Function at 0x14009d420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
mov r14, rcx
mov r15, rdx
mov rcx, qword [rcx + 0xc0]
nop dword [rax]
xor r13d, r13d
cmp qword [r15 + 0x50], rcx
je 0x14009d473
mov eax, dword [r15]
test eax, eax
je 0x14009d465
add r15, rax
jne 0x14009d450
lea r15, [rbp + 0xa0]
mov dword [rbp + 0xa4], r13d
mov r12d, dword [r15 + 4]
test rcx, rcx
jne 0x14009d4a0
test r12d, r12d
je 0x14009d4a0
mov rax, r13
lea rcx, [r15 + 0x130]
mov edx, r12d
nop
mov qword [rcx], rax
lea rcx, [rcx + 0x50]
inc rax
sub rdx, 1
jne 0x14009d490
mov rbx, r13
mov esi, r13d
mov rax, qword [r14]
mov ecx, dword [rax + 0x40]
cmp esi, ecx
jae 0x14009d4d6
mov edx, dword [rax]
mov r8, qword [rax + 0x30]
add edx, 8
mov eax, edx
imul eax, esi
nop
mov edi, eax
inc esi
add rdi, r8
add eax, edx
cmp dword [rdi], 0xffffffff
jne 0x14009d56f
cmp esi, ecx
jb 0x14009d4c0
test rbx, rbx
je 0x14009d689
lea rcx, [r14 + 8]
call sym.ProcessJacker.exe_PhfAcquireFastLockExclusive
mov esi, r13d
cmp dword [rbx], r13d
jbe 0x14009d540
mov rax, qword [rbx + 8]
lea rdx, [rbp + 0x268]
mov ecx, esi
mov rcx, qword [rax + rcx*8]
mov qword [rbp + 0x268], rcx
mov rcx, qword [r14]
call sym.ProcessJacker.exe_PhRemoveEntryHashtable
mov rcx, qword [rbp + 0x268]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d52d
call fcn.1400ae900
inc esi
cmp esi, dword [rbx]
jb 0x14009d4f0
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 + 8]
test eax, 0xffc00000
je 0x14009d640
lea ecx, [rax - 0x3fffff]
lock cmpxchg dword [r14 + 8], ecx
jne 0x14009d65b
mov rcx, qword [r14 + 0x10]
mov edx, 1
jmp 0x14009d66a
mov edx, r13d
test r12d, r12d
je 0x14009d59e
mov rax, qword [rdi + 8]
mov r8, qword [rax]
nop
mov eax, edx
lea rcx, [rax + rax*4]
add rcx, rcx
cmp r8, qword [r15 + rcx*8 + 0x130]
je 0x14009d4a6
inc edx
cmp edx, r12d
jb 0x14009d580
mov rdx, qword [rdi + 8]
lea rcx, [r14 + 0x60]
call sym.ProcessJacker.exe_PhInvokeCallback
test rbx, rbx
jne 0x14009d5fe
mov rbx, qword [0x14015e0c0]
mov edx, 0x10
mov rcx, rbx
call fcn.1400ae820
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov edx, 4
movzx ecx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], cx
mov dword [rbx], r13d
mov dword [rbx + 4], 2
lea r8d, [rdx + 0xc]
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 8], rax
mov eax, dword [rbx + 4]
mov rdi, qword [rdi + 8]
cmp dword [rbx], eax
jne 0x14009d62f
mov r8, qword [rbx + 8]
add eax, eax
mov r9d, eax
mov edx, 4
mov dword [rbx + 4], eax
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
shl r9, 3
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov qword [rbx + 8], rax
mov ecx, dword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rdi
inc dword [rbx]
jmp 0x14009d4a6
mov edx, eax
mov ecx, eax
shr edx, 0xc
and edx, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [r14 + 8], ecx
je 0x14009d662
pause
jmp 0x14009d540
test edx, edx
je 0x14009d673
mov rcx, qword [r14 + 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
lea rcx, [rbx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d689
call fcn.1400ae900
lea rcx, [r14 + 0xe0]
call qword [sym.imp.ntdll.dll_RtlInterlockedFlushSList]
mov rdi, rax
test rax, rax
je 0x14009d77f
mov rbx, rdi
mov rdi, qword [rdi]
cmp dword [rbx + 0x30], r13d
jne 0x14009d6ef
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14009d6ef
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + 0x70]
mov qword [rax + 0x70], rcx
lock inc dword [rcx - 8]
test rdx, rdx
je 0x14009d6e2
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d6e2
call fcn.1400ae900
mov rcx, qword [rbx + 0x18]
mov eax, dword [rbx + 0x30]
mov dword [rcx + 0x80], eax
mov rax, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x38]
mov rdx, qword [rax + 0x90]
mov qword [rax + 0x90], rcx
test rdx, rdx
je 0x14009d720
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d720
call fcn.1400ae900
mov rax, qword [rbx + 0x18]
mov byte [rax + 0xa1], 1
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14009d74a
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d74a
call fcn.1400ae900
mov rcx, qword [rbx + 0x18]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14009d764
call fcn.1400ae900
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov r8, rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rdi, rdi
jne 0x14009d6a2
test r12d, r12d
je 0x14009e152
movaps xmmword [rsp + 0x2f0], xmm6
add r15, 0x130
movss xmm6, dword [0x1401385ac]
mov esi, 0x30
mov rdx, qword [r15]
mov rcx, r14
call fcn.14009ce10
mov qword [rbp + 0x258], rax
mov rcx, rax
test rax, rax
jne 0x14009dd46
mov rdx, qword [0x140159b18]
mov rbx, qword [0x14015e960]
add rdx, 0xc0
mov rdi, qword [r15]
mov rcx, rbx
mov qword [rbp + 0x260], r13
mov qword [0x140159b10], 0xc0
call fcn.1400ae820
lock inc dword [rbx + 4]
mov dword [rax + 8], 1
mov r8d, 0xc0
movzx edx, byte [rbx + 2]
lea rbx, [rax + 0x10]
mov word [rax], dx
mov rcx, rbx
xor edx, edx
call fcn.1400e43c0
lea rdx, [rbx + 0xa2]
mov qword [rbx], rdi
mov r8d, 0xa
mov ecx, edi
call fcn.1400e57e0
xor r8d, r8d
mov rdx, rbx
lea ecx, [r8 + 6]
call fcn.1400136e0
mov rax, qword [r15 - 0x20]
mov edx, 0x40
mov qword [rbp + 0x258], rbx
mov qword [rbx + 8], rax
mov rax, qword [rbp + 0x258]
mov rcx, qword [r15 - 0x30]
mov qword [rsp + 0x30], r13
mov qword [rax + 0x10], rcx
mov rax, qword [rbp + 0x258]
mov rcx, qword [r15 - 0x28]
mov qword [rax + 0x18], rcx
mov rcx, qword [rbp + 0x258]
mov eax, dword [r15 + 0x10]
sub eax, dword [rcx + 0x48]
mov dword [rcx + 0x4c], eax
mov ecx, dword [r15 + 0x10]
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x48], ecx
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x60], ecx
mov ecx, dword [r15 + 0xc]
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x64], ecx
mov ecx, dword [r15 + 0x14]
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x84], ecx
mov rax, qword [rbp + 0x258]
mov ecx, dword [r15 + 0x18]
mov dword [rax + 0x88], ecx
cmp byte [0x14015e000], r13b
mov rax, qword [rbp + 0x258]
lea rbx, [rax + 0x98]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
mov rcx, rbx
jne 0x14009d936
xorps xmm0, xmm0
mov dword [rbp + 0x10], esi
lea r9, [rsp + 0x30]
mov qword [rbp + 0x18], r13
lea r8, [rbp + 0x10]
mov dword [rbp + 0x28], r13d
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtOpenThread]
cmp eax, 0xc0000022
jne 0x14009d940
movzx ecx, byte [0x14015e000]
test cl, cl
je 0x14009d94f
mov edx, 0x40
mov rcx, rbx
lea r8, [rsp + 0x30]
call fcn.1400c0680
test eax, eax
jns 0x14009d9c9
movzx ecx, byte [0x14015e000]
mov rax, qword [rbp + 0x258]
mov ebx, dword [sym.ProcessJacker.exe_ThreadQueryAccess]
mov qword [rsp + 0x40], r13
lea rdi, [rax + 0x98]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
test cl, cl
je 0x14009d97f
mov eax, ebx
and eax, 0x848
cmp eax, ebx
je 0x14009d9ba
xorps xmm0, xmm0
mov dword [rbp + 0x40], esi
lea r9, [rsp + 0x40]
