Function at 0x14004f660
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check os version
Encode data using xor
Execute shellcode via indirect call
Get number of processors
Hash data using crc32b
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x140073040]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
xor edi, edi
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x20
mov rax, qword [rdx]
cmp rax, rdx
je 0x14004f6c7
cmp qword [rax + 0x50], rdi
jne 0x14004f6c3
mov rax, qword [rax]
cmp rax, rdx
jne 0x14004f6b3
jmp 0x14004f6c7
lea rdi, [rax - 0x10]
mov rdi, qword [rdi + 0x30]
mov qword [rbp - 0x50], rdi
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
mov qword [rsp + 0x70], rbx
movzx r12d, word [rbx + 0x14]
add r12, rbx
mov qword [rbp - 0x40], r12
xor r13d, r13d
mov dword [rbp - 0x48], r13d
xor ebx, ebx
lea rsi, [0x1400a4510]
nop word [rax + rax]
lea r14, [rbx + rbx*4]
mov eax, dword [r12 + r14*8 + 0x3c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x14004fd13
mov edx, dword [r12 + r14*8 + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14004fbaa
xor r13d, r13d
mov rcx, qword gs:[0x60]
mov r15, qword [rcx + 0x18]
add r15, 0x20
mov rdi, qword [r15]
cmp rdi, r15
je 0x14004f788
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004f77a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x14004f784
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x14004f760
jmp 0x14004f788
lea r13, [rdi - 0x10]
mov rdi, qword [r13 + 0x30]
test rdi, rdi
je 0x14004f83f
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x14004f83f
mov eax, dword [rdi + 0x3c]
cmp dword [rax + rdi], 0x4550
jne 0x14004f83f
mov eax, dword [rax + rdi + 0x88]
add rax, rdi
je 0x14004f83f
mov r10d, dword [rax + 0x20]
add r10, rdi
mov esi, dword [rax + 0x24]
add rsi, rdi
mov r15d, dword [rax + 0x1c]
add r15, rdi
xor r9d, r9d
xor r8d, r8d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x14004f83f
lea r13, str.NtReadVirtualMemory
nop dword [rax]
mov edx, dword [r10 + r8*4]
add rdx, rdi
mov rax, r13
je 0x14004f834
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x14004f826
sub rdx, r13
test cl, cl
je 0x14004f81d
cmp byte [rax], 0
je 0x14004f826
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x14004f807
jmp 0x14004f826
cmp byte [rax], 0
je 0x14004f9c0
movsx edx, cl
movsx ecx, byte [rax]
cmp edx, ecx
je 0x14004f9c0
inc r9d
inc r8
cmp r9d, r11d
jb 0x14004f7f0
mov r15d, dword [r12 + r14*8 + 0x24]
add r15, qword [rbp - 0x50]
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
lea rdx, [0x1400a4510]
mov qword [rcx + rdx], r15
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rdx + 8], eax
mov esi, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov edx, 0x20
mov ecx, 0x4c11db7
call fcn.14005c350
mov r8d, eax
test rsi, rsi
je 0x14004f91d
nop dword [rax]
movzx ecx, byte [r15]
xor edi, ecx
lea r15, [r15 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004f890
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400a4510]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r14*8 + 0x20]
lea rax, [rbx + rbx*2]
mov rdx, qword [rsi + rax*8]
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14004f990
mov r12d, 0x167
nop
mov ecx, r9d
cmp r9, r12
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004f960
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004f950
mov r12, qword [rbp - 0x40]
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov r13, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x50]
jmp 0x14004fb90
movzx eax, word [rsi + r8*2]
mov r10d, dword [r15 + rax*4]
add r10, rdi
je 0x14004f83f
mov edx, dword [r12 + r14*8 + 0x24]
mov rdi, qword [rbp - 0x50]
add rdx, rdi
mov qword [rsp + 0x20], 0
mov r9d, dword [r12 + r14*8 + 0x20]
mov r13, qword [rbp - 0x80]
mov r8, r13
mov rcx, 0xffffffffffffffff
call r10
test eax, eax
js 0x14004fb89
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov eax, dword [r12 + r14*8 + 0x24]
add rax, rdi
lea rdx, [0x1400a4510]
mov qword [rcx + rdx], rax
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rdx + 8], eax
mov esi, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov r15, r13
mov edx, 0x20
mov ecx, 0x4c11db7
call fcn.14005c350
mov r8d, eax
test rsi, rsi
je 0x14004faed
nop word [rax + rax]
movzx ecx, byte [r15]
xor edi, ecx
lea r15, [r15 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004fa60
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400a4510]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r14*8 + 0x20]
mov rdx, r13
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14004fb60
mov r12d, 0x167
nop dword [rax]
mov ecx, r9d
cmp r9, r12
cmova ecx, r12d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004fb30
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004fb20
mov r12, qword [rbp - 0x40]
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov rdi, qword [rbp - 0x50]
jmp 0x14004fb90
lea rsi, [0x1400a4510]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r13d, dword [rbp - 0x48]
jmp 0x14004fd13
mov r15d, dword [r12 + r14*8 + 0x24]
add r15, rdi
lea rax, [rbx + rbx*2]
lea rcx, [rax*8]
mov qword [rcx + rsi], r15
mov eax, dword [r12 + r14*8 + 0x20]
mov dword [rcx + rsi + 8], eax
mov esi, dword [r12 + r14*8 + 0x20]
mov edi, 0xffffffff
mov edx, 0x20
mov ecx, 0x4c11db7
call fcn.14005c350
mov r8d, eax
test rsi, rsi
je 0x14004fc7d
movzx ecx, byte [r15]
xor edi, ecx
lea r15, [r15 + 1]
mov edx, edi
shr edx, 1
mov ecx, edx
xor ecx, r8d
test dil, 1
cmovne edx, ecx
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, r8d
test dl, 1
cmovne ecx, eax
mov edx, ecx
shr edx, 1
mov eax, edx
xor eax, r8d
test cl, 1
cmovne edx, eax
mov edi, edx
shr edi, 1
mov eax, edi
xor eax, r8d
test dl, 1
cmovne edi, eax
sub rsi, 1
jne 0x14004fbf0
not edi
lea rax, [rbx + rbx*2]
lea rsi, [0x1400a4510]
mov dword [rsi + rax*8 + 0xc], edi
mov r9d, dword [r12 + r14*8 + 0x20]
lea rax, [rbx + rbx*2]
mov rdx, qword [rsi + rax*8]
mov edi, 0xffff
mov r8d, edi
test r9, r9
je 0x14004fcec
mov r10d, 0x167
nop
mov ecx, r9d
cmp r9, r10
cmova ecx, r10d
mov eax, ecx
sub r9, rax
nop
mov rax, qword [rdx]
inc rdx
add edi, eax
add r8d, edi
add ecx, 0xffffffff
jne 0x14004fcc0
mov ecx, edi
shr ecx, 0x10
movzx edi, di
add edi, ecx
mov ecx, r8d
shr ecx, 0x10
movzx r8d, r8w
add r8d, ecx
test r9, r9
jne 0x14004fcb0
mov edx, edi
shr edx, 0x10
movzx eax, di
add edx, eax
mov ecx, r8d
shr ecx, 0x10
movzx eax, r8w
add ecx, eax
shl ecx, 0x10
or ecx, edx
lea rax, [rbx + rbx*2]
mov dword [rsi + rax*8 + 0x10], ecx
mov rdi, qword [rbp - 0x50]
inc r13d
mov dword [rbp - 0x48], r13d
inc rbx
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 6]
cmp r13d, eax
jle 0x14004f700
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rax]
cmp rsi, rax
je 0x14004fdf4
cmp qword [rsi + 0x50], 0
je 0x14004fdcc
mov rax, qword [rsi + 0x20]
movsxd r14, dword [rax + 0x3c]
add r14, rax
xor edi, edi
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
nop word [rax + rax]
mov ecx, dword [rbx]
add rcx, qword [rsi + 0x20]
mov r8d, 0x30
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14004fdbd
cmp dword [rbp + 0x20], 0x1000
jne 0x14004fdbd
test dword [rbp + 0x24], 0x100
jne 0x14004fdde
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jle 0x14004fd90
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rsi]
cmp rsi, rax
jne 0x14004fd67
jmp 0x14004fdf4
mov r8d, 0x15
lea rdx, str.Guard_hook_detected._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
xor r15d, r15d
mov qword [rbp - 0x40], r15
mov dword [rbp + 0x60], 0xb8
mov dword [rbp + 0x64], 0xd18b4c00
mov word [rbp + 0x68], 0x50f
mov byte [rbp + 0x6a], 0xc3
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov dword [rbp + 4], r15d
mov dword [rbp + 0x1c], r15d
lea rdi, [rbp + 0x90]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], r15w
je 0x14004fe5a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x14004fe50
mov r13d, 0x5c
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004fe70
mov word [rax], r15w
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], r15w
je 0x14004fe9f
add rax, 2
cmp word [rax], r15w
jne 0x14004fe95
mov ecx, 0x6e
lea rdx, [0x140067660]
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x14004feb0
mov word [rax], r15w
lea rcx, [rbp + 0x90]
mov eax, r15d
cmp word [rbp + 0x90], r15w
je 0x14004feec
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x14004fee0
add ax, ax
mov word [rsp + 0x70], ax
add ax, 2
mov word [rsp + 0x72], ax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp], 0x30
mov qword [rbp + 8], r15
mov dword [rbp + 0x18], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004ff79
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004ff6b
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x14004ff75
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x14004ff51
jmp 0x14004ff79
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
test r8, r8
je 0x140050012
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140050012
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050012
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050012
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050012
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x140050006
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050002
sub rdx, rsi
test cl, cl
je 0x14004fffd
cmp byte [rax], r15b
je 0x140050002
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x14004ffe7
jmp 0x140050002
cmp byte [rax], r15b
je 0x140050055
cmp cl, byte [rax]
je 0x140050055
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x14004ffd2
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14005006a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005004b
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140050066
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050031
jmp 0x14005006a
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x140050015
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r8, r8
je 0x140050103
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140050103
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050103
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050103
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050103
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400500f7
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400500f3
sub rdx, rsi
test cl, cl
je 0x1400500ee
cmp byte [rax], r15b
je 0x1400500f3
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400500d8
jmp 0x1400500f3
cmp byte [rax], r15b
je 0x140050144
cmp cl, byte [rax]
je 0x140050144
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400500c3
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050159
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005013a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140050155
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050120
jmp 0x140050159
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r8
jmp 0x140050106
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
lea rsi, str.NtClose
test r8, r8
je 0x140050286
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140050286
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050286
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050286
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor r15d, r15d
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050289
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400501ff
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400501fb
sub rdx, rsi
nop word [rax + rax]
test cl, cl
je 0x1400501f6
cmp byte [rax], r15b
je 0x1400501fb
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400501e0
jmp 0x1400501fb
cmp byte [rax], r15b
je 0x14005020d
cmp cl, byte [rax]
je 0x14005020d
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400501c5
jmp 0x140050289
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x140050289
test r14, r14
je 0x140050289
test r12, r12
je 0x140050289
lea r8, [rbp]
mov edx, 4
lea rcx, [rbp - 0x50]
call r12
test eax, eax
js 0x140050289
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x50]
call r14
test eax, eax
js 0x140050289
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140050289
call rdi
jmp 0x140050289
xor r15d, r15d
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400502cd
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400502bf
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400502c9
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400502a5
jmp 0x1400502cd
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
lea r14, str.NtQueryInformationProcess
lea r12, str.ZwUnmapViewOfSection
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x140050482
test r10, r10
je 0x140050482
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140050398
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050398
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050398
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050398
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r9
mov rax, r14
je 0x14005038c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140050384
sub rdx, r14
test cl, cl
je 0x14005037b
cmp byte [rax], 0
je 0x140050384
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x140050365
jmp 0x140050384
cmp byte [rax], 0
je 0x14005041b
cmp cl, byte [rax]
je 0x14005041b
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050350
mov rbx, r15
mov ecx, 0x5a4d
cmp word [r10], cx
jne 0x140050442
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140050442
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140050442
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050442
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r10
mov rax, r12
je 0x140050436
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050432
sub rdx, r12
test cl, cl
je 0x14005042d
cmp byte [rax], 0
je 0x140050432
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x140050405
jmp 0x140050432
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14005039b
cmp byte [rax], 0
je 0x140050458
cmp cl, byte [rax]
je 0x140050458
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400503f0
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x140050468
call rax
jmp 0x140050477
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140050445
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x5c], bx
test bx, bx
jne 0x1400504c5
mov esi, 0x16
lea ebx, [rsi + 3]
lea edi, [rsi + 1]
lea rcx, str.____Cant_get_syscall_auto__n
call fcn.1400477a0
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400504c1
cmp al, 6
jne 0x1400504be
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400504be
sub ecx, 1
je 0x1400504b9
cmp ecx, 1
jne 0x1400504c1
lea ebx, [rcx + 0x17]
jmp 0x1400504c1
movzx ebx, di
jmp 0x1400504c1
movzx ebx, si
mov word [rbp - 0x5c], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r14d, 0xb
mov qword [rsp + 0x70], r14
test rax, rax
je 0x1400505df
lea rcx, [rbp + 0x61]
lea rax, [rbp - 0x5c]
cmp rcx, rax
jbe 0x140050510
lea rcx, [rbp + 0x61]
lea rax, [rbp - 0x5a]
nop word [rax + rax]
movzx eax, byte [rbp - 0x5b]
mov byte [rbp + 0x62], al
mov byte [rbp + 0x61], bl
lea rcx, [rbp + 0x60]
cmp rdi, rcx
jbe 0x140050530
lea rcx, [rbp + 0x6b]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp - 0x40]
lea edx, [r9 - 1]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11, r14
mov r9, rdi
lea rbx, [rbp + 0x60]
sub rbx, rdi
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r8 - 0x61]
lea edx, [r8 - 0x20]
cmp eax, 0x19
cmova edx, r8d
lea eax, [r10 - 0x61]
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400505a8
inc r9
sub r11, 1
jne 0x140050572
jmp 0x1400505ad
cmp r8d, r10d
jne 0x1400505c9
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x1400505df
cmp qword [rbp - 0x40], 0
je 0x1400505df
mov r8d, 0x15
lea rdx, str.Debug_port_detected._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
mov dword [rbp - 0x48], r15d
mov dword [rbp + 0x70], 0xb8
mov dword [rbp + 0x74], 0xd18b4c00
mov word [rbp + 0x78], 0x50f
mov byte [rbp + 0x7a], 0xc3
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov dword [rbp + 4], r15d
mov dword [rbp + 0x1c], r15d
lea rdi, [rbp + 0x90]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], 0
je 0x14005063a
add rax, 2
cmp word [rax], 0
jne 0x140050630
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140050650
mov word [rax], r15w
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], cx
je 0x14005067e
add rax, 2
cmp word [rax], 0
jne 0x140050674
mov ecx, 0x6e
lea rdx, [0x140067660]
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140050690
mov word [rax], r15w
lea rcx, [rbp + 0x90]
mov eax, r15d
cmp word [rbp + 0x90], 0
je 0x1400506cc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1400506c0
add ax, ax
mov word [rbp - 0x30], ax
add ax, 2
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x90]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp], 0x30
mov qword [rbp + 8], r15
mov dword [rbp + 0x18], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050758
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005074a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140050754
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050730
jmp 0x140050758
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400507fb
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400507fb
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400507fb
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400507fb
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400507fb
lea rsi, str.ZwOpenSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400507ef
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400507eb
sub rdx, rsi
nop word [rax + rax]
test cl, cl
je 0x1400507e6
cmp byte [rax], 0
je 0x1400507eb
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400507d0
jmp 0x1400507eb
cmp byte [rax], 0
je 0x140050844
cmp cl, byte [rax]
je 0x140050844
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400507b5
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050859
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005083a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140050855
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050820
jmp 0x140050859
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x1400507fe
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400508fb
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400508fb
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400508fb
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400508fb
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400508fb
lea rsi, str.ZwMapViewOfSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400508ef
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400508eb
sub rdx, rsi
nop dword [rax + rax]
test cl, cl
je 0x1400508e6
cmp byte [rax], 0
je 0x1400508eb
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400508d0
jmp 0x1400508eb
cmp byte [rax], 0
je 0x14005093b
cmp cl, byte [rax]
je 0x14005093b
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400508b6
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050950
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050931
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x14005094c
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050917
jmp 0x140050950
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r8
jmp 0x1400508fe
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
test r8, r8
je 0x140050a7b
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140050a7b
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050a7b
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050a7b
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor r15d, r15d
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050a7e
lea rsi, str.NtClose
nop dword [rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400509f4
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400509f0
sub rdx, rsi
test cl, cl
je 0x1400509eb
cmp byte [rax], r15b
je 0x1400509f0
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400509d5
jmp 0x1400509f0
cmp byte [rax], r15b
je 0x140050a02
cmp cl, byte [rax]
je 0x140050a02
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400509c0
jmp 0x140050a7e
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x140050a7e
test r14, r14
je 0x140050a7e
test r12, r12
je 0x140050a7e
lea r8, [rbp]
mov edx, 4
lea rcx, [rbp - 0x50]
call r12
test eax, eax
js 0x140050a7e
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x50]
call r14
test eax, eax
js 0x140050a7e
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140050a7e
call rdi
jmp 0x140050a7e
xor r15d, r15d
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050ac8
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050aba
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140050ac4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050aa0
jmp 0x140050ac8
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x140050c57
test r10, r10
je 0x140050c57
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x140050b7a
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140050b7a
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140050b7a
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050b7a
lea r14, str.NtQueryInformationProcess
mov edx, dword [rdi]
add rdx, r9
mov rax, r14
je 0x140050b6e
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140050b66
sub rdx, r14
test cl, cl
je 0x140050b5d
cmp byte [rax], 0
je 0x140050b66
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050b47
jmp 0x140050b66
cmp byte [rax], 0
je 0x140050bfb
cmp cl, byte [rax]
je 0x140050bfb
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050b32
mov rbx, r15
cmp word [r10], r12w
jne 0x140050c22
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140050c22
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140050c22
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r15d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140050c22
lea r12, str.ZwUnmapViewOfSection
mov edx, dword [rdi]
add rdx, r10
mov rax, r12
je 0x140050c16
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050c12
sub rdx, r12
test cl, cl
je 0x140050c0d
cmp byte [rax], 0
je 0x140050c12
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050be5
jmp 0x140050c12
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x140050b7d
cmp byte [rax], 0
je 0x140050c38
cmp cl, byte [rax]
je 0x140050c38
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140050bd0
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x140050c48
call rax
jmp 0x140050c57
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140050c25
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x58], bx
test bx, bx
jne 0x140050c99
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140050c90
cmp al, 6
jne 0x140050c89
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140050c89
sub ecx, 1
je 0x140050c82
cmp ecx, 1
jne 0x140050c90
lea ebx, [rcx + 0x17]
jmp 0x140050c95
mov ebx, 0x17
jmp 0x140050c95
mov ebx, 0x16
jmp 0x140050c95
mov ebx, 0x19
mov word [rbp - 0x58], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140050dab
lea rcx, [rbp + 0x71]
lea rax, [rbp - 0x58]
cmp rcx, rax
jbe 0x140050cd0
lea rcx, [rbp + 0x71]
lea rax, [rbp - 0x56]
nop
movzx eax, byte [rbp - 0x57]
mov byte [rbp + 0x72], al
mov byte [rbp + 0x71], bl
lea rcx, [rbp + 0x70]
cmp rdi, rcx
jbe 0x140050cf0
lea rcx, [rbp + 0x7b]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x48]
lea edx, [r9 + 0x1b]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11d, 0xb
mov r9, rdi
lea rbx, [rbp + 0x70]
sub rbx, rdi
nop word [rax + rax]
movzx r8d, byte [r9]
movzx r10d, byte [rbx + r9]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140050d76
inc r9
sub r11, 1
jne 0x140050d40
jmp 0x140050d7b
cmp r8d, r10d
jne 0x140050d95
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x140050dab
cmp dword [rbp - 0x48], esi
jne 0x140050dab
mov r8d, 0x15
lea rdx, str.Debug_flag_detected._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
mov qword [rbp - 0x40], r15
mov dword [rbp + 0x80], 0xb8
mov dword [rbp + 0x84], 0xd18b4c00
mov word [rbp + 0x88], 0x50f
mov byte [rbp + 0x8a], 0xc3
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov dword [rbp + 4], r15d
mov dword [rbp + 0x1c], r15d
lea rdi, [rbp + 0x90]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], 0
je 0x140050e1a
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x140050e10
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rcx + rax]
test r13w, r13w
jne 0x140050e30
xor r13d, r13d
mov word [rax], r13w
lea rax, [rbp + 0x90]
cmp word [rbp + 0x90], r13w
je 0x140050e6a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x140050e60
lea rcx, [0x140067660]
sub rcx, rax
mov edx, 0x6e
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140050e80
mov word [rax], r13w
lea rcx, [rbp + 0x90]
mov eax, r13d
cmp word [rbp + 0x90], r13w
je 0x140050ebc
nop dword [rax + rax]
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x140050eb0
add ax, ax
mov word [rbp - 0x30], ax
add ax, 2
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x90]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
mov dword [rbp], 0x30
mov qword [rbp + 8], r13
mov dword [rbp + 0x18], 0x40
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140050f48
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140050f3a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140050f44
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140050f20
jmp 0x140050f48
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
mov r15d, 0x5a4d
test r8, r8
je 0x140050feb
cmp word [r8], r15w
jne 0x140050feb
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140050feb
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140050feb
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140050feb
lea rsi, str.ZwOpenSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x140050fdf
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x140050fdb
sub rdx, rsi
nop dword [rax + rax]
test cl, cl
je 0x140050fd6
cmp byte [rax], r13b
je 0x140050fdb
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140050fc0
jmp 0x140050fdb
cmp byte [rax], r13b
je 0x140051034
cmp cl, byte [rax]
je 0x140051034
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140050fa6
mov r12, r13
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140051049
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005102a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140051045
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051010
jmp 0x140051049
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x140050fee
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400510e1
cmp word [r8], r15w
jne 0x1400510e1
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400510e1
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400510e1
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400510e1
lea rsi, str.ZwMapViewOfSection
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400510d5
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400510d1
sub rdx, rsi
test cl, cl
je 0x1400510cc
cmp byte [rax], r13b
je 0x1400510d1
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400510b6
jmp 0x1400510d1
cmp byte [rax], r13b
je 0x140051124
cmp cl, byte [rax]
je 0x140051124
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400510a1
mov r14, r13
mov r15, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140051139
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005111a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140051135
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051100
jmp 0x140051139
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r8
jmp 0x1400510e4
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
mov r15d, 0x5a4d
test r8, r8
je 0x14005125c
cmp word [r8], r15w
jne 0x14005125c
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x14005125c
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x14005125c
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x14005125c
lea rsi, str.NtClose
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400511d7
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400511d3
sub rdx, rsi
test cl, cl
je 0x1400511ce
cmp byte [rax], r13b
je 0x1400511d3
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400511b8
jmp 0x1400511d3
cmp byte [rax], r13b
je 0x1400511e5
cmp cl, byte [rax]
je 0x1400511e5
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400511a3
jmp 0x14005125c
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x14005125c
test r14, r14
je 0x14005125c
test r12, r12
je 0x14005125c
lea r8, [rbp]
mov edx, 4
lea rcx, [rbp - 0x50]
call r12
test eax, eax
js 0x14005125c
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x50]
call r14
test eax, eax
js 0x14005125c
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14005125c
call rdi
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400512a8
nop dword [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005129a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400512a4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051280
jmp 0x1400512a8
lea r14, [rdi - 0x10]
mov r10, qword [r14 + 0x30]
mov r9, qword [rbp - 0x80]
test r9, r9
je 0x140051437
test r10, r10
je 0x140051437
cmp word [r9], r15w
jne 0x140051358
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140051358
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140051358
mov edi, dword [rax + 0x20]
add rdi, r9
mov ebx, dword [rax + 0x24]
add rbx, r9
mov esi, dword [rax + 0x1c]
add rsi, r9
mov r8d, r13d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140051358
lea r14, str.NtQueryInformationProcess
nop dword [rax]
mov edx, dword [rdi]
add rdx, r9
mov rax, r14
je 0x14005134c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140051344
sub rdx, r14
test cl, cl
je 0x14005133b
cmp byte [rax], r13b
je 0x140051344
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x140051325
jmp 0x140051344
cmp byte [rax], r13b
je 0x1400513db
cmp cl, byte [rax]
je 0x1400513db
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140051310
mov rbx, r13
cmp word [r10], r15w
jne 0x140051402
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140051402
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140051402
mov edi, dword [rax + 0x20]
add rdi, r10
mov esi, dword [rax + 0x24]
add rsi, r10
mov r14d, dword [rax + 0x1c]
add r14, r10
mov r8d, r13d
mov r11d, dword [rax + 0x14]
test r11d, r11d
je 0x140051402
lea r15, str.ZwUnmapViewOfSection
nop word [rax + rax]
mov edx, dword [rdi]
add rdx, r10
mov rax, r15
je 0x1400513f6
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400513f2
sub rdx, r15
test cl, cl
je 0x1400513ed
cmp byte [rax], r13b
je 0x1400513f2
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400513c5
jmp 0x1400513f2
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r9
jmp 0x14005135b
cmp byte [rax], r13b
je 0x140051418
cmp cl, byte [rax]
je 0x140051418
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400513b0
mov rax, r13
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x140051428
call rax
jmp 0x140051437
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140051405
movzx ebx, word [rbx + 4]
call rax
mov word [rbp - 0x54], bx
test bx, bx
jne 0x140051482
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140051476
cmp al, 6
jne 0x14005146f
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14005146f
sub ecx, 1
je 0x140051468
cmp ecx, 1
jne 0x140051476
mov ebx, 0x18
mov word [rbp - 0x54], bx
jmp 0x140051482
mov eax, 0x17
jmp 0x14005147b
mov eax, 0x16
jmp 0x14005147b
mov eax, 0x19
movzx ebx, ax
mov word [rbp - 0x54], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400515a0
lea rcx, [rbp + 0x81]
lea rax, [rbp - 0x54]
cmp rcx, rax
jbe 0x1400514c0
lea rcx, [rbp + 0x81]
lea rax, [rbp - 0x52]
nop
movzx eax, byte [rbp - 0x53]
mov byte [rbp + 0x82], al
mov byte [rbp + 0x81], bl
lea rcx, [rbp + 0x80]
cmp rdi, rcx
jbe 0x1400514f0
lea rcx, [rbp + 0x8b]
nop dword [rax]
nop word [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x40]
lea edx, [r9 + 0x16]
mov rcx, 0xffffffffffffffff
call rdi
mov ebx, eax
mov r9, rdi
lea r11, [rbp + 0x80]
sub r11, rdi
movzx r8d, byte [r9]
movzx r10d, byte [r9 + r11]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r8 - 0x61]
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14005156a
inc r9
sub qword [rsp + 0x70], 1
jne 0x140051532
jmp 0x14005156f
cmp r8d, r10d
jne 0x14005158a
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x1400515a0
cmp qword [rbp - 0x40], r13
je 0x1400515a0
mov r8d, 0x1e
lea rdx, str.Debug_object_handle_detected._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
call fcn.140047850
test al, al
je 0x1400515bf
mov r8d, 0x13
lea rdx, str.Debug_flag_hooked._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
call fcn.140048e40
test al, al
je 0x1400515de
mov r8d, 0x1a
lea rdx, str.Bad_hide_thread_detected._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
xor r12b, r12b
mov dword [rbp - 0x48], r13d
mov rsi, r13
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x14005162c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005161e
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140051628
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140051604
jmp 0x14005162c
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
lea r14, str.NtQuerySystemInformation
test r8, r8
je 0x140051868
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140051868
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140051868
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140051868
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140051868
mov edx, dword [rdi]
add rdx, r8
mov rax, r14
je 0x1400516cf
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400516cb
sub rdx, r14
nop word [rax + rax]
test cl, cl
je 0x1400516c6
cmp byte [rax], sil
je 0x1400516cb
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400516b0
jmp 0x1400516cb
cmp byte [rax], sil
je 0x1400516e0
cmp cl, byte [rax]
je 0x1400516e0
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140051695
jmp 0x140051868
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x140051868
lea r9, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
mov ebx, 0x16
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
jne 0x140051754
nop dword [rax]
test rsi, rsi
je 0x140051726
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x48]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea r9, [rbp - 0x48]
mov r8d, dword [rbp - 0x48]
mov rdx, rax
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
je 0x140051710
test eax, eax
jns 0x140051777
test rsi, rsi
je 0x140051868
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140051868
lea r11, [rsi + 8]
mov eax, dword [rsi]
test eax, eax
je 0x14005183c
mov r14d, eax
nop dword [rax + rax]
mov r8, r11
test r11, r11
je 0x14005182e
lea rbx, str.Hyhd
sub rbx, r11
nop word [rax + rax]
movsx r10d, byte [r8]
movsx r9d, byte [r8 + rbx]
lea eax, [r9 - 0x41]
lea edx, [r9 + 0x20]
cmp eax, 0x19
cmova edx, r9d
lea eax, [r10 - 0x41]
lea ecx, [r10 + 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, edx
jne 0x1400517ef
test r10b, r10b
je 0x1400517ea
test r9b, r9b
je 0x1400517ef
inc r8
jmp 0x1400517b0
test r9b, r9b
je 0x140051811
lea eax, [r9 - 0x41]
lea edx, [r9 + 0x20]
cmp eax, 0x19
cmova edx, r9d
lea eax, [r10 - 0x41]
lea ecx, [r10 + 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, edx
jne 0x14005182e
cmp dword [r11 + 4], r13d
jne 0x14005181d
cmp dword [r11 + 0x18], r13d
je 0x14005182e
cmp qword [r11 + 0x20], 0xa
ja 0x14005182b
cmp qword [r11 + 0x10], 0xa
jbe 0x14005182e
mov r12b, 1
add r11, 0x28
sub r14, 1
jne 0x140051790
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r12b, r12b
je 0x140051868
mov r8d, 0x26
lea rdx, str.HyperHide_debugging_process_detected._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400518ac
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14005189e
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400518a8
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051884
jmp 0x1400518ac
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
mov rax, r9
test r8, r8
je 0x1400518fc
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x1400518f7
mov ecx, 0x46
mov rdi, r8
sub rdi, r9
test cx, cx
je 0x1400518f1
cmp word [rax], r13w
je 0x1400518f7
add rax, 2
movzx edx, word [rax + rdi]
movzx ecx, dx
cmp dx, word [rax]
je 0x1400518d4
jmp 0x1400518f7
cmp word [rax], r13w
je 0x140051902
cmp cx, word [rax]
je 0x140051902
add r8, 2
jmp 0x1400518b7
add r8, 0x24
mov rbx, r13
mov edi, r13d
je 0x140051952
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x14005191f
mov edi, 1
jmp 0x140051925
cmp ax, 0x2b
jne 0x140051930
add r8, 2
nop dword [rax]
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14005194b
lea rbx, [rbx + rbx*4]
lea rbx, [rbx - 0x18]
lea rbx, [rdx + rbx*2]
jmp 0x140051925
test edi, edi
je 0x140051952
neg rbx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x140051add
cmp dl, 6
jne 0x1400519a1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400519a1
sub ecx, 1
je 0x1400519a1
cmp ecx, 1
je 0x1400519a1
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140051999
sub ecx, 1
je 0x140051999
cmp ecx, 1
jne 0x140051add
mov ecx, r13d
jmp 0x140051ae4
mov dword [rbp + 0x90], 0x114
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x1400519ef
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400519e1
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400519eb
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x1400519c7
jmp 0x1400519ef
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
test r8, r8
je 0x140051b45
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x140051b45
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x140051b45
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x140051b45
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov esi, dword [rax + 0x1c]
add rsi, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140051b45
lea r14, str.RtlGetVersion
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, r14
je 0x140051a94
movzx ecx, byte [rdx]
cmp cl, 0x52
jne 0x140051a90
sub rdx, r14
test cl, cl
je 0x140051a8b
cmp byte [rax], r13b
je 0x140051a90
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x140051a75
jmp 0x140051a90
cmp byte [rax], r13b
je 0x140051aa5
cmp cl, byte [rax]
je 0x140051aa5
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x140051a60
jmp 0x140051b45
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r8
je 0x140051b45
lea rcx, [rbp + 0x90]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0x9c]
cmp ecx, dword [rax + 0x120]
jne 0x140051b2f
mov eax, ecx
jmp 0x140051b24
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
jne 0x140051b2f
cmp dl, 0xa
je 0x140051b1b
cmp dl, 6
jne 0x140051b16
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140051b16
sub ecx, 1
je 0x140051b16
cmp ecx, 1
jne 0x140051b1b
mov eax, r13d
jmp 0x140051b22
mov eax, dword [0x7ffe0260]
cdqe
sub rax, rbx
cmp rax, 0x7d0
jbe 0x140051b45
mov r8d, 0x15
lea rdx, str.Build_number_hooked._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
mov qword [rbp - 0x50], r13
mov dword [rbp - 0x50], 8
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140051b98
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140051b8a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140051b94
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140051b70
jmp 0x140051b98
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140051c83
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140051c83
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140051c83
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140051c83
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x140051c83
lea rsi, str.NtQuerySystemInformation
mov edx, dword [rdi]
add rdx, r9
mov rax, rsi
je 0x140051c35
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x140051c31
sub rdx, rsi
test cl, cl
je 0x140051c2c
cmp byte [rax], r13b
je 0x140051c31
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x140051c16
jmp 0x140051c31
cmp byte [rax], r13b
je 0x140051c43
cmp cl, byte [rax]
je 0x140051c43
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140051c01
jmp 0x140051c83
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x140051c83
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp - 0x50]
lea ecx, [r9 + 0x67]
call rax
mov eax, dword [rbp - 0x4c]
shr eax, 1
test al, 1
je 0x140051c83
mov r8d, 0x1d
lea rdx, str.Code_integrity_check_failed._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
mov dword [rbp - 0x48], 0x104
mov r12d, 1
mov dword [rbp - 0x60], r12d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140051dae
lea rax, [rbp - 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140051da4
lea r10, [rbp + 0x3a0]
cmp byte [rbp + 0x3a0], r13b
je 0x140051da4
lea r11, str.TESTSIGNING
movzx ebx, byte [str.TESTSIGNING]
test r10, r10
je 0x140051da4
mov r8, r10
mov r9, r11
movzx eax, bl
nop dword [rax + rax]
movsx edx, byte [r8]
inc r8
movsx ecx, al
lea r9, [r9 + 1]
lea eax, [rcx - 0x41]
lea edi, [rcx + 0x20]
cmp eax, 0x19
cmova edi, ecx
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x140051d55
add edx, 0x20
cmp edx, edi
jne 0x140051d98
movzx eax, byte [r9]
test al, al
jne 0x140051d30
mov eax, r13d
inc eax
lea r11, [r11 + 1]
cmp byte [r11], r13b
jne 0x140051d64
cdqe
cmp r8, rax
je 0x140051da4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x1b
lea rdx, str.Started_with_DSE_disabled._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
jmp 0x140051dae
inc r10
cmp byte [r10], r13b
jne 0x140051d16
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.BCD00000000Objects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140052046
mov dword [rbp + 0x30], 0x104
mov dword [rbp - 0x38], r13d
xor sil, sil
mov edx, 0x4096
xor ecx, ecx
lea r9d, [rax + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov dword [rbp + 0x38], 0x4096
lea rax, [rbp + 0x58]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x4c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x44]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x90]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [rbp - 0x38]
test eax, eax
je 0x140052010
mov r14d, r13d
nop dword [rax]
mov dword [rbp + 0x34], 0xff
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x34]
lea r8, [rbp + 0x2a0]
mov edx, r14d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140052003
mov edx, 0x4096
xor ecx, ecx
lea r9d, [rax + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rdi, rax
xor eax, eax
mov ecx, 0x4096
rep stosb byte [rdi], al
mov rdx, rbx
test rbx, rbx
je 0x140051f91
cmp byte [rbx], al
je 0x140051efc
inc rdx
cmp byte [rdx], al
jne 0x140051ef5
mov al, 0x42
lea rcx, str.BCD00000000Objects_
sub rcx, rdx
nop dword [rax + rax]
mov byte [rdx], al
lea rdx, [rdx + 1]
movzx eax, byte [rcx + rdx]
test al, al
jne 0x140051f10
mov byte [rdx], r13b
mov rax, rbx
cmp byte [rbx], r13b
je 0x140051f38
nop dword [rax]
inc rax
cmp byte [rax], r13b
jne 0x140051f30
movzx ecx, byte [rbp + 0x2a0]
test cl, cl
je 0x140051f5d
lea rdx, [rbp + 0x2a0]
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
inc rax
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140051f50
mov byte [rax], r13b
mov rax, rbx
cmp byte [rbx], r13b
je 0x140051f70
inc rax
cmp byte [rax], r13b
jne 0x140051f68
mov cl, 0x5c
lea rdx, str.Elements16000049
sub rdx, rax
nop dword [rax]
mov byte [rax], cl
lea rax, [rax + 1]
movzx ecx, byte [rdx + rax]
test cl, cl
jne 0x140051f80
mov byte [rax], r13b
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140051ff2
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Element
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140051fe8
movzx esi, sil
cmp dword [r15], r12d
cmove esi, r12d
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
inc r14d
cmp r14d, dword [rbp - 0x38]
jb 0x140051e80
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
je 0x140052046
mov r8d, 0x2a
lea rdx, str.BCD_library_allows_prerelease_signatures._n
lea rcx, [rbp - 0x20]
call fcn.140059c60
cmp qword [rbp - 0x10], r13
je 0x14005207d
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
lea rcx, [rbp - 0x20]
call fcn.140059bc0
mov rdx, rax
xor r9d, r9d
lea r8, str.dana56
mov rcx, rdi
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400520bb
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400520b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400520b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005c834
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.14005c420
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret