Function at 0x140002fc0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov rax, qword [0x14004e090]
xor rax, rbp
mov qword [rbp + 0x50], rax
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r8d, r8d
sub r8d, 1
add r8d, 0
mov edx, ecx
add edx, 0x2fd954cb
add edx, r8d
sub edx, 0x2fd954cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
and cl, 1
mov byte [rbp - 0x22], cl
cmp eax, 0xa
setl al
and al, 1
mov byte [rbp - 0x21], al
mov dword [rbp - 0x28], 0x6e2b50ef
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x3c], eax
sub eax, 0x87a8199d
je 0x140005722
jmp 0x14000304f
mov eax, dword [rbp - 0x3c]
sub eax, 0x8bba3ff0
je 0x140005e5a
jmp 0x140003062
mov eax, dword [rbp - 0x3c]
sub eax, 0x8e5344da
je 0x1400066f7
jmp 0x140003075
mov eax, dword [rbp - 0x3c]
sub eax, 0x9319c510
je 0x1400054a6
jmp 0x140003088
mov eax, dword [rbp - 0x3c]
sub eax, 0x9eba4582
je 0x140003b2d
jmp 0x14000309b
mov eax, dword [rbp - 0x3c]
sub eax, 0x9ef2b07f
je 0x140004648
jmp 0x1400030ae
mov eax, dword [rbp - 0x3c]
sub eax, 0xa82683b9
je 0x140005d76
jmp 0x1400030c1
mov eax, dword [rbp - 0x3c]
sub eax, 0xa9c49bfe
je 0x1400068d1
jmp 0x1400030d4
mov eax, dword [rbp - 0x3c]
sub eax, 0xab370ab8
je 0x1400051e1
jmp 0x1400030e7
mov eax, dword [rbp - 0x3c]
sub eax, 0xb2eaae80
je 0x1400060e2
jmp 0x1400030fa
mov eax, dword [rbp - 0x3c]
sub eax, 0xb6106f72
je 0x140005110
jmp 0x14000310d
mov eax, dword [rbp - 0x3c]
sub eax, 0xbbef1f71
je 0x14000358a
jmp 0x140003120
mov eax, dword [rbp - 0x3c]
sub eax, 0xbc98e169
je 0x140006d89
jmp 0x140003133
mov eax, dword [rbp - 0x3c]
sub eax, 0xbd51bf28
je 0x140006c69
jmp 0x140003146
mov eax, dword [rbp - 0x3c]
sub eax, 0xc0d2cf9e
je 0x1400068c5
jmp 0x140003159
mov eax, dword [rbp - 0x3c]
sub eax, 0xc1c606c8
je 0x140004867
jmp 0x14000316c
mov eax, dword [rbp - 0x3c]
sub eax, 0xc1d02611
je 0x140006b51
jmp 0x14000317f
mov eax, dword [rbp - 0x3c]
sub eax, 0xc586d52d
je 0x140005a5a
jmp 0x140003192
mov eax, dword [rbp - 0x3c]
sub eax, 0xc70d91a2
je 0x140006f34
jmp 0x1400031a5
mov eax, dword [rbp - 0x3c]
sub eax, 0xc8308af3
je 0x140006aa6
jmp 0x1400031b8
mov eax, dword [rbp - 0x3c]
sub eax, 0xca528f97
je 0x140005953
jmp 0x1400031cb
mov eax, dword [rbp - 0x3c]
sub eax, 0xcaab9bdb
je 0x1400060ee
jmp 0x1400031de
mov eax, dword [rbp - 0x3c]
sub eax, 0xcbfdb67f
je 0x140006eac
jmp 0x1400031f1
mov eax, dword [rbp - 0x3c]
sub eax, 0xd1d4052f
je 0x14000502c
jmp 0x140003204
mov eax, dword [rbp - 0x3c]
sub eax, 0xd904d594
je 0x14000626f
jmp 0x140003217
mov eax, dword [rbp - 0x3c]
sub eax, 0xdde34c84
je 0x140006f63
jmp 0x14000322a
mov eax, dword [rbp - 0x3c]
sub eax, 0xe7836f1b
je 0x140006d45
jmp 0x14000323d
mov eax, dword [rbp - 0x3c]
sub eax, 0xe85fd86a
je 0x140006f92
jmp 0x140003250
mov eax, dword [rbp - 0x3c]
sub eax, 0xea7707c2
je 0x140005d82
jmp 0x140003263
mov eax, dword [rbp - 0x3c]
sub eax, 0xf175896b
je 0x140006e30
jmp 0x140003276
mov eax, dword [rbp - 0x3c]
sub eax, 0xf21054a4
je 0x140006db0
jmp 0x140003289
mov eax, dword [rbp - 0x3c]
sub eax, 0xf5ca5f29
je 0x1400067cc
jmp 0x14000329c
mov eax, dword [rbp - 0x3c]
sub eax, 0xfcc76c7a
je 0x140005104
jmp 0x1400032af
mov eax, dword [rbp - 0x3c]
sub eax, 0x6be3d3
je 0x140004412
jmp 0x1400032c2
mov eax, dword [rbp - 0x3c]
sub eax, 0x66d87ca
je 0x140006edd
jmp 0x1400032d5
mov eax, dword [rbp - 0x3c]
sub eax, 0x741f528
je 0x14000573d
jmp 0x1400032e8
mov eax, dword [rbp - 0x3c]
sub eax, 0xf42bb15
je 0x1400066eb
jmp 0x1400032fb
mov eax, dword [rbp - 0x3c]
sub eax, 0x157f3528
je 0x1400053fd
jmp 0x14000330e
mov eax, dword [rbp - 0x3c]
sub eax, 0x15e946d0
je 0x14000493b
jmp 0x140003321
mov eax, dword [rbp - 0x3c]
sub eax, 0x16b73a60
je 0x140003ff5
jmp 0x140003334
mov eax, dword [rbp - 0x3c]
sub eax, 0x1c5a0e1f
je 0x140006f40
jmp 0x140003347
mov eax, dword [rbp - 0x3c]
sub eax, 0x1ccc456f
je 0x140005a4e
jmp 0x14000335a
mov eax, dword [rbp - 0x3c]
sub eax, 0x21948485
je 0x140006188
jmp 0x14000336d
mov eax, dword [rbp - 0x3c]
sub eax, 0x2b11df6e
je 0x140005b45
jmp 0x140003380
mov eax, dword [rbp - 0x3c]
sub eax, 0x2d1345db
je 0x140004e19
jmp 0x140003393
mov eax, dword [rbp - 0x3c]
sub eax, 0x2d4a37df
je 0x140003dfd
jmp 0x1400033a6
mov eax, dword [rbp - 0x3c]
sub eax, 0x30fa7c5a
je 0x140006dd7
jmp 0x1400033b9
mov eax, dword [rbp - 0x3c]
sub eax, 0x3195bef0
je 0x140004ba2
jmp 0x1400033cc
mov eax, dword [rbp - 0x3c]
sub eax, 0x3867188d
je 0x140004e25
jmp 0x1400033df
mov eax, dword [rbp - 0x3c]
sub eax, 0x3ed5b442
je 0x140003e18
jmp 0x1400033f2
mov eax, dword [rbp - 0x3c]
sub eax, 0x3fd06a04
je 0x14000390b
jmp 0x140003405
mov eax, dword [rbp - 0x3c]
sub eax, 0x42f46160
je 0x1400038f0
jmp 0x140003418
mov eax, dword [rbp - 0x3c]
sub eax, 0x47fcd6e4
je 0x140006e1a
jmp 0x14000342b
mov eax, dword [rbp - 0x3c]
sub eax, 0x4ad96c73
je 0x140004956
jmp 0x14000343e
mov eax, dword [rbp - 0x3c]
sub eax, 0x4b2d6b77
je 0x140006482
jmp 0x140003451
mov eax, dword [rbp - 0x3c]
sub eax, 0x4ba549d9
je 0x14000421a
jmp 0x140003464
mov eax, dword [rbp - 0x3c]
sub eax, 0x52419590
je 0x1400053e2
jmp 0x140003477
mov eax, dword [rbp - 0x3c]
sub eax, 0x5735ae00
je 0x14000462d
jmp 0x14000348a
mov eax, dword [rbp - 0x3c]
sub eax, 0x5806ad3a
je 0x14000420e
jmp 0x14000349d
mov eax, dword [rbp - 0x3c]
sub eax, 0x58d8fdc2
je 0x140006ee9
jmp 0x1400034b0
mov eax, dword [rbp - 0x3c]
sub eax, 0x5c75c202
je 0x140006b77
jmp 0x1400034c3
mov eax, dword [rbp - 0x3c]
sub eax, 0x64971cda
je 0x140006e44
jmp 0x1400034d6
mov eax, dword [rbp - 0x3c]
sub eax, 0x6d7917f0
je 0x14000627b
jmp 0x1400034e9
mov eax, dword [rbp - 0x3c]
sub eax, 0x6e2b50ef
je 0x140003501
jmp 0x1400034fc
jmp 0x140006f9d
mov al, byte [rbp - 0x22]
mov cl, byte [rbp - 0x21]
mov r11b, al
xor r11b, 0xff
mov r8b, cl
xor r8b, 0xff
mov dl, 1
xor dl, 1
or r11b, r8b
or dl, 1
xor r11b, 0xff
and r11b, dl
mov dl, al
xor dl, 0xff
mov r10b, cl
and r10b, dl
xor cl, 0xff
and al, cl
or r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5c75c202
mov ecx, 0xbbef1f71
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rcx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x38]
mov eax, 0x10
mov qword [rbp - 0x48], rax
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov rdx, rsp
mov qword [rbp - 0x20], rdx
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov rdx, rsp
mov qword [rbp - 0x18], rdx
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x10], rax
mov eax, 0x130
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov rdx, rsp
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp - 8], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp + 8], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp + 0x10], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp + 0x18], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp + 0x20], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp + 0x28], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x48]
mov r9, rsp
mov qword [rbp + 0x30], r9
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x38], rax
mov rax, qword [rbp - 0x18]
mov qword [rax], r8
mov rax, qword [rbp - 0x10]
mov qword [rax], rcx
mov rax, qword [rbp]
mov dword [rax], 0
mov r9, qword [rbp - 8]
mov ecx, 0xb
mov r8d, 0x130
sub rsp, 0x20
call sub.ntoskrnl.exe_ZwQuerySystemInformation
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 8]
mov dword [rax], ecx
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
mov edx, 1
sub rsp, 0x20
call fcn.140001840
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x10]
mov qword [rax], rcx
mov rax, qword [rbp + 8]
cmp dword [rax], 0xc0000004
sete al
and al, 1
mov byte [rbp + 0x46], al
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r8d, r8d
sub r8d, 1
add r8d, 0
mov edx, ecx
add edx, 0xae962c63
add edx, r8d
sub edx, 0xae962c63
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl dil
mov dl, cl
xor dl, 0xff
and dl, 0
mov r8b, 1
xor r8b, 0
mov r9b, cl
and r9b, r8b
mov al, 1
xor al, 1
and al, 0
and r8b, 1
or dl, r9b
or al, r8b
xor dl, al
mov r8b, dil
xor r8b, 0xff
and r8b, 1
mov r9b, 1
xor r9b, 1
mov al, dil
and al, r9b
or r8b, al
mov bl, 1
xor bl, 0
and bl, 1
mov al, 1
xor al, 1
and al, 0
or bl, al
mov r9b, 1
xor r9b, 0
mov al, dl
xor al, r9b
and al, dl
xor cl, 0xff
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 0
or cl, r10b
or r9b, 0
xor cl, 0xff
and cl, r9b
mov r14b, r8b
xor r14b, 0xff
mov r10b, 1
xor r10b, 0
mov r9b, 1
xor r9b, 0
or r14b, r10b
or r9b, 0
xor r14b, 0xff
and r14b, r9b
xor dil, 0xff
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
or dil, r10b
or r9b, 1
xor dil, 0xff
and dil, r9b
mov r10b, al
and r10b, cl
xor al, cl
or r10b, al
mov al, r14b
xor al, 0xff
mov r11b, dil
xor r11b, 0xff
mov cl, 1
xor cl, 1
mov r9b, al
and r9b, 0xff
and r14b, cl
mov sil, r11b
and sil, 0xff
and dil, cl
or r9b, r14b
or sil, dil
xor r9b, sil
or al, r11b
xor al, 0xff
or cl, 1
and al, cl
or r9b, al
mov al, r10b
xor al, 0xff
and al, 1
mov r11b, 1
xor r11b, 1
and r10b, r11b
mov cl, r9b
xor cl, 0xff
and cl, 0xff
and r9b, r11b
or al, r10b
or cl, r9b
xor al, cl
mov cl, dl
and cl, r8b
xor dl, r8b
or cl, dl
mov dl, cl
xor dl, 0xff
and dl, 1
mov r8b, 1
xor r8b, 1
and cl, r8b
or dl, cl
mov cl, 1
xor cl, 0
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 0
mov r8b, cl
and r8b, 0
mov sil, r9b
and sil, 0
mov r11b, r10b
and r11b, 0
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or cl, r10b
xor cl, 0xff
or r9b, 0
and cl, r9b
or r8b, cl
xor r8b, 0xff
mov cl, dl
xor cl, r8b
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5c75c202
mov ecx, 0x42f46160
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dl, byte [rbp + 0x46]
mov eax, 0x8e5344da
mov ecx, 0x3fd06a04
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r8d, r8d
sub r8d, 0x79cd6f47
mov edx, ecx
add edx, r8d
sub edx, 0x4a9070a5
sub edx, 1
add edx, 0x4a9070a5
sub edx, 0x61964d74
add edx, 0x79cd6f47
add edx, 0x61964d74
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r9b
cmp eax, 0xa
setl al
mov dl, r9b
xor dl, 0xff
and dl, 0
mov r8b, 1
xor r8b, 0
mov r10b, r9b
and r10b, r8b
mov cl, 1
xor cl, 1
and cl, 0
and r8b, 1
or dl, r10b
or cl, r8b
xor dl, cl
mov r8b, al
xor r8b, 0xff
and r8b, 1
mov r10b, 1
xor r10b, 1
mov cl, al
and cl, r10b
or r8b, cl
mov cl, 1
xor cl, 0
and cl, 1
mov r11b, 1
xor r11b, 1
mov bl, r11b
and bl, 0
mov r10b, 1
xor r10b, 1
and r10b, 0xff
and r11b, 1
or cl, bl
or r10b, r11b
xor cl, r10b
mov r15b, dl
xor r15b, 0xff
mov r11b, 1
xor r11b, 0
mov r10b, 1
xor r10b, 1
or r15b, r11b
or r10b, 1
xor r15b, 0xff
and r15b, r10b
mov r10b, cl
xor r10b, 0xff
mov sil, r9b
xor sil, r10b
and sil, r9b
mov r9b, 1
xor r9b, 0
mov r14b, r8b
xor r14b, r9b
and r14b, r8b
mov r9b, cl
xor r9b, 0xff
mov dil, al
xor dil, r9b
and dil, al
mov al, r15b
xor al, 0xff
mov r10b, sil
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
mov r11b, al
and r11b, 0xff
and r15b, r9b
mov bl, r10b
and bl, 0xff
and sil, r9b
or r11b, r15b
or bl, sil
xor r11b, bl
or al, r10b
xor al, 0xff
or r9b, 1
and al, r9b
or r11b, al
mov al, r14b
xor al, 0xff
mov bl, dil
xor bl, 0xff
mov r9b, 1
xor r9b, 0
mov r10b, al
and r10b, 0
and r14b, r9b
mov sil, bl
and sil, 0
and dil, r9b
or r10b, r14b
or sil, dil
xor r10b, sil
or al, bl
xor al, 0xff
or r9b, 0
and al, r9b
or r10b, al
mov al, r11b
xor al, 0xff
and al, 0
mov bl, 1
xor bl, 0
and r11b, bl
mov r9b, r10b
xor r9b, 0xff
and r9b, 0
and r10b, bl
or al, r11b
or r9b, r10b
xor al, r9b
mov r10b, dl
and r10b, r8b
xor dl, r8b
or r10b, dl
mov dl, r10b
xor dl, 0xff
and dl, 1
mov r9b, 1
xor r9b, 1
and r10b, r9b
mov r8b, 1
xor r8b, 1
and r8b, 0xff
and r9b, 1
or dl, r10b
or r8b, r9b
xor dl, r8b
mov r8b, cl
and r8b, 0
xor cl, 0
or r8b, cl
xor r8b, 0xff
mov cl, dl
xor cl, r8b
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd51bf28
mov ecx, 0x9eba4582
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp - 8]
mov eax, dword [rax]
movabs rcx, 0x3d1ee4f631e97f7f
add rax, rcx
movabs rcx, 0xe2dd415d03457357
add rax, rcx
movabs rcx, 0x3d1ee4f631e97f7f
sub rax, rcx
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0x130
add rcx, rax
xor eax, eax
sub rax, rcx
movabs rcx, 0x16e548ee016e58d4
add rax, rcx
movabs rcx, 0xe2dd415d03457357
sub rax, rcx
movabs rcx, 0x16e548ee016e58d4
sub rax, rcx
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov dword [rax], ecx
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov edx, eax
mov ecx, 1
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov qword [rax], rcx
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov r8d, eax
xor edx, edx
sub rsp, 0x20
call fcn.14004ca80
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov r8d, dword [rax]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
mov r9, qword [rbp - 8]
mov ecx, 0xb
sub rsp, 0x20
call sub.ntoskrnl.exe_ZwQuerySystemInformation
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 8]
cmp dword [rax], 0
setge al
and al, 1
mov byte [rbp + 0x47], al
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
mov edx, eax
sub edx, 0x1d6a3c3e
sub edx, 0x57b15e8e
add edx, 0x1d6a3c3e
sub edx, 0x30792edb
sub edx, 1
add edx, 0x30792edb
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0x57b15e8e
add r8d, edx
xor edx, edx
sub edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl r8b
mov dl, al
xor dl, 0xff
and dl, 1
mov r9b, 1
xor r9b, 1
mov cl, al
and cl, r9b
or dl, cl
mov r9b, r8b
xor r9b, 0xff
and r9b, 0
mov r10b, 1
xor r10b, 0
mov r11b, r8b
and r11b, r10b
mov cl, 1
xor cl, 1
and cl, 0
and r10b, 1
or r9b, r11b
or cl, r10b
xor r9b, cl
mov cl, 1
xor cl, 1
and cl, 1
mov r10b, 1
xor r10b, 1
and r10b, 1
or cl, r10b
mov r15b, dl
xor r15b, 0xff
mov r11b, 1
xor r11b, 1
mov r10b, 1
xor r10b, 0
or r15b, r11b
or r10b, 0
xor r15b, 0xff
and r15b, r10b
mov r10b, cl
xor r10b, 0xff
mov r14b, al
xor r14b, r10b
and r14b, al
mov r10b, 1
xor r10b, 1
mov al, r9b
xor al, r10b
and al, r9b
xor r8b, 0xff
mov r11b, cl
xor r11b, 0xff
mov r10b, 1
xor r10b, 0
or r8b, r11b
or r10b, 0
xor r8b, 0xff
and r8b, r10b
mov r10b, r15b
xor r10b, 0xff
mov sil, r14b
xor sil, 0xff
mov bl, 1
xor bl, 1
mov r11b, r10b
and r11b, 0xff
and r15b, bl
mov dil, sil
and dil, 0xff
and r14b, bl
or r11b, r15b
or dil, r14b
xor r11b, dil
or r10b, sil
xor r10b, 0xff
or bl, 1
and r10b, bl
or r11b, r10b
mov r10b, al
and r10b, r8b
xor al, r8b
or r10b, al
mov al, r11b
xor al, 0xff
and al, 1
mov bl, 1
xor bl, 1
and r11b, bl
mov r8b, r10b
xor r8b, 0xff
and r8b, 0xff
and r10b, bl
or al, r11b
or r8b, r10b
xor al, r8b
mov r8b, dl
and r8b, r9b
xor dl, r9b
or r8b, dl
mov dl, r8b
xor dl, 0xff
and dl, 1
mov r9b, 1
xor r9b, 1
and r8b, r9b
or dl, r8b
mov r8b, cl
and r8b, 1
xor cl, 1
or r8b, cl
xor r8b, 0xff
mov cl, dl
xor cl, r8b
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbd51bf28
mov ecx, 0x2d4a37df
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dl, byte [rbp + 0x47]
mov eax, 0x3ed5b442
mov ecx, 0x4ba549d9
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov r8d, 0x24e24a08
add r8d, 0
sub r8d, 1
sub r8d, 0x24e24a08
mov edx, ecx
sub edx, 0x78db9e04
add edx, r8d
add edx, 0x78db9e04
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov cl, r11b
xor cl, 0xff
and cl, 0
mov dl, 1
xor dl, 0
mov r8b, r11b
and r8b, dl
mov al, 1
xor al, 1
and al, 0
and dl, 1
or cl, r8b
or al, dl
xor cl, al
mov dl, r10b
xor dl, 0xff
and dl, 1
mov r8b, 1
xor r8b, 1
mov al, r10b
and al, r8b
or dl, al
mov bl, 1
xor bl, 1
and bl, 1
mov r8b, 1
xor r8b, 1
mov r9b, r8b