mov qword [rbp + 0x48], r13
lea r8, [rbp + 0x40]
mov dword [rbp + 0x58], r13d
mov edx, ebx
mov qword [rbp + 0x50], r13
mov rcx, rdi
movdqu xmmword [rbp + 0x60], xmm0
call qword [sym.imp.ntdll.dll_NtOpenThread]
cmp eax, 0xc0000022
jne 0x14009d9c9
cmp byte [0x14015e000], r13b
je 0x14009d9c9
lea r8, [rsp + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.1400c0680
cmp dword [sym.ProcessJacker.exe_WindowsVersion], 0x3c
jb 0x14009da4c
cmp qword [r14 + 0xc0], r13
je 0x14009da17
mov rax, qword [rbp + 0x258]
lea r8, [rbp - 0x10]
mov r9d, 0x10
mov qword [rsp + 0x20], r13
mov rcx, qword [rax + 0x98]
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14009da4c
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x258]
jmp 0x14009da36
mov rdx, qword [rbp + 0x258]
movsx eax, byte [0x14015deb8]
mov ecx, dword [rdx]
cmp ecx, eax
jae 0x14009da53
mov rax, qword [0x14015ec48]
mov rcx, qword [rax + rcx*8]
mov rax, rcx
sub rax, qword [rdx + 0x50]
mov qword [rdx + 0x58], rax
mov rax, qword [rbp + 0x258]
mov qword [rax + 0x50], rcx
mov rdx, qword [rbp + 0x258]
mov rax, qword [rdx + 0x10]
sub rax, qword [rdx + 0x28]
mov qword [rdx + 0x30], rax
mov rcx, qword [rbp + 0x258]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x258]
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x38]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbp + 0x258]
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
mov rdx, qword [rbp + 0x258]
mov rcx, qword [rdx + 0x98]
test rcx, rcx
je 0x14009dac6
mov r9d, 8
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x260]
lea edx, [r9 + 1]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov rdx, qword [rbp + 0x258]
mov rax, qword [rbp + 0x260]
test rax, rax
jne 0x14009dadd
mov rax, qword [r15 - 0x10]
mov qword [rbp + 0x260], rax
mov qword [rdx + 0x68], rax
mov rax, qword [rbp + 0x258]
mov rcx, qword [rax + 0x98]
test rcx, rcx
je 0x14009db28
mov r9d, esi
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14009db21
mov rcx, qword [rbp + 0x258]
mov eax, dword [rbp + 0x9c]
mov dword [rcx + 0x8c], eax
jmp 0x14009db32
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x8c], 0x7fffffff
cmp qword [r14 + 0x108], r13
je 0x14009db60
mov rdx, qword [rbp + 0x258]
mov rcx, r14
lea r8, [rdx + 0x80]
mov rdx, qword [rdx + 0x68]
call fcn.14009d180
mov rcx, qword [rbp + 0x258]
mov qword [rcx + 0x70], rax
mov rbx, qword [rbp + 0x258]
cmp qword [rbx + 0x70], r13
jne 0x14009dc06
mov dword [rbx + 0x80], 2
mov edx, 0x42
mov rbx, qword [0x14015e0c8]
mov rcx, rbx
call fcn.1400ae820
lock inc dword [rbx + 4]
lea rdx, [rax + 0x10]
mov edi, 1
mov dword [rax + 8], edi
movzx ecx, byte [rbx + 2]
mov word [rax], cx
lea rax, [rdx + 0x10]
mov qword [rdx + 8], rax
lea r8d, [rdi + 0xf]
mov qword [rdx], rsi
mov word [rax + 0x30], r13w
mov rax, qword [rbp + 0x258]
mov qword [rax + 0x70], rdx
mov rax, qword [rbp + 0x258]
mov rdx, qword [rdx + 8]
mov rcx, qword [rax + 0x68]
mov dword [rdx], 0x780030
add rdx, 4
call fcn.1400e57bc
mov rax, qword [rbp + 0x258]
mov rbx, qword [rax + 0x70]
mov rcx, qword [rbx + 8]
call sym.ProcessJacker.exe_PhCountStringZ
add rax, rax
mov qword [rbx], rax
mov rbx, qword [rbp + 0x258]
jmp 0x14009dc0b
mov edi, 1
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov edx, 4
lea r8d, [rdx + 0x3c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, rax
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x10], r14
lock inc dword [r14 - 8]
mov qword [rdx + 0x18], rbx
test rbx, rbx
je 0x14009dc57
lock inc dword [rbx - 8]
mov rax, qword [r14 + 0x100]
mov qword [rdx + 0x20], rax
call fcn.14009c5f0
xor eax, eax
mov dword [rsp + 0x50], 0x48
mov qword [rsp + 0x54], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov dword [rbp - 0x6c], eax
mov rax, qword [rbp + 0x258]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
mov rax, qword [rbp + 0x258]
setne cl
mov byte [rax + 0xa0], cl
lea rcx, [r14 + 8]
call sym.ProcessJacker.exe_PhfAcquireFastLockExclusive
mov rcx, qword [r14]
lea rdx, [rbp + 0x258]
call sym.ProcessJacker.exe_PhAddEntryHashtable
nop dword [rax + rax]
mov eax, dword [r14 + 8]
test eax, 0xffc00000
je 0x14009dd01
lea ecx, [rax - 0x3fffff]
lock cmpxchg dword [r14 + 8], ecx
jne 0x14009dd1c
mov rcx, qword [r14 + 0x10]
mov edx, edi
jmp 0x14009dd28
mov edx, eax
mov ecx, eax
shr edx, 0xc
and edx, 0x3ff
and ecx, 0xffc00ffe
lock cmpxchg dword [r14 + 8], ecx
je 0x14009dd20
pause
jmp 0x14009dce0
test edx, edx
je 0x14009dd31
mov rcx, qword [r14 + 0x18]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtReleaseSemaphore]
mov rdx, qword [rbp + 0x258]
lea rcx, [r14 + 0x20]
call sym.ProcessJacker.exe_PhInvokeCallback
jmp 0x14009e13c
xor al, al
mov esi, 1
cmp byte [rcx + 0xa1], al
movzx edi, al
mov rax, qword [r15 - 0x30]
cmovne edi, esi
mov qword [rcx + 0x10], rax
mov rcx, qword [r15 - 0x28]
mov rax, qword [rbp + 0x258]
mov qword [rax + 0x18], rcx
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x60], ecx
mov ecx, dword [r15 + 0xc]
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x64], ecx
mov rax, qword [rbp + 0x258]
mov ecx, dword [r15 + 0x14]
mov dword [rax + 0x84], ecx
mov rcx, qword [rbp + 0x258]
mov eax, dword [r15 + 0x18]
cmp dword [rcx + 0x88], eax
je 0x14009ddc1
mov dword [rcx + 0x88], eax
movzx edi, sil
mov rcx, qword [rbp + 0x258]
lea r8, [rcx + 0x80]
cmp dword [r8], 2
jne 0x14009de17
cmp qword [r14 + 0x108], r13
je 0x14009de17
mov rdx, qword [rcx + 0x68]
mov rcx, r14
call fcn.14009d180
mov rcx, qword [rbp + 0x258]
mov rdx, qword [rcx + 0x70]
mov qword [rcx + 0x70], rax
test rdx, rdx
je 0x14009de0c
lea rcx, [rdx - 0x10]
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, esi
jne 0x14009de0c
call fcn.1400ae900
mov rcx, qword [rbp + 0x258]
movzx edi, sil
cmp byte [rcx + 0xa1], r13b
je 0x14009dea5
cmp dword [rcx + 0x80], 2
jne 0x14009dea5
mov rax, qword [r15 - 0x10]
cmp qword [rcx + 0x68], rax
je 0x14009dea5
mov qword [rcx + 0x68], rax
mov edx, 4
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov rbx, qword [rbp + 0x258]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, rax
xor eax, eax
mov qword [rdx], rax
mov qword [rdx + 8], rax
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x38], rax
mov qword [rdx + 0x10], r14
lock inc dword [r14 - 8]
mov qword [rdx + 0x18], rbx
test rbx, rbx
je 0x14009de8e
lock inc dword [rbx - 8]
mov rax, qword [r14 + 0x100]
mov qword [rdx + 0x20], rax
call fcn.14009c5f0
mov rcx, qword [rbp + 0x258]
mov eax, dword [r15 + 0x10]
sub eax, dword [rcx + 0x48]
mov edx, dword [rcx + 0x4c]
mov dword [rcx + 0x4c], eax
mov rax, qword [rbp + 0x258]
mov ecx, dword [r15 + 0x10]
movzx ebx, dil
mov dword [rax + 0x48], ecx
mov r10, qword [rbp + 0x258]
cmp dword [r10 + 0x4c], edx
cmovne ebx, esi
cmp dword [sym.ProcessJacker.exe_WindowsVersion], 0x3c
jb 0x14009df59
mov rdi, qword [r10 + 0x58]
cmp qword [r14 + 0xc0], r13
je 0x14009df19
mov rcx, qword [r10 + 0x98]
lea r8, [rbp]
mov r9d, 0x10
mov qword [rsp + 0x20], r13
lea edx, [r9 + 7]
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov r10, qword [rbp + 0x258]
test eax, eax
js 0x14009df59
mov rcx, qword [rbp]
jmp 0x14009df32
mov ecx, dword [r10]
movsx eax, byte [0x14015deb8]
cmp ecx, eax
jae 0x14009df59
mov rax, qword [0x14015ec48]
mov rcx, qword [rax + rcx*8]
mov rax, rcx
movzx ebx, bl
sub rax, qword [r10 + 0x50]
mov qword [r10 + 0x58], rax
mov rax, qword [rbp + 0x258]
mov qword [rax + 0x50], rcx
mov r10, qword [rbp + 0x258]
cmp qword [r10 + 0x58], rdi
cmovne ebx, esi
mov rax, qword [r10 + 0x10]
sub rax, qword [r10 + 0x28]
mov qword [r10 + 0x30], rax
mov rcx, qword [rbp + 0x258]
mov rax, qword [rcx + 0x10]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x258]
mov rax, qword [rcx + 0x18]
sub rax, qword [rcx + 0x38]
mov qword [rcx + 0x40], rax
mov rcx, qword [rbp + 0x258]
mov rax, qword [rcx + 0x18]
mov qword [rcx + 0x38], rax
cmp dword [sym.ProcessJacker.exe_WindowsVersion], 0x3c
mov r8, qword [rbp + 0x258]
jb 0x14009dfea
cmp byte [0x140152aeb], r13b
je 0x14009dfea
cmp qword [r14 + 0xc0], r13
je 0x14009dfc1
cmp qword [r8 + 0x98], r13
je 0x14009dfea
mov rax, qword [r8 + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x14009dfd6
addss xmm0, xmm6
mov rax, qword [0x14015ec10]
xorps xmm1, xmm1
test rax, rax
cvtsi2ss xmm1, rax
jmp 0x14009e01d
mov rax, qword [r8 + 0x40]
xorps xmm0, xmm0
add rax, qword [r8 + 0x30]
cvtsi2ss xmm0, rax
jns 0x14009e000
addss xmm0, xmm6
mov rdx, qword [0x14015eb98]
xorps xmm1, xmm1
add rdx, qword [0x14015ec28]
add rdx, qword [0x14015ec38]
cvtsi2ss xmm1, rdx
jns 0x14009e023
addss xmm1, xmm6
divss xmm0, xmm1
movss dword [r8 + 0x20], xmm0
mov rax, qword [rbp + 0x258]
mov rcx, qword [rax + 0x98]
mov esi, dword [rax + 0x8c]
test rcx, rcx
je 0x14009e07d
mov r9d, 0x30
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x70]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
test eax, eax
js 0x14009e076
mov rcx, qword [rbp + 0x258]
mov eax, dword [rbp + 0x9c]
mov dword [rcx + 0x8c], eax
jmp 0x14009e087
mov rax, qword [rbp + 0x258]
mov dword [rax + 0x8c], 0x7fffffff
mov rax, qword [rbp + 0x258]
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x48
movzx edi, bl
cmp dword [rax + 0x8c], esi
mov esi, 1
cmovne edi, esi
xor ecx, ecx
mov qword [rbp - 0x5c], rcx
mov qword [rbp - 0x54], rcx
mov qword [rbp - 0x4c], rcx
mov qword [rbp - 0x44], rcx
mov qword [rbp - 0x3c], rcx
mov qword [rbp - 0x34], rcx
mov qword [rbp - 0x2c], rcx
mov qword [rbp - 0x24], rcx
mov dword [rbp - 0x1c], ecx
mov ecx, dword [rax]
movzx ebx, byte [rax + 0xa0]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
movzx edx, dil
mov rax, qword [rbp + 0x258]
setne cl
cmp cl, bl
mov byte [rax + 0xa0], cl
cmovne edx, esi
mov rax, qword [rbp + 0x258]
mov byte [rax + 0xa1], r13b
test dl, dl
je 0x14009e11b
mov rdx, qword [rbp + 0x258]
lea rcx, [r14 + 0x40]
call sym.ProcessJacker.exe_PhInvokeCallback
mov rcx, qword [rbp + 0x258]
add rcx, 0xfffffffffffffff0
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, esi
jne 0x14009e137
call fcn.1400ae900
mov esi, 0x30
add r15, 0x50
sub r12, 1
jne 0x14009d7a4
movaps xmm6, xmmword [rsp + 0x2f0]
lea rcx, [r14 + 0x80]
xor edx, edx
call sym.ProcessJacker.exe_PhInvokeCallback
inc qword [r14 + 0x100]
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret