0xffffffffffffffff
mov qword [rbp + 0x18], 0xffffffffffffffff
call fcn.140001b70
movaps xmm0, xmmword [rbp - 0x50]
lea rax, [rbp + 0x1e0]
movaps xmm1, xmmword [rbp - 0x40]
mov ecx, 3
mov r9, qword [rbp + 0xa10]
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x200], xmm0
movaps xmm0, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x1f0], xmm1
movaps xmm1, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x220], xmm0
movaps xmm0, xmmword [rbp + 0x10]
movaps xmmword [rbp + 0x210], xmm1
movaps xmm1, xmmword [rbp]
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x230], xmm1
mov byte [rbp + 0x380], bl
mov dword [r9], 0x1a1
lea rsi, [rsi + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rsi - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rsi - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rsi - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rsi - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rsi - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rsi - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rsi - 0x20], xmm0
movups xmmword [rsi - 0x10], xmm1
sub rcx, 1
jne 0x14000f570
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movzx eax, byte [rax + 0x20]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
mov byte [rsi + 0x20], al
jmp 0x14000f699
cmp byte [r14 + 2], bl
je 0x14000f5e6
mov byte [r15], bl
mov dword [rdx], r12d
xor byte [r14 + 3], dil
cmp byte [r15], 0x1f
ja 0x14000f623
nop dword [rax]
nop word [rax + rax]
inc byte [r14 + 3]
mov r8, r15
movzx eax, byte [r14 + 3]
mov dl, 2
mov byte [r15 + 1], al
movzx ecx, byte [r13]
and cl, 0x7f
call fcn.140003e30
test eax, eax
je 0x14000f600
movzx edi, byte [r15]
mov r8, r14
movzx r13d, byte [r15 + 1]
mov edx, 2
mov rcx, r15
call fcn.14000e000
test bl, bl
je 0x14000f64f
lea rcx, [r15 + 2]
mov r8, r14
mov edx, r12d
call fcn.14000e000
test dil, dil
jne 0x14000f671
movzx eax, word [r14 + 0xe]
movzx ecx, r13w
mov edx, 0xff
shl cx, 8
and ax, dx
or cx, ax
mov word [r14 + 0xe], cx
mov r9, qword [rbp + 0xa10]
mov rdx, r15
mov ecx, r12d
add rcx, 2
mov eax, dword [r9]
cmp rcx, rax
cmovae ecx, eax
mov r8d, ecx
mov dword [r9], r8d
mov rcx, rsi
call fcn.140001820
mov edx, 0x4d525356
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdi, qword [rsp + 0xb80]
mov rbx, qword [rsp + 0xb88]
mov r12, qword [rsp + 0xb78]
add rsp, 0xb90
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret