Function at 0x14001dd20
Capabilities:
Create restart manager session
Enumerate processes that use resource
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d40]
mov eax, 0x3e40
call fcn.1400540e0
sub rsp, rax
mov rax, qword [0x1400a9100]
xor rax, rsp
mov qword [rbp + 0x3d30], rax
mov rbx, rdx
mov r12, rcx
mov qword [rbp - 0x78], rcx
xor edi, edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x34a0], xmm0
movups xmmword [rbp + 0x34b0], xmm0
movups xmmword [rbp + 0x34c0], xmm0
movups xmmword [rbp + 0x34d0], xmm0
mov word [rbp + 0x34e0], ax
lea r8, [rbp + 0x34a0]
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.RstrtMgr.DLL_RmStartSession
test eax, eax
je 0x14001ddb4
mov qword [r12], rdi
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], rdi
jmp 0x14001e586
lea rax, [rsp + 0x40]
mov qword [rbp - 0x58], rax
mov rax, qword [rbx]
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x60]
mov edx, 1
mov ecx, dword [rsp + 0x40]
call sub.RstrtMgr.DLL_RmRegisterResources
test eax, eax
je 0x14001ddfe
mov qword [r12], rdi
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], rdi
jmp 0x14001e57d
mov dword [rsp + 0x44], 0x14
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, [rsp + 0x44]
lea rdx, [rbp - 0x68]
mov ecx, dword [rsp + 0x40]
call sub.RstrtMgr.DLL_RmGetList
test eax, eax
jne 0x14001ddeb
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov r14, rdi
mov qword [rsp + 0x68], rdi
mov qword [rbp - 0x80], rdi
mov ecx, dword [0x1400b3560]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400abccc], ecx
jg 0x14001ea83
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x3910]
call fcn.14007ec80
mov edx, 0x208
lea rcx, [rbp + 0x3910]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
test eax, eax
jne 0x14001dec0
movups xmmword [rbp + 0x50], xmm0
mov rax, rdi
mov qword [rsp + 0x60], rax
mov qword [rbp + 0x60], rax
mov edi, 7
mov qword [rsp + 0x48], rdi
mov qword [rbp + 0x68], rdi
xor edi, edi
mov word [rbp + 0x50], di
mov rdx, qword [rsp + 0x48]
jmp 0x14001df5e
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rdi
mov r8d, eax
lea rdx, [rbp + 0x3910]
lea rcx, [rbp + 0x30]
call fcn.140004d30
nop
lea rcx, [rbp + 0x30]
call fcn.14001c280
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x48]
cmp r8, 7
cmova rcx, rdx
mov r9, qword [rbp + 0x40]
dec r9
cmp word [rcx + r9*2], 0x5c
je 0x14001df20
lea rax, [rbp + 0x30]
cmp r8, 7
cmova rax, rdx
cmp word [rax + r9*2], 0x2f
jne 0x14001df35
mov qword [rbp + 0x40], r9
lea rax, [rbp + 0x30]
cmp r8, 7
cmova rax, rdx
mov word [rax + r9*2], di
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rdx, xmm0
mov qword [rsp + 0x48], rdx
movq qword [rsp + 0x60], xmm1
mov eax, edi
mov dword [rsp + 0x54], eax
mov r15, qword [rbp + 0x50]
mov r13, qword [rsp + 0x78]
cmp dword [rsp + 0x44], 0
jbe 0x14001e52e
nop dword [rax + rax]
imul rcx, rax, 0x29c
lea rax, [rbp + 0x70]
add rax, rcx
mov qword [rbp - 0x78], rax
mov r8d, dword [rax]
cmp r8d, dword [0x1400abcc8]
je 0x14001e909
xor edx, edx
mov ecx, 0x450
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
cmp rax, 0xffffffffffffffff
cmove rbx, rdi
mov qword [rbp - 0x50], rbx
test rbx, rbx
jne 0x14001dfc8
jmp 0x14001e515
mov rax, qword [0x1400abcb8]
test rax, rax
je 0x14001e787
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x58], edi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rsp + 0x50]
mov edx, 0x1d
mov rcx, rbx
call rax
test eax, eax
jne 0x14001e787
cmp dword [rsp + 0x50], eax
jbe 0x14001e787
xor edx, edx
mov r8d, 0x412
lea rcx, [rbp + 0x34f0]
call fcn.14007ec80
mov r9d, 0x208
lea r8, [rbp + 0x34f0]
xor edx, edx
mov rcx, rbx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
test eax, eax
jne 0x14001e04e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001e515
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
mov dword [rbp - 0x20], edi
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rdi
mov qword [rbp], 7
mov word [rbp - 0x18], di
mov r14d, eax
lea rax, [rbp + 0x34f0]
lea rcx, [rbp - 0x18]
cmp r14, 7
ja 0x14001e121
mov qword [rbp - 8], r14
lea rax, [rax + r14*2]
cmp rax, rcx
jbe 0x14001e0d9
lea rcx, [rbp + 0x34f0]
lea rax, [rbp - 0x18]
cmp rcx, rax
ja 0x14001e0d9
lea rcx, [rbp - 0x18]
lea rax, [rbp + 0x34f0]
cmp rcx, rax
ja 0x14001e0c6
mov rsi, rdi
jmp 0x14001e0dc
lea rsi, [rbp - 0x18]
lea rax, [rbp + 0x34f0]
sub rsi, rax
sar rsi, 1
jmp 0x14001e0dc
mov rsi, r14
mov word [rbp + r14*2 - 0x18], di
lea rdi, [rsi + rsi]
mov r8, rdi
lea rdx, [rbp + 0x34f0]
lea rcx, [rbp - 0x18]
call fcn.14007e5e0
lea rcx, [rbp - 0x18]
add rcx, rdi
mov r8, r14
sub r8, rsi
add r8, r8
lea rax, [rsi + r14]
lea rdx, [rbp + 0x34f0]
lea rdx, [rdx + rax*2]
call fcn.14007e5e0
xor edi, edi
jmp 0x14001e139
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call fcn.14001d900
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], rdi
mov rsi, qword [rbp - 8]
lea r14, [rbp - 0x18]
cmp qword [rbp], 7
cmova r14, qword [rbp - 0x18]
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x14001ead1
cmp rsi, 7
ja 0x14001e18c
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x10], xmm0
jmp 0x14001e233
mov rdi, rsi
or rdi, 7
cmp rdi, rax
jbe 0x14001e1e1
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x14001e20e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001eacb
mov rcx, rax
call fcn.140053270
mov rcx, rax
test rax, rax
je 0x14001eabf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001e213
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001eacb
add rcx, rcx
jne 0x14001e1a9
xor eax, eax
jmp 0x14001e213
call fcn.140053270
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rdi
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14007e5e0
nop
lea rcx, [rbp + 0x10]
call fcn.14001c280
lea r11, [rbp + 0x50]
mov rdi, qword [rsp + 0x48]
cmp rdi, 7
cmova r11, r15
lea rsi, [rbp + 0x10]
mov r14, qword [rbp + 0x10]
mov r15, qword [rbp + 0x28]
cmp r15, 7
cmova rsi, r14
mov rax, qword [rbp + 0x20]
mov r8, qword [rsp + 0x60]
cmp r8, rax
ja 0x14001e2f3
sub rax, r8
test r8, r8
je 0x14001e5b8
lea rdi, [rax + 1]
lea rdi, [rsi + rdi*2]
mov rcx, rsi
movzx r10d, word [r11]
nop
mov rax, rdi
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14001e2bc
cmp word [rcx], r10w
je 0x14001e2b9
cmp rax, 1
je 0x14001e2bc
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x14001e2a6
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14001e2f3
mov rdx, r11
test r8, r8
je 0x14001e2e6
mov r9, rcx
sub r9, r11
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14001e350
add rdx, 2
sub r8, 1
jne 0x14001e2d2
sub rcx, rsi
cmp rcx, 2
jb 0x14001e5b3
mov r14, qword [rbp - 0x78]
lea r9, [r14 + 0x20c]
test r9, r9
je 0x14001e36a
cmp word [r9], 0
je 0x14001e36a
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x14001e311
mov rax, qword [rbp - 0x28]
cmp rdx, rax
ja 0x14001e35e
lea rsi, [rbp - 0x40]
cmp rax, 7
cmova rsi, qword [rbp - 0x40]
mov qword [rbp - 0x30], rdx
lea rdi, [rdx + rdx]
mov r8, rdi
mov rdx, r9
mov rcx, rsi
call fcn.14007e5e0
xor eax, eax
mov word [rsi + rdi], ax
jmp 0x14001e36a
add rcx, 2
mov r8, qword [rsp + 0x60]
jmp 0x14001e290
xor r8d, r8d
lea rcx, [rbp - 0x40]
call fcn.1400106c0
mov eax, dword [r14]
mov dword [rbp - 0x20], eax
mov r14, qword [rsp + 0x68]
cmp r13, r14
je 0x14001e3f3
xorps xmm0, xmm0
movups xmmword [r13], xmm0
xor edi, edi
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], rdi
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [r13], xmm0
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [r13 + 0x10], xmm1
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
mov eax, dword [rbp - 0x20]
mov dword [r13 + 0x20], eax
xorps xmm0, xmm0
movups xmmword [r13 + 0x28], xmm0
mov qword [r13 + 0x38], rdi
mov qword [r13 + 0x40], rdi
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [r13 + 0x28], xmm0
movups xmm1, xmmword [rbp - 8]
movups xmmword [r13 + 0x38], xmm1
mov qword [rbp - 8], rdi
mov edx, 7
mov qword [rbp], rdx
mov word [rbp - 0x18], di
add r13, 0x48
mov qword [rsp + 0x78], r13
jmp 0x14001e418
lea r8, [rbp - 0x40]
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.14001d640
mov r14, qword [rbp - 0x80]
mov qword [rsp + 0x68], r14
mov r13, qword [rsp + 0x78]
mov rdx, qword [rbp]
xor edi, edi
mov rax, qword [rbp + 0x28]
cmp rax, 7
jbe 0x14001e45c
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e453
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eabf
call fcn.1400532ac
mov rdx, qword [rbp]
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], di
cmp rdx, 7
jbe 0x14001e4a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e4a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eac5
call fcn.1400532ac
mov qword [rbp - 8], rdi
mov qword [rbp], 7
mov word [rbp - 0x18], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14001e4f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e4f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eac5
call fcn.1400532ac
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], di
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rbp + 0x50]
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp eax, dword [rsp + 0x44]
jb 0x14001df80
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x70]
mov qword [r12], rax
mov qword [r12 + 8], r13
mov qword [r12 + 0x10], r14
cmp rdx, 7
jbe 0x14001e57d
lea rdx, [rdx*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x14001e574
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eab9
mov rcx, r15
call fcn.1400532ac
nop
mov ecx, dword [rsp + 0x40]
call sub.RstrtMgr.DLL_RmEndSession
mov rax, r12
mov rcx, qword [rbp + 0x3d30]
xor rcx, rsp
call fcn.140053250
mov rbx, qword [rsp + 0x3e90]
add rsp, 0x3e40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [rsp + 0x48]
xor esi, esi
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rsi
cmp r15, 7
jbe 0x14001e603
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001e5fb
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eabf
mov rcx, r14
call fcn.1400532ac
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], si
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x14001e653
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e64e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eac5
call fcn.1400532ac
mov qword [rbp - 8], rsi
mov qword [rbp], 7
mov word [rbp - 0x18], si
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14001e6a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e69e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eac5
call fcn.1400532ac
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp rdi, 7
jbe 0x14001e6fa
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e6f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ea77
call fcn.1400532ac
nop
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x14001e57d
