Function at 0x1400799f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov qword [rsp + 0x198], r9
mov qword [rsp + 0x190], r8
mov r15, rdx
mov qword [rsp + 0x70], rcx
mov al, byte [rsp + 0x2f0]
mov cl, byte [rsp + 0x2e0]
mov rdx, qword [0x140143788]
xor rdx, rsp
mov qword [rsp + 0x270], rdx
test cl, cl
mov ecx, 0xc97246f5
mov edx, 0xcd244071
cmovne edx, ecx
mov dword [rsp + 0xf4], edx
mov edx, 0x4fc79bc4
mov ecx, 0xac4fe4eb
cmove edx, ecx
mov dword [rsp + 0xec], edx
cmp byte [rsp + 0x2e8], 0
mov edx, 0xbb0b1ae4
mov ebp, 0x2e92da2b
cmovne ebp, edx
mov dword [rsp + 0xe8], ebp
test al, al
mov eax, 0xe45e44e8
cmove eax, ecx
mov dword [rsp + 0xf0], eax
mov eax, 0xe01483cc
mov ecx, 0x4906d4b8
cmovne ecx, eax
mov dword [rsp + 0xf8], ecx
mov r12d, 0xbf262064
mov edi, 0x53a7a751
mov esi, 0x60fb1497
mov ebp, 0x66fbc9a3
mov r13d, 0x62f4b493
mov r14d, 0x44817557
mov ecx, 0x902be41b
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xbcb189fc
mov eax, 0xfbd3c098
nop word [rax + rax]
cmove ecx, eax
cmp dword [0x140145438], 0xa
cmovl ecx, eax
mov eax, ecx
cmp ecx, 0xeddde797
jle 0x140079b70
cmp eax, 0x3914cb16
jg 0x140079c00
cmp eax, 0x166f89ca
jg 0x140079cc9
cmp eax, 0x3cccec
jle 0x140079e52
cmp eax, 0x97ba287
jle 0x14007a0d5
cmp eax, 0x1335e87c
jg 0x14007a603
cmp eax, 0x97ba288
je 0x14007ada4
cmp eax, 0xe78dd28
je 0x14007adc2
mov ecx, eax
cmp eax, 0x12e273cb
jne 0x140079afd
mov eax, dword [rsp + 0x5c]
mov ecx, 0xed23fde6
jmp 0x140079afd
cmp eax, 0xb4f42875
jle 0x140079c70
cmp eax, 0xcfbf4ad6
jg 0x140079d24
cmp eax, 0xc3429727
jle 0x140079ea9
cmp eax, 0xc9576991
jle 0x14007a121
cmp eax, 0xcd244070
jg 0x14007a62b
cmp eax, 0xc9576992
je 0x14007ade0
cmp eax, 0xc97246f5
je 0x14007adfe
mov ecx, eax
cmp eax, 0xcb2b3851
jne 0x140079afd
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x824d2e10
mov eax, 0x3918359b
jmp 0x140079af0
cmp eax, 0x529959ff
jg 0x140079d75
cmp eax, 0x47709d58
jle 0x140079f07
cmp eax, 0x495fb20f
jle 0x14007a16d
cmp eax, 0x4b8988e1
jg 0x14007a662
cmp eax, 0x495fb210
je 0x14007ae17
cmp eax, 0x49d0260b
je 0x14007ae53
mov ecx, eax
cmp eax, 0x4a611a6f
jne 0x140079afd
mov ecx, 0xe3a03d75
xor eax, eax
mov qword [rsp + 0x140], rax
jmp 0x140079afd
cmp eax, 0x999b1d00
jle 0x140079de5
cmp eax, 0x9f5489bd
jle 0x140079f5d
cmp eax, 0xa5ee5dbc
jle 0x14007a1c7
cmp eax, 0xac386ed6
jg 0x14007a68f
cmp eax, 0xa5ee5dbd
je 0x14007ae83
cmp eax, 0xa5f77ebe
je 0x14007ae97
mov ecx, eax
cmp eax, 0xa99627ea
jne 0x140079afd
mov ecx, 0xcd244071
jmp 0x140079afd
cmp eax, 0x2732a0c9
jle 0x140079fa0
cmp eax, 0x32cd800e
jle 0x14007a20f
cmp eax, 0x37cf4b6b
jg 0x14007a6d7
cmp eax, 0x32cd800f
je 0x14007aebe
cmp eax, 0x339b7dac
je 0x14007aec8
mov ecx, eax
cmp eax, 0x3623bdb6
jne 0x140079afd
cmp byte [rsp + 0x4f], 0
mov ecx, 0xaf668f13
mov eax, 0x67ff868c
cmovne ecx, eax
jmp 0x140079afd
cmp eax, 0xdcbb624f
jle 0x14007a005
cmp eax, 0xe531a198
jle 0x14007a25b
cmp eax, 0xeaf8f1fe
jg 0x14007a718
cmp eax, 0xe531a199
je 0x14007aeed
cmp eax, 0xe6822a20
je 0x14007af0b
mov ecx, eax
cmp eax, 0xe8e09a82
jne 0x140079afd
mov rax, qword [rsp + 0x1c0]
jmp 0x14007bb87
cmp eax, 0x6ec2b6e8
jle 0x14007a04f
cmp eax, 0x743912c6
jle 0x14007a2cd
cmp eax, 0x7c285b40
jle 0x14007a745
cmp eax, 0x7c285b41
je 0x14007af15
cmp eax, 0x7cf1f0f6
je 0x14007af33
mov ecx, eax
cmp eax, 0x7eb1efd1
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Callback_returns_false__failed_
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0xdb3b5764
jmp 0x140079afd
cmp eax, 0x8a1ebdaf
jg 0x14007a092
cmp eax, 0x84562fe2
jg 0x14007a316
cmp eax, 0x824d2e0f
jle 0x14007a771
cmp eax, 0x824d2e10
je 0x14007af6a
cmp eax, 0x82a7b7b2
je 0x14007af87
mov ecx, eax
cmp eax, 0x833782c6
jne 0x140079afd
cmp qword [rsp + 0x30], 0
setne byte [rsp + 0x4b]
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xd46a296f
mov eax, 0x62b86c05
jmp 0x140079af0
cmp eax, 0xfab74bb2
jg 0x14007a34e
cmp eax, 0xefd6299d
jle 0x14007a7a6
cmp eax, 0xefd6299e
je 0x14007af91
cmp eax, 0xf1b00d67
je 0x14007afae
mov ecx, eax
cmp eax, 0xf5d635ac
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xbb66504b
mov eax, 0xcf97183b
jmp 0x140079af0
cmp eax, 0xbb3943a8
jg 0x14007a386
cmp eax, 0xb78aec8d
jle 0x14007a7f7
mov ecx, dword [rsp + 0xf8]
cmp eax, 0xb78aec8e
je 0x140079afd
cmp eax, 0xba535f2e
je 0x14007affb
mov ecx, eax
cmp eax, 0xbb0b1ae4
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9294ad56
mov eax, 0xeddde798
jmp 0x140079af0
cmp eax, 0x3faf18d1
jg 0x14007a3be
cmp eax, 0x39ee8344
jle 0x14007a826
cmp eax, 0x39ee8345
je 0x14007b35c
cmp eax, 0x3a919f7d
je 0x14007b387
mov ecx, eax
cmp eax, 0x3ef9a22f
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.___DriverEntry_returned_0x
call fcn.140004ca0
mov ecx, 0x801dce27
jmp 0x140079afd
cmp eax, 0x9b3f56ba
jg 0x14007a40c
cmp eax, 0x9a3b7433
jle 0x14007a848
cmp eax, 0x9a3b7434
je 0x14007b3b2
cmp eax, 0x9a41845d
je 0x14007b41c
mov ecx, eax
cmp eax, 0x9b01e4d1
jne 0x140079afd
mov ecx, 0x9c24efd9
jmp 0x140079afd
cmp eax, 0x212a08fe
jg 0x14007a458
cmp eax, 0x1909b4ef
jle 0x14007a88e
cmp eax, 0x1909b4f0
je 0x14007b42e
cmp eax, 0x1d4c4c13
je 0x14007b445
mov ecx, eax
cmp eax, 0x204327c0
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_call_driver_entry
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0x6383788a
jmp 0x140079afd
cmp eax, 0xd46a296e
jg 0x14007a49e
cmp eax, 0xd22e32d4
jle 0x14007a950
cmp eax, 0xd22e32d5
je 0x14007b44f
mov ecx, dword [rsp + 0xf0]
cmp eax, 0xd34ee128
je 0x140079afd
mov ecx, eax
cmp eax, 0xd37b9764
jne 0x140079afd
mov ecx, 0x5451964
jmp 0x140079afd
cmp eax, 0x63837889
jg 0x14007a50c
cmp eax, 0x622771fb
jle 0x14007a97d
cmp eax, 0x622771fc
je 0x14007b46d
cmp eax, 0x62b86c05
je 0x14007b7d6
mov ecx, eax
cmp eax, 0x635cb931
jne 0x140079afd
mov ecx, 0xfe58ffb4
jmp 0x140079afd
cmp eax, 0x9294ad55
jg 0x14007a5b7
cmp eax, 0x8dcf3462
jle 0x14007a9bb
cmp eax, 0x8dcf3463
je 0x14007b7ed
cmp eax, 0x902be41b
je 0x14007b804
mov ecx, eax
cmp eax, 0x918b9ba2
jne 0x140079afd
mov ecx, 0x8602d24e
jmp 0x140079afd
cmp eax, 0x387afd2
jle 0x14007a9f1
cmp eax, 0x387afd3
je 0x14007b82e
cmp eax, 0x48dfa1a
je 0x14007b8a7
mov ecx, eax
cmp eax, 0x5451964
jne 0x140079afd
mov rcx, qword [rsp + 0x1a0]
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0xd91ddfc9
jmp 0x140079afd
cmp eax, 0xc61b28a8
jle 0x14007aa13
cmp eax, 0xc61b28a9
je 0x14007b8b1
cmp eax, 0xc77cf569
je 0x14007b8cf
mov ecx, eax
cmp eax, 0xc79938cf
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x183abbc0
mov eax, 0x6c55e575
jmp 0x140079af0
cmp eax, 0x47cc3b58
jle 0x14007aa49
cmp eax, 0x47cc3b59
je 0x14007b90b
cmp eax, 0x4906d4b8
je 0x14007b915
mov ecx, eax
cmp eax, 0x494b3357
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_resolve_imports
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0x157a2dba
jmp 0x140079afd
cmp eax, 0xa3f817ce
jle 0x14007aa7f
cmp eax, 0xa3f817cf
je 0x14007b933
cmp eax, 0xa50b3089
je 0x14007b96c
mov ecx, eax
cmp eax, 0xa574e1b5
jne 0x140079afd
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0xc8], rax
mov ecx, 0x799166e9
jmp 0x140079afd
cmp eax, 0x2b028209
jle 0x14007aaa1
cmp eax, 0x2b02820a
je 0x14007b9c8
cmp eax, 0x2e92da2b
je 0x14007b9e6
mov ecx, eax
cmp eax, 0x32af19c0
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x48dfa1a
mov eax, 0xeaf8f1ff
jmp 0x140079af0
cmp eax, 0xe01483cb
jle 0x14007aad2
cmp eax, 0xe01483cc
je 0x14007ba7b
cmp eax, 0xe3a03d75
je 0x14007ba99
mov ecx, eax
cmp eax, 0xe45e44e8
jne 0x140079afd
mov r8, qword [rsp + 0x258]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call fcn.140014b90
mov rdx, qword [rsp + 0x258]
mov rcx, rbx
call fcn.1400150f0
mov rdx, qword [rsp + 0x258]
mov rcx, rbx
call fcn.140015bd0
mov ecx, 0x47cc3b59
jmp 0x140079afd
cmp eax, 0x6f93668d
jle 0x14007ab4f
cmp eax, 0x6f93668e
je 0x14007bac7
cmp eax, 0x72eba356
je 0x14007bad1
mov ecx, eax
cmp eax, 0x733590a7
jne 0x140079afd
mov eax, dword [rsp + 0x100]
test al, al
mov ecx, 0x6956fd32
mov eax, 0x46b59b31
cmovns ecx, eax
jmp 0x140079afd
cmp eax, 0x8602d24d
jle 0x14007ab71
cmp eax, 0x8602d24e
je 0x14007bae9
cmp eax, 0x86c6b6ca
je 0x14007bb07
mov ecx, eax
cmp eax, 0x87bed9fe
jne 0x140079afd
mov ecx, 0x9dcaefdf
jmp 0x140079afd
cmp eax, 0xfd465b58
jle 0x14007abc2
cmp eax, 0xfd465b59
je 0x14007bb25
cmp eax, 0xfe58ffb4
je 0x14007bb47
mov ecx, eax
cmp eax, 0xff4afd41
jne 0x140079afd
mov ecx, 0xba535f2e
jmp 0x140079afd
cmp eax, 0xbcb189fb
jle 0x14007ac1b
cmp eax, 0xbcb189fc
je 0x14007bb65
cmp eax, 0xbf8c3a3c
je 0x14007bb7f
mov ecx, eax
cmp eax, 0xc00cbf12
jne 0x140079afd
mov ecx, 0x37cf4b6c
jmp 0x140079afd
cmp eax, 0x4411066f
jle 0x14007ac3d
cmp eax, 0x44110670
je 0x14007bb99
cmp eax, 0x46b59b31
je 0x14007bf0a
mov ecx, eax
cmp eax, 0x471ebfce
jne 0x140079afd
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x258]
call fcn.140078750
mov ecx, 0xc77cf569
jmp 0x140079afd
cmp eax, 0x9d1b946c
jle 0x14007ac83
cmp eax, 0x9d1b946d
je 0x14007bf45
cmp eax, 0x9db8875d
je 0x14007bf63
mov ecx, eax
cmp eax, 0x9dcaefdf
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x87bed9fe
mov eax, 0x4b8988e2
jmp 0x140079af0
cmp eax, 0x2386576a
jle 0x14007acb9
cmp eax, 0x2386576b
je 0x14007bf92
cmp eax, 0x262ad43e
je 0x14007bfb0
mov ecx, eax
cmp eax, 0x265c6bb0
jne 0x140079afd
mov eax, dword [rsp + 0x104]
mov dword [rsp + 0xb8], eax
mov ecx, 0xac386ed7
jmp 0x140079afd
cmp eax, 0xd91ddfc8
jle 0x14007ad03
cmp eax, 0xd91ddfc9
je 0x14007a64e
cmp eax, 0xdaaebf6e
je 0x14007c02a
mov ecx, eax
cmp eax, 0xdb3b5764
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Callback_returns_false__failed_
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x7eb1efd1
mov eax, 0xc00cbf12
jmp 0x140079af0
cmp eax, 0x6956fd31
jle 0x14007ad30
cmp eax, 0x6956fd32
je 0x14007c034
cmp eax, 0x6bb03a10
je 0x14007c04c
mov ecx, eax
cmp eax, 0x6c55e575
jne 0x140079afd
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + rax + 0xc]
mov dword [rsp + 0x68], eax
xor eax, eax
cmp byte [rsp + 0x2e8], 0
je 0x14007a55f
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x38]
sub eax, dword [rsp + 0x9c]
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x258]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x258], 0
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x183abbc0
mov eax, 0xb78aec8e
jmp 0x140079af0
cmp eax, 0x93ce4ce3
jle 0x14007ad60
cmp eax, 0x93ce4ce4
je 0x14007c08b
cmp eax, 0x962553a7
je 0x14007c0ad
mov ecx, eax
cmp eax, 0x995ec0c5
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xc61b28a9
mov eax, 0x2143bbe3
jmp 0x140079af0
cmp eax, 0x1335e87d
je 0x14007c0cb
cmp eax, 0x1508cce6
je 0x14007c0d5
mov ecx, eax
cmp eax, 0x157a2dba
je 0x14007ad82
jmp 0x140079afd
cmp eax, 0xcd244071
je 0x14007c0f7
cmp eax, 0xcd59b888
je 0x14007c115
mov ecx, eax
cmp eax, 0xcf97183b
jne 0x140079afd
mov ecx, 0x799166e9
xor eax, eax
mov qword [rsp + 0xc8], rax
jmp 0x140079afd
cmp eax, 0x4b8988e2
je 0x14007c12b
cmp eax, 0x4fc79bc4
je 0x14007c135
mov ecx, eax
cmp eax, 0x5164b9a0
jne 0x140079afd
mov ecx, 0xbf8c3a3c
jmp 0x140079afd
cmp eax, 0xac386ed7
je 0x14007c153
mov ecx, dword [rsp + 0xf4]
cmp eax, 0xac4fe4eb
je 0x140079afd
mov ecx, eax
cmp eax, 0xaf668f13
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x3ef9a22f
mov eax, 0x801dce27
jmp 0x140079af0
cmp eax, 0x37cf4b6c
je 0x14007c17c
cmp eax, 0x38abe402
je 0x14007c19a
mov ecx, eax
cmp eax, 0x38d09a50
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x635cb931
mov eax, 0xfe58ffb4
jmp 0x140079af0
cmp eax, 0xeaf8f1ff
je 0x14007c1c5
cmp eax, 0xed23fde6
je 0x14007c1e7
mov ecx, eax
cmp eax, 0xed70f6af
jne 0x140079afd
mov ecx, 0x86c6b6ca
jmp 0x140079afd
cmp eax, 0x743912c7
je 0x14007c211
cmp eax, 0x7b9502fb
jne 0x14007c576
mov eax, dword [rsp + 0x6c]
mov rax, qword [rsp + 0x160]
mov ecx, 0xf1b00d67
jmp 0x140079afd
cmp eax, 0x801dce27
je 0x14007c244
mov ecx, eax
cmp eax, 0x80af3309
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Invalid_format_of_PE_image
call fcn.140004ca0
mov ecx, 0x8479cdd2
jmp 0x140079afd
cmp eax, 0xeddde798
je 0x14007c27d
mov ecx, eax
cmp eax, 0xefab07c1
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Image_is_not_64_bit
call fcn.140004ca0
mov qword [rsp + 0x148], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x3ccced
mov eax, 0x3914cb17
jmp 0x140079af0
cmp eax, 0xb4f42876
je 0x14007c2ca
mov ecx, eax
cmp eax, 0xb5d8d7e2
jne 0x140079afd
cmp byte [rsp + 0x4d], 0
mov ecx, 0x93ce4ce4
mov eax, 0x6bb03a10
cmovne ecx, eax
jmp 0x140079afd
cmp eax, 0x3914cb17
je 0x14007c2e8
mov ecx, eax
cmp eax, 0x3918359b
jne 0x140079afd
mov ecx, 0x72eba356
jmp 0x140079afd
cmp eax, 0x999b1d01
je 0x14007c2f2
mov ecx, eax
cmp eax, 0x99a2f0e0
jne 0x140079afd
mov rax, qword [rsp + 0xa0]
add rax, 0x18
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x1a8], rax
mov ecx, 0x47709d59
jmp 0x140079afd
cmp eax, 0x166f89cb
je 0x14007c320
mov ecx, eax
cmp eax, 0x183abbc0
jne 0x140079afd
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x258], 0
mov ecx, 0x6c55e575
jmp 0x140079afd
cmp eax, 0xcfbf4ad7
je 0x14007c348
mov ecx, eax
cmp eax, 0xd181f8f6
jne 0x140079afd
mov dword [rsp + 0xb4], 2
mov rax, qword [rsp + 0x30]
jmp 0x14007ae71
cmp eax, 0x52995a00
je 0x14007c361
mov ecx, eax
cmp eax, 0x538c87b4
jne 0x140079afd
mov r8, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call fcn.140015650
mov qword [rsp + 0x1c0], rax
mov ecx, 0xe8e09a82
jmp 0x140079afd
cmp eax, 0x8a1ebdb0
je 0x14007c396
mov ecx, eax
cmp eax, 0x8af8505b
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xdaaebf6e
mov eax, 0xd34ee128
jmp 0x140079af0
cmp eax, 0x3ccced
je 0x14007c3b1
mov ecx, eax
cmp eax, 0x1c2df0e
jne 0x140079afd
mov ecx, 0x9d1b946d
jmp 0x140079afd
cmp eax, 0xc3429728
je 0x14007ad82
mov ecx, eax
cmp eax, 0xc50d7e9d
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x622771fc
mov eax, 0x44110670
jmp 0x140079af0
cmp eax, 0x47709d59
je 0x14007c3ce
mov ecx, eax
cmp eax, 0x47a1caf4
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xa208ec7c
mov eax, 0x265c6bb0
jmp 0x140079af0
cmp eax, 0x9f5489be
je 0x14007c3ea
mov ecx, eax
cmp eax, 0xa208ec7c
jne 0x140079afd
mov ecx, 0x47a1caf4
jmp 0x140079afd
cmp eax, 0x2732a0ca
je 0x14007c408
mov ecx, eax
cmp eax, 0x2831ae24
jne 0x140079afd
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x38], eax
mov ecx, 0xa5f77ebe
jmp 0x140079afd
cmp eax, 0xdcbb6250
je 0x14007c426
mov ecx, eax
cmp eax, 0xdf2b4a69
jne 0x140079afd
mov dword [rsp + 0x214], 0
mov rax, qword [rsp + 0x268]
cmp byte [rsp + 0x2f8], 0
lea rcx, [rsp + 0x260]
lea rdx, [rsp + 0x258]
cmovne rcx, rdx
mov r9, qword [rcx]
mov r8, qword [rsp + 0x178]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x214]
call fcn.14007df60
test al, al
mov ecx, 0x204327c0
mov eax, 0x3faf18d2
cmovne ecx, eax
jmp 0x140079afd
cmp eax, 0x6ec2b6e9
je 0x14007c430
mov ecx, eax
cmp eax, 0x6f8c275e
jne 0x140079afd
