Function at 0x140007830
Capabilities:
Create process on windows
Enumerate threads
Resume thread
Suspend thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140054080]
xor rax, rsp
mov qword [rbp + 0x208], rax
mov dword [rsp + 0x50], 1
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
xor r15d, r15d
mov qword [rbp + 0xf8], r15
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], r15
mov r8d, 0x43
lea rdx, str._vmware_hostShared_Folders_vmware_shareInjector_BJJinjector.log
lea rcx, [rbp + 0x88]
call fcn.140005930
nop
cmp qword [rbp + 0x98], r15
je 0x140007910
mov ecx, 0x108
call fcn.14001a618
mov rbx, rax
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x108
mov rcx, rax
call fcn.14003d100
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0xf
cmova rdx, qword [rbp + 0x88]
mov rcx, rbx
call fcn.14000a120
nop
mov qword [0x140054cd0], rax
lea rdx, str.___This_is_a_Bytecode_Jiu_Jitsu_injector._Lets_roll_
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
lea rdx, str.___Log_file_name:
lea rcx, [0x140055b00]
call fcn.1400054b0
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 0xf
cmova rdx, qword [rbp + 0x88]
mov r8, qword [rbp + 0x98]
mov rcx, rax
call fcn.14000be50
mov rcx, rax
call fcn.140005760
lea rcx, [0x14004b428]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400573b0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x164], xmm0
movups xmmword [rbp + 0x174], xmm0
movups xmmword [rbp + 0x184], xmm0
movups xmmword [rbp + 0x194], xmm0
movups xmmword [rbp + 0x1a4], xmm0
movups xmmword [rbp + 0x1b4], xmm0
mov dword [rbp + 0x1c4], eax
mov dword [rbp + 0x160], 0x68
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
movups xmm1, xmmword [str.cscript.exe_._target.vbs]
movups xmmword [rbp + 0x1d0], xmm1
movups xmm0, xmmword [0x14004af08]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [0x14004af18]
movups xmmword [rbp + 0x1f0], xmm1
movzx eax, word [0x14004af28]
mov word [rbp + 0x200], ax
lea rdx, str.___Creating_an_interpreter_process_...
lea rcx, [0x140055b00]
call fcn.1400054b0
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140007a88
call fcn.140017120
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Done.
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
lea rdx, str.___Command_line:
lea rcx, [0x140055b00]
call fcn.1400054b0
lea rdx, [rbp + 0x1d0]
call fcn.14000ad30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14000ba10
movzx edx, ax
mov rcx, rbx
call fcn.14000b860
mov rcx, rbx
call fcn.140004ef0
lea rdx, str.___Waiting_for_the_debugger_attach_...
lea rcx, [0x140055b00]
call fcn.1400054b0
lea rdx, [rsp + 0x58]
call fcn.14000b040
lea rdx, str.___Suspending_threads_...
lea rcx, [0x140055b00]
call fcn.1400054b0
mov edi, dword [rbp - 0x18]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
mov r13, r15
mov qword [rsp + 0x68], r15
mov qword [rbp - 0x80], r15
mov dword [rsp + 0x50], 1
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140007b62
mov dword [rsp + 0x50], r15d
mov r14, qword [rsp + 0x78]
mov qword [rbp - 0x30], r14
jmp 0x140007c9c
mov dword [rbp - 0x10], 0x1c
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x140007bcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x409
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x50], r15d
mov r14, qword [rsp + 0x78]
mov qword [rbp - 0x30], r14
jmp 0x140007c9c
mov r14, qword [rsp + 0x78]
mov qword [rbp - 0x30], r14
nop dword [rax + rax]
cmp dword [rbp - 4], edi
jne 0x140007c70
mov r8d, dword [rbp - 8]
mov edx, 1
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140007c37
cmp r14, r13
je 0x140007c1a
mov qword [r14], rax
add r14, 8
mov qword [rsp + 0x78], r14
jmp 0x140007c70
lea r8, [rsp + 0x68]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140016f90
mov r13, qword [rbp - 0x80]
mov r14, qword [rsp + 0x78]
jmp 0x140007c70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x409
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140007be0
mov qword [rsp + 0x68], r13
mov qword [rbp - 0x30], r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x50], r15d
mov rsi, qword [rsp + 0x70]
mov qword [rbp + 0xe8], rsi
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov rbx, r14
sub rbx, rsi
mov qword [rbp - 0x38], rbx
mov r12, rbx
sar r12, 3
movabs rax, 0x1fffffffffffffff
test r12, r12
je 0x140007d4e
cmp r12, rax
ja 0x140008dce
lea rbx, [r12*8]
test rbx, rbx
jne 0x140007cf8
xor edi, edi
jmp 0x140007d35
cmp rbx, 0x1000
jb 0x140007d2a
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140008dd4
call fcn.14001a618
test rax, rax
je 0x140008dda
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140007d35
mov rcx, rbx
call fcn.14001a618
mov rdi, rax
lea r15, [rdi + rbx]
mov r8, qword [rbp - 0x38]
mov rdx, rsi
mov rcx, rdi
call fcn.14003c980
lea rsi, [rdi + r12*8]
jmp 0x140007d56
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
mov rbx, rdi
cmp rdi, rsi
je 0x140007d72
nop
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
add rbx, 8
cmp rbx, rsi
jne 0x140007d60
test rdi, rdi
je 0x140007db3
sub r15, rdi
sar r15, 3
lea rdx, [r15*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140007dab
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008dda
mov rcx, rdi
call fcn.14001a610
lea rdx, str.Done.
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
lea rdx, str.___Enumerating_heap_memory_...
lea rcx, [0x140055b00]
call fcn.1400054b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xor ebx, ebx
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rbx
mov ecx, 0x28
call fcn.14001a618
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe0], rbx
mov ecx, 0x28
call fcn.14001a618
mov r12, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0xd8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov edx, dword [rbp - 0x18]
lea rcx, [rbp + 0xc8]
call fcn.14000ce50
nop
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x60]
call fcn.140009080
mov rsi, rax
mov qword [rsp + 0x60], rax
mov rcx, qword [rax]
mov rdi, qword [rcx]
cmp rdi, rcx
je 0x140007ee0
mov rax, qword [rdi + 0x28]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140007ed6
nop dword [rax]
movups xmm6, xmmword [rbx + 0x10]
lea rdx, str.trace:_heap__start_addr:_0x
mov rcx, qword [0x140054cd0]
call fcn.1400054b0
movq rdx, xmm6
mov rcx, rax
call fcn.140003010
mov rcx, rax
lea rdx, str.__end_addr:_0x
call fcn.1400054b0
psrldq xmm6, 8
movq rdx, xmm6
mov rcx, rax
call fcn.140003010
mov rcx, rax
call fcn.140005760
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x28]
jne 0x140007e80
mov rdi, qword [rdi]
cmp rdi, qword [rsi]
jne 0x140007e70
xor ebx, ebx
mov rcx, rsi
call fcn.140008fd0
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x60]
call fcn.140009080
mov rsi, rax
mov qword [rbp - 0x38], rax
mov r15, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rbx
mov ecx, 0x28
call fcn.14001a618
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x38], rax
mov dword [rsp + 0x50], 2
mov rax, qword [rsi]
mov rdi, qword [rax]
cmp rdi, rax
je 0x140007ff0
nop
mov rax, qword [rdi + 0x28]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140007fe2
mov r9, qword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
sub r9, r8
mov rdx, r15
lea rcx, [rbp - 0x10]
call fcn.14000cc70
movups xmm6, xmmword [rax]
movsd xmm7, qword [rax + 0x10]
mov rsi, qword [rbp + 0x38]
movabs rax, 0x666666666666666
cmp qword [rbp + 0x40], rax
je 0x140008de0
lea rax, [rbp + 0x38]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], 0
mov ecx, 0x28
call fcn.14001a618
movups xmmword [rax + 0x10], xmm6
movsd qword [rax + 0x20], xmm7
inc qword [rbp + 0x40]
mov rcx, qword [rsi + 8]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov qword [rbp + 0xb0], 0
mov qword [rsi + 8], rax
mov qword [rcx], rax
mov rbx, qword [rbx]
cmp rbx, qword [rdi + 0x28]
jne 0x140007f50
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rdi]
cmp rdi, qword [rsi]
jne 0x140007f40
xor ebx, ebx
mov rcx, rsi
call fcn.140008fd0
mov rax, qword [r12 + 8]
mov qword [rax], rbx
mov rcx, qword [r12]
test rcx, rcx
je 0x140008025
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008010
mov qword [r12 + 8], r12
mov rdi, qword [rbp + 0x38]
mov qword [rsp + 0x60], rdi
mov qword [rbp + 0xd8], rdi
mov qword [rbp + 0x38], r12
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0x40], rbx
mov dword [rsp + 0x50], ebx
mov qword [r12], rbx
mov rcx, rbx
test rbx, rbx
je 0x140008075
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008060
mov edx, 0x28
mov rcx, qword [rbp + 0x38]
call fcn.14001a610
mov qword [rsp + 0x20], rdi
mov r9, qword [rdi]
mov r8, qword [rbp + 0x50]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x50]
call fcn.14000b1c0
lea rdx, str.Done.
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
lea rdx, str.___Enumerating_stack_memory_...
lea rcx, [0x140055b00]
call fcn.1400054b0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb0], rbx
mov ecx, 0x28
call fcn.14001a618
mov r15, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov r8, qword [rbp - 0x28]
mov edx, dword [rbp - 0x18]
lea rcx, [rbp + 0xb8]
call fcn.14000d5c0
nop
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x60]
call fcn.140008e90
mov r12, rax
mov qword [rbp - 0x38], rax
mov rdi, qword [rax]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400081f3
nop word [rax + rax]
lea rdx, str.trace:_stack__base:_0x
mov rcx, qword [0x140054cd0]
call fcn.1400054b0
mov rdx, qword [rbx + 0x10]
mov rcx, rax
call fcn.140003010
mov rcx, rax
lea rdx, str.__limit:_0x
call fcn.1400054b0
mov rdx, qword [rbx + 0x18]
mov rcx, rax
call fcn.140003010
mov rcx, rax
lea rdx, str.__size:_0x
call fcn.1400054b0
mov rsi, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, 4
lea rcx, [rbp - 0x78]
call fcn.140019c5c
mov r8, qword [rax]
mov rcx, qword [rsi]
movsxd rcx, dword [rcx + 4]
add rcx, rsi
mov rdx, qword [rax + 8]
call r8
mov rdx, qword [rbx + 0x20]
mov rcx, rsi
call fcn.140003210
mov rcx, rax
call fcn.140005760
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140008140
mov rcx, qword [r12]
mov rax, qword [rcx + 8]
xor edi, edi
mov qword [rax], rdi
mov rcx, qword [rcx]
test rcx, rcx
je 0x140008225
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008210
mov edx, 0x28
mov rcx, qword [r12]
call fcn.14001a610
lea rdx, [rbp + 0xb8]
lea rcx, [rbp - 0x78]
call fcn.140008e90
mov rsi, rax
mov qword [rbp - 0x38], rax
mov r12, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rdi
mov ecx, 0x28
call fcn.14001a618
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x38], rax
mov dword [rsp + 0x50], 4
mov rcx, qword [rsi]
mov rbx, qword [rcx]
cmp rbx, rcx
je 0x140008312
nop dword [rax]
mov r9, qword [rbx + 0x20]
mov r8, qword [rbx + 0x18]
mov rdx, r12
lea rcx, [rbp - 0x10]
call fcn.14000d250
movups xmm6, xmmword [rax]
movsd xmm7, qword [rax + 0x10]
mov rdi, qword [rbp + 0x38]
movabs rax, 0x666666666666666
cmp qword [rbp + 0x40], rax
je 0x140008ded
lea rax, [rbp + 0x38]
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 0
mov ecx, 0x28
call fcn.14001a618
movups xmmword [rax + 0x10], xmm6
movsd qword [rax + 0x20], xmm7
inc qword [rbp + 0x40]
mov rcx, qword [rdi + 8]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov qword [rbp + 0x68], 0
mov qword [rdi + 8], rax
mov qword [rcx], rax
mov rbx, qword [rbx]
mov rcx, qword [rsi]
cmp rbx, rcx
jne 0x140008290
xor edi, edi
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rcx, qword [rcx]
test rcx, rcx
je 0x140008336
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008321
mov edx, 0x28
mov rcx, qword [rsi]
call fcn.14001a610
mov rax, qword [r15 + 8]
xor esi, esi
mov qword [rax], rsi
mov rcx, qword [r15]
test rcx, rcx
je 0x140008375
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008360
mov qword [r15 + 8], r15
mov rdi, qword [rbp + 0x38]
mov qword [rsp + 0x50], rdi
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0x38], r15
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0x40], rsi
mov qword [r15], rsi
mov edx, 0x28
mov rcx, qword [rbp + 0x38]
call fcn.14001a610
mov qword [rsp + 0x20], rdi
mov r9, qword [rdi]
mov r8, qword [rbp + 0x50]
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x50]
call fcn.14000b1c0
lea rdx, str.Done.
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
lea rdx, str.___Searching_a_string:
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
lea rdx, str.Hello__Black_Hat_folks_
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
mov r12, rsi
mov rax, qword [rbp + 0x50]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400084fa
nop
mov r13d, esi
nop dword [rax]
nop word [rax + rax]
movsxd rdi, r13d
mov r8, qword [rbx + 0x20]
sub r8, rdi
mov rdx, qword [rbx + 0x18]
add rdx, rdi
mov r9, qword [str.x48x00x65x00x6Cx00x6Cx00x6Fx00x2Cx00x20x00x42x00x6Cx00x61x00x63x00x6Bx00x20x00x48x00x61x00x74x00x20x00x66x00x6Fx00x6Cx00x6Bx00x73x00x21x00]
lea rcx, [rbp + 0x60]
call fcn.14000e720
mov r15, qword [rbp + 0x68]
test r15, r15
je 0x1400084df
lea rdx, str.___A_search_pattern_found_at_0x
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rdx, qword [rbx + 0x10]
add rdx, rdi
mov r14, qword [rbp + 0x60]
add rdx, r14
mov rcx, rax
call fcn.140003010
mov rcx, rax
call fcn.140005760
lea r8, [rdi + r14]
mov r9, r15
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
call fcn.14000e920
movsxd rsi, dword [0x140054ee4]
add rdi, qword [rbx + 0x10]
add rdi, r14
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x78]
call fcn.140008e90
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14000ead0
test rax, rax
cmovne r12, rax
lea eax, [r14 + r15]
add r13d, eax
jmp 0x140008430
mov rbx, qword [rbx]
cmp rbx, qword [rbp + 0x50]
mov esi, 0
jne 0x140008420
mov r14, qword [rbp - 0x30]
mov r13, qword [rsp + 0x68]
lea rdx, str.___A_management_structure_addr_found_at_0x
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rdx, r12
mov rcx, rax
call fcn.140003010
mov rcx, rax
call fcn.140005760
lea rdx, str.Management_structure_addr:_0x
mov rcx, qword [0x140054cd0]
call fcn.1400054b0
mov rdx, r12
mov rcx, rax
call fcn.140003010
mov rcx, rax
call fcn.140005760
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rsi
mov rax, qword [0x140054ec8]
mov qword [rbp + 0x10], rax
mov eax, dword [0x140054ed0]
mov dword [rbp + 0x18], eax
mov r8, qword [0x140054ef0]
mov rdx, qword [0x140054ee8]
sub r8, rdx
sar r8, 2
lea rcx, [rbp + 0x20]
call fcn.140005b80
mov rax, qword [0x140054ed8]
mov qword [rbp + 0x60], rax
mov eax, dword [0x140054ee0]
mov dword [rbp + 0x68], eax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov qword [rbp + 0x48], rsi
lea r8, [rbp + 0x60]
xor edx, edx
lea rcx, [rbp + 0x38]
call fcn.14000c2e0
mov qword [rbp + 0x128], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov qword [rbp + 0x150], rsi
mov word [rbp + 0x120], 2
mov r8, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x140]
call fcn.140005a30
mov r8, qword [0x140054f08]
mov rdx, qword [0x140054f00]
sub r8, rdx
sar r8, 2
lea rcx, [rbp + 0x128]
call fcn.140005b80
mov dword [rbp + 0x158], esi
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0x110], rsi
lea r8, [rbp + 0x120]
xor edx, edx
lea rcx, [rbp + 0x100]
call fcn.14000c110
lea rax, [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x10]
call fcn.140003420
mov rbx, rax
mov rcx, qword [rbp + 0x10]
mov qword [rbp + 0x60], rcx
mov ecx, dword [rbp + 0x18]
mov dword [rbp + 0x68], ecx
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x70]
call fcn.140003650
nop
mov r9, rbx
lea r8, [rbp + 0x60]
mov rdx, r12
mov rcx, qword [rbp - 0x28]
call fcn.1400021a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], rsi
mov r8, qword [0x140054f20]
mov rdx, qword [0x140054f18]
sub r8, rdx
sar r8, 2
lea rcx, [rbp + 0x60]
call fcn.140005b80
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x60], rax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x58], eax
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140003650
lea r8, [rbp - 0x60]
mov rdx, r12
mov rcx, qword [rbp - 0x28]
call fcn.1400025f0
mov rbx, rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.140003650
mov r9, rbx
lea r8, [rbp - 0x10]
mov rdx, r12
mov rcx, qword [rbp - 0x28]
call fcn.140002c50
lea rdx, str.___Resuming_threads_...
lea rcx, [0x140055b00]
call fcn.1400054b0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov r12, rsi
mov rbx, r14
mov r15, qword [rsp + 0x70]
sub rbx, r15
sar rbx, 3
test rbx, rbx
je 0x1400087c8
movabs rax, 0x1fffffffffffffff
cmp rbx, rax
ja 0x140008dfa
lea rbx, [rbx*8]
test rbx, rbx
jne 0x140008766
mov rdi, rsi
jmp 0x1400087a3
cmp rbx, 0x1000
jb 0x140008798
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140008e00
call fcn.14001a618
test rax, rax
je 0x140008dc8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400087a3
mov rcx, rbx
call fcn.14001a618
mov rdi, rax
lea r12, [rbx + rdi]
mov r8, r14
sub r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.14003c980
mov rax, r14
sub rax, r15
sar rax, 3
lea rsi, [rdi + rax*8]
jmp 0x1400087d0
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
mov rbx, rdi
cmp rdi, rsi
je 0x1400087f2
nop dword [rax + rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rbx, 8
cmp rbx, rsi
jne 0x1400087e0
test rdi, rdi
je 0x140008833
sub r12, rdi
sar r12, 3
lea rdx, [r12*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000882b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008dc8
mov rcx, rdi
call fcn.14001a610
lea rdx, str.Done
lea rcx, [0x140055b00]
call fcn.1400054b0
mov rcx, rax
call fcn.140005760
lea rdx, str.___Exiting_...
lea rcx, [0x140055b00]
call fcn.1400054b0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor r12d, r12d
mov esi, r12d
mov rax, r14
sub rax, r15
sar rax, 3
test rax, rax
je 0x140008907
movabs rcx, 0x1fffffffffffffff
cmp rax, rcx
ja 0x140008dfa
lea rbx, [rax*8]
test rbx, rbx
jne 0x1400088a8
mov edi, r12d
jmp 0x1400088e5
cmp rbx, 0x1000
jb 0x1400088da
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140008e00
call fcn.14001a618
test rax, rax
je 0x140008dc8
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400088e5
mov rcx, rbx
call fcn.14001a618
mov rdi, rax
lea rsi, [rbx + rdi]
mov r8, r14
sub r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.14003c980
sub r14, r15
sar r14, 3
lea r14, [rdi + r14*8]
jmp 0x140008911
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rbx, rdi
cmp rdi, r14
je 0x140008936
nop dword [rax]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140008979
add rbx, 8
cmp rbx, r14
jne 0x140008920
test rdi, rdi
je 0x1400089f3
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400089eb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008dc8
jmp 0x1400089eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rdx, [rbp - 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x409
mov r8d, eax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x1400089f3
sub rsi, rdi
sar rsi, 3
lea rdx, [rsi*8]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400089eb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008dc8
mov rcx, rdi
call fcn.14001a610
mov rax, qword [rbp + 0x50]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140008a12
nop
mov rcx, qword [rbx + 0x18]
call fcn.14001a610
mov rbx, qword [rbx]
cmp rbx, qword [rbp + 0x50]
jne 0x140008a00
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140008a59
mov rax, qword [rbp + 0x70]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e06
call fcn.14001a610
nop
lea rcx, [rbp + 0x100]
call fcn.140004620
nop
mov rcx, qword [rbp + 0x140]
test rcx, rcx
je 0x140008aaa
mov rdx, qword [rbp + 0x150]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008aa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e0c
call fcn.14001a610
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140008af7
mov rax, qword [rbp + 0x138]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008af1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e0c
call fcn.14001a610
nop
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140008b36
mov rdx, qword [rbp + 0x48]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e12
call fcn.14001a610
nop
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140008b7d
mov rax, qword [rbp + 0x30]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e18
call fcn.14001a610
nop
mov rcx, qword [rbp + 0xb8]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rcx, qword [rcx]
test rcx, rcx
je 0x140008ba8
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008b93
mov edx, 0x28
mov rcx, qword [rbp + 0xb8]
call fcn.14001a610
nop
mov rdi, qword [rsp + 0x50]
mov rax, qword [rdi + 8]
mov qword [rax], r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008be5
nop
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008bd0
mov edx, 0x28
mov rcx, rdi
call fcn.14001a610
nop
mov rcx, qword [rbp + 0xc8]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rdi, qword [rcx]
test rdi, rdi
je 0x140008c68
nop dword [rax]
mov rsi, qword [rdi]
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rcx, qword [rcx]
test rcx, rcx
je 0x140008c45
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008c30
mov edx, 0x20
mov rcx, qword [rdi + 0x28]
call fcn.14001a610
mov edx, 0x38
mov rcx, rdi
call fcn.14001a610
mov rdi, rsi
test rsi, rsi
jne 0x140008c10
mov edx, 0x38
mov rcx, qword [rbp + 0xc8]
call fcn.14001a610
nop
mov rdi, qword [rsp + 0x60]
mov rax, qword [rdi + 8]
mov qword [rax], r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x140008ca5
nop
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008c90
mov edx, 0x28
mov rcx, rdi
call fcn.14001a610
nop
mov rcx, qword [rbp + 0x50]
mov rax, qword [rcx + 8]
mov qword [rax], r12
mov rcx, qword [rcx]
test rcx, rcx
je 0x140008ce5
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x28
call fcn.14001a610
mov rcx, rbx
test rbx, rbx
jne 0x140008cd0
mov edx, 0x28
mov rcx, qword [rbp + 0x50]
call fcn.14001a610
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140008d35
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e1e
call fcn.14001a610
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], 0xf
mov byte [rbp + 0x88], 0
test r15, r15
je 0x140008d86
sub r13, r15
and r13, 0xfffffffffffffff8
mov rax, r15
cmp r13, 0x1000
jb 0x140008d7b
add r13, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008dc2
mov rdx, r13
mov rcx, r15
call fcn.14001a610
xor eax, eax
mov rcx, qword [rbp + 0x208]
xor rcx, rsp
call fcn.14001a5f0
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140022fe8
nop
call fcn.140022fe8
nop
call fcn.140006f90
int3
call fcn.140001530
int3
call fcn.140022fe8
nop
lea rcx, str.list_too_long
call fcn.140017600
nop
lea rcx, str.list_too_long
call fcn.140017600
nop
call fcn.140006f90
int3
call fcn.140001530
nop
call fcn.140022fe8
nop
call fcn.140022fe8
nop
call fcn.140022fe8
nop
call fcn.140022fe8
nop
call fcn.140022fe8
int3