and r9b, 1
mov al, 1
xor al, 1
and al, 0xff
and r8b, 1
or bl, r9b
or al, r8b
xor bl, al
mov al, 1
xor al, 1
mov r9b, cl
xor r9b, al
and r9b, cl
xor r11b, 0xff
mov r8b, bl
xor r8b, 0xff
mov al, 1
xor al, 0
or r11b, r8b
or al, 0
xor r11b, 0xff
and r11b, al
mov r8b, 1
xor r8b, 1
mov al, dl
xor al, r8b
and al, dl
mov sil, bl
xor sil, 0xff
mov r8b, r10b
xor r8b, sil
and r8b, r10b
mov r10b, r9b
and r10b, r11b
xor r9b, r11b
or r10b, r9b
mov r9b, al
and r9b, r8b
xor al, r8b
or r9b, al
mov al, r10b
xor al, 0xff
and al, 0
mov r11b, 1
xor r11b, 0
and r10b, r11b
mov r8b, r9b
xor r8b, 0xff
and r8b, 0
and r9b, r11b
or al, r10b
or r8b, r9b
xor al, r8b
mov r9b, cl
and r9b, dl
xor cl, dl
or r9b, cl
mov cl, r9b
xor cl, 0xff
and cl, 1
mov r8b, 1
xor r8b, 1
and r9b, r8b
mov dl, 1
xor dl, 1
and dl, 0xff
and r8b, 1
or cl, r9b
or dl, r8b
xor cl, dl
mov dl, 1
xor dl, 1
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
mov r8b, dl
and r8b, 0xff
mov sil, r9b
and sil, 1
mov r11b, r10b
and r11b, 0xff
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or dl, r10b
xor dl, 0xff
or r9b, 1
and dl, r9b
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 1
or cl, r8b
or dl, 1
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7836f1b
mov ecx, 0x16b73a60
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov dword [rax], 0
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
sub edx, 0x81dae125
add edx, 0xd887e6c2
add edx, 0x81dae125
add edx, 0x68e6d791
sub edx, 1
sub edx, 0x68e6d791
add edx, 0x4f68470b
sub edx, 0xd887e6c2
sub edx, 0x4f68470b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r8b
mov cl, r11b
xor cl, 0xff
and cl, 1
mov dl, 1
xor dl, 1
mov al, r11b
and al, dl
or cl, al
mov dl, r8b
xor dl, 0xff
and dl, 1
mov r9b, 1
xor r9b, 1
mov al, r8b
and al, r9b
or dl, al
mov bl, 1
xor bl, 1
and bl, 1
mov r9b, 1
xor r9b, 1
mov r10b, r9b
and r10b, 1
mov al, 1
xor al, 1
and al, 0xff
and r9b, 1
or bl, r10b
or al, r9b
xor bl, al
mov al, 1
xor al, 1
mov r9b, cl
xor r9b, al
and r9b, cl
xor r11b, 0xff
mov r10b, bl
xor r10b, 0xff
mov al, 1
xor al, 0
or r11b, r10b
or al, 0
xor r11b, 0xff
and r11b, al
mov r10b, 1
xor r10b, 1
mov al, dl
xor al, r10b
and al, dl
xor r8b, 0xff
mov sil, bl
xor sil, 0xff
mov r10b, 1
xor r10b, 0
or r8b, sil
or r10b, 0
xor r8b, 0xff
and r8b, r10b
mov r10b, r9b
and r10b, r11b
xor r9b, r11b
or r10b, r9b
mov r9b, al
and r9b, r8b
xor al, r8b
or r9b, al
mov al, r10b
xor al, 0xff
and al, 1
mov r11b, 1
xor r11b, 1
and r10b, r11b
mov r8b, r9b
xor r8b, 0xff
and r8b, 0xff
and r9b, r11b
or al, r10b
or r8b, r9b
xor al, r8b
mov r9b, cl
and r9b, dl
xor cl, dl
or r9b, cl
mov dl, r9b
xor dl, 0xff
and dl, 1
mov r8b, 1
xor r8b, 1
and r9b, r8b
mov cl, 1
xor cl, 1
and cl, 0xff
and r8b, 1
or dl, r9b
or cl, r8b
xor dl, cl
mov cl, 1
xor cl, 1
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 0
mov r8b, cl
and r8b, 0
mov sil, r9b
and sil, 1
mov r11b, r10b
and r11b, 0
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or cl, r10b
xor cl, 0xff
or r9b, 0
and cl, r9b
or r8b, cl
xor r8b, 0xff
mov cl, dl
xor cl, r8b
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe7836f1b
mov ecx, 0x5806ad3a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0xa9c49bfe
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r8d, r8d
sub r8d, 0xc0102e6a
mov edx, ecx
sub edx, r8d
add edx, 0x795dbb61
sub edx, 1
sub edx, 0x795dbb61
sub edx, 0x7f094edf
sub edx, 0xc0102e6a
add edx, 0x7f094edf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r8b
cmp eax, 0xa
setl al
mov cl, r8b
xor cl, 0xff
and cl, 1
mov r9b, 1
xor r9b, 1
mov dl, r8b
and dl, r9b
or cl, dl
mov r9b, al
xor r9b, 0xff
and r9b, 1
mov r10b, 1
xor r10b, 1
mov dl, al
and dl, r10b
or r9b, dl
mov dl, 1
xor dl, 1
and dl, 1
mov r11b, 1
xor r11b, 1
mov bl, r11b
and bl, 1
mov r10b, 1
xor r10b, 1
and r10b, 0xff
and r11b, 1
or dl, bl
or r10b, r11b
xor dl, r10b
mov r15b, cl
xor r15b, 0xff
mov r11b, 1
xor r11b, 1
mov r10b, 1
xor r10b, 1
or r15b, r11b
or r10b, 1
xor r15b, 0xff
and r15b, r10b
mov r10b, dl
xor r10b, 0xff
mov sil, r8b
xor sil, r10b
and sil, r8b
mov r8b, 1
xor r8b, 1
mov r14b, r9b
xor r14b, r8b
and r14b, r9b
mov r8b, dl
xor r8b, 0xff
mov dil, al
xor dil, r8b
and dil, al
mov al, r15b
xor al, 0xff
mov r11b, sil
xor r11b, 0xff
mov r10b, 1
xor r10b, 1
mov r8b, al
and r8b, 0xff
and r15b, r10b
mov bl, r11b
and bl, 0xff
and sil, r10b
or r8b, r15b
or bl, sil
xor r8b, bl
or al, r11b
xor al, 0xff
or r10b, 1
and al, r10b
or r8b, al
mov al, r14b
xor al, 0xff
mov bl, dil
xor bl, 0xff
mov r11b, 1
xor r11b, 1
mov r10b, al
and r10b, 0xff
and r14b, r11b
mov sil, bl
and sil, 0xff
and dil, r11b
or r10b, r14b
or sil, dil
xor r10b, sil
or al, bl
xor al, 0xff
or r11b, 1
and al, r11b
or r10b, al
mov r11b, r8b
xor r11b, 0xff
mov al, r10b
and al, r11b
xor r10b, 0xff
and r8b, r10b
or al, r8b
mov r8b, cl
and r8b, r9b
xor cl, r9b
or r8b, cl
mov cl, r8b
xor cl, 0xff
and cl, 1
mov r9b, 1
xor r9b, 1
and r8b, r9b
or cl, r8b
mov r8b, dl
and r8b, 1
xor dl, 1
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 1
or cl, r8b
or dl, 1
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xbc98e169
mov ecx, 0x6be3d3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
lea rdx, str.ntkrnlpa.exe
sub rsp, 0x20
call sub.ntoskrnl.exe_strstr
add rsp, 0x20
cmp rax, 0
setne al
and al, 1
mov byte [rbp + 0x48], al
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
add edx, 0x92c29af6
add edx, 0x4775c304
sub edx, 0x92c29af6
add edx, 0xb5db4b3d
sub edx, 1
sub edx, 0xb5db4b3d
add edx, 0x679fb1af
sub edx, 0x4775c304
sub edx, 0x679fb1af
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r8b
cmp eax, 0xa
setl r11b
mov al, r8b
xor al, 0xff
and al, 1
mov dl, 1
xor dl, 1
mov r9b, r8b
and r9b, dl
mov cl, 1
xor cl, 1
and cl, 0xff
and dl, 1
or al, r9b
or cl, dl
xor al, cl
mov cl, r11b
xor cl, 0xff
and cl, 1
mov r9b, 1
xor r9b, 1
mov r10b, r11b
and r10b, r9b
mov dl, 1
xor dl, 1
and dl, 0xff
and r9b, 1
or cl, r10b
or dl, r9b
xor cl, dl
mov dl, 1
xor dl, 1
and dl, 1
mov r9b, 1
xor r9b, 1
and r9b, 1
or dl, r9b
mov r10b, 1
xor r10b, 1
mov r9b, al
xor r9b, r10b
and r9b, al
mov r10b, dl
xor r10b, 0xff
mov bl, r8b
xor bl, r10b
and bl, r8b
mov r8b, cl
xor r8b, 0xff
mov sil, 1
xor sil, 1
mov r10b, 1
xor r10b, 0
or r8b, sil
or r10b, 0
xor r8b, 0xff
and r8b, r10b
xor r11b, 0xff
mov sil, dl
xor sil, 0xff
mov r10b, 1
xor r10b, 0
or r11b, sil
or r10b, 0
xor r11b, 0xff
and r11b, r10b
mov r10b, r9b
and r10b, bl
xor r9b, bl
or r10b, r9b
mov r9b, r8b
and r9b, r11b
xor r8b, r11b
or r9b, r8b
mov r11b, r10b
xor r11b, 0xff
and r11b, 0
mov bl, 1
xor bl, 0
and r10b, bl
mov r8b, r9b
xor r8b, 0xff
and r8b, 0
and r9b, bl
or r11b, r10b
or r8b, r9b
xor r11b, r8b
mov r9b, al
and r9b, cl
xor al, cl
or r9b, al
mov al, r9b
xor al, 0xff
and al, 0
mov r8b, 1
xor r8b, 0
and r9b, r8b
mov cl, 1
xor cl, 1
and cl, 0
and r8b, 1
or al, r9b
or cl, r8b
xor al, cl
mov cl, dl
and cl, 1
xor dl, 1
or cl, dl
xor cl, 0xff
mov r10b, al
xor r10b, cl
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xbc98e169
mov ecx, 0x5735ae00
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dl, byte [rbp + 0x48]
mov eax, 0x9ef2b07f
mov ecx, 0x4ad96c73
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r9d, r9d
sub r9d, 1
add r9d, 0
xor r8d, r8d
sub r8d, ecx
xor edx, edx
sub edx, r9d
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl dil
mov sil, dl
xor sil, 0xff
and sil, 1
mov cl, 1
xor cl, 1
mov r8b, dl
and r8b, cl
mov al, 1
xor al, 1
and al, 0xff
and cl, 1
or sil, r8b
or al, cl
xor sil, al
mov r11b, dil
xor r11b, 0xff
and r11b, 1
mov cl, 1
xor cl, 1
mov r8b, dil
and r8b, cl
mov al, 1
xor al, 1
and al, 0xff
and cl, 1
or r11b, r8b
or al, cl
xor r11b, al
mov bl, 1
xor bl, 1