mov ecx, 0x38d09a50
jmp 0x140079afd
cmp eax, 0x84562fe3
je 0x14007c447
mov ecx, eax
cmp eax, 0x8479cdd2
jne 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Invalid_format_of_PE_image
call fcn.140004ca0
mov qword [rsp + 0x1a0], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x80af3309
mov eax, 0xd37b9764
jmp 0x140079af0
cmp eax, 0xfab74bb3
je 0x140079ace
mov ecx, eax
cmp eax, 0xfbd3c098
jne 0x140079afd
mov eax, dword [rsp + 0x5c]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x9c]
add rcx, rax
mov qword [rsp + 0x1f0], rcx
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xbcb189fc
mov eax, 0xe6822a20
jmp 0x140079af0
cmp eax, 0xbb3943a9
je 0x14007c461
mov ecx, eax
cmp eax, 0xbb66504b
jne 0x140079afd
mov ecx, 0xf5d635ac
jmp 0x140079afd
cmp eax, 0x3faf18d2
je 0x14007c48d
mov ecx, eax
cmp eax, 0x404516b5
jne 0x140079afd
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x188], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9db8875d
mov eax, 0x9b3f56bb
jmp 0x140079af0
cmp eax, 0x9b3f56bb
je 0x14007c4a5
mov ecx, eax
cmp eax, 0x9c24efd9
jne 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x1508cce6
mov eax, 0x9a3b7434
jmp 0x140079af0
cmp eax, 0x212a08ff
je 0x14007c4e8
mov ecx, eax
cmp eax, 0x2143bbe3
jne 0x140079afd
mov rcx, qword [rsp + 0x148]
lea rdx, [fcn.140005a60]
call fcn.140079830
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xc61b28a9
mov eax, 0x1335e87d
jmp 0x140079af0
cmp eax, 0xd46a296f
je 0x14007c500
mov ecx, eax
cmp eax, 0xd55b3b72
jne 0x140079afd
mov dword [rsp + 0xb8], 0
mov ecx, 0xac386ed7
jmp 0x140079afd
cmp eax, 0x6383788a
je 0x14007c50f
mov ecx, eax
cmp eax, 0x67ff868c
jne 0x140079afd
mov eax, dword [rsp + 0x214]
mov dword [rsp + 0x108], eax
mov ecx, 0x8a1ebdb0
jmp 0x140079afd
cmp eax, 0x9294ad56
je 0x14007c52d
mov ecx, eax
cmp eax, 0x92986072
jne 0x140079afd
mov ecx, 0x733590a7
jmp 0x140079afd
mov dword [rsp + 0x98], 2
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xd0], rax
mov ecx, 0x7cf1f0f6
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xbb66504b
mov eax, 0xf5d635ac
jmp 0x140079af0
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x87bed9fe
mov eax, 0x9dcaefdf
jmp 0x140079af0
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x7b9502fb
mov eax, 0xf1b00d67
jmp 0x140079af0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.140015bd0
mov ecx, 0xa99627ea
jmp 0x140079afd
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x200], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x918b9ba2
mov eax, 0x8602d24e
jmp 0x140079af0
mov rax, qword [rsp + 0x180]
mov eax, dword [rsp + 0xbc]
mov dword [rsp + 0xb4], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x110], rax
mov ecx, 0x495fb210
jmp 0x140079afd
xor eax, eax
mov qword [rsp + 0x138], rax
mov ecx, 0xfd465b59
jmp 0x140079afd
mov edx, dword [rsp + 0x38]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
mov ecx, 0x212a08ff
jmp 0x140079afd
mov ecx, 0xc50d7e9d
jmp 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.140004ca0
mov qword [rsp + 0x1d0], rax
mov ecx, 0xa50b3089
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xefd6299e
mov eax, 0xa3f817cf
jmp 0x140079af0
mov ecx, 0x743912c7
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x262ad43e
mov eax, 0x387afd3
jmp 0x140079af0
cmp dword [rsp + 0x98], 2
mov ecx, 0xfd465b59
mov eax, 0x404516b5
cmove ecx, eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x130], rax
jmp 0x140079afd
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 0xcb2b3851
jmp 0x140079afd
mov ecx, 0xc79938cf
jmp 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.140004ca0
mov ecx, 0xa3f817cf
jmp 0x140079afd
movsxd rax, dword [rsp + 0x6c]
lea rax, [rax + rax*4]
shl rax, 3
add rax, qword [rsp + 0x160]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x24]
mov dword [rsp + 0x100], eax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x7b9502fb
mov eax, 0x92986072
jmp 0x140079af0
mov rcx, qword [rsp + 0x1f8]
mov eax, dword [0x14014490c]
mov edx, dword [0x140144910]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete byte [rsp + 0x2a]
cmp edx, 0xa
setl byte [rsp + 0x2b]
mov eax, 0x651f8c1c
jmp 0x14007b040
mov eax, 0xbf262064
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp eax, 0x53a7a750
jg 0x14007b0a0
cmp eax, 0xa8f544f
jg 0x14007b0f0
cmp eax, 0x8f1a67d6
je 0x14007b172
cmp eax, 0xbf262064
je 0x14007b19a
cmp eax, 0xca7e097e
jne 0x14007b040
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x4d251681
cmove eax, esi
cmp dword [0x140144910], 0xa
cmovl eax, esi
jmp 0x14007b040
cmp eax, 0x62f4b492
jle 0x14007b120
cmp eax, 0x62f4b493
je 0x14007b22f
cmp eax, 0x66fbc9a3
je 0x14007b239
cmp eax, 0x651f8c1c
jne 0x14007b040
mov dl, byte [rsp + 0x2a]
cmp byte [rsp + 0x2b], 0
mov eax, 0x59ac7363
cmovne eax, r14d
test dl, dl
cmovne eax, r14d
jmp 0x14007b040
cmp eax, 0xa8f5450
je 0x14007b243
cmp eax, 0x44817557
je 0x14007b2cf
cmp eax, 0x4d251681
