https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations