Function at 0x1400109a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1258
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov dword [rsp + 0x30c], 0
mov qword [rsp + 0x148], 0
lea rax, [rsp + 0x9c0]
mov rdi, rax
xor eax, eax
mov ecx, 0xc0
rep stosb byte [rdi], al
mov dword [rsp + 0x458], 0
mov r8d, 0x4d525356
mov edx, 0x32
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x148], rax
cmp qword [rsp + 0x148], 0
jne 0x140010a31
jmp 0x140013db6
mov r8d, 0x32
xor edx, edx
mov rcx, qword [rsp + 0x148]
call fcn.140001bd0
mov rax, qword [rsp + 0x148]
mov byte [rax], 1
mov dword [rsp + 0x150], 0
mov byte [rsp + 0x141], 0
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov dword [rsp + 0x30c], eax
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x12a8]
movzx eax, byte [rax]
mov dword [rsp + 0x1a4], eax
mov eax, dword [rsp + 0x1a4]
sub eax, 0x1d
mov dword [rsp + 0x1a4], eax
cmp dword [rsp + 0x1a4], 0x92
ja case.0x140010adf.31
movsxd rax, dword [rsp + 0x1a4]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x13e1c]
mov eax, dword [rcx + rax*4 + 0x13dcc]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x12a0]
mov rcx, qword [rsp + 0x12a8]
movzx ecx, word [rcx + 1]
mov word [rax + 0xc], cx
mov eax, 0xa0cb
mov rcx, qword [rsp + 0x12a0]
mov word [rcx + 0xe], ax
mov rax, qword [rsp + 0x12a0]
movzx ecx, byte [rsp + 0x12a0]
mov byte [rax + 3], cl
mov rax, qword [rsp + 0x12a0]
mov byte [rax + 1], 1
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x148]
mov byte [rcx + rax + 2], 2
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x148]
mov byte [rcx + rax + 2], 0xa
mov eax, 1
imul rax, rax, 4
mov rcx, qword [rsp + 0x12a0]
movzx eax, byte [rcx + rax + 0x456]
cmp eax, 3
je 0x140010ba9
mov eax, 1
imul rax, rax, 4
mov rcx, qword [rsp + 0x12a0]
movzx eax, byte [rcx + rax + 0x456]
cmp eax, 5
je 0x140010ba9
mov dword [rsp + 0x2f8], 0xa
jmp 0x140010bb4
mov dword [rsp + 0x2f8], 0x1a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x148]
movzx edx, byte [rsp + 0x2f8]
mov byte [rcx + rax + 2], dl
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 0x43a]
cmp eax, 5
jle 0x140010c0b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x148]
mov rdx, qword [rsp + 0x12a0]
movzx edx, byte [rdx + 0x43a]
mov byte [rcx + rax + 2], dl
jmp 0x140010c21
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x148]
mov byte [rcx + rax + 2], 0xa
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x148]
mov byte [rcx + rax + 2], 0
movzx eax, word [rsp + 0x12a0]
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
movzx eax, word [rsp + 0x12a0]
sar eax, 8
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
mov dword [rsp + 0x150], 5
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12a8]
mov rcx, qword [rsp + 0x12a0]
mov ecx, dword [rcx + 0x43c]
cmp dword [rax + 1], ecx
jne 0x140010d8f
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 1]
cmp eax, 1
jne 0x140010d8f
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rcx, qword [rsp + 0x12a0]
call fcn.140016c00
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
mov rcx, qword [rsp + 0x12a0]
call fcn.140016c00
sar eax, 8
and eax, 0xff
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x148]
mov byte [rcx + rax + 2], 0x10
mov dword [rsp + 0x150], 3
mov byte [rsp + 0x141], 1
mov rax, qword [rsp + 0x12a0]
mov byte [rax + 2], 1
mov rax, qword [rsp + 0x12a0]
mov eax, dword [rax + 0x43c]
mov dword [0x1400084e0], eax
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 2
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140010e3d
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
test eax, eax
jl 0x140010e3d
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
cmp eax, 7
jg 0x140010e3d
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x12a0]
lea rax, [rcx + rax + 0x456]
mov rcx, qword [rsp + 0x148]
add rcx, 2
mov r8d, 6
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x150], 6
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 2
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140010f0f
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
test eax, eax
jl 0x140010f0f
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
shl eax, 1
mov dword [rsp + 0x38c], eax
mov rcx, qword [rsp + 0x12a0]
call fcn.140016c00
mov ecx, dword [rsp + 0x38c]
cmp ecx, eax
jge 0x140010f0f
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x12a0]
lea rax, [rcx + rax + 0x4a6]
mov rcx, qword [rsp + 0x148]
add rcx, 2
mov r8d, 6
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x150], 6
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14001102b
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
test eax, eax
jl 0x14001102b
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
shl eax, 1
mov dword [rsp + 0x390], eax
mov rcx, qword [rsp + 0x12a0]
call fcn.140016c00
mov ecx, dword [rsp + 0x390]
cmp ecx, eax
jge 0x14001102b
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
add rax, 3
mov rcx, qword [rsp + 0x12a8]
movzx ecx, word [rcx + 1]
shl ecx, 1
movsxd rcx, ecx
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rdx + rcx + 0x4a6]
mov r8d, 2
mov rdx, rax
call fcn.140001880
mov dword [rsp + 0x150], 0
mov byte [rsp + 0x141], 0
mov rcx, qword [rsp + 0x12a0]
call fcn.140016c00
mov rcx, qword [rsp + 0x12a0]
add rcx, 0x4a6
mov r9, qword [rsp + 0x12a0]
mov r8d, eax
mov rdx, rcx
lea rcx, [0x1400010e8]
call fcn.140016c70
test eax, eax
jne 0x14001102b
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400110ba
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov dword [rsp + 0x18c], 7
jmp 0x140011068
mov eax, dword [rsp + 0x18c]
dec eax
mov dword [rsp + 0x18c], eax
cmp dword [rsp + 0x18c], 0
jl 0x1400110a7
movsxd rax, dword [rsp + 0x18c]
mov ecx, 7
sub ecx, dword [rsp + 0x18c]
movsxd rcx, ecx
mov rdx, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x12a0]
movzx eax, byte [rdi + rax + 0x44e]
mov byte [rdx + rcx + 2], al
jmp 0x140011058
mov dword [rsp + 0x150], 8
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140011154
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
inc rax
mov rcx, qword [rsp + 0x148]
add rcx, 2
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x12a0]
add rax, 0x14a6
mov rcx, qword [rsp + 0x148]
add rcx, 2
mov rdx, rax
call fcn.140004d30
mov dword [rsp + 0x150], 4
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140011397
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 4
mov rcx, rax
call fcn.140010960
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x12a0]
mov rax, qword [rax + 0x49e]
mov rcx, qword [rsp + 0x398]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x398], rax
lea rdx, [rsp + 0x3b8]
lea rcx, [rsp + 0x398]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
and eax, 0xff
test eax, eax
jne 0x140011268
movzx ecx, byte [rsp + 0x3be]
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
movzx ecx, byte [rsp + 0x3c0]
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
movzx ecx, byte [rsp + 0x3c2]
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
jmp 0x140011379
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
and eax, 0xff
cmp eax, 3
jne 0x140011319
movsx eax, word [rsp + 0x3b8]
cdq
mov ecx, 0x64
idiv ecx
mov eax, edx
movzx ecx, al
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
movzx ecx, byte [rsp + 0x3c6]
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
movzx ecx, byte [rsp + 0x3ba]
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
movzx ecx, byte [rsp + 0x3bc]
call fcn.140005460
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x148]
mov byte [rdx + rcx + 2], al
jmp 0x140011379
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
sar eax, 8
cdqe
mov rcx, qword [rsp + 0x12a8]
movzx ecx, word [rcx + 1]
and ecx, 0xff
movsxd rcx, ecx
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rdx + rcx + 0x466]
mov rdx, qword [rsp + 0x148]
add rdx, 2
mov qword [rsp + 0x450], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x450]
mov rcx, rax
call fcn.140001880
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
sar eax, 8
mov dword [rsp + 0x150], eax
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140011493
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
and eax, 0xff
mov dword [0x1400084e8], eax
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 3]
sar eax, 8
mov dword [0x1400084e4], eax
movsxd rax, dword [0x1400084e4]
movsxd rcx, dword [0x1400084e8]
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rdx + rcx + 0x466]
mov r8, rax
mov rdx, qword [rsp + 0x12b8]
call fcn.140001880
movsxd rax, dword [0x1400084e8]
mov rcx, qword [rsp + 0x12a0]
lea rax, [rcx + rax + 0x466]
mov r8, qword [rsp + 0x12a0]
mov edx, dword [0x1400084e4]
mov rcx, rax
call fcn.140010960
mov rax, qword [rsp + 0x12b0]
mov dword [rax], 0
cmp qword [rsp + 0x148], 0
je 0x14001148e
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x14001172e
cmp dword [0x1400084e8], 7
jl 0x1400114f4
mov rax, qword [rsp + 0x12a0]
add rax, 0x466
mov r9, qword [rsp + 0x12a0]
mov r8d, 0x38
mov rdx, rax
lea rcx, [0x1400010f8]
call fcn.140016c70
test eax, eax
jne 0x1400114ef
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
jmp 0x140013bdc
movabs rax, 0xfffff78000000014
mov rax, qword [rax]
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x12a0]
mov rax, qword [rax + 0x49e]
mov rcx, qword [rsp + 0x3d8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x448], rax
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x448]
call qword [sym.imp.ntoskrnl.exe_RtlTimeToTimeFields]
cmp dword [0x1400084e8], 0
jne 0x140011605
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x12a0]
movzx eax, byte [rcx + rax + 0x466]
and eax, 0x7f
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x12a0]
mov byte [rdx + rcx + 0x466], al
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + rax + 0x466]
call fcn.140005440
movzx eax, al
mov word [rsp + 0x2f2], ax
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + rax + 0x466]
call fcn.140005440
movzx eax, al
mov word [rsp + 0x2f0], ax
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + rax + 0x466]
call fcn.140005440
movzx eax, al
mov word [rsp + 0x2ee], ax
jmp 0x1400116b9
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + rax + 0x469]
call fcn.140005440
movzx eax, al
mov word [rsp + 0x2ec], ax
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + rax + 0x469]
call fcn.140005440
movzx eax, al
mov word [rsp + 0x2ea], ax
mov eax, 1
imul rax, rax, 3
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + rax + 0x469]
call fcn.140005440
movzx eax, al
mov word [rsp + 0x2e8], ax
movsx eax, word [rsp + 0x2e8]
cmp eax, 0x5a
jge 0x1400116a4
movsx eax, word [rsp + 0x2e8]
add eax, 0x7d0
mov word [rsp + 0x2e8], ax
jmp 0x1400116b9
movsx eax, word [rsp + 0x2e8]
add eax, 0x76c
mov word [rsp + 0x2e8], ax
lea rdx, [rsp + 0x438]
lea rcx, [rsp + 0x2e8]
call qword [sym.imp.ntoskrnl.exe_RtlTimeFieldsToTime]
mov rax, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0x438]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x12a0]
mov qword [rcx + 0x49e], rax
mov rax, qword [rsp + 0x12a0]
add rax, 0x49e
mov r9, qword [rsp + 0x12a0]
mov r8d, 8
mov rdx, rax
lea rcx, [0x140001118]
call fcn.140016c70
test eax, eax
jne 0x14001172e
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x1400118d4
mov rax, qword [rsp + 0x12a0]
mov rcx, qword [rsp + 0x12b0]
mov ecx, dword [rcx]
mov dword [rax + 0x14c2], ecx
mov rax, qword [rsp + 0x12a8]
inc rax
mov r8, qword [rsp + 0x12a0]
mov edx, 4
mov rcx, rax
call fcn.140010960
mov r8, qword [rsp + 0x12a0]
mov rax, qword [rsp + 0x12a0]
mov edx, dword [rax + 0x14c2]
mov rcx, qword [rsp + 0x12b8]
call fcn.140010960
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
cmp eax, 3
jle 0x1400117c0
mov dword [rsp + 0x2fc], 1
jmp 0x1400117cb
mov dword [rsp + 0x2fc], 0
mov rax, qword [rsp + 0x12a0]
movzx ecx, byte [rsp + 0x2fc]
mov byte [rax + 0x14c6], cl
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
cmp eax, 7
jge 0x140011807
mov rax, qword [rsp + 0x12a8]
movzx eax, byte [rax + 1]
mov dword [rsp + 0x300], eax
jmp 0x140011812
mov dword [rsp + 0x300], 8
mov rax, qword [rsp + 0x12a0]
movzx ecx, byte [rsp + 0x300]
mov byte [rax + 0x14c7], cl
mov rax, qword [rsp + 0x12a0]
add rax, 0x14c8
mov r8d, 0x30
xor edx, edx
mov rcx, rax
call fcn.140001bd0
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
cmp rax, 0x30
jae 0x140011874
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
mov qword [rsp + 0x3e0], rax
jmp 0x140011880
mov qword [rsp + 0x3e0], 0x30
mov rax, qword [rsp + 0x12a0]
add rax, 0x14c8
mov r8, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x12b8]
mov rcx, rax
call fcn.140001880
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
cmp qword [rsp + 0x148], 0
je 0x1400118cf
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
jmp 0x140013bdc
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140012afb
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x408]
call fcn.140001bd0
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x158]
call fcn.140001bd0
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
cmp rax, 0x30
jae 0x140011945
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
mov qword [rsp + 0x3e8], rax
jmp 0x140011951
mov qword [rsp + 0x3e8], 0x30
mov rax, qword [rsp + 0x12a0]
add rax, 0x14c8
mov r8, qword [rsp + 0x3e8]
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.140001880
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
cmp rax, 0x30
jae 0x1400119a5
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
mov qword [rsp + 0x3f0], rax
jmp 0x1400119b1
mov qword [rsp + 0x3f0], 0x30
mov rax, qword [rsp + 0x12a0]
add rax, 0x14c8
mov r8, qword [rsp + 0x3f0]
mov rdx, rax
lea rcx, [rsp + 0x408]
call fcn.140001880
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 0x14c6]
test eax, eax
jne 0x140011a58
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x4d0]
call fcn.140001bd0
mov rax, qword [rsp + 0x12a0]
add rax, 0x14f8
lea rcx, [0x140001130]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
lea rax, str.RegistryMACHINESystemCurrentControlSet_aaa
mov qword [rsp + 0x30], rax
lea rax, [0x140001140]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
lea rcx, [rsp + 0x4d0]
call fcn.1400043a0
jmp 0x140011ac4
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x4d0]
call fcn.140001bd0
mov rax, qword [rsp + 0x12a0]
add rax, 0x14f8
lea rcx, [0x140001158]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
lea rax, str.RegistryMACHINESystemCurrentControlSet_aaa
mov qword [rsp + 0x30], rax
lea rax, [0x140001140]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
lea rcx, [rsp + 0x4d0]
call fcn.1400043a0
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x4a8]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x478], 0x30
mov qword [rsp + 0x480], 0
mov dword [rsp + 0x490], 0x40
lea rax, [rsp + 0x4a8]
mov qword [rsp + 0x488], rax
mov qword [rsp + 0x498], 0
mov qword [rsp + 0x4a0], 0
lea r8, [rsp + 0x478]
mov edx, 0x20019
lea rcx, [rsp + 0x3f8]
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [rsp + 0x2e4], eax
cmp dword [rsp + 0x2e4], 0
jl 0x1400126a8
mov eax, 2
imul rax, rax, 0
lea rax, [rsp + rax + 0x4d0]
mov r8d, 0x100
xor edx, edx
mov rcx, rax
call fcn.140001bd0
mov rax, qword [rsp + 0x12a0]
mov eax, dword [rax + 0x14c2]
mov dword [rsp + 0x2e0], eax
cmp dword [rsp + 0x2e0], 0x10
je 0x140011bb5
cmp dword [rsp + 0x2e0], 0x20
je 0x140011d95
cmp dword [rsp + 0x2e0], 0x30
je 0x140012205
jmp 0x140012670
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x4d0]
call fcn.140001bd0
mov eax, 1
imul rax, rax, 0xf
movzx eax, byte [rsp + rax + 0x158]
mov ecx, 1
imul rcx, rcx, 0xe
movzx ecx, byte [rsp + rcx + 0x158]
mov edx, 1
imul rdx, rdx, 0xd
movzx edx, byte [rsp + rdx + 0x158]
mov edi, 1
imul rdi, rdi, 0xc
movzx edi, byte [rsp + rdi + 0x158]
mov r8d, 1
imul r8, r8, 0xb
movzx r8d, byte [rsp + r8 + 0x158]
mov r9d, 1
imul r9, r9, 0xa
movzx r9d, byte [rsp + r9 + 0x158]
mov r10d, 1
imul r10, r10, 9
movzx r10d, byte [rsp + r10 + 0x158]
mov r11d, 1
imul r11, r11, 8
movzx r11d, byte [rsp + r11 + 0x158]
mov ebx, 1
imul rbx, rbx, 7
movzx ebx, byte [rsp + rbx + 0x158]
mov esi, 1
imul rsi, rsi, 6
movzx esi, byte [rsp + rsi + 0x158]
mov ebp, 1
imul rbp, rbp, 5
movzx ebp, byte [rsp + rbp + 0x158]
mov r14d, 1
imul r14, r14, 4
movzx r14d, byte [rsp + r14 + 0x158]
mov r15d, 1
imul r15, r15, 3
movzx r15d, byte [rsp + r15 + 0x158]
mov r12d, 1
imul r12, r12, 2
movzx r12d, byte [rsp + r12 + 0x158]
mov r13d, 1
imul r13, r13, 1
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3a0], r13d
mov r13d, 1
imul r13, r13, 0
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xa8], ecx
mov dword [rsp + 0xa0], edx
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x90], r8d
mov dword [rsp + 0x88], r9d
mov dword [rsp + 0x80], r10d
mov dword [rsp + 0x78], r11d
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], r12d
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r13d
lea rax, [0x140001168]
mov qword [rsp + 0x30], rax
lea rax, [0x140001170]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
lea rcx, [rsp + 0x4d0]
call fcn.1400043a0
jmp 0x140012670
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x4d0]
call fcn.140001bd0
mov eax, 1
imul rax, rax, 0x1f
movzx eax, byte [rsp + rax + 0x158]
mov ecx, 1
imul rcx, rcx, 0x1e
movzx ecx, byte [rsp + rcx + 0x158]
mov edx, 1
imul rdx, rdx, 0x1d
movzx edx, byte [rsp + rdx + 0x158]
mov ebx, 1
imul rbx, rbx, 0x1c
movzx ebx, byte [rsp + rbx + 0x158]
mov edi, 1
imul rdi, rdi, 0x1b
movzx edi, byte [rsp + rdi + 0x158]
mov esi, 1
imul rsi, rsi, 0x1a
movzx esi, byte [rsp + rsi + 0x158]
mov ebp, 1
imul rbp, rbp, 0x19
movzx ebp, byte [rsp + rbp + 0x158]
mov r8d, 1
imul r8, r8, 0x18
movzx r8d, byte [rsp + r8 + 0x158]
mov r9d, 1
imul r9, r9, 0x17
movzx r9d, byte [rsp + r9 + 0x158]
mov r10d, 1
imul r10, r10, 0x16
movzx r10d, byte [rsp + r10 + 0x158]
mov r11d, 1
imul r11, r11, 0x15
movzx r11d, byte [rsp + r11 + 0x158]
mov r14d, 1
imul r14, r14, 0x14
movzx r14d, byte [rsp + r14 + 0x158]
mov r15d, 1
imul r15, r15, 0x13
movzx r15d, byte [rsp + r15 + 0x158]
mov r12d, 1
imul r12, r12, 0x12
movzx r12d, byte [rsp + r12 + 0x158]
mov r13d, 1
imul r13, r13, 0x11
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3a4], r13d
mov r13d, 1
imul r13, r13, 0x10
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3a8], r13d
mov r13d, 1
imul r13, r13, 0xf
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3ac], r13d
mov r13d, 1
imul r13, r13, 0xe
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3b0], r13d
mov r13d, 1
imul r13, r13, 0xd
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3c8], r13d
mov r13d, 1
imul r13, r13, 0xc
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3cc], r13d
mov r13d, 1
imul r13, r13, 0xb
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x3d0], r13d
mov r13d, 1
imul r13, r13, 0xa
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x320], r13d
mov r13d, 1
imul r13, r13, 9
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x324], r13d
mov r13d, 1
imul r13, r13, 8
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x328], r13d
mov r13d, 1
imul r13, r13, 7
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x32c], r13d
mov r13d, 1
imul r13, r13, 6
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x330], r13d
mov r13d, 1
imul r13, r13, 5
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x334], r13d
mov r13d, 1
imul r13, r13, 4
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x338], r13d
mov r13d, 1
imul r13, r13, 3
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x33c], r13d
mov r13d, 1
imul r13, r13, 2
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x340], r13d
mov r13d, 1
imul r13, r13, 1
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x344], r13d
mov r13d, 1
imul r13, r13, 0
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x130], eax
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], ebx
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x108], esi
mov dword [rsp + 0x100], ebp
mov dword [rsp + 0xf8], r8d
mov dword [rsp + 0xf0], r9d
mov dword [rsp + 0xe8], r10d
mov dword [rsp + 0xe0], r11d
mov dword [rsp + 0xd8], r14d
mov dword [rsp + 0xd0], r15d
mov dword [rsp + 0xc8], r12d
mov eax, dword [rsp + 0x3a4]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsp + 0x3a8]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x3ac]
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0x3c8]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x3cc]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x3d0]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x320]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x324]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x328]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x32c]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x330]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x334]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x338]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x33c]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x340]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x344]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r13d
lea rax, [0x1400011f8]
mov qword [rsp + 0x30], rax
lea rax, [0x140001200]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
lea rcx, [rsp + 0x4d0]
call fcn.1400043a0
jmp 0x140012670
mov r8d, 0x100
xor edx, edx
lea rcx, [rsp + 0x4d0]
call fcn.140001bd0
mov eax, 1
imul rax, rax, 0x1f
movzx eax, byte [rsp + rax + 0x158]
mov ecx, 1
imul rcx, rcx, 0x1e
movzx ecx, byte [rsp + rcx + 0x158]
mov edx, 1
imul rdx, rdx, 0x1d
movzx edx, byte [rsp + rdx + 0x158]
mov ebx, 1
imul rbx, rbx, 0x1c
movzx ebx, byte [rsp + rbx + 0x158]
mov edi, 1
imul rdi, rdi, 0x1b
movzx edi, byte [rsp + rdi + 0x158]
mov esi, 1
imul rsi, rsi, 0x1a
movzx esi, byte [rsp + rsi + 0x158]
mov ebp, 1
imul rbp, rbp, 0x19
movzx ebp, byte [rsp + rbp + 0x158]
mov r8d, 1
imul r8, r8, 0x18
movzx r8d, byte [rsp + r8 + 0x158]
mov r9d, 1
imul r9, r9, 0x17
movzx r9d, byte [rsp + r9 + 0x158]
mov r10d, 1
imul r10, r10, 0x16
movzx r10d, byte [rsp + r10 + 0x158]
mov r11d, 1
imul r11, r11, 0x15
movzx r11d, byte [rsp + r11 + 0x158]
mov r14d, 1
imul r14, r14, 0x14
movzx r14d, byte [rsp + r14 + 0x158]
mov r15d, 1
imul r15, r15, 0x13
movzx r15d, byte [rsp + r15 + 0x158]
mov r12d, 1
imul r12, r12, 0x12
movzx r12d, byte [rsp + r12 + 0x158]
mov r13d, 1
imul r13, r13, 0x11
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x348], r13d
mov r13d, 1
imul r13, r13, 0x10
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x34c], r13d
mov r13d, 1
imul r13, r13, 0xf
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x350], r13d
mov r13d, 1
imul r13, r13, 0xe
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x354], r13d
mov r13d, 1
imul r13, r13, 0xd
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x358], r13d
mov r13d, 1
imul r13, r13, 0xc
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x35c], r13d
mov r13d, 1
imul r13, r13, 0xb
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x360], r13d
mov r13d, 1
imul r13, r13, 0xa
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x364], r13d
mov r13d, 1
imul r13, r13, 9
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x368], r13d
mov r13d, 1
imul r13, r13, 8
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x36c], r13d
mov r13d, 1
imul r13, r13, 7
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x370], r13d
mov r13d, 1
imul r13, r13, 6
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x374], r13d
mov r13d, 1
imul r13, r13, 5
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x378], r13d
mov r13d, 1
imul r13, r13, 4
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x37c], r13d
mov r13d, 1
imul r13, r13, 3
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x380], r13d
mov r13d, 1
imul r13, r13, 2
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x384], r13d
mov r13d, 1
imul r13, r13, 1
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x388], r13d
mov r13d, 1
imul r13, r13, 0
movzx r13d, byte [rsp + r13 + 0x158]
mov dword [rsp + 0x130], eax
mov dword [rsp + 0x128], ecx
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x118], ebx
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x108], esi
mov dword [rsp + 0x100], ebp
mov dword [rsp + 0xf8], r8d
mov dword [rsp + 0xf0], r9d
mov dword [rsp + 0xe8], r10d
mov dword [rsp + 0xe0], r11d
mov dword [rsp + 0xd8], r14d
mov dword [rsp + 0xd0], r15d
mov dword [rsp + 0xc8], r12d
mov eax, dword [rsp + 0x348]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsp + 0x34c]
mov dword [rsp + 0xb8], eax
mov eax, dword [rsp + 0x350]
mov dword [rsp + 0xb0], eax
mov eax, dword [rsp + 0x354]
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0x358]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0x35c]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x360]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x364]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x368]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x36c]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x370]
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x374]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x378]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x37c]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x380]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x384]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x388]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r13d
lea rax, [0x140001308]
mov qword [rsp + 0x30], rax
lea rax, [0x140001200]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x800
xor r9d, r9d
xor r8d, r8d
mov edx, 0x100
lea rcx, [rsp + 0x4d0]
call fcn.1400043a0
mov r9d, 0x10
lea r8, [rsp + 0x158]
lea rdx, [rsp + 0x4d0]
mov rcx, qword [rsp + 0x3f8]
call fcn.1400058f0
mov dword [rsp + 0x2e4], eax
mov rcx, qword [rsp + 0x3f8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x2e4], 0
jge case.0x1400126f3.3
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 0x14c7]
mov dword [rsp + 0x304], eax
cmp dword [rsp + 0x304], 6
ja case.0x1400126f3.3
movsxd rax, dword [rsp + 0x304]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x13eb0]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x12a0]
add rax, 0x1520
mov r8d, 0x80
mov rdx, rax
lea rcx, [rsp + 0x5d0]
call fcn.140003a50
lea r9, [rsp + 0x158]
lea r8, [rsp + 0x408]
mov edx, 0xa
lea rcx, [rsp + 0x5d0]
call fcn.140001da0
jmp case.0x1400126f3.3
mov rax, qword [rsp + 0x12a0]
add rax, 0x1520
mov r8d, 0x80
mov rdx, rax
lea rcx, [rsp + 0x5d0]
call fcn.140003a50
lea r9, [rsp + 0x158]
lea r8, [rsp + 0x408]
mov edx, 0xa
lea rcx, [rsp + 0x5d0]
call fcn.140001da0
mov byte [rsp + 0x140], 0
jmp 0x1400127a1
movzx eax, byte [rsp + 0x140]
inc al
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x140]
cmp eax, 0x10
jge 0x1400127e7
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x140]
add ecx, 0x10
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x408]
movzx eax, byte [rsp + rax + 0x158]
xor eax, ecx
movzx ecx, byte [rsp + 0x140]
mov byte [rsp + rcx + 0x158], al
jmp 0x140012790
jmp case.0x1400126f3.3
mov rax, qword [rsp + 0x12a0]
add rax, 0x1520
mov r8d, 0x80
mov rdx, rax
lea rcx, [rsp + 0x5d0]
call fcn.140003a50
lea r9, [rsp + 0x158]
lea r8, [rsp + 0x408]
mov edx, 0xa
lea rcx, [rsp + 0x5d0]
call fcn.140001da0
mov byte [rsp + 0x140], 0
jmp 0x14001284d
movzx eax, byte [rsp + 0x140]
inc al
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x140]
cmp eax, 0x10
jge 0x140012893
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x140]
add ecx, 0x10
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x408]
movzx eax, byte [rsp + rax + 0x158]
xor eax, ecx
movzx ecx, byte [rsp + 0x140]
mov byte [rsp + rcx + 0x158], al
jmp 0x14001283c
mov byte [rsp + 0x140], 0
jmp 0x1400128ae
movzx eax, byte [rsp + 0x140]
inc al
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x140]
cmp eax, 0x10
jge 0x1400128f4
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x140]
add ecx, 0x20
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x408]
movzx eax, byte [rsp + rax + 0x158]
xor eax, ecx
movzx ecx, byte [rsp + 0x140]
mov byte [rsp + rcx + 0x158], al
jmp 0x14001289d
jmp case.0x1400126f3.3
mov rax, qword [rsp + 0x12a0]
add rax, 0x1520
mov r8d, 0x80
mov rdx, rax
lea rcx, [rsp + 0x5d0]
call fcn.1400036d0
lea r9, [rsp + 0x158]
lea r8, [rsp + 0x408]
mov edx, 0xa
lea rcx, [rsp + 0x5d0]
call fcn.140001da0
jmp case.0x1400126f3.3
mov byte [rsp + 0x140], 0
jmp 0x14001295f
movzx eax, byte [rsp + 0x140]
inc al
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x140]
cmp eax, 0x10
jge 0x1400129a5
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x140]
add ecx, 0x10
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x408]
movzx eax, byte [rsp + rax + 0x158]
xor eax, ecx
movzx ecx, byte [rsp + 0x140]
mov byte [rsp + rcx + 0x158], al
jmp 0x14001294e
jmp case.0x1400126f3.3
mov byte [rsp + 0x140], 0
jmp 0x1400129c5
movzx eax, byte [rsp + 0x140]
inc al
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x140]
cmp eax, 0x10
jge 0x140012a0b
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x140]
add ecx, 0x10
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x408]
movzx eax, byte [rsp + rax + 0x408]
xor eax, ecx
movzx ecx, byte [rsp + 0x140]
mov byte [rsp + rcx + 0x408], al
jmp 0x1400129b4
mov byte [rsp + 0x140], 0
jmp 0x140012a26
movzx eax, byte [rsp + 0x140]
inc al
mov byte [rsp + 0x140], al
movzx eax, byte [rsp + 0x140]
cmp eax, 0x10
jge 0x140012a6c
movzx eax, byte [rsp + 0x140]
movzx ecx, byte [rsp + 0x140]
add ecx, 0x20
movsxd rcx, ecx
movzx ecx, byte [rsp + rcx + 0x408]
movzx eax, byte [rsp + rax + 0x408]
xor eax, ecx
movzx ecx, byte [rsp + 0x140]
mov byte [rsp + rcx + 0x408], al
jmp 0x140012a15
mov rax, qword [rsp + 0x12a0]
add rax, 0x1520
mov r8d, 0x80
mov rdx, rax
lea rcx, [rsp + 0x5d0]
call fcn.1400036d0
lea r9, [rsp + 0x158]
lea r8, [rsp + 0x408]
mov edx, 0xa
lea rcx, [rsp + 0x5d0]
call fcn.140001da0
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a0]
movsxd rax, dword [rax + 0x14c2]
mov rcx, qword [rsp + 0x148]
add rcx, 2
mov r8, rax
lea rdx, [rsp + 0x158]
call fcn.140001880
mov dword [rsp + 0x150], 0x10
mov byte [rsp + 0x141], 1
jmp 0x140013bdc
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov eax, 1
imul rax, rax, 2
mov rcx, qword [rsp + 0x148]
mov byte [rcx + rax + 2], 0
mov dword [rsp + 0x150], 1
mov rax, qword [rsp + 0x12b0]
mov dword [rax], 1
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x148]
add rcx, 2
mov r8d, eax
mov rdx, rcx
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
cmp qword [rsp + 0x148], 0
je 0x140012b81
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
mov dword [rsp + 0x1a8], eax
cmp dword [rsp + 0x1a8], 0
je 0x140012bd9
cmp dword [rsp + 0x1a8], 1
je 0x140012c11
cmp dword [rsp + 0x1a8], 2
je 0x140012e4d
cmp dword [rsp + 0x1a8], 3
je 0x140012f7e
jmp 0x140012fd9
mov byte [rsp + 0x1a0], 1
mov byte [rsp + 0x1a1], 0
mov byte [rsp + 0x1a2], 0
mov r8d, 3
lea rdx, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
jmp 0x140012fd9
mov byte [rsp + 0x1b8], 0x12
mov byte [rsp + 0x1b9], 0x34
mov byte [rsp + 0x1ba], 0x56
mov byte [rsp + 0x1bb], 0x78
mov byte [rsp + 0x1bc], 6
mov byte [rsp + 0x1bd], 1
mov byte [rsp + 0x1be], 0
mov byte [rsp + 0x1bf], 0
mov byte [rsp + 0x1c0], 2
mov byte [rsp + 0x1c1], 0xca
mov byte [rsp + 0x1c2], 0
mov byte [rsp + 0x1c3], 0xe
mov byte [rsp + 0x1c4], 0
mov byte [rsp + 0x1c5], 0
mov byte [rsp + 0x1c6], 0x39
mov byte [rsp + 0x1c7], 0x37
mov byte [rsp + 0x1c8], 2
mov byte [rsp + 0x1c9], 0x24
mov byte [rsp + 0x1ca], 0
mov byte [rsp + 0x1cb], 2
mov byte [rsp + 0x1cc], 0
mov byte [rsp + 0x1cd], 2
mov byte [rsp + 0x1ce], 0
mov byte [rsp + 0x1cf], 0
mov byte [rsp + 0x1d0], 3
mov byte [rsp + 0x1d1], 0x19
mov byte [rsp + 0x1d2], 0x22
mov byte [rsp + 0x1d3], 0xc3
mov byte [rsp + 0x1d4], 0x7b
mov byte [rsp + 0x1d5], 0
mov byte [rsp + 0x1d6], 0
mov byte [rsp + 0x1d7], 0
mov byte [rsp + 0x1d8], 0
mov byte [rsp + 0x1d9], 0
mov byte [rsp + 0x1da], 0
mov byte [rsp + 0x1db], 0
mov byte [rsp + 0x1dc], 0xf8
mov byte [rsp + 0x1dd], 0
mov byte [rsp + 0x1de], 3
mov byte [rsp + 0x1df], 0x7e
mov byte [rsp + 0x1e0], 0
mov byte [rsp + 0x1e1], 0
mov byte [rsp + 0x1e2], 0x92
mov byte [rsp + 0x1e3], 0x8b
mov byte [rsp + 0x1e4], 0
mov byte [rsp + 0x1e5], 0
mov byte [rsp + 0x1e6], 0
mov eax, 1
imul rax, rax, 3
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x1b8], al
mov eax, 1
imul rax, rax, 2
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x1b8], al
mov eax, 1
imul rax, rax, 1
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x1b8], al
mov eax, 1
imul rax, rax, 0
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x1b8], al
mov r8d, 0x2f
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
jmp 0x140012fd9
mov byte [rsp + 0x190], 0x12
mov byte [rsp + 0x191], 0x34
mov byte [rsp + 0x192], 0x56
mov byte [rsp + 0x193], 0x78
mov byte [rsp + 0x194], 0
mov byte [rsp + 0x195], 0
mov byte [rsp + 0x196], 1
mov byte [rsp + 0x197], 0
mov byte [rsp + 0x198], 1
mov byte [rsp + 0x199], 0x21
mov byte [rsp + 0x19a], 0
mov byte [rsp + 0x19b], 0
mov byte [rsp + 0x19c], 1
mov byte [rsp + 0x19d], 0
mov eax, 1
imul rax, rax, 3
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x190], al
mov eax, 1
imul rax, rax, 2
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x190], al
mov eax, 1
imul rax, rax, 1
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x190], al
mov eax, 1
imul rax, rax, 0
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 0x456]
mov byte [rsp + rcx + 0x190], al
mov r8d, 0xe
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
jmp 0x140012fd9
mov byte [rsp + 0x1b0], 0
mov byte [rsp + 0x1b1], 0
mov byte [rsp + 0x1b2], 8
mov byte [rsp + 0x1b3], 0
mov byte [rsp + 0x1b4], 0
mov byte [rsp + 0x1b5], 0
mov byte [rsp + 0x1b6], 0
mov byte [rsp + 0x1b7], 0
mov r8d, 8
lea rdx, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
cmp qword [rsp + 0x148], 0
je 0x140012ff7
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x12a0]
lea rax, [rcx + rax + 4]
mov r8d, 8
xor edx, edx
mov rcx, rax
call fcn.140001bd0
mov rax, qword [rsp + 0x12a8]
inc rax
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rdx + rcx + 4]
mov r8d, 4
mov rdx, rax
call fcn.140001880
mov rax, qword [rsp + 0x12b0]
cmp dword [rax], 8
jbe 0x140013076
mov dword [rsp + 0x308], 8
jmp 0x140013087
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov dword [rsp + 0x308], eax
mov eax, dword [rsp + 0x308]
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rsp + 0x12a0]
lea rcx, [rdx + rcx + 4]
mov r8d, eax
mov rdx, qword [rsp + 0x12b8]
call fcn.140001880
cmp qword [rsp + 0x148], 0
je 0x1400130d2
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
mov byte [rsp + 0x1e8], 0x79
mov byte [rsp + 0x1e9], 0x4c
mov byte [rsp + 0x1ea], 0xe1
mov byte [rsp + 0x1eb], 0x88
mov byte [rsp + 0x1ec], 0xcb
mov byte [rsp + 0x1ed], 0xc1
mov byte [rsp + 0x1ee], 0x78
mov byte [rsp + 0x1ef], 0x53
mov byte [rsp + 0x1f0], 0x11
mov byte [rsp + 0x1f1], 0x69
mov byte [rsp + 0x1f2], 0xe0
mov byte [rsp + 0x1f3], 0xb2
mov byte [rsp + 0x1f4], 0xca
mov byte [rsp + 0x1f5], 0x97
mov byte [rsp + 0x1f6], 0xc9
mov byte [rsp + 0x1f7], 0x76
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x12b8]
call fcn.140001bd0
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x310]
call fcn.140001bd0
mov eax, 1
imul rax, rax, 0
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x12a0]
movzx eax, byte [rdx + rax + 4]
mov byte [rsp + rcx + 0x310], al
mov r8d, 0x80
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x6f0]
call fcn.140003a50
lea r9, [rsp + 0x4b8]
lea r8, [rsp + 0x310]
mov edx, 0xa
lea rcx, [rsp + 0x6f0]
call fcn.140001da0
mov r8d, 0x14
xor edx, edx
lea rcx, [rsp + 0x460]
call fcn.140001bd0
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x310]
call fcn.140001bd0
mov eax, 1
imul rax, rax, 4
mov rcx, qword [rsp + 0x12a0]
lea rax, [rcx + rax + 4]
mov ecx, 1
imul rcx, rcx, 8
lea rcx, [rsp + rcx + 0x310]
mov r8d, 8
mov rdx, rax
call fcn.140001880
mov eax, 1
imul rax, rax, 8
movzx eax, byte [rsp + rax + 0x310]
mov ecx, 1
imul rcx, rcx, 9
movzx ecx, byte [rsp + rcx + 0x310]
xor eax, ecx
and eax, 0x1f
mov ecx, 1
imul rcx, rcx, 2
mov byte [rsp + rcx + 0x310], al
mov eax, 1
imul rax, rax, 2
mov ecx, 1
imul rcx, rcx, 0x12
movzx eax, byte [rsp + rax + 0x310]
mov byte [rsp + rcx + 0x460], al
mov r8d, 0x80
lea rdx, [rsp + 0x4b8]
lea rcx, [rsp + 0x6f0]
call fcn.140003a50
lea r9, [rsp + 0x460]
lea r8, [rsp + 0x310]
mov edx, 0xa
lea rcx, [rsp + 0x6f0]
call fcn.140001da0
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov r8d, eax
lea rdx, [rsp + 0x460]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
cmp qword [rsp + 0x148], 0
je 0x14001332a
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
test eax, eax
jne 0x140013769
mov rax, qword [rsp + 0x12b0]
cmp dword [rax], 0x7c1
jne 0x140013769
mov byte [rsp + 0x200], 0xff
mov byte [rsp + 0x201], 0xc0
mov byte [rsp + 0x202], 0
mov byte [rsp + 0x203], 0
mov byte [rsp + 0x204], 0
mov byte [rsp + 0x205], 4
mov byte [rsp + 0x206], 4
mov byte [rsp + 0x207], 0
mov byte [rsp + 0x208], 0xff
mov byte [rsp + 0x209], 0xc1
mov byte [rsp + 0x20a], 0
mov byte [rsp + 0x20b], 4
mov byte [rsp + 0x20c], 0
mov byte [rsp + 0x20d], 1
mov byte [rsp + 0x20e], 0
mov byte [rsp + 0x20f], 1
mov byte [rsp + 0x210], 0xff
mov byte [rsp + 0x211], 0xc2
mov byte [rsp + 0x212], 0
mov byte [rsp + 0x213], 5
mov byte [rsp + 0x214], 0
mov byte [rsp + 0x215], 0xfd
mov byte [rsp + 0x216], 0
mov byte [rsp + 0x217], 2
mov byte [rsp + 0x218], 0xff
mov byte [rsp + 0x219], 0xc8
mov byte [rsp + 0x21a], 1
mov byte [rsp + 0x21b], 2
mov byte [rsp + 0x21c], 0
mov byte [rsp + 0x21d], 8
mov byte [rsp + 0x21e], 4
mov byte [rsp + 0x21f], 3
mov byte [rsp + 0x220], 0xff
mov byte [rsp + 0x221], 0xc9
mov byte [rsp + 0x222], 2
mov byte [rsp + 0x223], 0x89
mov byte [rsp + 0x224], 0
mov byte [rsp + 0x225], 2
mov byte [rsp + 0x226], 0
mov byte [rsp + 0x227], 7
mov byte [rsp + 0x228], 0xff
mov byte [rsp + 0x229], 0xcc
mov byte [rsp + 0x22a], 2
mov byte [rsp + 0x22b], 0x8b
mov byte [rsp + 0x22c], 0
mov byte [rsp + 0x22d], 6
mov byte [rsp + 0x22e], 4
mov byte [rsp + 0x22f], 0xd
mov byte [rsp + 0x230], 0xff
mov byte [rsp + 0x231], 0xf4
mov byte [rsp + 0x232], 1
mov byte [rsp + 0x233], 0xa
mov byte [rsp + 0x234], 0
mov byte [rsp + 0x235], 0xfc
mov byte [rsp + 0x236], 0
mov byte [rsp + 0x237], 4
mov byte [rsp + 0x238], 0xff
mov byte [rsp + 0x239], 0xf5
mov byte [rsp + 0x23a], 2
mov byte [rsp + 0x23b], 6
mov byte [rsp + 0x23c], 0
mov byte [rsp + 0x23d], 0x80
mov byte [rsp + 0x23e], 0
mov byte [rsp + 0x23f], 5
mov byte [rsp + 0x240], 0xff
mov byte [rsp + 0x241], 0xca
mov byte [rsp + 0x242], 2
mov byte [rsp + 0x243], 0x86
mov byte [rsp + 0x244], 0
mov byte [rsp + 0x245], 3
mov byte [rsp + 0x246], 0
mov byte [rsp + 0x247], 6
mov byte [rsp + 0x248], 0xff
mov byte [rsp + 0x249], 0xcd
mov byte [rsp + 0x24a], 2
mov byte [rsp + 0x24b], 0x91
mov byte [rsp + 0x24c], 0
mov byte [rsp + 0x24d], 1
mov byte [rsp + 0x24e], 0
mov byte [rsp + 0x24f], 9
mov byte [rsp + 0x250], 0xff
mov byte [rsp + 0x251], 0xcb
mov byte [rsp + 0x252], 2
mov byte [rsp + 0x253], 0x92
mov byte [rsp + 0x254], 0
mov byte [rsp + 0x255], 1
mov byte [rsp + 0x256], 0
mov byte [rsp + 0x257], 0xb
mov byte [rsp + 0x258], 0xff
mov byte [rsp + 0x259], 0xff
mov byte [rsp + 0x25a], 0xff
mov byte [rsp + 0x25b], 0xff
mov byte [rsp + 0x25c], 0xff
mov byte [rsp + 0x25d], 0xff
mov byte [rsp + 0x25e], 0xff
mov byte [rsp + 0x25f], 0xff
mov byte [rsp + 0x260], 0xff
mov byte [rsp + 0x261], 0xff
mov byte [rsp + 0x262], 0xff
mov byte [rsp + 0x263], 0xff
mov byte [rsp + 0x264], 0xff
mov byte [rsp + 0x265], 0xff
mov byte [rsp + 0x266], 0xff
mov byte [rsp + 0x267], 0xff
mov byte [rsp + 0x268], 0xff
mov byte [rsp + 0x269], 0xff
mov byte [rsp + 0x26a], 0xff
mov byte [rsp + 0x26b], 0xff
mov byte [rsp + 0x26c], 0xff
mov byte [rsp + 0x26d], 0xff
mov byte [rsp + 0x26e], 0xff
mov byte [rsp + 0x26f], 0xff
mov r8d, 0x7c1
mov edx, 0xff
lea rcx, [rsp + 0xa80]
call fcn.140001bd0
mov r8d, 0x70
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xa80]
call fcn.140001880
mov eax, 1
imul rax, rax, 0x7c0
mov byte [rsp + rax + 0xa80], 0
mov dword [rsp + 0x150], 0x7c1
mov rax, qword [rsp + 0x12b0]
mov dword [rax], 0x7c1
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov r8d, eax
lea rdx, [rsp + 0xa80]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
jmp 0x140013b90
mov rax, qword [rsp + 0x12a8]
movzx eax, word [rax + 1]
test eax, eax
jne 0x140013b90
cmp dword [rsp + 0x30c], 0x1a1
jne 0x140013b90
mov byte [rsp + 0x270], 0xff
mov byte [rsp + 0x271], 0xc0
mov byte [rsp + 0x272], 0
mov byte [rsp + 0x273], 0
mov byte [rsp + 0x274], 0
mov byte [rsp + 0x275], 4
mov byte [rsp + 0x276], 4
mov byte [rsp + 0x277], 0
mov byte [rsp + 0x278], 0xff
mov byte [rsp + 0x279], 0xc1
mov byte [rsp + 0x27a], 0
mov byte [rsp + 0x27b], 4
mov byte [rsp + 0x27c], 0
mov byte [rsp + 0x27d], 1
mov byte [rsp + 0x27e], 0
mov byte [rsp + 0x27f], 1
mov byte [rsp + 0x280], 0xff
mov byte [rsp + 0x281], 0xc2
mov byte [rsp + 0x282], 0
mov byte [rsp + 0x283], 5
mov byte [rsp + 0x284], 0
mov byte [rsp + 0x285], 0xfd
mov byte [rsp + 0x286], 0
mov byte [rsp + 0x287], 2
mov byte [rsp + 0x288], 0xff
mov byte [rsp + 0x289], 0xc8
mov byte [rsp + 0x28a], 1
mov byte [rsp + 0x28b], 2
mov byte [rsp + 0x28c], 0
mov byte [rsp + 0x28d], 8
mov byte [rsp + 0x28e], 4
mov byte [rsp + 0x28f], 3
mov byte [rsp + 0x290], 0xff
mov byte [rsp + 0x291], 0xc9
mov byte [rsp + 0x292], 2
mov byte [rsp + 0x293], 0x89
mov byte [rsp + 0x294], 0
mov byte [rsp + 0x295], 2
mov byte [rsp + 0x296], 0
mov byte [rsp + 0x297], 7
mov byte [rsp + 0x298], 0xff
mov byte [rsp + 0x299], 0xcc
mov byte [rsp + 0x29a], 2
mov byte [rsp + 0x29b], 0x8b
mov byte [rsp + 0x29c], 0
mov byte [rsp + 0x29d], 6
mov byte [rsp + 0x29e], 4
mov byte [rsp + 0x29f], 0xd
mov byte [rsp + 0x2a0], 0xff
mov byte [rsp + 0x2a1], 0xf4
mov byte [rsp + 0x2a2], 1
mov byte [rsp + 0x2a3], 0xa
mov byte [rsp + 0x2a4], 0
mov byte [rsp + 0x2a5], 0xfc
mov byte [rsp + 0x2a6], 0
mov byte [rsp + 0x2a7], 4
mov byte [rsp + 0x2a8], 0xff
mov byte [rsp + 0x2a9], 0xf5
mov byte [rsp + 0x2aa], 2
mov byte [rsp + 0x2ab], 6
mov byte [rsp + 0x2ac], 0
mov byte [rsp + 0x2ad], 0x80
mov byte [rsp + 0x2ae], 0
mov byte [rsp + 0x2af], 5
mov byte [rsp + 0x2b0], 0xff
mov byte [rsp + 0x2b1], 0xca
mov byte [rsp + 0x2b2], 2
mov byte [rsp + 0x2b3], 0x86
mov byte [rsp + 0x2b4], 0
mov byte [rsp + 0x2b5], 3
mov byte [rsp + 0x2b6], 0
mov byte [rsp + 0x2b7], 6
mov byte [rsp + 0x2b8], 0xff
mov byte [rsp + 0x2b9], 0xcd
mov byte [rsp + 0x2ba], 2
mov byte [rsp + 0x2bb], 0x91
mov byte [rsp + 0x2bc], 0
mov byte [rsp + 0x2bd], 1
mov byte [rsp + 0x2be], 0
mov byte [rsp + 0x2bf], 9
mov byte [rsp + 0x2c0], 0xff
mov byte [rsp + 0x2c1], 0xcb
mov byte [rsp + 0x2c2], 2
mov byte [rsp + 0x2c3], 0x92
mov byte [rsp + 0x2c4], 0
mov byte [rsp + 0x2c5], 1
mov byte [rsp + 0x2c6], 0
mov byte [rsp + 0x2c7], 0xb
mov byte [rsp + 0x2c8], 0xff
mov byte [rsp + 0x2c9], 0xff
mov byte [rsp + 0x2ca], 0xff
mov byte [rsp + 0x2cb], 0xff
mov byte [rsp + 0x2cc], 0xff
mov byte [rsp + 0x2cd], 0xff
mov byte [rsp + 0x2ce], 0xff
mov byte [rsp + 0x2cf], 0xff
mov byte [rsp + 0x2d0], 0xff
mov byte [rsp + 0x2d1], 0xff
mov byte [rsp + 0x2d2], 0xff
mov byte [rsp + 0x2d3], 0xff
mov byte [rsp + 0x2d4], 0xff
mov byte [rsp + 0x2d5], 0xff
mov byte [rsp + 0x2d6], 0xff
mov byte [rsp + 0x2d7], 0xff
mov byte [rsp + 0x2d8], 0xff
mov byte [rsp + 0x2d9], 0xff
mov byte [rsp + 0x2da], 0xff
mov byte [rsp + 0x2db], 0xff
mov byte [rsp + 0x2dc], 0xff
mov byte [rsp + 0x2dd], 0xff
mov byte [rsp + 0x2de], 0xff
mov byte [rsp + 0x2df], 0xff
mov r8d, 0x1a1
mov edx, 0xff
lea rcx, [rsp + 0x810]
call fcn.140001bd0
mov r8d, 0x70
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x810]
call fcn.140001880
mov eax, 1
imul rax, rax, 0x1a0
mov byte [rsp + rax + 0x810], 0
mov dword [rsp + 0x150], 0x1a1
mov rax, qword [rsp + 0x12b0]
mov dword [rax], 0x1a1
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov r8d, eax
lea rdx, [rsp + 0x810]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
cmp qword [rsp + 0x148], 0
je 0x140013bae
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140013db6
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140013bce
mov rax, qword [rsp + 0x148]
mov byte [rax], 0
mov rax, qword [rsp + 0x12b0]
mov dword [rax], 0
movzx eax, byte [rsp + 0x440]
mov rcx, qword [rsp + 0x12a0]
movzx ecx, byte [rcx + 3]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x12a0]
mov byte [rcx + 3], al
mov rax, qword [rsp + 0x148]
movzx eax, byte [rax]
test eax, eax
jl 0x140013c7d
mov rax, qword [rsp + 0x148]
movzx eax, byte [rax]
cmp eax, 0x1f
jg 0x140013c7d
mov rax, qword [rsp + 0x12a0]
movzx eax, byte [rax + 3]
inc al
mov byte [rsp + 0x154], al
mov rax, qword [rsp + 0x12a0]
movzx ecx, byte [rsp + 0x154]
mov byte [rax + 3], cl
mov rax, qword [rsp + 0x148]
movzx ecx, byte [rsp + 0x154]
mov byte [rax + 1], cl
mov rax, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x12a8]
movzx ecx, byte [rcx]
and ecx, 0x7f
mov r8, rax
mov dl, 2
call fcn.1400054a0
test eax, eax
je 0x140013c1e
mov rax, qword [rsp + 0x148]
movzx eax, byte [rax]
mov byte [rsp + 0x188], al
mov rax, qword [rsp + 0x148]
movzx eax, byte [rax + 1]
mov byte [rsp + 0x189], al
mov rax, qword [rsp + 0x148]
mov r8, qword [rsp + 0x12a0]
mov edx, 2
mov rcx, rax
call fcn.140010960
movzx eax, byte [rsp + 0x141]
test eax, eax
je 0x140013cee
mov rax, qword [rsp + 0x148]
add rax, 2
mov r8, qword [rsp + 0x12a0]
mov edx, dword [rsp + 0x150]
mov rcx, rax
call fcn.140010960
movzx eax, byte [rsp + 0x188]
test eax, eax
jne 0x140013d24
mov rax, qword [rsp + 0x12a0]
movzx eax, word [rax + 0xe]
and eax, 0xff
movzx ecx, byte [rsp + 0x189]
shl ecx, 8
or eax, ecx
mov rcx, qword [rsp + 0x12a0]
mov word [rcx + 0xe], ax
mov eax, dword [rsp + 0x150]
add rax, 2
mov rcx, qword [rsp + 0x12b0]
mov ecx, dword [rcx]
cmp rax, rcx
jae 0x140013d53
mov eax, dword [rsp + 0x150]
add rax, 2
mov qword [rsp + 0x400], rax
jmp 0x140013d65
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x12b0]
mov ecx, dword [rsp + 0x400]
mov dword [rax], ecx
mov rax, qword [rsp + 0x12b0]
mov eax, dword [rax]
mov r8d, eax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x12b8]
call fcn.140001880
cmp qword [rsp + 0x148], 0
je 0x140013db6
mov edx, 0x4d525356
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
add rsp, 0x1258
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret