Function at 0x140003d00
Capabilities:
Access peb ldr_data
Hash data using fnv
Protect spawned processes with mitigation policies
Resolve function by parsing pe exports
Spoof parent pid

Disassembly:
push rsi
push rdi
sub rsp, 0x718
mov qword [rsp + 0x98], rcx
mov rax, rcx
mov qword [rsp + 0xa0], rax
mov rax, qword [0x14003ef40]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0x640], r9
mov qword [rsp + 0x638], r8
mov qword [rsp + 0x630], rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x610], xmm0
movaps xmmword [rsp + 0x600], xmm0
movaps xmmword [rsp + 0x5f0], xmm0
movaps xmmword [rsp + 0x5e0], xmm0
movaps xmmword [rsp + 0x5d0], xmm0
movaps xmmword [rsp + 0x5c0], xmm0
movaps xmmword [rsp + 0x5b0], xmm0
mov dword [rsp + 0x5b0], 0x70
mov dword [rsp + 0x5ec], 1
mov word [rsp + 0x5f0], 0
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor r8d, r8d
mov ecx, r8d
mov edx, 2
lea r9, [rsp + 0x628]
call rax
mov dword [rsp + 0x5a8], 0
lea rax, [rsp + 0x59f]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x688]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x240]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x688]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x250], rax
lea rax, [rsp + 0x670]
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x250]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x250]
mov qword [rsp + 0x2c8], rcx
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2c8]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + rdx + 0x88]
mov qword [rsp + 0x690], rcx
mov rcx, qword [rsp + 0x250]
mov edx, dword [rsp + 0x690]
add rcx, rdx
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x694]
mov dword [rax + 0x10], ecx
lea rax, [rsp + 0x670]
mov qword [rsp + 0x258], rax
mov rcx, qword [rsp + 0x258]
mov rax, qword [rcx + 8]
cmp rax, qword [rcx]
je 0x140004083
lea rax, [rsp + 0x670]
mov qword [rsp + 0x260], rax
mov rax, qword [rsp + 0x260]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x234], eax
mov eax, dword [rsp + 0x234]
mov ecx, eax
add ecx, 0xffffffff
mov dword [rsp + 0x234], ecx
cmp eax, 0
je 0x14000407e
movabs rax, 0x26d4896f1e26fc7c
mov qword [rsp + 0x280], rax
mov rax, qword [rsp + 0x280]
shr rax, 0x20
mov ecx, eax
mov eax, dword [rsp + 0x234]
mov dword [rsp + 0x294], eax
lea rax, [rsp + 0x670]
mov qword [rsp + 0x288], rax
mov r8, qword [rsp + 0x288]
mov rax, qword [r8]
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
mov r8d, dword [r8 + 0x20]
add rdx, r8
mov r8d, dword [rsp + 0x294]
mov edx, dword [rdx + r8*4]
add rax, rdx
mov dword [rsp + 0x27c], ecx
mov qword [rsp + 0x270], rax
mov eax, dword [rsp + 0x27c]
mov dword [rsp + 0x26c], eax
mov rax, qword [rsp + 0x270]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x270], rcx
mov al, byte [rax]
mov byte [rsp + 0x26b], al
cmp byte [rsp + 0x26b], 0
je 0x140004046
mov cl, byte [rsp + 0x26b]
mov eax, dword [rsp + 0x26c]
mov byte [rsp + 0x2d7], cl
mov dword [rsp + 0x2d0], eax
mov eax, dword [rsp + 0x2d0]
mov dword [rsp + 0x94], eax
movsx eax, byte [rsp + 0x2d7]
cmp eax, 0x41
jl 0x140004012
movsx eax, byte [rsp + 0x2d7]
cmp eax, 0x5a
jg 0x140004012
movsx eax, byte [rsp + 0x2d7]
or eax, 0x20
mov dword [rsp + 0x90], eax
jmp 0x140004021
movsx eax, byte [rsp + 0x2d7]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x94]
mov ecx, dword [rsp + 0x90]
xor eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
mov dword [rsp + 0x26c], eax
jmp 0x140003f81
mov eax, dword [rsp + 0x26c]
movabs rcx, 0x26d4896f1e26fc7c
mov qword [rsp + 0x298], rcx
movabs rcx, 0xffffffff
and rcx, qword [rsp + 0x298]
cmp eax, ecx
je 0x1400040b9
jmp 0x140003ee2
jmp 0x140004083
lea rax, [rsp + 0x688]
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov rcx, qword [rax]
mov qword [rsp + 0x2d8], rcx
mov rcx, qword [rsp + 0x2d8]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x140003e0c
mov eax, dword [rsp + 0x234]
mov dword [rsp + 0x2bc], eax
lea rax, [rsp + 0x670]
mov qword [rsp + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x1c]
add rcx, rdx
mov qword [rsp + 0x2a8], rcx
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x24]
add rcx, rdx
mov qword [rsp + 0x2a0], rcx
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2a0]
mov r8d, dword [rsp + 0x2bc]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x238], rax
mov rax, qword [rsp + 0x238]
call rax
mov qword [rsp + 0x5a0], rax
lea rax, [rsp + 0x628]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x5a8]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x5a0]
mov qword [rsp + 0xb8], rax
lea rax, [rsp + 0x5af]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x660]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x190]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x660]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x648]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x1a0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x1a0]
mov qword [rsp + 0x218], rcx
mov rcx, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x218]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + rdx + 0x88]
mov qword [rsp + 0x668], rcx
mov rcx, qword [rsp + 0x1a0]
mov edx, dword [rsp + 0x668]
add rcx, rdx
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x66c]
mov dword [rax + 0x10], ecx
lea rax, [rsp + 0x648]
mov qword [rsp + 0x1a8], rax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [rcx + 8]
cmp rax, qword [rcx]
je 0x14000442c
lea rax, [rsp + 0x648]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x184], eax
mov eax, dword [rsp + 0x184]
mov ecx, eax
add ecx, 0xffffffff
mov dword [rsp + 0x184], ecx
cmp eax, 0
je 0x140004427
movabs rax, 0x25d487dc9472ff1b
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
shr rax, 0x20
mov ecx, eax
mov eax, dword [rsp + 0x184]
mov dword [rsp + 0x1e4], eax
lea rax, [rsp + 0x648]
mov qword [rsp + 0x1d8], rax
mov r8, qword [rsp + 0x1d8]
mov rax, qword [r8]
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
mov r8d, dword [r8 + 0x20]
add rdx, r8
mov r8d, dword [rsp + 0x1e4]
mov edx, dword [rdx + r8*4]
add rax, rdx
mov dword [rsp + 0x1cc], ecx
mov qword [rsp + 0x1c0], rax
mov eax, dword [rsp + 0x1cc]
mov dword [rsp + 0x1bc], eax
mov rax, qword [rsp + 0x1c0]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x1c0], rcx
mov al, byte [rax]
mov byte [rsp + 0x1bb], al
cmp byte [rsp + 0x1bb], 0
je 0x1400043ef
mov cl, byte [rsp + 0x1bb]
mov eax, dword [rsp + 0x1bc]
mov byte [rsp + 0x227], cl
mov dword [rsp + 0x220], eax
mov eax, dword [rsp + 0x220]
mov dword [rsp + 0x8c], eax
movsx eax, byte [rsp + 0x227]
cmp eax, 0x41
jl 0x1400043bb
movsx eax, byte [rsp + 0x227]
cmp eax, 0x5a
jg 0x1400043bb
movsx eax, byte [rsp + 0x227]
or eax, 0x20
mov dword [rsp + 0x88], eax
jmp 0x1400043ca
movsx eax, byte [rsp + 0x227]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x8c]
mov ecx, dword [rsp + 0x88]
xor eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
mov dword [rsp + 0x1bc], eax
jmp 0x14000432a
mov eax, dword [rsp + 0x1bc]
movabs rcx, 0x25d487dc9472ff1b
mov qword [rsp + 0x1e8], rcx
movabs rcx, 0xffffffff
and rcx, qword [rsp + 0x1e8]
cmp eax, ecx
je 0x140004462
jmp 0x14000428b
jmp 0x14000442c
lea rax, [rsp + 0x660]
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x210]
mov rcx, qword [rax]
mov qword [rsp + 0x228], rcx
mov rcx, qword [rsp + 0x228]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x1400041b5
mov eax, dword [rsp + 0x184]
mov dword [rsp + 0x20c], eax
lea rax, [rsp + 0x648]
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0x200]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x1c]
add rcx, rdx
mov qword [rsp + 0x1f8], rcx
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x24]
add rcx, rdx
mov qword [rsp + 0x1f0], rcx
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x1f0]
mov r8d, dword [rsp + 0x20c]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov rcx, qword [rsp + 0xc8]
mov r8, qword [rcx]
mov rcx, qword [rsp + 0xc0]
mov edx, dword [rcx]
mov rcx, qword [rsp + 0xb8]
mov rcx, qword [rcx]
call rax
mov qword [rsp + 0x618], rax
mov rcx, qword [rsp + 0x618]
mov rax, qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov edx, 2
xor r8d, r8d
mov dword [rsp + 0x7c], r8d
lea r9, [rsp + 0x628]
call rax
mov dword [rsp + 0x568], 0x30
mov qword [rsp + 0x570], 0
mov dword [rsp + 0x580], 0
mov qword [rsp + 0x578], 0
mov qword [rsp + 0x588], 0
mov qword [rsp + 0x590], 0
mov rcx, qword [rsp + 0x630]
call fcn.140003510
mov dword [rsp + 0x564], eax
mov eax, dword [rsp + 0x564]
mov qword [rsp + 0x550], rax
mov qword [rsp + 0x558], 0
mov edx, dword [0x140043014]
lea rcx, [rsp + 0x544]
mov qword [rsp + 0x70], rcx
call fcn.140003320
mov rcx, qword [rsp + 0x70]
mov rax, rsp
lea rdx, [rsp + 0x550]
mov qword [rax + 0x20], rdx
lea rdx, [rsp + 0x548]
mov qword [rsp + 0x80], rdx
mov r8d, 0x80
lea r9, [rsp + 0x568]
call fcn.140003c40
mov edx, dword [rsp + 0x7c]
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x618]
mov rax, rsp
mov qword [rax + 0x30], 0
mov qword [rax + 0x28], 0
mov qword [rax + 0x20], 8
mov rax, qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov r8d, 0x20000
call rax
lea rax, [rsp + 0x564]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x630]
mov qword [rsp + 0xf0], rax
lea rax, [0x14002d4a0]
mov qword [rsp + 0xe8], rax
lea rax, str._4s___Spoofed_parent_process:__ws__PID:__lu__n
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x543]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x2f0], rax
mov rax, qword [rsp + 0x2f0]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x6b0]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x300], rax
lea rax, [rsp + 0x698]
mov qword [rsp + 0x2f8], rax
mov rax, qword [rsp + 0x2f8]
mov rcx, qword [rsp + 0x300]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x300]
mov qword [rsp + 0x378], rcx
mov rcx, qword [rsp + 0x378]
mov rdx, qword [rsp + 0x378]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + rdx + 0x88]
mov qword [rsp + 0x6b8], rcx
mov rcx, qword [rsp + 0x300]
mov edx, dword [rsp + 0x6b8]
add rcx, rdx
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x6bc]
mov dword [rax + 0x10], ecx
lea rax, [rsp + 0x698]
mov qword [rsp + 0x308], rax
mov rcx, qword [rsp + 0x308]
mov rax, qword [rcx + 8]
cmp rax, qword [rcx]
je 0x14000491c
lea rax, [rsp + 0x698]
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x310]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x2e4], eax
mov eax, dword [rsp + 0x2e4]
mov ecx, eax
add ecx, 0xffffffff
mov dword [rsp + 0x2e4], ecx
cmp eax, 0
je 0x140004917
movabs rax, 0x17a3c5cf1dc582db
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
shr rax, 0x20
mov ecx, eax
mov eax, dword [rsp + 0x2e4]
mov dword [rsp + 0x344], eax
lea rax, [rsp + 0x698]
mov qword [rsp + 0x338], rax
mov r8, qword [rsp + 0x338]
mov rax, qword [r8]
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
mov r8d, dword [r8 + 0x20]
add rdx, r8
mov r8d, dword [rsp + 0x344]
mov edx, dword [rdx + r8*4]
add rax, rdx
mov dword [rsp + 0x32c], ecx
mov qword [rsp + 0x320], rax
mov eax, dword [rsp + 0x32c]
mov dword [rsp + 0x31c], eax
mov rax, qword [rsp + 0x320]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x320], rcx
mov al, byte [rax]
mov byte [rsp + 0x31b], al
cmp byte [rsp + 0x31b], 0
je 0x1400048df
mov cl, byte [rsp + 0x31b]
mov eax, dword [rsp + 0x31c]
mov byte [rsp + 0x387], cl
mov dword [rsp + 0x380], eax
mov eax, dword [rsp + 0x380]
mov dword [rsp + 0x6c], eax
movsx eax, byte [rsp + 0x387]
cmp eax, 0x41
jl 0x1400048b4
movsx eax, byte [rsp + 0x387]
cmp eax, 0x5a
jg 0x1400048b4
movsx eax, byte [rsp + 0x387]
or eax, 0x20
mov dword [rsp + 0x68], eax
jmp 0x1400048c0
movsx eax, byte [rsp + 0x387]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x68]
xor eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
mov dword [rsp + 0x31c], eax
jmp 0x140004829
mov eax, dword [rsp + 0x31c]
movabs rcx, 0x17a3c5cf1dc582db
mov qword [rsp + 0x348], rcx
movabs rcx, 0xffffffff
and rcx, qword [rsp + 0x348]
cmp eax, ecx
je 0x140004952
jmp 0x14000478a
jmp 0x14000491c
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov rcx, qword [rax]
mov qword [rsp + 0x388], rcx
mov rcx, qword [rsp + 0x388]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x1400046b4
mov eax, dword [rsp + 0x2e4]
mov dword [rsp + 0x36c], eax
lea rax, [rsp + 0x698]
mov qword [rsp + 0x360], rax
mov rax, qword [rsp + 0x360]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x1c]
add rcx, rdx
mov qword [rsp + 0x358], rcx
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x24]
add rcx, rdx
mov qword [rsp + 0x350], rcx
mov rax, qword [rax]
mov rcx, qword [rsp + 0x358]
mov rdx, qword [rsp + 0x350]
mov r8d, dword [rsp + 0x36c]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0xf8]
mov r9d, dword [rcx]
mov rcx, qword [rsp + 0xf0]
mov r8, qword [rcx]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call rax
movabs rax, 0x100000000000
mov qword [rsp + 0x538], rax
mov rcx, qword [rsp + 0x618]
xor edx, edx
mov r8d, 0x20007
lea r9, [rsp + 0x538]
xor eax, eax
mov qword [rsp + 0x20], 8
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
mov dword [rsp + 0x534], 0
cmp dword [section..data], 3
jne 0x140004a75
mov dword [rsp + 0x534], 0x80010
jmp 0x140004a80
mov dword [rsp + 0x534], 0x8080004
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x528], rax
lea rax, [rsp + 0x5b0]
mov qword [rsp + 0x520], rax
mov qword [rsp + 0x518], 0
mov dword [rsp + 0x514], 1
mov qword [rsp + 0x508], 0
mov qword [rsp + 0x500], 0
mov rax, qword [rsp + 0x638]
mov qword [rsp + 0x4f8], rax
lea rax, [rsp + 0x528]
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x520]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x640]
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x518]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x534]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x514]
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0x508]
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x4f8]
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x638]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x533]
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x6d8]
mov qword [rsp + 0x3a0], rax
mov rax, qword [rsp + 0x3a0]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x6d8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x3b0], rax
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov rcx, qword [rsp + 0x3b0]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x3b0]
mov qword [rsp + 0x428], rcx
mov rcx, qword [rsp + 0x428]
mov rdx, qword [rsp + 0x428]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + rdx + 0x88]
mov qword [rsp + 0x6e0], rcx
mov rcx, qword [rsp + 0x3b0]
mov edx, dword [rsp + 0x6e0]
add rcx, rdx