mov rbx, rdi
cmp rdi, r13
je 0x14001e72a
lea rcx, [rbx + 0x28]
call fcn.140001be0
mov rcx, rbx
call fcn.140001be0
add rbx, 0x48
cmp rbx, r13
jne 0x14001e710
mov rcx, qword [rsp + 0x68]
sub rcx, rdi
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*8]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001e77a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ea7d
mov rcx, rdi
call fcn.1400532ac
jmp 0x14001e57d
mov qword [r12], rdi
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdi, qword [rsp + 0x48]
cmp rdi, 7
jbe 0x14001e7e0
lea rdx, [rdi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x14001e7d7
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ea77
mov rcx, r15
call fcn.1400532ac
nop
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14001e57d
cmp rsi, r13
je 0x14001e8b1
lea rbx, [rsi + 0x40]
xor r15d, r15d
nop
mov rdx, qword [rbx]
cmp rdx, 7
jbe 0x14001e83f
mov rcx, qword [rbx - 0x18]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001e83a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001ea7d
mov rcx, r8
call fcn.1400532ac
mov qword [rbx - 8], r15
mov qword [rbx], 7
mov word [rbx - 0x18], r15w
mov rdx, qword [rbx - 0x28]
cmp rdx, 7
jbe 0x14001e88f
mov rcx, qword [rbx - 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001e88a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001ea7d
mov rcx, r8
call fcn.1400532ac
mov qword [rbx - 0x30], r15
mov qword [rbx - 0x28], 7
mov word [rbx - 0x40], r15w
add rbx, 0x48
lea rax, [rbx - 0x40]
cmp rax, r13
jne 0x14001e800
sub r14, rsi
movabs rax, 0xe38e38e38e38e39
imul r14
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*8]
shl rdx, 3
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001e8fc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ea7d
mov rcx, rsi
call fcn.1400532ac
jmp 0x14001e57d
mov qword [r12], rdi
mov qword [r12 + 8], rdi
mov qword [r12 + 0x10], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 7
jbe 0x14001e958
lea rdx, [rdi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x14001e94f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ea77
mov rcx, r15
call fcn.1400532ac
nop
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x14001e57d
cmp rsi, r13
je 0x14001ea27
lea rbx, [rsi + 0x40]
xor r15d, r15d
mov rdx, qword [rbx]
cmp rdx, 7
jbe 0x14001e9b5
mov rcx, qword [rbx - 0x18]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001e9b0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001ea7d
mov rcx, r8
call fcn.1400532ac
mov qword [rbx - 8], r15
mov qword [rbx], 7
mov word [rbx - 0x18], r15w
mov rdx, qword [rbx - 0x28]
cmp rdx, 7
jbe 0x14001ea05
mov rcx, qword [rbx - 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001ea00
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001ea7d
mov rcx, r8
call fcn.1400532ac
mov qword [rbx - 0x30], r15
mov qword [rbx - 0x28], 7
mov word [rbx - 0x40], r15w
add rbx, 0x48
lea rax, [rbx - 0x40]
cmp rax, r13
jne 0x14001e976
sub r14, rsi
movabs rax, 0xe38e38e38e38e39
imul r14
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*8]
shl rdx, 3
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001e8fc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ea7d
jmp 0x14001e8fc
call fcn.1400593b4
nop
call fcn.1400593b4
nop
lea rcx, [0x1400abccc]
call fcn.140053388
cmp dword [0x1400abccc], 0xffffffff
jne 0x14001de65
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x1400abcc8], eax
lea rcx, [0x1400abccc]
call fcn.14005331c
jmp 0x14001de65
call fcn.1400593b4
nop
call fcn.1400593b4
nop
call fcn.1400593b4
nop
call fcn.140001420
int3
call fcn.1400014c0
int3