Function at 0x1400a3b90
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x14017a390]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rdi, rdx
mov r15d, ecx
xor esi, esi
mov dword [rsp + 0x30], esi
mov rbx, qword [0x140180188]
mov qword [rbp + 0x110], rsi
lea rax, [0x140136ad8]
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], rsi
mov rax, qword [rbx]
cmp dword [rax], esi
je 0x1400a3c4b
mov qword [rbp + 0x250], rsi
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x110], rax
lea r8, [0x140149ea7]
mov qword [rsp + 0x28], r8
lea rax, str._DLLPROTECT__::_DllProtectStart___
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.1400afc40
nop
lea rcx, [rbp - 0x20]
call fcn.1400a8f70
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 0x48], xmm1
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a3c89
mov qword [rsp + 0x20], rdi
mov r9d, r15d
lea r8, str.options:__d__proc_name:__s
lea rdx, [0x140136b60]
xor ecx, ecx
call fcn.1400afdd0
lea rax, str.bddllp_77C5D6EB_2669_4344_BA08_BAD4BF895666
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov dword [0x14017fe50], r15d
mov ecx, r15d
and ecx, 0x30
mov dword [0x140180264], ecx
mov eax, r15d
shr eax, 1
and al, 1
mov byte [0x140180261], al
mov eax, r15d
shr eax, 3
and al, 1
mov byte [0x14018026a], al
mov eax, r15d
shr eax, 2
and al, 1
mov byte [0x140180262], al
mov eax, r15d
shr eax, 6
and al, 1
mov byte [0x140180263], al
mov eax, r15d
shr eax, 7
and al, 1
mov byte [0x140180268], al
mov eax, r15d
shr eax, 8
and al, 1
mov byte [0x140180269], al
cmp ecx, 0x30
jne 0x1400a3de8
lea rcx, [rbp - 0x20]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a3d96
mov dword [rbp + 0x260], esi
mov qword [rbp - 0x30], rsi
lea rax, [rbp + 0x260]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_activate_dllprotect_in_report_mode_and_block_mode_at_the_same_time
mov qword [rbp + 0x270], rax
mov qword [rbp + 0x278], 0x49
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x50]
call fcn.1400c79c0
nop
mov ebx, 0x201
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
jmp 0x1400a3d9a
mov ebx, dword [rsp + 0x30]
test bl, 1
je 0x1400a4d44
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400a4d44
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a43bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4d83
jmp 0x1400a43bb
mov rcx, rdi
call fcn.1400b9000
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
mov r14, qword [0x14017a2e0]
lea rdi, [0x14017a2d0]
cmp qword [0x14017a2e8], 8
cmovae rdi, qword [0x14017a2d0]
cmp r14, 8
jae 0x1400a3e2e
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x30], xmm0
mov ebx, 7
jmp 0x1400a3e6a
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.140002ab0
mov qword [rbp + 0x30], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.1400f5570
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rbx
lea rcx, [rbp + 0x30]
call fcn.1400b91e0
call fcn.1400b6850
call fcn.1400b3d90
test r15b, 0x50
je 0x1400a41fe
cmp qword [0x1401802b0], 0
je 0x1400a41fe
lea rdx, [0x140138010]
mov ecx, 0x18
call fcn.1400f3730
mov rcx, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400a411d
lea rax, vtable.EventsCbkDumper.0
mov qword [rcx], rax
mov rax, qword [0x1401802b0]
mov qword [rcx + 8], rax
mov rax, qword [0x1401802b8]
mov qword [rcx + 0x10], rax
mov qword [0x1401802c0], rcx
test rcx, rcx
je 0x1400a4124
lea rdx, [0x140138010]
mov ecx, 0xe8
call fcn.1400f3730
mov r14, rax
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400a3ff7
mov rbx, qword [0x1401802c0]
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rsi
mov ecx, 0x10
call fcn.1400f3600
mov qword [rax + 8], rsi
mov qword [r14], rax
mov qword [rax], r14
lea rcx, [r14 + 0x28]
mov edx, 2
call fcn.1400cc850
lea rcx, [r14 + 0x78]
call fcn.1400cd7e0
nop
lea r12, [r14 + 0xc0]
mov qword [rsp + 0x30], r12
mov qword [r12], r14
mov qword [r12 + 8], rbx
xor eax, eax
mov byte [r12 + 0x10], al
xorps xmm0, xmm0
movups xmmword [r12 + 0x18], xmm0
mov eax, 1
xchg byte [r12 + 0x10], al
mov ecx, 0x10
call fcn.1400f3600
test rax, rax
je 0x1400a3fa3
mov qword [rax], r12
lea rcx, [0x1400a33d0]
mov qword [rax + 8], rcx
jmp 0x1400a3fa6
mov rax, rsi
mov qword [rbp + 0x270], rax
mov edi, 0x800
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14009a0a0]
xor edx, edx
xor ecx, ecx
call fcn.140108760
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400a4d9b
cmp dword [r12 + 0x20], 0
jne 0x1400a4d95
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [r12 + 0x18], xmm0
jmp 0x1400a3ffe
mov r14, rsi
mov edi, dword [rsp + 0x30]
mov qword [0x1401802c8], r14
test r14, r14
jne 0x1400a4202
lea rcx, [rbp - 0x20]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], r14d
je 0x1400a409e
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x70], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_queue
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x1c
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x290]
call fcn.1400c79c0
bts edi, 0xc
or edi, 4
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0x10
cmovae r9, qword [rbp + 0x290]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
test dil, 4
je 0x1400a40fe
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 0x10
jb 0x1400a40e5
inc rdx
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a40e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4da9
call fcn.1400f35f0
mov qword [rbp + 0x2a0], rsi
mov qword [rbp + 0x2a8], 0xf
mov byte [rbp + 0x290], 0
mov rcx, qword [0x1401802c0]
test rcx, rcx
je 0x1400a4d44
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x1400a4d44
mov qword [0x1401802c0], rsi
lea rcx, [rbp - 0x20]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a41ac
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.failed_to_alloc_events_consumer
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400c79c0
nop
mov ebx, 0x402
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
jmp 0x1400a41b0
mov ebx, dword [rsp + 0x30]
test bl, 2
je 0x1400a4d44
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400a4d44
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a43bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4d89
jmp 0x1400a43bb
mov edi, dword [rsp + 0x30]
test r15b, 1
jne 0x1400a4213
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x14017fe48], rax
test rax, rax
je 0x1400a42d0
lea rdx, [0x140136750]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140180038]
test rax, rax
cmovne rcx, rax
mov qword [0x140180038], rcx
lea rdx, [0x1401367b0]
mov rcx, qword [0x14017fe48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14017fe58]
test rax, rax
cmovne rcx, rax
mov qword [0x14017fe58], rcx
lea rdx, [0x140136870]
mov rcx, qword [0x14017fe48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140180228]
test rax, rax
cmovne rcx, rax
mov qword [0x140180228], rcx
lea rdx, [0x140136810]
mov rcx, qword [0x14017fe48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x1401801a0]
test rax, rax
cmovne rcx, rax
mov qword [0x1401801a0], rcx
lea rcx, [0x14014b610]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x14017fe28], rax
test rax, rax
jne 0x1400a43c5
lea rcx, [rbp - 0x20]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a4375
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_ntdll.dll_module_handle
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x22
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400c79c0
bts edi, 0xd
or edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
test dil, 8
je 0x1400a4d44
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400a4d44
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a43bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4daf
call fcn.1400f35f0
jmp 0x1400a4d44
lea rdx, str.NtCreateSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14017fe20], rax
test rax, rax
jne 0x1400a44bc
lea rcx, [rbp - 0x20]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a446d
mov dword [rbp + 0x260], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x260]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rax, str.cannot_get_NtCreateSection_proc_address
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x27
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400c79c0
bts edi, 0xe
or edi, 0x10
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
test dil, 0x10
je 0x1400a4d44
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400a4d44
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a43bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4d8f
jmp 0x1400a43bb
call fcn.1400c8ce0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.1400c9360
lea rdx, [0x1400a9850]
lea rcx, [0x14017fe58]
call fcn.1400c8550
test eax, eax
jne 0x1400a4542
lea rdx, [0x1400a9740]
lea rcx, [0x140180038]
call fcn.1400c8550
test eax, eax
jne 0x1400a4542
lea rdx, [0x1400a9460]
lea rcx, [0x1401801a0]
call fcn.1400c8550
test eax, eax
jne 0x1400a4542
lea rdx, [0x1400a95b0]
lea rcx, [0x140180228]
call fcn.1400c8550
test eax, eax
jne 0x1400a4542
lea rdx, [0x1400ad040]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.1400c8550
test eax, eax
je 0x1400a4556
call fcn.1400c8b90
mov ecx, 1
call fcn.1400aef10
jmp 0x1400a4d44
cmp byte [0x140180268], 0
je 0x1400a4667
lea rcx, [rbp + 0x1c0]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a45fc
mov dword [rbp + 0x280], esi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x280]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, str.activating_NtCreateSection_Hook
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x130]
call fcn.1400c79c0
bts edi, 0xf
or edi, 0x20
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae r9, qword [rbp + 0x130]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
test dil, 0x20
je 0x1400a4646
and edi, 0xffffffdf
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400a4646
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4641
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4db5
call fcn.1400f35f0
lea rdx, [0x1400a9ac0]
lea rcx, [0x14017fe20]
call fcn.1400c8550
test eax, eax
je 0x1400a4667
call fcn.1400c8b90
jmp 0x1400a4d44
call fcn.1400c8dc0
lea r14, [0x14017a230]
mov rdx, r14
cmp qword [0x14017a248], 8
cmovae rdx, qword [0x14017a230]
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], si
mov r8, qword [0x14017a240]
lea rcx, [rbp + 0x80]
call fcn.1400021f0
or edi, 0x30000
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], si
mov r8d, 0xd
lea rdx, str.cryptbase.dll
lea rcx, [rbp + 0x60]
call fcn.1400021f0
or edi, 0xc0000
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140013ee0
mov rbx, rax
lea rcx, [rbp + 0x60]
call fcn.140002d40
mov rdx, rbx
lea rcx, [rbp + 0x360]
call fcn.140002430
nop
lea rcx, [rbp + 0x80]
call fcn.140002d40
lea rcx, [rbp + 0x360]
cmp qword [rbp + 0x378], 8
cmovae rcx, qword [rbp + 0x360]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x14017fe30], rax
test rax, rax
jne 0x1400a484d
lea rcx, [rbp + 0x1f0]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a4803
mov dword [rbp + 0x310], esi
mov qword [rbp + 0xe0], rsi
lea rax, [rbp + 0x310]
mov qword [rbp + 0xe8], rax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x280], xmm0
lea rax, str.cannot_load_cryptbase.dll
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 0x19
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x160]
call fcn.1400c79c0
bts edi, 0x14
or edi, 0x40
mov dword [rsp + 0x30], edi
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r9, qword [rbp + 0x160]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
test dil, 0x40
je 0x1400a484d
and edi, 0xffffffbf
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400a484d
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4848
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4dbb
call fcn.1400f35f0
mov rdx, r14
cmp qword [0x14017a248], 8
cmovae rdx, qword [0x14017a230]
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], si
mov r8, qword [0x14017a240]
lea rcx, [rbp + 0xc0]
call fcn.1400021f0
or edi, 0x600000
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], si
mov r8d, 0xb
lea rdx, str.profapi.dll
lea rcx, [rbp + 0xa0]
call fcn.1400021f0
or edi, 0x1800000
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xc0]
call fcn.140013ee0
mov rbx, rax
lea rcx, [rbp + 0xa0]
call fcn.140002d40
mov rdx, rbx
lea rcx, [rbp + 0x340]
call fcn.140002430
nop
lea rcx, [rbp + 0xc0]
call fcn.140002d40
lea rcx, [rbp + 0x340]
cmp qword [rbp + 0x358], 8
cmovae rcx, qword [rbp + 0x340]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x14017fe38], rax
test rax, rax
jne 0x1400a4a1e
lea rcx, [rbp + 0x220]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a49da
mov dword [rbp + 0x300], esi
mov qword [rbp + 0x100], rsi
lea rax, [rbp + 0x300]
mov qword [rbp + 0x108], rax
movaps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x310], xmm0
lea rax, str.cannot_load_profapi.dll
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0x17
lea r8, [rbp + 0x310]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.1400c79c0
bts edi, 0x19
bts edi, 7
mov dword [rsp + 0x30], edi
lea r9, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r9, qword [rbp - 0x20]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
test dil, dil
jns 0x1400a4a1e
btr edi, 7
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400a4a1e
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4a19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4dc1
call fcn.1400f35f0
cmp qword [0x14017a248], 8
cmovae r14, qword [0x14017a230]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov r8, qword [0x14017a240]
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.1400021f0
or edi, 0xc000000
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], si
mov r8d, 0xc
lea rdx, str.wintrust.dll
lea rcx, [rbp + 0x10]
call fcn.1400021f0
or edi, 0x30000000
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x50]
call fcn.140013ee0
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.140002d40
mov rdx, rbx
lea rcx, [rbp + 0x320]
call fcn.140002430
nop
lea rcx, [rsp + 0x50]
call fcn.140002d40
lea rcx, [rbp + 0x320]
cmp qword [rbp + 0x338], 8
cmovae rcx, qword [rbp + 0x320]
xor edx, edx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x14017fe40], rax
test rax, rax
jne 0x1400a4be3
lea rcx, [rbp + 0x190]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a4b95
mov dword [rbp + 0x290], esi
mov qword [rbp + 0x250], rsi
lea rax, [rbp + 0x290]
mov qword [rbp + 0x258], rax
movaps xmm0, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x300], xmm0
lea rax, str.cannot_load_wintrust.dll
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x268], 0x18
lea r8, [rbp + 0x300]
lea rdx, [rbp + 0x260]
lea rcx, [rbp - 0x68]
call fcn.1400c79c0
bts edi, 0x1e
bts edi, 8
mov dword [rsp + 0x30], edi
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r9, qword [rbp - 0x68]
xor r8d, r8d
lea rdx, str._DLLPROTECT__::_DllProtectStart____
xor ecx, ecx
call fcn.1400afab0
nop
bt edi, 8
jae 0x1400a4d1d
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400a4d1d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a4bd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a4d7d
call fcn.1400f35f0
jmp 0x1400a4d1d
mov qword [rbp + 0x250], rsi
lea rdi, [0x14017afd0]
mov qword [rbp + 0x258], rdi
lea r8, [rbp + 0x250]
mov rdx, qword [0x14017fe28]
lea rcx, [rbp + 0x2e0]
call fcn.1400b3200
nop
lea rcx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rcx, qword [rbp + 0x2e0]
xor edx, edx
call fcn.1400ace40
mov ebx, eax
lea rcx, [rbp + 0x190]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a4c77
lea r9, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae r9, qword [rbp + 0x2e0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x140136b60]
xor ecx, ecx
call fcn.1400afdd0
mov dword [rbp + 0x250], esi
mov qword [rbp + 0x258], rdi
lea r8, [rbp + 0x250]
xor edx, edx
lea rcx, [rbp + 0x2c0]
call fcn.1400b3200
nop
lea rcx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 8
cmovae rcx, qword [rbp + 0x2c0]
xor edx, edx
call fcn.1400ace40
mov ebx, eax
lea rcx, [rbp + 0x290]
call fcn.1400a8f70
mov rax, qword [rax]
cmp dword [rax], 0
je 0x1400a4cfe
lea r9, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], 8
cmovae r9, qword [rbp + 0x2c0]
mov dword [rsp + 0x20], ebx
lea r8, str.signature_check_moking_mocking_for__s_returned__d
lea rdx, [0x140136b60]
xor ecx, ecx
call fcn.1400afdd0
mov esi, 1
lea rcx, [rbp + 0x2c0]
call fcn.140002d40
nop
lea rcx, [rbp + 0x2e0]
call fcn.140002d40
nop
lea rcx, [rbp + 0x320]
call fcn.140002d40
nop
lea rcx, [rbp + 0x340]
call fcn.140002d40
nop
lea rcx, [rbp + 0x360]
call fcn.140002d40
nop
lea rcx, [rbp + 0x110]
call fcn.1400a2c80
mov eax, esi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1400f2e00
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400f9bf0
nop
call fcn.1400f9bf0
int3
call fcn.1400f9bf0
int3
call fcn.1400f9bf0
nop
call fcn.140105a00
nop
mov dword [rbp - 0x28], esi
mov ecx, 6
call fcn.1400cca30
nop
call fcn.1400f9bf0
int3
call fcn.1400f9bf0
int3
call fcn.1400f9bf0
nop
call fcn.1400f9bf0
nop
call fcn.1400f9bf0
int3