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x6e4]
mov dword [rax + 0x10], ecx
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x3b8], rax
mov rcx, qword [rsp + 0x3b8]
mov rax, qword [rcx + 8]
cmp rax, qword [rcx]
je 0x140004e23
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x3c0]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x394], eax
mov eax, dword [rsp + 0x394]
mov ecx, eax
add ecx, 0xffffffff
mov dword [rsp + 0x394], ecx
cmp eax, 0
je 0x140004e1e
movabs rax, 0x17549c7e902fb210
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
shr rax, 0x20
mov ecx, eax
mov eax, dword [rsp + 0x394]
mov dword [rsp + 0x3f4], eax
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x3e8], rax
mov r8, qword [rsp + 0x3e8]
mov rax, qword [r8]
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
mov r8d, dword [r8 + 0x20]
add rdx, r8
mov r8d, dword [rsp + 0x3f4]
mov edx, dword [rdx + r8*4]
add rax, rdx
mov dword [rsp + 0x3dc], ecx
mov qword [rsp + 0x3d0], rax
mov eax, dword [rsp + 0x3dc]
mov dword [rsp + 0x3cc], eax
mov rax, qword [rsp + 0x3d0]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x3d0], rcx
mov al, byte [rax]
mov byte [rsp + 0x3cb], al
cmp byte [rsp + 0x3cb], 0
je 0x140004de6
mov cl, byte [rsp + 0x3cb]
mov eax, dword [rsp + 0x3cc]
mov byte [rsp + 0x437], cl
mov dword [rsp + 0x430], eax
mov eax, dword [rsp + 0x430]
mov dword [rsp + 0x64], eax
movsx eax, byte [rsp + 0x437]
cmp eax, 0x41
jl 0x140004dbb
movsx eax, byte [rsp + 0x437]
cmp eax, 0x5a
jg 0x140004dbb
movsx eax, byte [rsp + 0x437]
or eax, 0x20
mov dword [rsp + 0x60], eax
jmp 0x140004dc7
movsx eax, byte [rsp + 0x437]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
xor eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
mov dword [rsp + 0x3cc], eax
jmp 0x140004d30
mov eax, dword [rsp + 0x3cc]
movabs rcx, 0x17549c7e902fb210
mov qword [rsp + 0x3f8], rcx
movabs rcx, 0xffffffff
and rcx, qword [rsp + 0x3f8]
cmp eax, ecx
je 0x140004e59
jmp 0x140004c91
jmp 0x140004e23
lea rax, [rsp + 0x6d8]
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x420]
mov rcx, qword [rax]
mov qword [rsp + 0x438], rcx
mov rcx, qword [rsp + 0x438]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x140004bbb
mov eax, dword [rsp + 0x394]
mov dword [rsp + 0x41c], eax
lea rax, [rsp + 0x6c0]
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x410]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x1c]
add rcx, rdx
mov qword [rsp + 0x408], rcx
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x24]
add rcx, rdx
mov qword [rsp + 0x400], rcx
mov rax, qword [rax]
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x400]
mov r8d, dword [rsp + 0x41c]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov rcx, qword [rsp + 0x150]
mov rdi, qword [rcx]
mov rcx, qword [rsp + 0x148]
mov rsi, qword [rcx]
mov rcx, qword [rsp + 0x140]
mov r11, qword [rcx]
mov rcx, qword [rsp + 0x130]
mov r10d, dword [rcx]
mov rcx, qword [rsp + 0x128]
mov r9d, dword [rcx]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rcx]
mov rcx, qword [rsp + 0x108]
mov rcx, qword [rcx]
mov r8, rsp
mov qword [r8 + 0x48], rdi
mov qword [r8 + 0x40], rsi
mov qword [r8 + 0x38], r11
mov dword [r8 + 0x28], r10d
mov dword [r8 + 0x20], r9d
mov qword [r8 + 0x30], 0
xor r8d, r8d
mov r9d, r8d
mov r8, r9
call rax
mov rax, qword [rsp + 0x98]
add rax, 0x10
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x638]
mov qword [rsp + 0x170], rax
lea rax, [0x14002d4a0]
mov qword [rsp + 0x168], rax
lea rax, str._4s___Spawned_process:__t_ws__PID:__lu__n
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x4f7]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x700]
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x450]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov qword [rax], rcx
mov rax, qword [rsp + 0x700]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x460], rax
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x458], rax
mov rax, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x460]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x460]
mov qword [rsp + 0x4d8], rcx
mov rcx, qword [rsp + 0x4d8]
mov rdx, qword [rsp + 0x4d8]
movsxd rdx, dword [rdx + 0x3c]
mov rcx, qword [rcx + rdx + 0x88]
mov qword [rsp + 0x708], rcx
mov rcx, qword [rsp + 0x460]
mov edx, dword [rsp + 0x708]
add rcx, rdx
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x70c]
mov dword [rax + 0x10], ecx
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x468], rax
mov rcx, qword [rsp + 0x468]
mov rax, qword [rcx + 8]
cmp rax, qword [rcx]
je 0x14000523c
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov rax, qword [rax + 8]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x444], eax
mov eax, dword [rsp + 0x444]
mov ecx, eax
add ecx, 0xffffffff
mov dword [rsp + 0x444], ecx
cmp eax, 0
je 0x140005237
movabs rax, 0xc524c96f16e863c
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
shr rax, 0x20
mov ecx, eax
mov eax, dword [rsp + 0x444]
mov dword [rsp + 0x4a4], eax
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x498], rax
mov r8, qword [rsp + 0x498]
mov rax, qword [r8]
mov rdx, qword [r8]
mov r8, qword [r8 + 8]
mov r8d, dword [r8 + 0x20]
add rdx, r8
mov r8d, dword [rsp + 0x4a4]
mov edx, dword [rdx + r8*4]
add rax, rdx
mov dword [rsp + 0x48c], ecx
mov qword [rsp + 0x480], rax
mov eax, dword [rsp + 0x48c]
mov dword [rsp + 0x47c], eax
mov rax, qword [rsp + 0x480]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x480], rcx
mov al, byte [rax]
mov byte [rsp + 0x47b], al
cmp byte [rsp + 0x47b], 0
je 0x1400051ff
mov cl, byte [rsp + 0x47b]
mov eax, dword [rsp + 0x47c]
mov byte [rsp + 0x4e7], cl
mov dword [rsp + 0x4e0], eax
mov eax, dword [rsp + 0x4e0]
mov dword [rsp + 0x5c], eax
movsx eax, byte [rsp + 0x4e7]
cmp eax, 0x41
jl 0x1400051d4
movsx eax, byte [rsp + 0x4e7]
cmp eax, 0x5a
jg 0x1400051d4
movsx eax, byte [rsp + 0x4e7]
or eax, 0x20
mov dword [rsp + 0x58], eax
jmp 0x1400051e0
movsx eax, byte [rsp + 0x4e7]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
xor eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
mov dword [rsp + 0x47c], eax
jmp 0x140005149
mov eax, dword [rsp + 0x47c]
movabs rcx, 0xc524c96f16e863c
mov qword [rsp + 0x4a8], rcx
movabs rcx, 0xffffffff
and rcx, qword [rsp + 0x4a8]
cmp eax, ecx
je 0x140005272
jmp 0x1400050aa
jmp 0x14000523c
lea rax, [rsp + 0x700]
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov rcx, qword [rax]
mov qword [rsp + 0x4e8], rcx
mov rcx, qword [rsp + 0x4e8]
mov rcx, qword [rcx]
mov qword [rax], rcx
jmp 0x140004fd4
mov eax, dword [rsp + 0x444]
mov dword [rsp + 0x4cc], eax
lea rax, [rsp + 0x6e8]
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x1c]
add rcx, rdx
mov qword [rsp + 0x4b8], rcx
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 0x24]
add rcx, rdx
mov qword [rsp + 0x4b0], rcx
mov rax, qword [rax]
mov rcx, qword [rsp + 0x4b8]
mov rdx, qword [rsp + 0x4b0]
mov r8d, dword [rsp + 0x4cc]
movzx edx, word [rdx + r8*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x448], rax
mov rax, qword [rsp + 0x448]
mov rcx, qword [rsp + 0x178]
mov r9d, dword [rcx]
mov rcx, qword [rsp + 0x170]
mov r8, qword [rcx]
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x160]
call rax
call fcn.140003430
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.14002cd90
mov rax, qword [rsp + 0xa0]
add rsp, 0x718
pop rdi
pop rsi
ret