Function at 0x1400029f0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
mov qword [rbp - 0x10], rcx
mov qword [rcx + 8], rdx
lea rax, vtable.ProcessChecks::EnumerateSuspiciousTimers.0
mov qword [rcx], rax
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
lea rcx, [0x14002a790]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rsi, rsi
je 0x140003251
test rax, rax
je 0x140003251
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x10
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_NtContinue]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], r15b
lea rdx, str.NtContinue
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x140002b04
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140002b11
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002b4c
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003277
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x17
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_RtlCaptureContext]
movups xmmword [rax], xmm0
mov eax, dword [0x14002aad0]
mov dword [rcx + 0x10], eax
movzx eax, word [0x14002aad4]
mov word [rcx + 0x14], ax
movzx eax, byte [0x14002aad6]
mov byte [rcx + 0x16], al
mov byte [rcx + 0x17], 0
lea rdx, [0x14002aaa8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x140002c0d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140002c1a
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002c55
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000327d
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x13
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_RtlCopyMemory]
movups xmmword [rax], xmm0
movzx eax, word [0x14002aaf8]
mov word [rcx + 0x10], ax
movzx eax, byte [0x14002aafa]
mov byte [rcx + 0x12], al
mov byte [rcx + 0x13], 0
lea rdx, str.RtlCopyMemory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x140002d0d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140002d1a
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002d55
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003283
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x13
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_RtlMoveMemory]
movups xmmword [rax], xmm0
movzx eax, word [0x14002ab20]
mov word [rcx + 0x10], ax
movzx eax, byte [0x14002ab22]
mov byte [rcx + 0x12], al
mov byte [rcx + 0x13], 0
lea rdx, str.RtlMoveMemory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x140002e0d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140002e1a
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002e55
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003289
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x19
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_NtFreeVirtualMemory]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14002ab50]
movsd qword [rax + 0x10], xmm0
movzx eax, byte [0x14002ab58]
mov byte [rcx + 0x18], al
mov byte [rcx + 0x19], 0
lea rdx, str.NtFreeVirtualMemory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x140002f0f
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140002f1c
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002f57
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000328f
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x1d
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_NtAllocateVirtualMemory]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14002ab88]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x14002ab90]
mov dword [rcx + 0x18], eax
movzx eax, byte [0x14002ab94]
mov byte [rcx + 0x1c], al
mov byte [rcx + 0x1d], 0
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x14000301a
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140003027
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140003062
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000305d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003295
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x14
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.ntdll_NtCreateThread]
movups xmmword [rax], xmm0
mov eax, dword [0x14002abb8]
mov dword [rcx + 0x10], eax
mov byte [rcx + 0x14], 0
lea rdx, str.NtCreateThread
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x14000310e
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x14000311b
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140003156
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000329b
call fcn.14000769c
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
mov ecx, 0x20
call fcn.140007660
mov rcx, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x15
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.kernel32_ResumeThread]
movups xmmword [rax], xmm0
mov eax, dword [0x14002abe0]
mov dword [rcx + 0x10], eax
movzx eax, byte [0x14002abe4]
mov byte [rcx + 0x14], al
mov byte [rcx + 0x15], 0
lea rdx, str.ResumeThread
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140002910
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, qword [rdi + 0x20]
je 0x14000320c
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [rax + 0x20]
mov qword [rdx + 0x20], rax
add qword [rdi + 0x18], 0x28
jmp 0x140003219
mov r8, rax
lea rcx, [rdi + 0x10]
call fcn.140003ab0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140003251
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000324b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003271
call fcn.14000769c
nop
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140011ad4
nop
call fcn.140011ad4
int3
call fcn.140011ad4
int3
call fcn.140011ad4
int3
call fcn.140011ad4
int3
call fcn.140011ad4
int3
call fcn.140011ad4
int3
call fcn.140011ad4
int3