and bl, 1
mov al, 1
xor al, 1
and al, 1
or bl, al
mov al, sil
xor al, 0xff
mov r8b, 1
xor r8b, 1
mov cl, 1
xor cl, 0
or al, r8b
or cl, 0
xor al, 0xff
and al, cl
xor dl, 0xff
mov r8b, bl
xor r8b, 0xff
mov cl, 1
xor cl, 1
or dl, r8b
or cl, 1
xor dl, 0xff
and dl, cl
mov cl, 1
xor cl, 1
mov r14b, r11b
xor r14b, cl
and r14b, r11b
xor dil, 0xff
mov r8b, bl
xor r8b, 0xff
mov cl, 1
xor cl, 0
or dil, r8b
or cl, 0
xor dil, 0xff
and dil, cl
mov cl, al
and cl, dl
xor al, dl
or cl, al
mov al, r14b
xor al, 0xff
mov r9b, dil
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov dl, al
and dl, 0xff
and r14b, r8b
mov r10b, r9b
and r10b, 0xff
and dil, r8b
or dl, r14b
or r10b, dil
xor dl, r10b
or al, r9b
xor al, 0xff
or r8b, 1
and al, r8b
or dl, al
mov r8b, cl
xor r8b, 0xff
mov al, dl
and al, r8b
xor dl, 0xff
and cl, dl
or al, cl
mov cl, sil
xor cl, 0xff
mov r9b, r11b
xor r9b, 0xff
mov r8b, 1
xor r8b, 0
mov dl, cl
and dl, 0
and sil, r8b
mov r10b, r9b
and r10b, 0
and r11b, r8b
or dl, sil
or r10b, r11b
xor dl, r10b
or cl, r9b
xor cl, 0xff
or r8b, 0
and cl, r8b
or dl, cl
mov cl, dl
xor cl, 0xff
and cl, 1
mov r8b, 1
xor r8b, 1
and dl, r8b
or cl, dl
mov dl, 1
xor dl, 1
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
mov r8b, dl
and r8b, 0xff
mov sil, r9b
and sil, 1
mov r11b, r10b
and r11b, 0xff
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or dl, r10b
xor dl, 0xff
or r9b, 1
and dl, r9b
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 0
or cl, r8b
or dl, 0
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf21054a4
mov ecx, 0xc1c606c8
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
lea rdx, str.ntoskrnl.exe
sub rsp, 0x20
call sub.ntoskrnl.exe_strstr
add rsp, 0x20
cmp rax, 0
setne al
and al, 1
mov byte [rbp + 0x49], al
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
xor r9d, r9d
sub r9d, 1
add r9d, 0
xor r8d, r8d
sub r8d, eax
xor edx, edx
sub edx, r9d
add r8d, edx
xor edx, edx
sub edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, cl
xor dl, 0xff
mov r11b, al
xor r11b, dl
and r11b, al
mov dl, al
xor dl, 0xff
mov r10b, cl
and r10b, dl
xor cl, 0xff
and al, cl
or r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf21054a4
mov ecx, 0x15e946d0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dl, byte [rbp + 0x49]
mov eax, 0x3867188d
mov ecx, 0x4ad96c73
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r9d, r9d
sub r9d, 0xd8fcdc2d
sub r9d, 1
add r9d, 0xd8fcdc2d
xor r8d, r8d
sub r8d, ecx
xor edx, edx
sub edx, r9d
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r8b
cmp eax, 0xa
setl dl
mov sil, r8b
xor sil, 0xff
and sil, 1
mov cl, 1
xor cl, 1
mov r9b, r8b
and r9b, cl
mov al, 1
xor al, 1
and al, 0xff
and cl, 1
or sil, r9b
or al, cl
xor sil, al
mov r10b, dl
xor r10b, 0xff
and r10b, 1
mov cl, 1
xor cl, 1
mov al, dl
and al, cl
or r10b, al
mov bl, 1
xor bl, 0
and bl, 0
mov cl, 1
xor cl, 0
mov r9b, cl
and r9b, 0
mov al, 1
xor al, 1
and al, 0
and cl, 1
or bl, r9b
or al, cl
xor bl, al
mov cl, 1
xor cl, 0
mov al, sil
xor al, cl
and al, sil
mov r9b, bl
xor r9b, 0xff
mov cl, r8b
xor cl, r9b
and cl, r8b
mov r8b, 1
xor r8b, 0
mov r14b, r10b
xor r14b, r8b
and r14b, r10b
mov r8b, bl
xor r8b, 0xff
mov dil, dl
xor dil, r8b
and dil, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov al, r14b
xor al, 0xff
mov r9b, dil
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov cl, al
and cl, 0xff
and r14b, r8b
mov r11b, r9b
and r11b, 0xff
and dil, r8b
or cl, r14b
or r11b, dil
xor cl, r11b
or al, r9b
xor al, 0xff
or r8b, 1
and al, r8b
or cl, al
mov r11b, dl
xor r11b, 0xff
and r11b, 0
mov r8b, 1
xor r8b, 0
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0
and cl, r8b
or r11b, dl
or al, cl
xor r11b, al
mov al, sil
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and sil, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, sil
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov r10b, dl
xor r10b, 0xff
and r10b, 1
mov cl, 1
xor cl, 1
and dl, cl
mov al, 1
xor al, 1
and al, 0xff
and cl, 1
or r10b, dl
or al, cl
xor r10b, al
mov al, 1
xor al, 0
mov r8b, bl
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov cl, al
and cl, 0
mov sil, dl
and sil, 0
mov r9b, r8b
and r9b, 0
and bl, dl
or cl, sil
or r9b, bl
xor cl, r9b
or al, r8b
xor al, 0xff
or dl, 0
and al, dl
or cl, al
xor r10b, 0xff
xor cl, 0xff
mov al, 1
xor al, 1
or r10b, cl
or al, 1
xor r10b, 0xff
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x30fa7c5a
mov ecx, 0x3195bef0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
add rcx, 8
mov rax, qword [rbp + 0x28]
mov qword [rax], rcx
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rax], rcx
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov ecx, dword [rax + 0x18]
mov rax, qword [rbp]
mov dword [rax], ecx
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, 0x1054c1f9
add edx, 0
sub edx, 1
sub edx, 0x1054c1f9
xor r8d, r8d
sub r8d, edx
mov edx, ecx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete cl
cmp eax, 0xa
setl al
mov sil, cl
xor sil, 0xff
and sil, 0
mov r8b, 1
xor r8b, 0
mov r9b, cl
and r9b, r8b
mov dl, 1
xor dl, 1
and dl, 0
and r8b, 1
or sil, r9b
or dl, r8b
xor sil, dl
mov bl, al
xor bl, 0xff
and bl, 1
mov r8b, 1
xor r8b, 1
mov dl, al
and dl, r8b
or bl, dl
mov dl, 1
xor dl, 0
and dl, 1
mov r9b, 1
xor r9b, 1
mov r10b, r9b
and r10b, 0
mov r8b, 1
xor r8b, 1
and r8b, 0xff
and r9b, 1
or dl, r10b
or r8b, r9b
xor dl, r8b
mov r8b, 1
xor r8b, 0
mov r15b, sil
xor r15b, r8b
and r15b, sil
mov r8b, dl
xor r8b, 0xff
mov r11b, cl
xor r11b, r8b
and r11b, cl
mov cl, 1
xor cl, 0
mov r14b, bl
xor r14b, cl
and r14b, bl
mov cl, dl
xor cl, 0xff
mov dil, al
xor dil, cl
and dil, al
mov cl, r15b
xor cl, 0xff
mov r9b, r11b
xor r9b, 0xff
mov r8b, 1
xor r8b, 0
mov al, cl
and al, 0
and r15b, r8b
mov r10b, r9b
and r10b, 0
and r11b, r8b
or al, r15b
or r10b, r11b
xor al, r10b
or cl, r9b
xor cl, 0xff
or r8b, 0
and cl, r8b
or al, cl
mov r8b, r14b
xor r8b, 0xff
mov r10b, dil
xor r10b, 0xff
mov r9b, 1
xor r9b, 0
mov cl, r8b
and cl, 0
and r14b, r9b
mov r11b, r10b
and r11b, 0
and dil, r9b
or cl, r14b
or r11b, dil
xor cl, r11b
or r8b, r10b
xor r8b, 0xff
or r9b, 0
and r8b, r9b
or cl, r8b
mov r8b, al
xor r8b, 0xff
mov r11b, cl
and r11b, r8b
xor cl, 0xff
and al, cl
or r11b, al
mov al, sil
xor al, 0xff
mov r8b, bl
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov r9b, al
and r9b, 0
and sil, cl
mov r10b, r8b
and r10b, 0
and bl, cl
or r9b, sil
or r10b, bl
xor r9b, r10b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or r9b, al
mov al, r9b
xor al, 0xff
and al, 0
mov r8b, 1
xor r8b, 0
and r9b, r8b
mov cl, 1
xor cl, 1
and cl, 0
and r8b, 1
or al, r9b
or cl, r8b
xor al, cl
mov cl, dl
and cl, 0
xor dl, 0
or cl, dl
xor cl, 0xff
mov r10b, al
xor r10b, cl
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x30fa7c5a
mov ecx, 0x2d1345db
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0x6d7917f0
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r9d, r9d
sub r9d, 0x4b896e02
sub r9d, 1
add r9d, 0x4b896e02
xor r8d, r8d
sub r8d, ecx
xor edx, edx
sub edx, r9d
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r9b
cmp eax, 0xa
setl dil
mov cl, r9b
xor cl, 0xff
and cl, 1
mov dl, 1
xor dl, 1
mov al, r9b
and al, dl
or cl, al
mov r8b, dil
xor r8b, 0xff
and r8b, 1
mov dl, 1
xor dl, 1
mov r10b, dil
and r10b, dl
mov al, 1
xor al, 1
and al, 0xff
and dl, 1
or r8b, r10b
or al, dl
xor r8b, al
mov dl, 1
xor dl, 0
and dl, 0
mov r10b, 1
xor r10b, 0
mov r11b, r10b
and r11b, 0
mov al, 1
xor al, 1
and al, 0
and r10b, 1
or dl, r11b
or al, r10b
xor dl, al
mov r10b, 1
xor r10b, 0
mov al, cl
xor al, r10b
and al, cl
xor r9b, 0xff
mov r11b, dl
xor r11b, 0xff
mov r10b, 1
xor r10b, 1
or r9b, r11b
or r10b, 1
xor r9b, 0xff
and r9b, r10b
mov r14b, r8b
xor r14b, 0xff
mov r11b, 1
xor r11b, 0
mov r10b, 1
xor r10b, 0
or r14b, r11b
or r10b, 0
xor r14b, 0xff
and r14b, r10b
xor dil, 0xff
mov r11b, dl
xor r11b, 0xff
mov r10b, 1
xor r10b, 0
or dil, r11b
or r10b, 0
xor dil, 0xff
and dil, r10b
mov r11b, al
and r11b, r9b
xor al, r9b
or r11b, al
mov al, r14b
xor al, 0xff
mov bl, dil
xor bl, 0xff
mov r9b, 1
xor r9b, 1
mov r10b, al
and r10b, 0xff
and r14b, r9b
mov sil, bl
and sil, 0xff
and dil, r9b
or r10b, r14b
or sil, dil
xor r10b, sil
or al, bl
xor al, 0xff
or r9b, 1
and al, r9b
or r10b, al
mov al, r11b
xor al, 0xff
and al, 0
mov bl, 1
xor bl, 0
and r11b, bl
mov r9b, r10b
xor r9b, 0xff
and r9b, 0
and r10b, bl
or al, r11b
or r9b, r10b
xor al, r9b
mov r10b, cl
and r10b, r8b
xor cl, r8b
or r10b, cl
mov cl, r10b
xor cl, 0xff
and cl, 1
mov r9b, 1
xor r9b, 1
and r10b, r9b
mov r8b, 1
xor r8b, 1
and r8b, 0xff
and r9b, 1
or cl, r10b
or r8b, r9b
xor cl, r8b
mov r8b, dl
and r8b, 0
xor dl, 0
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 1
or cl, r8b
or dl, 1
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x47fcd6e4
mov ecx, 0xd1d4052f
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x30]
mov dword [rax], 0
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, 0xc3bc3579
add edx, 0
sub edx, 1
sub edx, 0xc3bc3579
xor r8d, r8d
sub r8d, edx
mov edx, ecx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl cl
mov r11b, dl
xor r11b, 0xff
mov r8b, cl
xor r8b, 0xff
mov al, 1
xor al, 1
or r11b, r8b
or al, 1
xor r11b, 0xff
and r11b, al
mov r10b, dl
xor r10b, 0xff
and r10b, 0
mov r8b, 1
xor r8b, 0
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0
and cl, r8b
or r10b, dl
or al, cl
xor r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x47fcd6e4
mov ecx, 0xfcc76c7a
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0xb6106f72
jmp 0x140006f9d
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
xor r8d, r8d
sub r8d, 0x1e23f036
mov edx, eax
sub edx, r8d
add edx, 0x9e9c1683
sub edx, 1
sub edx, 0x9e9c1683
sub edx, 0x7f012481
sub edx, 0x1e23f036
add edx, 0x7f012481
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov r11b, al
xor r11b, 0xff
mov r8b, cl
xor r8b, 0xff
mov dl, 1
xor dl, 1
or r11b, r8b
or dl, 1
xor r11b, 0xff
and r11b, dl
mov dl, al
xor dl, 0xff
mov r10b, cl
and r10b, dl
xor cl, 0xff
and al, cl
or r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xf175896b
mov ecx, 0xab370ab8
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
cmp eax, dword [rcx]
setb al
and al, 1
mov byte [rbp + 0x4a], al
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor edx, edx
sub edx, 1
add edx, 0
xor r8d, r8d
sub r8d, edx
mov edx, ecx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r14b
cmp eax, 0xa
setl cl
mov sil, r14b
xor sil, 0xff
and sil, 0
mov dl, 1
xor dl, 0
mov r8b, r14b
and r8b, dl
mov al, 1
xor al, 1
and al, 0
and dl, 1
or sil, r8b
or al, dl
xor sil, al
mov bl, cl
xor bl, 0xff
and bl, 1
mov dl, 1
xor dl, 1
mov al, cl
and al, dl
or bl, al
mov dl, 1
xor dl, 0
and dl, 0
mov r8b, 1
xor r8b, 0
mov r9b, r8b
and r9b, 0
mov al, 1
xor al, 1
and al, 0
and r8b, 1
or dl, r9b
or al, r8b
xor dl, al
mov r15b, sil
xor r15b, 0xff
mov r8b, 1
xor r8b, 0
mov al, 1
xor al, 0
or r15b, r8b
or al, 0
xor r15b, 0xff
and r15b, al
xor r14b, 0xff
mov r8b, dl
xor r8b, 0xff
mov al, 1
xor al, 1
or r14b, r8b
or al, 1
xor r14b, 0xff
and r14b, al
mov r8b, 1
xor r8b, 0
mov al, bl
xor al, r8b
and al, bl
mov r8b, dl
xor r8b, 0xff
mov r9b, cl
xor r9b, r8b
and r9b, cl
mov r8b, r15b
xor r8b, 0xff
mov r11b, r14b
xor r11b, 0xff
mov r10b, 1
xor r10b, 0
mov cl, r8b
and cl, 0
and r15b, r10b
mov dil, r11b
and dil, 0
and r14b, r10b
or cl, r15b
or dil, r14b
xor cl, dil
or r8b, r11b
xor r8b, 0xff
or r10b, 0
and r8b, r10b
or cl, r8b
mov r8b, al
and r8b, r9b
xor al, r9b
or r8b, al
mov r9b, cl
xor r9b, 0xff
mov al, r8b
and al, r9b
xor r8b, 0xff
and cl, r8b
or al, cl
mov cl, sil
xor cl, 0xff
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
mov r8b, cl
and r8b, 0xff
and sil, r9b
mov r11b, r10b
and r11b, 0xff
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or cl, r10b
xor cl, 0xff
or r9b, 1
and cl, r9b
or r8b, cl
mov cl, r8b
xor cl, 0xff
and cl, 1
mov r9b, 1
xor r9b, 1
and r8b, r9b
or cl, r8b
mov r8b, dl
and r8b, 0
xor dl, 0
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 0
or cl, r8b
or dl, 0
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf175896b
mov ecx, 0x52419590
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dl, byte [rbp + 0x4a]
mov eax, 0xcaab9bdb
mov ecx, 0x157f3528
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
add edx, 0x437eb40d
sub edx, 0x580586f5
sub edx, 0x437eb40d
xor r8d, r8d
sub r8d, 1
add edx, r8d
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0x580586f5
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r9b
cmp eax, 0xa
setl r8b
mov cl, r8b
xor cl, 0xff
mov al, r9b
xor al, cl
and al, r9b
mov cl, r9b
xor cl, 0xff
and cl, 1
mov r10b, 1
xor r10b, 1
and r9b, r10b
mov dl, r8b
xor dl, 0xff
and dl, 0xff
and r8b, r10b
or cl, r9b
or dl, r8b
xor cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x64971cda
mov ecx, 0x9319c510
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
add rcx, 8
mov rax, qword [rbp + 0x30]
movsxd rax, dword [rax]
imul rax, rax, 0x128
add rcx, rax
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
add rcx, 0x28
xor edx, edx
sub rsp, 0x20
call fcn.140001840
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
add rcx, 0x28
sub rsp, 0x20
call sub.ntoskrnl.exe_strstr
add rsp, 0x20
cmp rax, 0
setne al
and al, 1
mov byte [rbp + 0x4b], al
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, 0x3a4a3b04
add edx, 0
sub edx, 1
sub edx, 0x3a4a3b04
xor r8d, r8d
sub r8d, edx
mov edx, ecx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl dil
mov sil, dl
xor sil, 0xff
and sil, 1
mov cl, 1
xor cl, 1
mov r8b, dl
and r8b, cl
mov al, 1
xor al, 1
and al, 0xff
and cl, 1
or sil, r8b
or al, cl
xor sil, al
mov r11b, dil
xor r11b, 0xff
and r11b, 1
mov cl, 1
xor cl, 1
mov al, dil
and al, cl
or r11b, al
mov bl, 1
xor bl, 0
and bl, 0
mov cl, 1
xor cl, 0
mov r8b, cl
and r8b, 0
mov al, 1
xor al, 1
and al, 0
and cl, 1
or bl, r8b
or al, cl
xor bl, al
mov cl, 1
xor cl, 0
mov al, sil
xor al, cl
and al, sil
xor dl, 0xff
mov r8b, bl
xor r8b, 0xff
mov cl, 1
xor cl, 0
or dl, r8b
or cl, 0
xor dl, 0xff
and dl, cl
mov cl, 1
xor cl, 0
mov r14b, r11b
xor r14b, cl
and r14b, r11b
xor dil, 0xff
mov r8b, bl
xor r8b, 0xff
mov cl, 1
xor cl, 1
or dil, r8b
or cl, 1
xor dil, 0xff
and dil, cl
mov cl, al
and cl, dl
xor al, dl
or cl, al
mov al, r14b
xor al, 0xff
mov r9b, dil
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov dl, al
and dl, 0xff
and r14b, r8b
mov r10b, r9b
and r10b, 0xff
and dil, r8b
or dl, r14b
or r10b, dil
xor dl, r10b
or al, r9b
xor al, 0xff
or r8b, 1
and al, r8b
or dl, al
mov r8b, cl
xor r8b, 0xff
mov al, dl
and al, r8b
xor dl, 0xff
and cl, dl
or al, cl
mov cl, sil
xor cl, 0xff
mov r9b, r11b
xor r9b, 0xff
mov r8b, 1
xor r8b, 0
mov dl, cl
and dl, 0
and sil, r8b
mov r10b, r9b
and r10b, 0
and r11b, r8b
or dl, sil
or r10b, r11b
xor dl, r10b
or cl, r9b
xor cl, 0xff
or r8b, 0
and cl, r8b
or dl, cl
mov cl, dl
xor cl, 0xff
and cl, 1
mov r8b, 1
xor r8b, 1
and dl, r8b
or cl, dl
mov dl, 1
xor dl, 0
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 0
mov r8b, dl
and r8b, 0
mov sil, r9b
and sil, 0
mov r11b, r10b
and r11b, 0
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or dl, r10b
xor dl, 0xff
or r9b, 0
and dl, r9b
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 0
or cl, r8b
or dl, 0
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x64971cda
mov ecx, 0x87a8199d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dl, byte [rbp + 0x4b]
mov eax, 0xc586d52d
mov ecx, 0x741f528
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r8d, r8d
sub r8d, 0xcc7082fd
mov edx, ecx
add edx, r8d
xor r8d, r8d
sub r8d, 1
add edx, r8d
add edx, 0xde7986a6
add edx, 0xcc7082fd
sub edx, 0xde7986a6
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r14b
cmp eax, 0xa
setl r9b
mov cl, r14b
xor cl, 0xff
and cl, 1
mov dl, 1
xor dl, 1
mov al, r14b
and al, dl
or cl, al
mov dl, r9b
xor dl, 0xff
and dl, 0
mov r8b, 1
xor r8b, 0
mov r10b, r9b
and r10b, r8b
mov al, 1
xor al, 1
and al, 0
and r8b, 1
or dl, r10b
or al, r8b
xor dl, al
mov al, 1
xor al, 0
and al, 1
mov r8b, 1
xor r8b, 1
and r8b, 0
or al, r8b
mov r8b, 1
xor r8b, 0
mov r15b, cl
xor r15b, r8b
and r15b, cl
xor r14b, 0xff
mov r10b, al
xor r10b, 0xff
mov r8b, 1
xor r8b, 0
or r14b, r10b
or r8b, 0
xor r14b, 0xff
and r14b, r8b
mov r8b, dl
xor r8b, 0xff
mov r11b, 1
xor r11b, 0
mov r10b, 1
xor r10b, 0
or r8b, r11b
or r10b, 0
xor r8b, 0xff
and r8b, r10b
mov r10b, al
xor r10b, 0xff
mov r11b, r9b
xor r11b, r10b
and r11b, r9b
mov r9b, r15b
xor r9b, 0xff
mov sil, r14b
xor sil, 0xff
mov bl, 1
xor bl, 0
mov r10b, r9b
and r10b, 0
and r15b, bl
mov dil, sil
and dil, 0
and r14b, bl
or r10b, r15b
or dil, r14b
xor r10b, dil
or r9b, sil
xor r9b, 0xff
or bl, 0
and r9b, bl
or r10b, r9b
mov r9b, r8b
and r9b, r11b
xor r8b, r11b
or r9b, r8b
mov r11b, r10b
xor r11b, 0xff
and r11b, 0
mov bl, 1
xor bl, 0
and r10b, bl
mov r8b, r9b
xor r8b, 0xff
and r8b, 0
and r9b, bl
or r11b, r10b
or r8b, r9b
xor r11b, r8b
mov r8b, cl
and r8b, dl
xor cl, dl
or r8b, cl
mov r10b, r8b
xor r10b, 0xff
and r10b, 1
mov dl, 1
xor dl, 1
and r8b, dl
mov cl, 1
xor cl, 1
and cl, 0xff
and dl, 1
or r10b, r8b
or cl, dl
xor r10b, cl
mov cl, al
and cl, 0
xor al, 0
or cl, al
xor r10b, 0xff
xor cl, 0xff
mov al, 1
xor al, 0
or r10b, cl
or al, 0
xor r10b, 0xff
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcbfdb67f
mov ecx, 0xca528f97
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov ecx, dword [rax + 0x18]
mov rax, qword [rbp]
mov dword [rax], ecx
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
sub edx, 0x9da5a44a
sub edx, 0x5c76b336
add edx, 0x9da5a44a
add edx, 0x26a39bac
sub edx, 1
sub edx, 0x26a39bac
add edx, 0xd0aedf85
add edx, 0x5c76b336
sub edx, 0xd0aedf85
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl cl
mov al, cl
xor al, 0xff
mov r11b, dl
xor r11b, al
and r11b, dl
mov r10b, dl
xor r10b, 0xff
and r10b, 1
mov r8b, 1
xor r8b, 1
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0xff
and cl, r8b
or r10b, dl
or al, cl
xor r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xcbfdb67f
mov ecx, 0x1ccc456f
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0xcaab9bdb
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
add edx, 0xe5736772
sub edx, 0x4375b6f3
sub edx, 0xe5736772
sub edx, 0x65464aae
sub edx, 1
add edx, 0x65464aae
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0x4375b6f3
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl cl
mov r11b, dl
xor r11b, 0xff
mov r8b, cl
xor r8b, 0xff
mov al, 1
xor al, 0
or r11b, r8b
or al, 0
xor r11b, 0xff
and r11b, al
mov r10b, dl
xor r10b, 0xff
and r10b, 0
mov r8b, 1
xor r8b, 0
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0
and cl, r8b
or r10b, dl
or al, cl
xor r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x66d87ca
mov ecx, 0x2b11df6e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, 0x7c5d28a4
add edx, 0
sub edx, 1
sub edx, 0x7c5d28a4
xor r8d, r8d
sub r8d, edx
mov edx, ecx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r10b
cmp eax, 0xa
setl dil
mov cl, r10b
xor cl, 0xff
and cl, 1
mov dl, 1
xor dl, 1
mov al, r10b
and al, dl
or cl, al
mov dl, dil
xor dl, 0xff
and dl, 0
mov r8b, 1
xor r8b, 0
mov r9b, dil
and r9b, r8b
mov al, 1
xor al, 1
and al, 0
and r8b, 1
or dl, r9b
or al, r8b
xor dl, al
mov al, 1
xor al, 0
and al, 0
mov r9b, 1
xor r9b, 0
mov r11b, r9b
and r11b, 0
mov r8b, 1
xor r8b, 1
and r8b, 0
and r9b, 1
or al, r11b
or r8b, r9b
xor al, r8b
mov r9b, cl
xor r9b, 0xff
mov r11b, 1
xor r11b, 0
mov r8b, 1
xor r8b, 1
or r9b, r11b
or r8b, 1
xor r9b, 0xff
and r9b, r8b
xor r10b, 0xff
mov r11b, al
xor r11b, 0xff
mov r8b, 1
xor r8b, 0
or r10b, r11b
or r8b, 0
xor r10b, 0xff
and r10b, r8b
mov r14b, dl
xor r14b, 0xff
mov r11b, 1
xor r11b, 0
mov r8b, 1
xor r8b, 0
or r14b, r11b
or r8b, 0
xor r14b, 0xff
and r14b, r8b
xor dil, 0xff
mov r11b, al
xor r11b, 0xff
mov r8b, 1
xor r8b, 1
or dil, r11b
or r8b, 1
xor dil, 0xff
and dil, r8b
mov r8b, r9b
and r8b, r10b
xor r9b, r10b
or r8b, r9b
mov r10b, r14b
xor r10b, 0xff
mov bl, dil
xor bl, 0xff
mov r11b, 1
xor r11b, 1
mov r9b, r10b
and r9b, 0xff
and r14b, r11b
mov sil, bl
and sil, 0xff
and dil, r11b
or r9b, r14b
or sil, dil
xor r9b, sil
or r10b, bl
xor r10b, 0xff
or r11b, 1
and r10b, r11b
or r9b, r10b
mov r10b, r8b
xor r10b, 0xff
mov r11b, r9b
and r11b, r10b
xor r9b, 0xff
and r8b, r9b
or r11b, r8b
mov r8b, cl
and r8b, dl
xor cl, dl
or r8b, cl
mov r10b, r8b
xor r10b, 0xff
and r10b, 0
mov dl, 1
xor dl, 0
and r8b, dl
mov cl, 1
xor cl, 1
and cl, 0
and dl, 1
or r10b, r8b
or cl, dl
xor r10b, cl
mov cl, al
and cl, 0
xor al, 0
or cl, al
xor r10b, 0xff
xor cl, 0xff
mov al, 1
xor al, 0
or r10b, cl
or al, 0
xor r10b, 0xff
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x66d87ca
mov ecx, 0xa82683b9
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0xea7707c2
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
xor r8d, r8d
sub r8d, ecx
xor edx, edx
sub edx, 0x3a6c6f1e
add r8d, edx
xor edx, edx
sub edx, r8d
sub edx, 0xa0d67452
sub edx, 1
add edx, 0xa0d67452
sub edx, 0x933d5394
sub edx, 0x3a6c6f1e
add edx, 0x933d5394
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl cl
mov al, cl
xor al, 0xff
mov r11b, dl
xor r11b, al
and r11b, dl
mov r10b, dl
xor r10b, 0xff
and r10b, 0
mov r8b, 1
xor r8b, 0
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0
and cl, r8b
or r10b, dl
or al, cl
xor r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x58d8fdc2
mov ecx, 0x8bba3ff0
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x30]
mov ecx, dword [rax]
mov eax, 0xfe362dca
add eax, 0
sub eax, ecx
sub eax, 0xfe362dca
mov edx, 0x15d7907
add edx, 0
sub edx, 1
sub edx, 0x15d7907
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 0xa10feed0
sub ecx, eax
add ecx, 0xa10feed0
mov rax, qword [rbp + 0x30]
mov dword [rax], ecx
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
sub edx, 0x527e3cc1
sub edx, 0x64980b0d
add edx, 0x527e3cc1
xor r8d, r8d
sub r8d, 1
add edx, r8d
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0x64980b0d
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl dil
mov sil, dl
xor sil, 0xff
and sil, 0
mov cl, 1
xor cl, 0
mov r8b, dl
and r8b, cl
mov al, 1
xor al, 1
and al, 0
and cl, 1
or sil, r8b
or al, cl
xor sil, al
mov r10b, dil
xor r10b, 0xff
and r10b, 1
mov cl, 1
xor cl, 1
mov al, dil
and al, cl
or r10b, al
mov bl, 1
xor bl, 1
and bl, 1
mov al, 1
xor al, 1
and al, 1
or bl, al
mov al, 1
xor al, 1
mov cl, sil
xor cl, al
and cl, sil
xor dl, 0xff
mov r8b, bl
xor r8b, 0xff
mov al, 1
xor al, 1
or dl, r8b
or al, 1
xor dl, 0xff
and dl, al
mov al, 1
xor al, 1
mov r14b, r10b
xor r14b, al
and r14b, r10b
xor dil, 0xff
mov r8b, bl
xor r8b, 0xff
mov al, 1
xor al, 1
or dil, r8b
or al, 1
xor dil, 0xff
and dil, al
mov al, cl
and al, dl
xor cl, dl
or al, cl
mov dl, r14b
xor dl, 0xff
mov r9b, dil
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov cl, dl
and cl, 0xff
and r14b, r8b
mov r11b, r9b
and r11b, 0xff
and dil, r8b
or cl, r14b
or r11b, dil
xor cl, r11b
or dl, r9b
xor dl, 0xff
or r8b, 1
and dl, r8b
or cl, dl
mov dl, al
xor dl, 0xff
mov r11b, cl
and r11b, dl
xor cl, 0xff
and al, cl
or r11b, al
mov al, sil
xor al, 0xff
mov dl, r10b
xor dl, 0xff
mov cl, 1
xor cl, 1
mov r8b, al
and r8b, 0xff
and sil, cl
mov r9b, dl
and r9b, 0xff
and r10b, cl
or r8b, sil
or r9b, r10b
xor r8b, r9b
or al, dl
xor al, 0xff
or cl, 1
and al, cl
or r8b, al
mov al, r8b
xor al, 0xff
and al, 0
mov dl, 1
xor dl, 0
and r8b, dl
mov cl, 1
xor cl, 1
and cl, 0
and dl, 1
or al, r8b
or cl, dl
xor al, cl
mov dl, 1
xor dl, 1
mov r9b, bl
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov cl, dl
and cl, 0xff
mov sil, r8b
and sil, 1
mov r10b, r9b
and r10b, 0xff
and bl, r8b
or cl, sil
or r10b, bl
xor cl, r10b
or dl, r9b
xor dl, 0xff
or r8b, 1
and dl, r8b
or cl, dl
xor cl, 0xff
mov r10b, al
xor r10b, cl
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x58d8fdc2
mov ecx, 0xb2eaae80
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0xb6106f72
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
sub edx, 0x3153dac8
sub edx, 0x5684e043
add edx, 0x3153dac8
xor r8d, r8d
sub r8d, 1
add edx, r8d
xor r8d, r8d
sub r8d, 0x5684e043
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl r8b
mov al, dl
xor al, 0xff
mov r9b, r8b
xor r9b, 0xff
mov cl, 1
xor cl, 0
or al, r9b
or cl, 0
xor al, 0xff
and al, cl
mov r9b, dl
xor r9b, 0xff
mov cl, r8b
and cl, r9b
xor r8b, 0xff
and dl, r8b
or cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc70d91a2
mov ecx, 0x21948485
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
add edx, 0xddf62d23
sub edx, 0x75951884
sub edx, 0xddf62d23
sub edx, 0x2a6322b4
sub edx, 1
add edx, 0x2a6322b4
sub edx, 0x83a08a16
add edx, 0x75951884
add edx, 0x83a08a16
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl cl
mov r11b, dl
xor r11b, 0xff
mov r8b, cl
xor r8b, 0xff
mov al, 1
xor al, 0
or r11b, r8b
or al, 0
xor r11b, 0xff
and r11b, al
mov r10b, dl
xor r10b, 0xff
and r10b, 0
mov r8b, 1
xor r8b, 0
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0
and cl, r8b
or r10b, dl
or al, cl
xor r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xc70d91a2
mov ecx, 0xd904d594
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0x6d7917f0
jmp 0x140006f9d
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
mov edx, eax
sub edx, 0x8b28b4f0
add edx, 0xb5bfa238
add edx, 0x8b28b4f0
xor r8d, r8d
sub r8d, 1
add edx, r8d
xor r8d, r8d
sub r8d, 0xb5bfa238
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl r8b
mov sil, al
xor sil, 0xff
and sil, 1
mov dl, 1
xor dl, 1
mov cl, al
and cl, dl
or sil, cl
mov r11b, r8b
xor r11b, 0xff
and r11b, 1
mov dl, 1
xor dl, 1
mov cl, r8b
and cl, dl
or r11b, cl
mov bl, 1
xor bl, 1
and bl, 1
mov cl, 1
xor cl, 1
and cl, 1
or bl, cl
mov r15b, sil
xor r15b, 0xff
mov dl, 1
xor dl, 1
mov cl, 1
xor cl, 1
or r15b, dl
or cl, 1
xor r15b, 0xff
and r15b, cl
mov cl, bl
xor cl, 0xff
mov r14b, al
xor r14b, cl
and r14b, al
mov cl, 1
xor cl, 1
mov al, r11b
xor al, cl
and al, r11b
xor r8b, 0xff
mov dl, bl
xor dl, 0xff
mov cl, 1
xor cl, 1
or r8b, dl
or cl, 1
xor r8b, 0xff
and r8b, cl
mov dl, r15b
xor dl, 0xff
mov r10b, r14b
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
mov cl, dl
and cl, 0xff
and r15b, r9b
mov dil, r10b
and dil, 0xff
and r14b, r9b
or cl, r15b
or dil, r14b
xor cl, dil
or dl, r10b
xor dl, 0xff
or r9b, 1
and dl, r9b
or cl, dl
mov dl, al
and dl, r8b
xor al, r8b
or dl, al
mov r8b, cl
xor r8b, 0xff
mov al, dl
and al, r8b
xor dl, 0xff
and cl, dl
or al, cl
mov cl, sil
xor cl, 0xff
mov r9b, r11b
xor r9b, 0xff
mov r8b, 1
xor r8b, 1
mov dl, cl
and dl, 0xff
and sil, r8b
mov r10b, r9b
and r10b, 0xff
and r11b, r8b
or dl, sil
or r10b, r11b
xor dl, r10b
or cl, r9b
xor cl, 0xff
or r8b, 1
and cl, r8b
or dl, cl
mov cl, dl
xor cl, 0xff
and cl, 1
mov r8b, 1
xor r8b, 1
and dl, r8b
or cl, dl
mov dl, 1
xor dl, 1
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 0
mov r8b, dl
and r8b, 0
mov sil, r9b
and sil, 1
mov r11b, r10b
and r11b, 0
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or dl, r10b
xor dl, 0xff
or r9b, 0
and dl, r9b
or r8b, dl
xor cl, 0xff
xor r8b, 0xff
mov dl, 1
xor dl, 1
or cl, r8b
or dl, 1
xor cl, 0xff
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x1c5a0e1f
mov ecx, 0x4b2d6b77
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
mov edx, eax
sub edx, 0xc27a1d2
add edx, 0x1eb080f1
add edx, 0xc27a1d2
xor r8d, r8d
sub r8d, 1
add edx, r8d
sub edx, 0x5b562812
sub edx, 0x1eb080f1
add edx, 0x5b562812
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl r8b
mov cl, al
xor cl, 0xff
and cl, 1
mov r9b, 1
xor r9b, 1
mov r10b, al
and r10b, r9b
mov dl, 1
xor dl, 1
and dl, 0xff
and r9b, 1
or cl, r10b
or dl, r9b
xor cl, dl
mov dl, r8b
xor dl, 0xff
and dl, 0
mov r10b, 1
xor r10b, 0
mov r11b, r8b
and r11b, r10b
mov r9b, 1
xor r9b, 1
and r9b, 0
and r10b, 1
or dl, r11b
or r9b, r10b
xor dl, r9b
mov bl, 1
xor bl, 0
and bl, 1
mov r9b, 1
xor r9b, 1
and r9b, 0
or bl, r9b
mov r15b, cl
xor r15b, 0xff
mov r10b, 1
xor r10b, 0
mov r9b, 1
xor r9b, 1
or r15b, r10b
or r9b, 1
xor r15b, 0xff
and r15b, r9b
mov r9b, bl
xor r9b, 0xff
mov r14b, al
xor r14b, r9b
and r14b, al
mov al, dl
xor al, 0xff
mov r10b, 1
xor r10b, 0
mov r9b, 1
xor r9b, 1
or al, r10b
or r9b, 1
xor al, 0xff
and al, r9b
mov r9b, bl
xor r9b, 0xff
mov r10b, r8b
xor r10b, r9b
and r10b, r8b
mov r8b, r15b
xor r8b, 0xff
mov sil, r14b
xor sil, 0xff
mov r11b, 1
xor r11b, 1
mov r9b, r8b
and r9b, 0xff
and r15b, r11b
mov dil, sil
and dil, 0xff
and r14b, r11b
or r9b, r15b
or dil, r14b
xor r9b, dil
or r8b, sil
xor r8b, 0xff
or r11b, 1
and r8b, r11b
or r9b, r8b
mov r8b, al
and r8b, r10b
xor al, r10b
or r8b, al
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov r10b, 1
xor r10b, 1
and r9b, r10b
mov al, r8b
xor al, 0xff
and al, 0xff
and r8b, r10b
or r11b, r9b
or al, r8b
xor r11b, al
mov al, cl
and al, dl
xor cl, dl
or al, cl
mov r10b, al
xor r10b, 0xff
and r10b, 1
mov cl, 1
xor cl, 1
and al, cl
or r10b, al
mov al, 1
xor al, 0
mov r8b, bl
xor r8b, 0xff
mov dl, 1
xor dl, 0
mov cl, al
and cl, 0
mov sil, dl
and sil, 0
mov r9b, r8b
and r9b, 0
and bl, dl
or cl, sil
or r9b, bl
xor cl, r9b
or al, r8b
xor al, 0xff
or dl, 0
and al, dl
or cl, al
xor r10b, 0xff
xor cl, 0xff
mov al, 1
xor al, 1
or r10b, cl
or al, 1
xor r10b, 0xff
and r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x1c5a0e1f
mov ecx, 0xf42bb15
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0x8e5344da
jmp 0x140006f9d
mov ecx, dword [0x14004e10c]
mov eax, dword [0x14004e108]
mov edx, ecx
add edx, 0xff3024c8
sub edx, 0xae6ddbce
sub edx, 0xff3024c8
xor r8d, r8d
sub r8d, 1
add edx, r8d
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0xae6ddbce
add r8d, edx
xor edx, edx
sub edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete dl
cmp eax, 0xa
setl cl
mov al, cl
xor al, 0xff
mov r11b, dl
xor r11b, al
and r11b, dl
mov r10b, dl
xor r10b, 0xff
and r10b, 1
mov r8b, 1
xor r8b, 1
and dl, r8b
mov al, cl
xor al, 0xff
and al, 0xff
and cl, r8b
or r10b, dl
or al, cl
xor r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdde34c84
mov ecx, 0xf5ca5f29
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov rax, qword [rbp]
mov ecx, dword [rax]
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
mov edx, eax
sub edx, 0x39b50935
add edx, 0x5bb2e410
add edx, 0x39b50935
sub edx, 0x62cd244e
sub edx, 1
add edx, 0x62cd244e
sub edx, 0x6792e7b
sub edx, 0x5bb2e410
add edx, 0x6792e7b
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov r11b, al
xor r11b, 0xff
mov r8b, cl
xor r8b, 0xff
mov dl, 1
xor dl, 0
or r11b, r8b
or dl, 0
xor r11b, 0xff
and r11b, dl
mov dl, al
xor dl, 0xff
mov r10b, cl
and r10b, dl
xor cl, 0xff
and al, cl
or r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xdde34c84
mov ecx, 0xc0d2cf9e
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov dword [rbp - 0x28], 0xa9c49bfe
jmp 0x140006f9d
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
mov edx, eax
add edx, 0xd1328753
sub edx, 0x7a491fd0
sub edx, 0xd1328753
xor r8d, r8d
sub r8d, 1
add edx, r8d
xor r8d, r8d
sub r8d, edx
xor edx, edx
sub edx, 0x7a491fd0
add r8d, edx
xor edx, edx
sub edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl dl
mov sil, al
xor sil, 0xff
and sil, 0
mov r8b, 1
xor r8b, 0
mov r9b, al
and r9b, r8b
mov cl, 1
xor cl, 1
and cl, 0
and r8b, 1
or sil, r9b
or cl, r8b
xor sil, cl
mov bl, dl
xor bl, 0xff
and bl, 0
mov r8b, 1
xor r8b, 0
mov r9b, dl
and r9b, r8b
mov cl, 1
xor cl, 1
and cl, 0
and r8b, 1
or bl, r9b
or cl, r8b
xor bl, cl
mov cl, 1
xor cl, 0
and cl, 1
mov r8b, 1
xor r8b, 1
and r8b, 0
or cl, r8b
mov r9b, 1
xor r9b, 0
mov r8b, sil
xor r8b, r9b
and r8b, sil
mov r9b, cl
xor r9b, 0xff
mov r10b, al
xor r10b, r9b
and r10b, al
mov r9b, 1
xor r9b, 0
mov al, bl
xor al, r9b
and al, bl
xor dl, 0xff
mov r11b, cl
xor r11b, 0xff
mov r9b, 1
xor r9b, 1
or dl, r11b
or r9b, 1
xor dl, 0xff
and dl, r9b
mov r9b, r8b
and r9b, r10b
xor r8b, r10b
or r9b, r8b
mov r8b, al
and r8b, dl
xor al, dl
or r8b, al
mov al, r9b
xor al, 0xff
and al, 1
mov r10b, 1
xor r10b, 1
and r9b, r10b
mov dl, r8b
xor dl, 0xff
and dl, 0xff
and r8b, r10b
or al, r9b
or dl, r8b
xor al, dl
mov dl, sil
xor dl, 0xff
mov r10b, bl
xor r10b, 0xff
mov r9b, 1
xor r9b, 1
mov r8b, dl
and r8b, 0xff
and sil, r9b
mov r11b, r10b
and r11b, 0xff
and bl, r9b
or r8b, sil
or r11b, bl
xor r8b, r11b
or dl, r10b
xor dl, 0xff
or r9b, 1
and dl, r9b
or r8b, dl
mov dl, r8b
xor dl, 0xff
and dl, 1
mov r9b, 1
xor r9b, 1
and r8b, r9b
or dl, r8b
mov r8b, cl
and r8b, 0
xor cl, 0
or r8b, cl
xor r8b, 0xff
mov cl, dl
xor cl, r8b
and cl, dl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xe85fd86a
mov ecx, 0xc8308af3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov rax, qword [rbp - 0x20]
mov eax, dword [rax]
mov dword [rbp + 0x4c], eax
mov eax, dword [0x14004e10c]
mov ecx, dword [0x14004e108]
xor edx, edx
sub edx, 1
add edx, 0
xor r8d, r8d
sub r8d, edx
mov edx, eax
sub edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, cl
xor dl, 0xff
mov r11b, al
xor r11b, dl
and r11b, al
mov dl, al
xor dl, 0xff
mov r10b, cl
and r10b, dl
xor cl, 0xff
and al, cl
or r10b, al
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe85fd86a
mov ecx, 0xc1d02611
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x28], eax
jmp 0x140006f9d
mov eax, dword [rbp + 0x4c]
mov dword [rbp - 0x4c], eax
mov rcx, qword [rbp + 0x50]
xor rcx, rbp
sub rsp, 0x20
call fcn.14004c990
mov eax, dword [rbp - 0x4c]
lea rsp, [rbp + 0x58]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov r8, qword [rbp - 0x30]
mov r11, qword [rbp - 0x38]
mov eax, 0x10
mov qword [rbp - 0x78], rax
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x78]
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov r10, rsp
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rcx, rsp
mov qword [rbp - 0x60], rcx
mov eax, 0x130
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov rdx, rsp
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov r9, rsp
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov rsi, rsp
mov qword [rbp - 0x70], rsi
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x78]
mov rsi, rsp
mov qword [rbp - 0x68], rsi
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rsi, rsp
mov qword [rbp - 0x58], rsi
mov qword [r10], r11
mov qword [rcx], r8
mov dword [rax], 0
mov ecx, 0xb
mov r8d, 0x130
sub rsp, 0x20
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov rcx, qword [rbp - 0x68]
add rsp, 0x20
mov edx, eax
mov rax, qword [rbp - 0x60]
mov dword [rcx], edx
mov rcx, qword [rax]
mov edx, 1
sub rsp, 0x20
call fcn.140001840
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x58]
mov qword [rax], rcx
mov dword [rbp - 0x28], 0xbbef1f71
jmp 0x140006f9d
mov rax, qword [rbp - 8]
mov eax, dword [rax]
movabs rcx, 0x74047d28926fd04d
add rax, rcx
movabs rcx, 0xc98eec32d26af5a4
sub rax, rcx
movabs rcx, 0x74047d28926fd04d
sub rax, rcx
xor ecx, ecx
sub rcx, rax
xor eax, eax
sub rax, 0x130
add rcx, rax
xor eax, eax
sub rax, rcx
xor ecx, ecx
movabs rdx, 0xc98eec32d26af5a4
sub rcx, rdx
sub rax, rcx
mov ecx, eax
mov rax, qword [rbp + 0x18]
mov dword [rax], ecx
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov edx, eax
mov ecx, 1
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov qword [rax], rcx
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
mov rax, qword [rbp + 0x18]
mov eax, dword [rax]
mov r8d, eax
xor edx, edx
sub rsp, 0x20
call fcn.14004ca80
add rsp, 0x20
mov rax, qword [rbp + 0x18]
mov r8d, dword [rax]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
mov r9, qword [rbp - 8]
mov ecx, 0xb
sub rsp, 0x20
call sub.ntoskrnl.exe_ZwQuerySystemInformation
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp + 8]
mov dword [rax], ecx
mov rax, qword [rbp + 8]
mov dword [rbp - 0x28], 0x9eba4582
jmp 0x140006f9d
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov dword [rax], 0
mov dword [rbp - 0x28], 0x16b73a60
jmp 0x140006f9d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
lea rdx, str.ntkrnlpa.exe
sub rsp, 0x20
call sub.ntoskrnl.exe_strstr
add rsp, 0x20
mov dword [rbp - 0x28], 0x6be3d3
jmp 0x140006f9d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
lea rdx, str.ntoskrnl.exe
sub rsp, 0x20
call sub.ntoskrnl.exe_strstr
add rsp, 0x20
mov dword [rbp - 0x28], 0xc1c606c8
jmp 0x140006f9d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
add rcx, 8
mov rax, qword [rbp + 0x28]
mov qword [rax], rcx
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rax], rcx
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov ecx, dword [rax + 0x18]
mov rax, qword [rbp]
mov dword [rax], ecx
mov dword [rbp - 0x28], 0x3195bef0
jmp 0x140006f9d
mov rax, qword [rbp + 0x30]
mov dword [rax], 0
mov dword [rbp - 0x28], 0xd1d4052f
jmp 0x140006f9d
mov rax, qword [rbp + 0x30]
mov rax, qword [rbp + 0x20]
mov dword [rbp - 0x28], 0xab370ab8
jmp 0x140006f9d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
add rcx, 8
mov rax, qword [rbp + 0x30]
movsxd rax, dword [rax]
imul rax, rax, 0x128
add rcx, rax
mov rax, qword [rbp + 0x38]
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
add rcx, 0x28
xor edx, edx
sub rsp, 0x20
call fcn.140001840
add rsp, 0x20
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rax]
add rcx, 0x28
sub rsp, 0x20
call sub.ntoskrnl.exe_strstr
add rsp, 0x20
mov dword [rbp - 0x28], 0x9319c510
jmp 0x140006f9d
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
mov qword [rax], rcx
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov ecx, dword [rax + 0x18]
mov rax, qword [rbp]
mov dword [rax], ecx
mov dword [rbp - 0x28], 0xca528f97
jmp 0x140006f9d
mov dword [rbp - 0x28], 0x2b11df6e
jmp 0x140006f9d
mov rax, qword [rbp + 0x30]
mov ecx, dword [rax]
add ecx, 0xec64bf35
add ecx, 0x9d7118e9
sub ecx, 0xec64bf35
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 1
add eax, ecx
xor ecx, ecx
sub ecx, eax
sub ecx, 0x69a2f893
sub ecx, 0x9d7118e9
add ecx, 0x69a2f893
mov rax, qword [rbp + 0x30]
mov dword [rax], ecx
mov dword [rbp - 0x28], 0x8bba3ff0
jmp 0x140006f9d
mov dword [rbp - 0x28], 0x21948485
jmp 0x140006f9d
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov dword [rbp - 0x28], 0x4b2d6b77
jmp 0x140006f9d
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x20
mov rax, qword [rbp]
mov ecx, dword [rax]
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov dword [rbp - 0x28], 0xf5ca5f29
jmp 0x140006f9d
mov rax, qword [rbp - 0x20]
mov dword [rbp - 0x28], 0xc8308af3
jmp 0x140003039