jne 0x14007b040
mov rax, qword [rsp + 0x50]
mov eax, 0x60fb1497
jmp 0x14007b040
cmp eax, 0x59ac7363
je 0x14007b2fa
cmp eax, 0x60fb1497
jne 0x14007b32a
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, 4
mov qword [rsp + 0x90], rax
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x4d251681
cmove eax, r13d
cmp dword [0x140144910], 0xa
cmovl eax, r13d
jmp 0x14007b040
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0xa8f5450
cmove eax, r12d
cmp dword [0x140144910], 0xa
cmovl eax, r12d
jmp 0x14007b040
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax]
mov rdx, qword [rsp + 0x50]
add rax, rdx
add rax, 0x18
mov edx, 0xbcf8787c
nop word cs:[rax + rax]
cmp edx, 0xfb386df8
je 0x14007b304
cmp edx, 0xbcf8787c
jne 0x14007b1c0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx]
mov dword [rsp + 0x2c], edx
mov edx, 0xea695d3a
nop dword [rax]
cmp edx, 0x1af6257a
je 0x14007b20f
cmp edx, 0xea695d3a
jne 0x14007b1f0
mov dword [rsp + 0x3c], 0xfffff1ff
mov edx, 0x1af6257a
jmp 0x14007b1f0
mov edx, dword [rsp + 0x2c]
and edx, dword [rsp + 0x3c]
or edx, 0x800
mov rbx, qword [rsp + 0x40]
mov dword [rbx], edx
mov edx, dword [rsp + 0x2c]
mov edx, 0xfb386df8
jmp 0x14007b1c0
mov eax, 0x8f1a67d6
jmp 0x14007b040
mov eax, 0xca7e097e
jmp 0x14007b040
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax]
mov rdx, qword [rsp + 0x50]
add rax, rdx
add rax, 0x18
mov edx, 0xbcf8787c
nop
cmp edx, 0xfb386df8
je 0x14007b02c
cmp edx, 0xbcf8787c
jne 0x14007b260
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx]
mov dword [rsp + 0x2c], edx
mov edx, 0xea695d3a
nop dword [rax]
cmp edx, 0x1af6257a
je 0x14007b2af
cmp edx, 0xea695d3a
jne 0x14007b290
mov dword [rsp + 0x3c], 0xfffff1ff
mov edx, 0x1af6257a
jmp 0x14007b290
mov edx, dword [rsp + 0x2c]
and edx, dword [rsp + 0x3c]
or edx, 0x800
mov rbx, qword [rsp + 0x40]
mov dword [rbx], edx
mov edx, dword [rsp + 0x2c]
mov edx, 0xfb386df8
jmp 0x14007b260
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x59ac7363
cmove eax, ebp
cmp dword [0x140144910], 0xa
cmovl eax, ebp
jmp 0x14007b040
mov eax, 0x44817557
jmp 0x14007b040
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0xa8f5450
cmove eax, edi
cmp dword [0x140144910], 0xa
cmovl eax, edi
jmp 0x14007b040
cmp eax, 0x53a7a751
jne 0x14007b040
mov edx, dword [rsp + 0x214]
call fcn.14007e1b0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, dword [rsp + 0xec]
jmp 0x140079afd
mov rcx, r15
call fcn.140089030
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
mov ecx, 0x99a2f0e0
mov eax, 0x962553a7
cmove ecx, eax
jmp 0x140079afd
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xd46a296f
mov eax, 0x833782c6
jmp 0x140079af0
mov rax, qword [rsp + 0xd8]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xa0]
add rax, 4
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
add rax, 0x10
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
movzx eax, word [rax]
mov qword [rsp + 0x80], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x1508cce6
mov eax, 0x82a7b7b2
jmp 0x140079af0
mov rax, qword [rsp + 0xa0]
mov ecx, 0x999b1d01
jmp 0x140079afd
cmp byte [rsp + 0x4e], 0
mov ecx, 0x2b02820a
mov eax, 0x93ce4ce4
cmovne ecx, eax
jmp 0x140079afd
mov ecx, 0xb5d8d7e2
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x3ccced
mov eax, 0xefab07c1
jmp 0x140079af0
mov rcx, qword [rsp + 0x168]
mov eax, dword [0x14014490c]
mov edx, dword [0x140144910]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete byte [rsp + 0x2a]
cmp edx, 0xa
setl byte [rsp + 0x2b]
mov eax, 0x651f8c1c
jmp 0x14007b4b0
mov eax, 0xbf262064
nop word cs:[rax + rax]
nop dword [rax]
cmp eax, 0x53a7a750
jg 0x14007b510
cmp eax, 0xa8f544f
jg 0x14007b560
cmp eax, 0x8f1a67d6
je 0x14007b5e2
cmp eax, 0xbf262064
je 0x14007b60a
cmp eax, 0xca7e097e
jne 0x14007b4b0
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x4d251681
cmove eax, esi
cmp dword [0x140144910], 0xa
cmovl eax, esi
jmp 0x14007b4b0
cmp eax, 0x62f4b492
jle 0x14007b590
cmp eax, 0x62f4b493
je 0x14007b69f
cmp eax, 0x66fbc9a3
je 0x14007b6a9
cmp eax, 0x651f8c1c
jne 0x14007b4b0
mov dl, byte [rsp + 0x2a]
cmp byte [rsp + 0x2b], 0
mov eax, 0x59ac7363
cmovne eax, r14d
test dl, dl
cmovne eax, r14d
jmp 0x14007b4b0
cmp eax, 0xa8f5450
je 0x14007b6b3
cmp eax, 0x44817557
je 0x14007b73f
cmp eax, 0x4d251681
jne 0x14007b4b0
mov rax, qword [rsp + 0x50]
mov eax, 0x60fb1497
jmp 0x14007b4b0
cmp eax, 0x59ac7363
je 0x14007b76a
cmp eax, 0x60fb1497
jne 0x14007b79a
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, 4
mov qword [rsp + 0x90], rax
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x4d251681
cmove eax, r13d
cmp dword [0x140144910], 0xa
cmovl eax, r13d
jmp 0x14007b4b0
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0xa8f5450
cmove eax, r12d
cmp dword [0x140144910], 0xa
cmovl eax, r12d
jmp 0x14007b4b0
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax]
mov rdx, qword [rsp + 0x50]
add rax, rdx
add rax, 0x18
mov edx, 0xbcf8787c
nop word cs:[rax + rax]
cmp edx, 0xfb386df8
je 0x14007b774
cmp edx, 0xbcf8787c
jne 0x14007b630
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx]
mov dword [rsp + 0x2c], edx
mov edx, 0xea695d3a
nop dword [rax]
cmp edx, 0x1af6257a
je 0x14007b67f
cmp edx, 0xea695d3a
jne 0x14007b660
mov dword [rsp + 0x3c], 0xfffff1ff
mov edx, 0x1af6257a
jmp 0x14007b660
mov edx, dword [rsp + 0x2c]
and edx, dword [rsp + 0x3c]
or edx, 0x800
mov rbx, qword [rsp + 0x40]
mov dword [rbx], edx
mov edx, dword [rsp + 0x2c]
mov edx, 0xfb386df8
jmp 0x14007b630
mov eax, 0x8f1a67d6
jmp 0x14007b4b0
mov eax, 0xca7e097e
jmp 0x14007b4b0
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax]
mov rdx, qword [rsp + 0x50]
add rax, rdx
add rax, 0x18
mov edx, 0xbcf8787c
nop
cmp edx, 0xfb386df8
je 0x14007b49e
cmp edx, 0xbcf8787c
jne 0x14007b6d0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx]
mov dword [rsp + 0x2c], edx
mov edx, 0xea695d3a
nop dword [rax]
cmp edx, 0x1af6257a
je 0x14007b71f
cmp edx, 0xea695d3a
jne 0x14007b700
mov dword [rsp + 0x3c], 0xfffff1ff
mov edx, 0x1af6257a
jmp 0x14007b700
mov edx, dword [rsp + 0x2c]
and edx, dword [rsp + 0x3c]
or edx, 0x800
mov rbx, qword [rsp + 0x40]
mov dword [rbx], edx
mov edx, dword [rsp + 0x2c]
mov edx, 0xfb386df8
jmp 0x14007b6d0
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x59ac7363
cmove eax, ebp
cmp dword [0x140144910], 0xa
cmovl eax, ebp
jmp 0x14007b4b0
mov eax, 0x44817557
jmp 0x14007b4b0
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0xa8f5450
cmove eax, edi
cmp dword [0x140144910], 0xa
cmovl eax, edi
jmp 0x14007b4b0
cmp eax, 0x53a7a751
jne 0x14007b4b0
mov edx, dword [rsp + 0x68]
call fcn.140061f40
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0x44110670
jmp 0x140079afd
cmp byte [rsp + 0x4b], 0
mov ecx, 0xe531a199
mov eax, 0x339b7dac
cmovne ecx, eax
jmp 0x140079afd
cmp byte [rsp + 0x4c], 0
mov ecx, 0xe78dd28
mov eax, 0xc9576992
cmovne ecx, eax
jmp 0x140079afd
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x268], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x260], rax
mov ecx, 0x39ee8345
jmp 0x140079afd
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax + 0x10]
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x178], rax
lea rcx, [0x140149ab0]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.140004ca0
mov rdx, qword [rsp + 0x178]
mov rcx, rax
call fcn.140011ac0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
cmp qword [rsp + 0x300], 0
setne byte [rsp + 0x4d]
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x262ad43e
mov eax, 0x1d4c4c13
jmp 0x140079af0
mov ecx, 0x32af19c0
jmp 0x140079afd
mov rcx, qword [rsp + 0x148]
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0x2143bbe3
jmp 0x140079afd
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x258]
call fcn.140078750
mov qword [rsp + 0x1b0], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x471ebfce
mov eax, 0x6f8c275e
jmp 0x140079af0
mov ecx, 0xcd244071
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x12e273cb
mov eax, 0xed23fde6
jmp 0x140079af0
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.140004ca0
mov qword [rsp + 0x1c8], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xefd6299e
mov eax, 0xed70f6af
jmp 0x140079af0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x1d0]
call fcn.140011ac0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov rax, qword [rsp + 0xa8]
mov r8d, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
mov rdx, r15
call fcn.1400b22a0
mov rax, qword [rsp + 0x150]
movzx eax, word [rax]
add rax, qword [rsp + 0x78]
mov qword [rsp + 0x160], rax
mov ecx, 0xd55b3b72
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x7eb1efd1
mov eax, 0xdb3b5764
jmp 0x140079af0
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa8]
mov rbx, r15
mov r15, qword [rsp + 0x88]
sub r15, qword [rax + 0x18]
mov rdx, qword [rsp + 0x60]
lea r12, [rsp + 0x238]
mov rcx, r12
call fcn.1400893c0
mov rcx, r12
mov ebp, 0x66fbc9a3
mov esi, 0x60fb1497
mov edi, 0x53a7a751
mov r12d, 0xbf262064
mov rdx, r15
mov r15, rbx
call fcn.14007c5b0
mov rdx, qword [rsp + 0x60]
lea rbx, [rsp + 0x218]
mov rcx, rbx
call fcn.140089b40
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
call fcn.14007d0e0
test al, al
mov ecx, 0x494b3357
mov eax, 0xfab74bb3
cmovne ecx, eax
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x471ebfce
mov eax, 0xc77cf569
jmp 0x140079af0
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x208], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xdcbb6250
mov eax, 0x2386576b
jmp 0x140079af0
mov ecx, 0x538c87b4
jmp 0x140079afd
mov dword [rsp + 0xbc], 1
mov rax, qword [rsp + 0x88]
jmp 0x14007c1d5
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x918b9ba2
mov eax, 0x166f89cb
jmp 0x140079af0
mov rcx, qword [rsp + 0x1c8]
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0x6ec2b6e9
jmp 0x140079afd
mov rax, qword [rsp + 0x158]
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x140], rax
mov ecx, 0xe3a03d75
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x635cb931
mov eax, 0x5164b9a0
jmp 0x140079af0
mov eax, dword [rsp + 0x5c]
mov rax, qword [rsp + 0x60]
mov eax, dword [rsp + 0x9c]
mov ecx, 0xfbd3c098
jmp 0x140079afd
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x118], rax
mov ecx, 0x3a919f7d
jmp 0x140079afd
mov rcx, qword [rsp + 0x168]
mov eax, dword [0x14014490c]
mov edx, dword [0x140144910]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete byte [rsp + 0x2a]
cmp edx, 0xa
setl byte [rsp + 0x2b]
mov eax, 0x651f8c1c
jmp 0x14007bbd0
mov eax, 0xbf262064
nop
cmp eax, 0x53a7a750
jg 0x14007bc30
cmp eax, 0xa8f544f
jg 0x14007bc80
cmp eax, 0x8f1a67d6
je 0x14007bd02
cmp eax, 0xbf262064
je 0x14007bd2a
cmp eax, 0xca7e097e
jne 0x14007bbd0
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x4d251681
cmove eax, esi
cmp dword [0x140144910], 0xa
cmovl eax, esi
jmp 0x14007bbd0
cmp eax, 0x62f4b492
jle 0x14007bcb0
cmp eax, 0x62f4b493
je 0x14007bdbf
cmp eax, 0x66fbc9a3
je 0x14007bdc9
cmp eax, 0x651f8c1c
jne 0x14007bbd0
mov dl, byte [rsp + 0x2a]
cmp byte [rsp + 0x2b], 0
mov eax, 0x59ac7363
cmovne eax, r14d
test dl, dl
cmovne eax, r14d
jmp 0x14007bbd0
cmp eax, 0xa8f5450
je 0x14007bdd3
cmp eax, 0x44817557
je 0x14007be5f
cmp eax, 0x4d251681
jne 0x14007bbd0
mov rax, qword [rsp + 0x50]
mov eax, 0x60fb1497
jmp 0x14007bbd0
cmp eax, 0x59ac7363
je 0x14007be8a
cmp eax, 0x60fb1497
jne 0x14007beba
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
add rax, 4
mov qword [rsp + 0x90], rax
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x4d251681
cmove eax, r13d
cmp dword [0x140144910], 0xa
cmovl eax, r13d
jmp 0x14007bbd0
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0xa8f5450
cmove eax, r12d
cmp dword [0x140144910], 0xa
cmovl eax, r12d
jmp 0x14007bbd0
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax]
mov rdx, qword [rsp + 0x50]
add rax, rdx
add rax, 0x18
mov edx, 0xbcf8787c
nop word cs:[rax + rax]
cmp edx, 0xfb386df8
je 0x14007be94
cmp edx, 0xbcf8787c
jne 0x14007bd50
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx]
mov dword [rsp + 0x2c], edx
mov edx, 0xea695d3a
nop dword [rax]
cmp edx, 0x1af6257a
je 0x14007bd9f
cmp edx, 0xea695d3a
jne 0x14007bd80
mov dword [rsp + 0x3c], 0xfffff1ff
mov edx, 0x1af6257a
jmp 0x14007bd80
mov edx, dword [rsp + 0x2c]
and edx, dword [rsp + 0x3c]
or edx, 0x800
mov rbx, qword [rsp + 0x40]
mov dword [rbx], edx
mov edx, dword [rsp + 0x2c]
mov edx, 0xfb386df8
jmp 0x14007bd50
mov eax, 0x8f1a67d6
jmp 0x14007bbd0
mov eax, 0xca7e097e
jmp 0x14007bbd0
mov rax, qword [rsp + 0x90]
movsxd rax, dword [rax]
mov rdx, qword [rsp + 0x50]
add rax, rdx
add rax, 0x18
mov edx, 0xbcf8787c
nop
cmp edx, 0xfb386df8
je 0x14007bbca
cmp edx, 0xbcf8787c
jne 0x14007bdf0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
mov edx, dword [rdx]
mov dword [rsp + 0x2c], edx
mov edx, 0xea695d3a
nop dword [rax]
cmp edx, 0x1af6257a
je 0x14007be3f
cmp edx, 0xea695d3a
jne 0x14007be20
mov dword [rsp + 0x3c], 0xfffff1ff
mov edx, 0x1af6257a
jmp 0x14007be20
mov edx, dword [rsp + 0x2c]
and edx, dword [rsp + 0x3c]
or edx, 0x800
mov rbx, qword [rsp + 0x40]
mov dword [rbx], edx
mov edx, dword [rsp + 0x2c]
mov edx, 0xfb386df8
jmp 0x14007bdf0
mov qword [rsp + 0x50], rcx
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0x59ac7363
cmove eax, ebp
cmp dword [0x140144910], 0xa
cmovl eax, ebp
jmp 0x14007bbd0
mov eax, 0x44817557
jmp 0x14007bbd0
mov eax, dword [0x14014490c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov eax, 0xa8f5450
cmove eax, edi
cmp dword [0x140144910], 0xa
cmovl eax, edi
jmp 0x14007bbd0
cmp eax, 0x53a7a751
jne 0x14007bbd0
mov edx, dword [rsp + 0x68]
call fcn.140061f40
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x622771fc
mov eax, 0x84562fe3
jmp 0x140079af0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
mov ecx, dword [rcx + 0xc]
add rcx, rax
mov qword [rsp + 0x1d8], rcx
mov rax, qword [rsp + 0xc0]
mov eax, dword [rax + 0x14]
add rax, r15
mov qword [rsp + 0x1e0], rax
mov ecx, 0x38abe402
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x1c2df0e
mov eax, 0xd181f8f6
jmp 0x140079af0
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x70]
call fcn.140015bd0
mov ecx, 0x9b3f56bb
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xdcbb6250
mov eax, 0xa574e1b5
jmp 0x140079af0
mov rax, qword [rsp + 0xa8]
mov ebx, dword [rax + 0x10]
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x88]
add rbx, qword [rsp + 0x88]
lea rcx, [0x140149ab0]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.140004ca0
mov rcx, rax
mov rdx, rbx
call fcn.140011ac0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0x387afd3
jmp 0x140079afd
mov ecx, 0x8af8505b
jmp 0x140079afd
mov eax, dword [rsp + 0x6c]
add eax, 1
mov dword [rsp + 0x104], eax
mov ecx, 0xb4f42876
jmp 0x140079afd
mov rax, qword [rsp + 0x258]
mov r9, qword [rsp + 0x170]
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x260]
lea rdx, [rsp + 0x268]
call qword [rsp + 0x300]
mov byte [rsp + 0x4e], al
mov ecx, 0x1909b4f0
jmp 0x140079afd
lea rax, [rsp + 0x214]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov ecx, 0xdf2b4a69
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x80af3309
mov eax, 0x8479cdd2
jmp 0x140079af0
mov ecx, 0x97ba288
jmp 0x140079afd
mov rax, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xa0]
mov ecx, 0x9a3b7434
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x824d2e10
mov eax, 0xcb2b3851
jmp 0x140079af0
mov rax, qword [rsp + 0xe0]
mov eax, dword [rsp + 0x6c]
mov ecx, 0x52995a00
jmp 0x140079afd
mov ecx, 0xcfbf4ad7
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xdaaebf6e
mov eax, 0x8af8505b
jmp 0x140079af0
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x6c], eax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xcd59b888
mov eax, 0x52995a00
jmp 0x140079af0
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x1c2df0e
mov eax, 0x9d1b946d
jmp 0x140079af0
mov rdx, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rax + 0x10]
mov rcx, qword [rsp + 0x1d8]
call fcn.1400b22a0
mov ecx, 0x6956fd32
jmp 0x140079afd
mov dword [rsp + 0xbc], 2
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x120], rax
mov ecx, 0x49d0260b
jmp 0x140079afd
mov eax, dword [rsp + 0x5c]
mov qword [rsp + 0x1b8], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x12e273cb
mov eax, 0x6f93668e
jmp 0x140079af0
mov r8, qword [rsp + 0x1f0]
mov r9, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x70]
call fcn.140010d50
test al, al
mov ecx, 0xbb3943a9
mov eax, 0x7c285b41
cmovne ecx, eax
jmp 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.___DriverEntry_returned_0x
call fcn.140004ca0
mov qword [rsp + 0x1f8], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x3ef9a22f
mov eax, 0xff4afd41
jmp 0x140079af0
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov qword [rsp + 0x1e8], rcx
lea rcx, [0x140149ab0]
lea rdx, str.___Skipped_0x
call fcn.140004ca0
mov qword [rsp + 0x168], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9294ad56
mov eax, 0x32cd800f
jmp 0x140079af0
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xa208ec7c
mov eax, 0x47a1caf4
jmp 0x140079af0
mov ecx, 0x995ec0c5
jmp 0x140079afd
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xd8], rax
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9a41845d
mov eax, 0x9b01e4d1
jmp 0x140079af0
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0xd0], rax
mov eax, dword [rsp + 0x10c]
mov dword [rsp + 0x98], eax
mov ecx, 0x7cf1f0f6
jmp 0x140079afd
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x128], rax
mov ecx, dword [rsp + 0xe8]
jmp 0x140079afd
mov rax, qword [rsp + 0xe0]
movzx eax, word [rax + 2]
mov ecx, dword [rsp + 0x6c]
cmp ecx, eax
setl byte [rsp + 0x4c]
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xcd59b888
mov eax, 0x8dcf3463
jmp 0x140079af0
mov eax, dword [rsp + 0x108]
mov rcx, qword [rsp + 0x308]
mov dword [rcx], eax
mov ecx, 0xaf668f13
jmp 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Image_is_not_64_bit
call fcn.140004ca0
mov ecx, 0xefab07c1
jmp 0x140079afd
mov rax, qword [rsp + 0x1a8]
movzx eax, word [rax]
mov dword [rsp + 0xfc], eax
mov ecx, 0x9f5489be
jmp 0x140079afd
mov eax, dword [rsp + 0xfc]
cmp eax, 0x20b
mov ecx, 0xd22e32d5
mov eax, 0x2831ae24
cmove ecx, eax
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9a41845d
mov eax, 0x999b1d01
jmp 0x140079af0
mov ecx, 0x2386576b
jmp 0x140079afd
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x130], rax
mov ecx, 0x404516b5
jmp 0x140079afd
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x128], rax
mov ecx, 0x2e92da2b
jmp 0x140079afd
lea rcx, [0x140149ab0]
lea rdx, str.____Failed_to_write_local_image_to_remote_image
call fcn.140004ca0
mov rcx, rax
lea rdx, [fcn.140005a60]
call fcn.140079830
mov ecx, 0xc3429728
jmp 0x140079afd
cmp qword [rsp + 0x308], 0
setne byte [rsp + 0x4f]
mov ecx, 0x3623bdb6
jmp 0x140079afd
mov rcx, qword [rsp + 0x60]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x70]
call fcn.140015bd0
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9db8875d
mov eax, 0xa5ee5dbd
jmp 0x140079af0
cmp qword [rsp + 0x60], 0
mov ecx, 0x2732a0ca
mov eax, 0x4a611a6f
cmove ecx, eax
jmp 0x140079afd
mov rax, qword [rsp + 0x30]
mov ecx, 0x833782c6
jmp 0x140079afd
mov eax, dword [0x140145434]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x48dfa1a
mov eax, 0x32af19c0
jmp 0x140079af0
mov eax, dword [rsp + 0x68]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
lea rcx, [0x140149ab0]
lea rdx, str.___Skipped_0x
call fcn.140004ca0
mov ecx, 0xeddde798
jmp 0x140079afd
mov ecx, eax
cmp eax, 0x799166e9
jne 0x140079afd
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400a74d0
mov rax, qword [rsp + 0xc8]
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret