Function at 0x140008950
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r12b
lea r8d, [r12 + 0x18]
lea rdx, str.NtQuerySystemInformation
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140008a4c
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140008a4c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a58e
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008a91
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a594
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x28
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140008b4f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140008b4f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a59a
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008b94
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5a0
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlInitUnicodeString
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140008c52
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140008c52
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5a6
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008c97
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5ac
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlFreeUnicodeString
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140008d55
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140008d55
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5b2
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008d9a
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5b8
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlHashUnicodeString
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140008e58
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140008e58
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5be
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008e9d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5c4
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.RtlUpcaseUnicodeChar
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140008f5b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140008f5b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5ca
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140008fa0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5d0
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000905e
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000905e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5d6
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400090a3
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000909e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5dc
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x17
lea rdx, str.NtSetInformationProcess
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009161
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009161
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000915b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5e2
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400091a6
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5e8
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009264
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009264
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000925e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5ee
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400092a9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400092a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5f4
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x11
lea rdx, str.NtDuplicateObject
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009367
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009367
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5fa
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400093ac
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400093a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a600
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtQueryObject
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000946a
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000946a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009464
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a606
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400094af
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a60c
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtQuerySection
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000956d
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000956d
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009567
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a612
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400095b2
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a618
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1a
lea rdx, str.RtlCreateActivationContext
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009670
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009670
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000966a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a61e
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400096b5
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a624
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x14
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009773
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009773
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000976d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a62a
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400097b8
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a630
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009876
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009876
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a636
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400098bb
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400098b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a63c
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x13
lea rdx, str.NtLockVirtualMemory
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009979
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009979
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009973
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a642
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400099be
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a648
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtSuspendProcess
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009a7c
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009a7c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009a76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a64e
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140009ac1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009abc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a654
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xf
lea rdx, str.NtResumeProcess
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009b7f
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009b7f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a65a
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140009bc4
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a660
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.RtlImageNtHeader
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009c82
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009c82
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a666
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140009cc7
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a66c
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xc
lea rdx, str.NtLoadDriver
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009d85
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009d85
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a672
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140009dca
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009dc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a678
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xe
lea rdx, str.NtUnloadDriver
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009e88
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009e88
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a67e
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140009ecd
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009ec8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a684
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x1c
lea rdx, str.RtlDosPathNameToNtPathName_U
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x140009f8b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140009f8b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a68a
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140009fd0
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009fcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a690
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xb
lea rdx, str.NtOpenEvent
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000a08e
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000a08e
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a088
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a696
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000a0d3
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a69c
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0xd
lea rdx, str.NtCreateEvent
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000a191
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000a191
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a18b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a6a2
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000a1d6
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a6a8
call fcn.140079aa4
call fcn.1400019a0
mov rsi, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x10
lea rdx, str.NtQueueApcThread
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea rbx, [rsi + 0x40]
mov qword [rbp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000a294
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], r14
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000a294
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a28e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a6ae
call fcn.140079aa4
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000a2d9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a2d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a6b4
call fcn.140079aa4
call fcn.1400019a0
mov rbx, rax
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov r8d, 0x16
lea rdx, str.RtlEncodeSystemPointer
lea rcx, [rbp - 0x50]
call fcn.140002600
nop
lea r14, [rbx + 0x40]
mov qword [rbp + 0x30], r14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rdx, qword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000a397
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.140004b70
mov qword [rbp - 0x10], rsi
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.14000a6c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14000a397
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a588
call fcn.140079aa4
nop
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.NtWow64QueryInformationProcess64
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, rdi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.Wow64GetThreadContext
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.Wow64SetThreadContext
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.Wow64SuspendThread
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
call fcn.1400019a0
mov rbx, rax
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rbp - 0x50]
call fcn.140002510
nop
mov r8, r15
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400083a0
nop
lea rcx, [rbp - 0x50]
call fcn.1400024b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
nop
call fcn.1400892cc
int3