Function at 0x14003e9c0
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x140
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x1a0]
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x138], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea rbp, [rsp + 0x98]
mov qword [rbp], r12
mov rcx, qword [0x14036d560]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov rdx, rbp
call qword [case.0x1401f58d0.0]
mov rax, qword [rbp]
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
mov r9, r15
call fcn.14003e470
test eax, eax
je 0x14003eb76
mov ebp, eax
cmp eax, 0x3e
jne 0x14003ed69
lea rdi, [rsp + 0xa0]
mov r8d, 0x98
mov rcx, rdi
mov dl, 0xaa
call fcn.1401a64a0
mov rcx, rdi
call fcn.1400d2000
lea rcx, [rsp + 0xc8]
cmp rcx, rsi
je 0x14003ea8a
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
call fcn.14003f860
mov rcx, r15
call fcn.14003a2e0
test al, al
je 0x14003eae6
mov dword [rsp + 0x70], 1
call fcn.14019ff80
cmp eax, 4
jg 0x14003eac9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x14003eae6
cmp dword [rsp + 0x70], 0
jne 0x14003eae6
mov rcx, qword [0x14036d568]
test rcx, rcx
je 0x14003edb0
call fcn.1400e69a0
mov qword [rsp + 0xf0], rax
lea rdx, str.no_sandbox
mov rcx, rbx
call fcn.1400bda30
test al, al
jne 0x14003eb1d
call fcn.1400bd2d0
lea rdx, str.no_sandbox
mov rcx, rax
call fcn.1400bda30
test al, al
jne 0x14003eb1d
mov rcx, r15
call fcn.14003d7e0
test al, al
jne 0x14003eb25
mov byte [rsp + 0x112], 1
lea rsi, [rsp + 0x70]
lea r8, [rsp + 0xa0]
mov rcx, rsi
mov rdx, rbx
call fcn.1400ded40
mov rcx, r14
mov rdx, rsi
call fcn.1400dfb60
mov rcx, rsi
call fcn.1400c9770
mov rcx, r14
call fcn.1400dfcf0
xor ecx, ecx
test al, al
mov ebp, 0x3f
cmovne ebp, ecx
lea rcx, [rsp + 0xa0]
call fcn.1400d2070
jmp 0x14003ed69
test byte [0x14036aa50], 0x19
jne 0x14003ee0d
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
xor eax, eax
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x90], eax
mov rsi, qword [0x14036d560]
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], rcx
lea rbp, [rsp + 0x70]
mov rcx, rbx
mov rdx, rbp
call fcn.1400bf7a0
cmp byte [rbp + 0x17], 0
jns 0x14003ebe0
mov rbp, qword [rsp + 0x70]
lea rdi, [rsp + 0x58]
mov rcx, rbx
mov rdx, rdi
call fcn.1400bd9d0
cmp byte [rdi + 0x17], 0
mov rdx, rdi
jns 0x14003ebfe
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsi]
mov rax, qword [rax + 0x10]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x94]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x88]
mov rcx, rsi
mov r8, rbp
call qword [case.0x1401f58d0.0]
mov ebp, eax
mov rcx, rdi
call fcn.1400c3520
cmp byte [rsp + 0x87], 0
jns 0x14003ec5e
mov rcx, qword [rsp + 0x70]
call fcn.1401a2ea8
lea rcx, [rsp + 0x70]
mov qword [rcx + 0x10], r12
movaps xmm0, xmmword [0x140232ef0]
movaps xmmword [rcx], xmm0
lea rdx, [rsp + 0xa0]
call fcn.1400e21e0
test byte [0x14036aa50], 0x19
jne 0x14003ee66
test ebp, ebp
je 0x14003eca7
mov edx, dword [rsp + 0x90]
lea rcx, str.Process.Sandbox.Launch.Error
call fcn.1400cd390
jmp 0x14003ed5f
mov rsi, qword [0x140390858]
test rsi, rsi
je 0x14003ece5
lea rdi, [rsp + 0x58]
mov rcx, rbx
mov rdx, rdi
call fcn.1400bf7a0
mov edx, dword [rsp + 0x80]
mov rcx, rsi
mov r8, rdi
call fcn.1400c19d0
cmp byte [rdi + 0x17], 0
jns 0x14003ece5
mov rcx, qword [rsp + 0x58]
call fcn.1401a2ea8
mov edx, dword [rsp + 0x94]
test edx, edx
je 0x14003ed11
mov esi, dword [rsp + 0x90]
lea rcx, str.Process.Sandbox.Launch.WarningResultCode
call fcn.1400cd390
lea rcx, str.Process.Sandbox.Launch.Warning
mov edx, esi
call fcn.1400cd390
mov rdx, qword [rsp + 0x70]
mov rcx, r15
call fcn.14003a2a0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14003eebc
lea rcx, [rsp + 0x70]
call fcn.1400e25c0
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov rdx, rax
call fcn.1400dfa30
mov rcx, r14
mov rdx, rsi
call fcn.1400dfb60
mov rcx, rsi
call fcn.1400c9770
lea rcx, [rsp + 0x70]
call fcn.1400e2350
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x98], 0
test rcx, rcx
je 0x14003ed8c
mov edx, 1
call fcn.140172510
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.1401a4270
mov eax, ebp
add rsp, 0x140
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 8
call fcn.1401a2e6c
mov rsi, rax
mov rcx, rax
call fcn.140063e10
mov qword [0x14036d568], rsi
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call fcn.1401028e0
test eax, eax
je 0x14003ee01
mov qword [0x14036d568], 0
mov ebp, 0x2f
jmp 0x14003eb64
mov rcx, qword [0x14036d568]
jmp 0x14003ead9
call sub.KERNEL32.dll_GetCurrentThreadId
mov esi, eax
lea rdi, [rsp + 0xa0]
mov qword [rdi], r12
mov rcx, rdi
call fcn.1401a0500
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x14036aa50]
lea r8, str.StartProcessWithAccess::LAUNCHPROCESS
mov cl, 0x42
xor r9d, r9d
call fcn.1400ec9b0
jmp 0x14003eb83
call sub.KERNEL32.dll_GetCurrentThreadId
mov esi, eax
lea rdi, [rsp + 0x58]
mov qword [rdi], r12
mov rcx, rdi
call fcn.1401a0500
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rdx, [0x14036aa50]
lea r8, str.StartProcessWithAccess::LAUNCHPROCESS
mov cl, 0x45
xor r9d, r9d
call fcn.1400ec9b0
jmp 0x14003ec8b
int3