Function at 0x14001c750
Capabilities:
Acquire debug privileges
Create thread
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x9a0
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x990], rax
mov rsi, rdx
mov edi, ecx
lea rcx, [0x14001c250]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov cl, 1
call fcn.1400011d0
mov qword [rsp + 0x48], rax
call fcn.1400190e0
mov qword [rsp + 0xc0], rax
mov eax, 4
mov rcx, qword gs:[0x58]
mov r14, qword [rcx]
mov qword [rsp + 0x70], r14
mov ecx, dword [rax + r14]
cmp dword [0x1400a66fc], ecx
jle 0x14001c7f1
lea rcx, [0x1400a66fc]
call fcn.140047980
cmp dword [0x1400a66fc], 0xffffffff
jne 0x14001c7f1
mov byte [0x1400a66f8], 0
lea rcx, [0x1400a66fc]
call fcn.140047920
xor r15d, r15d
mov qword [rsp + 0x4c0], r15
mov qword [rsp + 0x4d0], r15
mov qword [rsp + 0x4d8], 7
mov word [rsp + 0x4c0], r15w
mov qword [rsp + 0x4e0], r15
mov qword [rsp + 0x4f0], r15
mov qword [rsp + 0x4f8], 7
mov word [rsp + 0x4e0], r15w
mov qword [rsp + 0x500], r15
mov qword [rsp + 0x510], r15
mov qword [rsp + 0x518], 7
mov word [rsp + 0x500], r15w
mov qword [rsp + 0x520], r15
mov qword [rsp + 0x530], r15
mov qword [rsp + 0x538], 7
mov word [rsp + 0x520], r15w
mov qword [rsp + 0x540], r15
mov qword [rsp + 0x550], r15
mov qword [rsp + 0x558], 7
mov word [rsp + 0x540], r15w
mov qword [rsp + 0x560], r15
mov qword [rsp + 0x570], r15
mov qword [rsp + 0x578], 7
mov word [rsp + 0x560], r15w
mov qword [rsp + 0x580], r15
mov qword [rsp + 0x590], r15
mov qword [rsp + 0x598], 7
mov word [rsp + 0x580], r15w
mov qword [rsp + 0x5a0], r15
mov qword [rsp + 0x5b0], r15
mov qword [rsp + 0x5b8], 7
mov word [rsp + 0x5a0], r15w
mov qword [rsp + 0x5c0], r15
mov qword [rsp + 0x5d0], r15
mov qword [rsp + 0x5d8], 7
mov word [rsp + 0x5c0], r15w
mov dword [rsp + 0x5e0], 0x1000000
mov dword [rsp + 0x5e4], 0x10101
mov qword [rsp + 0x5e8], r15
mov dword [rsp + 0x5f0], 1
mov dword [rsp + 0x5f4], 0xffffffff
mov dword [rsp + 0x5f8], r15d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x600], xmm0
mov qword [rsp + 0x610], r15
mov qword [rsp + 0x618], 0xa
mov dword [rsp + 0x620], 1
mov r13, 0xffffffffffffffff
mov dword [rsp + 0x624], r13d
mov qword [rsp + 0x628], r15
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov qword [rsp + 0x658], r15
lea rcx, [rsp + 0x660]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov byte [rsp + 0x40], r15b
lea rcx, str.sds_regmon.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0xb8], rax
lea r8, [0x14008f7b8]
lea rdx, str.Dumper_2.50__s_bit_
mov r14, qword [rsp + 0x48]
mov rcx, r14
call fcn.140022090
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea rcx, [rsp + 0xf0]
call fcn.140014bb0
nop
cmp qword [rax + 0x18], 8
jb 0x14001ca39
mov rax, qword [rax]
mov r9d, ebx
mov r8, rax
lea rdx, str.System_UUID:__s__pid__d
mov rcx, r14
call fcn.140022090
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x14001ca97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e326
call fcn.1400477f0
lea r8, [rsp + 0x4c0]
mov rdx, rsi
mov ecx, edi
call fcn.140019400
test al, al
je 0x14001e32c
call qword [sym.imp.libyara64.dll_yr_initialize]
test eax, eax
sete byte [rsp + 0x40]
test eax, eax
jne 0x14001e477
mov qword [rsp + 0x370], r15
mov dword [rsp + 0x398], r15d
mov dword [rsp + 0x3b0], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x370]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001e4a2
lea r8, [rsp + 0x3b4]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14001e4cd
mov dword [rsp + 0x3bc], 2
lea rax, [rsp + 0x398]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rsp + 0x3b0]
xor edx, edx
mov rcx, qword [rsp + 0x370]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14001e4f8
cmp byte [rsp + 0x5e0], 0
je 0x14001cc40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4c0]
call fcn.14001c4f0
lea rdx, str.Saving_snapshot...
mov rcx, r14
call fcn.140022090
lea rdx, [rsp + 0x4e0]
mov rcx, qword [rsp + 0x50]
call fcn.14002eca0
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14001cbf4
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001cbf4
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001cbf4
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14001e025
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001e025
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r13d
cmp r13d, 1
jne 0x14001e025
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x14001e025
xor edx, edx
mov r8d, 0xa0
lea rcx, [rsp + 0x8f0]
call fcn.14004a2e0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x8f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x900], xmm1
movdqa xmmword [rsp + 0x910], xmm0
mov eax, dword [rsp + 0x624]
mov dword [rsp + 0x920], eax
lea rcx, [rsp + 0x928]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x950], xmm0
mov qword [rsp + 0x960], r15
lea rcx, [rsp + 0x968]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov ecx, 0x68
call fcn.140047d0c
mov qword [rsp + 0x378], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rax + 0x60], rcx
lea r9, [rsp + 0x8f0]
lea r8, [rsp + 0x4c0]
lea rdx, [rsp + 0x4c0]
mov rcx, rax
call fcn.14001f930
nop
mov rdx, qword [0x1400a8760]
mov qword [0x1400a8760], rax
test rdx, rdx
je 0x14001cd27
call fcn.14001ef10
mov rax, qword [0x1400a8760]
test rax, rax
je 0x14001e524
xorps xmm0, xmm0
movups xmmword [rsp + 0x6b0], xmm0
movups xmmword [rsp + 0x6c0], xmm0
movups xmmword [rsp + 0x6d0], xmm0
movups xmmword [rsp + 0x6e0], xmm0
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0x6b0]
call fcn.1400420c0
nop
xor edx, edx
mov r8d, 0xa0
lea rcx, [rsp + 0x410]
call fcn.14004a2e0
mov rax, qword [0x1400a8760]
mov qword [rsp + 0x410], rax
mov dword [rsp + 0x418], 0x1f4
mov qword [rsp + 0x420], r15
mov qword [rsp + 0x428], r15
mov ecx, 0x40
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x420], rax
lea rcx, [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [rsp + 0x458], 0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x460], xmm0
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x478], r15
mov qword [rsp + 0x480], r15
mov ecx, 0x38
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x478], rax
lea rcx, [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x6f0], xmm0
movups xmmword [rsp + 0x700], xmm0
movups xmmword [rsp + 0x710], xmm0
movups xmmword [rsp + 0x720], xmm0
movups xmmword [rsp + 0x730], xmm0
movups xmmword [rsp + 0x740], xmm0
movups xmmword [rsp + 0x750], xmm0
lea rax, [rsp + 0x410]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6b0]
lea r8, [rsp + 0x4c0]
mov rdx, qword [0x1400a8760]
lea rcx, [rsp + 0x6f0]
call fcn.14002a2d0
nop
cmp byte [rsp + 0x5e1], 0
je 0x14001db75
xorps xmm0, xmm0
movups xmmword [rsp + 0x3d0], xmm0
movups xmmword [rsp + 0x400], xmm0
lea rax, str..pipe_filesaver_pipe
mov qword [rsp + 0x3d8], rax
movdqa xmmword [rsp + 0x3e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x3f0], xmm1
mov qword [rsp + 0x400], r15
lea rax, vtable.UploadService.0
mov qword [rsp + 0x3d0], rax
mov rax, qword [0x1400a8760]
mov qword [rsp + 0x408], rax
cmp byte [rsp + 0x5e4], 0
je 0x14001cfc5
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov rcx, qword [rsp + 0x3e8]
test rcx, rcx
je 0x14001cf5a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x3e8], rbx
test rbx, rbx
je 0x14001e550
mov dword [rsp + 0x39c], r15d
lea rax, [rsp + 0x39c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x3d0]
lea r8, [0x140001810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rsp + 0x3e0]
test rcx, rcx
je 0x14001cfb4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x3e0], rbx
test rbx, rbx
je 0x14001e57b
cmp byte [rsp + 0x458], 0
jne 0x14001d06e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov rcx, qword [rsp + 0x468]
test rcx, rcx
je 0x14001cffb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x468], rbx
test rbx, rbx
je 0x14001e5a6
mov dword [rsp + 0x3a0], r15d
lea rax, [rsp + 0x3a0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x418]
lea r8, [0x140024df0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rsp + 0x460]
test rcx, rcx
je 0x14001d055
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x460], rbx
test rbx, rbx
je 0x14001e5d1
mov byte [rsp + 0x458], 1
call fcn.14003c620
mov rsi, rax
mov qword [rsp + 0x378], rax
test rax, rax
je 0x14001d126
cmp byte [rsp + 0x5e6], 0
je 0x14001d0c7
mov rax, qword [rax]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rcx, rsi
call rbx
mov rcx, r14
test al, al
je 0x14001d0b9
lea rdx, str.Protect_process_successfull
call fcn.140022090
jmp 0x14001d0d6
lea rdx, str.Protect_process_fail
call fcn.140022090
jmp 0x14001d0d6
lea rdx, str.Protect_process_disabled
mov rcx, r14
call fcn.140022090
cmp byte [rsp + 0x5e7], 0
je 0x14001d117
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov rcx, rsi
call rbx
mov rcx, r14
test al, al
je 0x14001d109
lea rdx, str.Hide_process_successfull
call fcn.140022090
jmp 0x14001d126
lea rdx, str.Hide_process_fail
call fcn.140022090
jmp 0x14001d126
lea rdx, str.Hide_process_disabled
mov rcx, r14
call fcn.140022090
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x88], xmm1
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x4c0]
call fcn.14001c4f0
lea rdx, str.Waiting_for_inital_process_pid
mov rcx, r14
call fcn.140022090
lea r9, str.GlobalDmpMon_DataAvailableEvent
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rsp + 0x8e0], rax
lea r9, str.GlobalDmpMon_DataAcceptedEvent
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov rcx, qword [rsp + 0x628]
test rcx, rcx
je 0x14001d1a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x628], rbx
test rdi, rdi
je 0x14001e758
test rbx, rbx
je 0x14001e758
lea rax, str.GlobalDmpMon_DataMem
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000004
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov qword [rsp + 0x8e8], rax
test rax, rax
je 0x14001e5fd
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
test rax, rax
je 0x14001e628
mov eax, dword [rax]
mov dword [rsp + 0x5f4], eax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x5f4]
lea rdx, str.Inital_process_pid_is__d
mov rcx, r14
call fcn.140022090
xor edx, edx
mov r8d, 0xa0
lea rcx, [rsp + 0x760]
call fcn.14004a2e0
lea r9, [rsp + 0x4c0]
lea r8, [rsp + 0x6f0]
mov rdx, qword [0x1400a8760]
lea rcx, [rsp + 0x760]
call fcn.1400150f0
nop
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov eax, dword [rsp + 0x618]
div dword [rsp + 0x5f0]
mov r12d, eax
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0x10624dd3
mul r12d
shr edx, 6
mov ecx, edx
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
cvtps2pd xmm1, xmm0
mov eax, 0x10624dd3
mul dword [rsp + 0x618]
shr edx, 6
movsd qword [rsp + 0x20], xmm1
mov r9d, dword [rsp + 0x5f0]
mov r8d, edx
lea rdx, str.Monitoring_start_for_total__d_seconds___d_rounds_for__f_seconds
mov rcx, r14
call fcn.140022090
xor edx, edx
mov r8d, 0xe0
lea rcx, [rsp + 0x800]
call fcn.14004a2e0
lea r8, [rsp + 0x4c0]
mov rdx, qword [0x1400a8760]
lea rcx, [rsp + 0x800]
call fcn.140019160
nop
cmp byte [rsp + 0x808], 0
jne 0x14001d3fd
xor ecx, ecx
call fcn.1400011d0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov rcx, qword [rsp + 0x818]
test rcx, rcx
je 0x14001d38a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x818], rbx
test rbx, rbx
je 0x14001e654
mov dword [rsp + 0x3a4], r15d
lea rax, [rsp + 0x3a4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x800]
lea r8, [0x14003d2f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rsp + 0x810]
test rcx, rcx
je 0x14001d3e4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x810], rbx
test rbx, rbx
je 0x14001e67f
mov byte [rsp + 0x808], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x380], xmm0
mov rax, qword [0x1400a8760]
mov qword [rsp + 0x380], rax
movdqu xmmword [rsp + 0x388], xmm0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
mov rcx, qword [rsp + 0x390]
test rcx, rcx
je 0x14001d448
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x390], rbx
test rbx, rbx
je 0x14001e6ab
mov dword [rsp + 0x3a8], r15d
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x380]
lea r8, [0x140040960]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov rcx, qword [rsp + 0x388]
test rcx, rcx
je 0x14001d4a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x388], rbx
test rbx, rbx
je 0x14001e6d6
mov ebx, r15d
mov rdi, qword [rsp + 0x90]
nop
cmp ebx, dword [rsp + 0x5f0]
jae 0x14001d603
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rsp + 0x5ec], ebx
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8d, ebx
lea rdx, str.Monitoring_round__d
mov rcx, r14
call fcn.140022090
mov r8d, r12d
mov edx, dword [rsp + 0x5f4]
lea rcx, [rsp + 0x760]
call fcn.140016e00
xor ecx, ecx
call fcn.1400011d0
mov r14, rax
mov rax, qword [rsp + 0x70]
mov ecx, 4
mov ecx, dword [rcx + rax]
cmp dword [0x1400a66fc], ecx
jle 0x14001d560
lea rcx, [0x1400a66fc]
call fcn.140047980
cmp dword [0x1400a66fc], 0xffffffff
jne 0x14001d560
mov byte [0x1400a66f8], 0
lea rcx, [0x1400a66fc]
call fcn.140047920
cmp byte [0x1400a66f8], 0
jne 0x14001d5f7
lea r9, [rsp + 0x760]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x4c0]
call fcn.14002f7a0
lea rdx, str.Dumping_new_named_objects
mov rcx, r14
call fcn.140022090
mov rdx, qword [0x1400a8760]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x14001d5d2
lock inc dword [rdi + 8]
mov rsi, qword [rsp + 0x378]
mov rdi, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rdi
lea rcx, [rsp + 0x98]
call fcn.140026020
inc ebx
mov r14, qword [rsp + 0x48]
jmp 0x14001d4c0
cmp byte [rsp + 0x6f8], 0
je 0x14001d75e
mov eax, 0x10624dd3
mul dword [rsp + 0x618]
shr edx, 6
mov r8d, edx
lea rdx, str.Monitoring_time_extended_for__d_seconds
mov rcx, r14
call fcn.140022090
lea rdx, [rsp + 0x4c0]
mov rcx, qword [0x1400a8760]
call fcn.14001c290
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [rsp + 0x618]
lea rcx, [rsp + 0x630]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8d, ebx
mov edx, dword [rsp + 0x5f4]
lea rcx, [rsp + 0x760]
call fcn.140016e00
xor ecx, ecx
call fcn.1400011d0
mov rbx, rax
mov rax, qword [rsp + 0x70]
mov ecx, 4
mov edx, dword [rcx + rax]
cmp dword [0x1400a66fc], edx
jle 0x14001d6c7
lea rcx, [0x1400a66fc]
call fcn.140047980
cmp dword [0x1400a66fc], 0xffffffff
jne 0x14001d6c7
mov byte [0x1400a66f8], 0
lea rcx, [0x1400a66fc]
call fcn.140047920
cmp byte [0x1400a66f8], 0
jne 0x14001d75e
lea r9, [rsp + 0x760]
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x4c0]
call fcn.14002f7a0
lea rdx, str.Dumping_new_named_objects
mov rcx, rbx
call fcn.140022090
mov rdx, qword [0x1400a8760]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa8], xmm0
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x14001d739
lock inc dword [rdi + 8]
mov rsi, qword [rsp + 0x378]
mov rdi, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rdi
lea rcx, [rsp + 0xa8]
call fcn.140026020
cmp byte [rsp + 0x808], 0
je 0x14001d7d5
xor ecx, ecx
call fcn.1400011d0
mov rbx, rax
xor edx, edx
mov rcx, qword [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001d7d5
lea rdx, str.RegMonitor::Stop__:_signaling_finish_event
mov rcx, rbx
call fcn.140022090
mov rcx, qword [rsp + 0x818]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x810]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001e701
lea rdx, str.RegMonitor::Stop__:_done
mov rcx, rbx
call fcn.140022090
mov byte [rsp + 0x808], 0
lea rcx, [rsp + 0x800]
call fcn.14003d520
xor edx, edx
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001d847
xor ecx, ecx
call fcn.1400011d0
mov rbx, rax
lea rdx, str.ScreenshotMaker::Stop__:_signaling_finish_event
mov rcx, rax
call fcn.140022090
mov rcx, qword [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001e72c
lea rdx, str.ScreenshotMaker::Stop__:_done
mov rcx, rbx
call fcn.140022090
cmp byte [rsp + 0x5e4], 0
je 0x14001d85e
lea rcx, [rsp + 0x3d0]
call fcn.140001310
mov rdx, qword [rsp + 0x410]
lea rcx, [rsp + 0x418]
call fcn.1400239f0
lea rcx, [rsp + 0x418]
call fcn.140023950
nop
lea rcx, [rsp + 0x380]
call fcn.1400408c0
mov rcx, qword [rsp + 0x390]
test rcx, rcx
je 0x14001d8a9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x390], r15
mov rcx, qword [rsp + 0x388]
test rcx, rcx
je 0x14001d8c4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x388], r15
lea rcx, [rsp + 0x800]
call fcn.14003d250
mov r8, qword [rsp + 0x8d0]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x8d0]
lea rcx, [rsp + 0x8d0]
call fcn.14001f4e0
mov edx, 0x40
mov rcx, qword [rsp + 0x8d0]
call fcn.1400477f0
lea rcx, [rsp + 0x8c0]
call fcn.14001ec60
mov r8, qword [rsp + 0x8b0]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x8b0]
lea rcx, [rsp + 0x8b0]
call fcn.14001f370
mov edx, 0x40
mov rcx, qword [rsp + 0x8b0]
call fcn.1400477f0
lea rcx, [rsp + 0x880]
call fcn.140008c60
lea rcx, [rsp + 0x850]
call fcn.140008c60
lea rcx, [rsp + 0x828]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rsp + 0x818]
test rcx, rcx
je 0x14001d987
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x818], r15
mov rcx, qword [rsp + 0x810]
test rcx, rcx
je 0x14001d9a2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x810], r15
lea rcx, [rsp + 0x760]
call fcn.140015300
mov rcx, qword [rsp + 0x7f0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14001d9f8
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x7f0]
lea rcx, [rsp + 0x7f0]
call fcn.1400188e0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.1400477f0
cmp byte [rbx + 0x19], 0
je 0x14001d9c1
mov rcx, qword [rsp + 0x7f0]
mov edx, 0x20
call fcn.1400477f0
lea rcx, [rsp + 0x7c8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rsp + 0x7b8]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x7b8]
lea rcx, [rsp + 0x7b8]
call fcn.1400187a0
mov edx, 0x38
mov rcx, qword [rsp + 0x7b8]
call fcn.1400477f0
mov rcx, qword [rsp + 0x798]
test rcx, rcx
je 0x14001da5e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x798], r15
mov rcx, qword [rsp + 0x790]
test rcx, rcx
je 0x14001da79
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x790], r15
mov rcx, qword [rsp + 0x788]
cmp rcx, 0xffffffffffffffff
je 0x14001da95
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x788], r13
mov rcx, qword [rsp + 0x760]
test rcx, rcx
je 0x14001daae
mov rax, qword [rcx]
mov edx, 1
call qword [rax + VariantCopy]
nop
test rdi, rdi
je 0x14001daf3
mov eax, r13d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14001daeb
mov rbx, qword [rsp + 0x90]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001daeb
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rsi, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14001db40
mov eax, r13d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14001db38
mov rbx, qword [rsp + 0x80]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001db38
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rsi, qword [rsp + 0x378]
test rsi, rsi
je 0x14001db54
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + 0x30]
nop
lea rax, vtable.UploadService.0
mov qword [rsp + 0x3d0], rax
lea rcx, [rsp + 0x3d0]
call fcn.140018f60
jmp 0x14001dbfe
lea rdx, str.Loading_pre_snapshot...
mov rcx, r14
call fcn.140022090
xorps xmm0, xmm0
movups xmmword [rsp + 0x4b0], xmm0
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x4b0]
call fcn.14002f030
nop
xor r9d, r9d
lea r8, [rsp + 0x4b0]
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0x4c0]
call fcn.14002f7a0
nop
mov rbx, qword [rsp + 0x4b8]
test rbx, rbx
je 0x14001dbfe
mov eax, r13d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14001dbfe
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r13d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14001dbfe
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VariantCopy]
xor ecx, ecx
call fcn.1400011d0
mov r12, rax
lea rax, [rsp + 0x488]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rbx, qword [rsp + 0x478]
mov rbx, qword [rbx]
nop
cmp byte [rbx + 0x19], 0
jne 0x14001dd81
mov eax, dword [rbx + 0x20]
mov dword [rsp + 0x690], eax
mov rsi, qword [rbx + 0x30]
test rsi, rsi
je 0x14001dc55
lock inc dword [rsi + 8]
mov rsi, qword [rbx + 0x30]
mov rdi, qword [rbx + 0x28]
mov qword [rsp + 0x698], rdi
mov qword [rsp + 0x6a0], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r14, rax
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.14002fc40
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
xorps xmm2, xmm2
test rax, rax
js 0x14001dc9a
cvtsi2sd xmm2, rax
jmp 0x14001dcac
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
xorps xmm0, xmm0
test r14, r14
js 0x14001dcbb
cvtsi2sd xmm0, r14
jmp 0x14001dcd1
mov rax, r14
shr rax, 1
and r14d, 1
or rax, r14
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm2, xmm0
divsd xmm2, qword [0x140095710]
movq r8, xmm2
lea rdx, str.CProcessInfo::upload_all:_upload_pinfo_time__f
mov rcx, r12
call fcn.140022090
nop
test rsi, rsi
je 0x14001dd2f
mov eax, r13d
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x14001dd2f
mov rdi, qword [rsp + 0x6a0]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, r13d
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x14001dd2f
mov rcx, qword [rsp + 0x6a0]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14001dd5e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14001dd56
cmp rbx, qword [rax + 0x10]
jne 0x14001dd56
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14001dd43
mov rbx, rax
jmp 0x14001dc30
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14001dc30
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14001dd70
jmp 0x14001dc30
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rbx, qword [rsp + 0x738]
test rbx, rbx
je 0x14001ddc6
mov rcx, qword [rbx]
mov qword [rbx], r15
test rcx, rcx
je 0x14001ddab
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001ddb9
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov edx, 8
mov rcx, rbx
call fcn.1400477f0
mov rbx, qword [rsp + 0x730]
test rbx, rbx
je 0x14001ddff
mov rcx, qword [rbx]
mov qword [rbx], r15
test rcx, rcx
je 0x14001dde4
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001ddf2
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov edx, 8
mov rcx, rbx
call fcn.1400477f0
mov rbx, qword [rsp + 0x728]
test rbx, rbx
je 0x14001de38
mov rcx, qword [rbx]
mov qword [rbx], r15
test rcx, rcx
je 0x14001de1d
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001de2b
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov edx, 8
mov rcx, rbx
call fcn.1400477f0
lea rcx, [rsp + 0x700]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
lea rcx, [rsp + 0x488]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov r8, qword [rsp + 0x478]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x478]
call fcn.1400187a0
mov edx, 0x38
mov rcx, qword [rsp + 0x478]
call fcn.1400477f0
nop
lea rcx, [rsp + 0x418]
call fcn.140023950
mov rcx, qword [rsp + 0x468]
test rcx, rcx
je 0x14001deb1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x468], r15
mov rcx, qword [rsp + 0x460]
test rcx, rcx
je 0x14001decc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x460], r15
lea rcx, [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rsp + 0x420]
call fcn.14001ecd0
nop
mov rcx, qword [rsp + 0x6d8]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14001df37
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x6d8]
lea rcx, [rsp + 0x6d8]
call fcn.14001f490
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.1400477f0
cmp byte [rbx + 0x19], 0
je 0x14001df00
mov rcx, qword [rsp + 0x6d8]
mov edx, 0x28
call fcn.1400477f0
lea rcx, [rsp + 0x6b8]
call fcn.14001ee10
mov rbx, qword [rsp + 0x6b0]
test rbx, rbx
je 0x14001df88
mov rcx, qword [rbx]
mov qword [rbx], r15
test rcx, rcx
je 0x14001df6c
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001df7a
call qword [sym.imp.libyara64.dll_yr_rules_destroy]
mov edx, 8
mov rcx, rbx
call fcn.1400477f0
nop
lea rcx, [rsp + 0x968]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rsp + 0x950]
test rcx, rcx
je 0x14001dff8
mov rax, qword [rsp + 0x960]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dfdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e784
call fcn.1400477f0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x950], xmm0
mov qword [rsp + 0x960], r15
lea rcx, [rsp + 0x928]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rcx, [rsp + 0x908]
call fcn.14001ee10
lea rcx, [rsp + 0x8f0]
call fcn.14001ee10
mov r14, qword [rsp + 0x48]
jmp 0x14001e02f
cmp qword [0x1400a8760], 0
je 0x14001e0fb
cmp byte [rsp + 0x5e1], 0
jne 0x14001e062
lea rdx, str.Making_screenshot
mov rcx, r14
call fcn.140022090
mov rcx, qword [0x1400a8760]
call fcn.140040710
lea rdx, str.Finalizing
mov rcx, r14
call fcn.140022090
mov rdi, qword [0x1400a8760]
xor ecx, ecx
call fcn.1400011d0
mov rbx, rax
lea rdx, str.CFileSaver::Finalize__:_signaling_finish_event
mov rcx, rax
call fcn.140022090
mov rcx, qword [rdi + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x14001e0ae
lea rdx, str.CFileSaver::Finalize__:_failed_to_signal_finish_event
mov rcx, rbx
call fcn.140022090
lea rdx, str.CFileSaver::Finalize__:_waiting_UploaderThread
mov rcx, rbx
call fcn.140022090
mov edx, 0xffffffff
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
test eax, eax
jne 0x14001e0e6
lea rdx, str.CFileSaver::Finalize__:_UploaderThread_exited
call fcn.140022090
jmp 0x14001e0f6
mov r8d, eax
lea rdx, str.CFileSaver::Finalize__:_waiting_UploaderThread_failed__d
call fcn.140022090
nop
jmp 0x14001e0fb
mov rdx, qword [0x1400a8760]
mov qword [0x1400a8760], r15
test rdx, rdx
je 0x14001e113
call fcn.14001ef10
cmp byte [rsp + 0x40], 0
je 0x14001e120
call qword [sym.imp.libyara64.dll_yr_finalize]
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14001e133
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, rax
xorps xmm2, xmm2
test rax, rax
js 0x14001e14b
cvtsi2sd xmm2, rax
jmp 0x14001e15d
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rbx + 0x48]
xorps xmm0, xmm0
test rcx, rcx
js 0x14001e175
cvtsi2sd xmm0, rcx
jmp 0x14001e18a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
subsd xmm2, xmm0
divsd xmm2, qword [0x140095710]
movq r8, xmm2
lea rdx, str.Total_seconds:__f
mov rcx, rbx
call fcn.140022090
xor ecx, ecx
call fcn.1400011d0
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x20]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rdx + 0x18]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdx + 0x10]
mov qword [rsp + 0x20], rcx
mov r9, qword [rdx + 8]
mov r8, qword [rdx]
lea rdx, str.dumping:__llu__compress:__llu__logging:__llu__upload:__llu__yara:__llu
mov rcx, rax
call fcn.140022090
lea rdx, str.Done
mov rcx, rbx
call fcn.140022090
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x3b0], xmm0
mov qword [rsp + 0x3c0], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov r8d, 8
lea rdx, str.done.txt
lea rcx, [rsp + 0x50]
call fcn.140002760
nop
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0x50]
call fcn.140022d50
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14001e293
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e28e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e78a
call fcn.1400477f0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rcx, qword [rsp + 0x3b0]
test rcx, rcx
je 0x14001e2ea
mov rdx, qword [rsp + 0x3c0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e2e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001e790
call fcn.1400477f0
nop
lea rcx, [rsp + 0x4c0]
call fcn.14001e7a0
xor eax, eax
mov rcx, qword [rsp + 0x990]
xor rcx, rsp
call fcn.1400477d0
lea r11, [rsp + 0x9a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14004e14c
nop
lea rcx, str.parameters:_n
call fcn.14001f7a0
lea rcx, str._o__folder_or_url_for_dumps_____________specify_folder_or_URL__where_to_store_dumps_n
call fcn.14001f7a0
lea rcx, str._s__path_to_snapshot_file_______________create_inital_snapshot_and_save_to_file_n
call fcn.14001f7a0
lea rcx, str._d__path_to_snapshot_file_______________dump_changes_against_specified_snapshot_n
call fcn.14001f7a0
lea rcx, str._m__time_in_seconds_____________________process_monitor_mode_n
call fcn.14001f7a0
lea rcx, str._dll__yesno____________________________dump_process_DLLs_that_are_not_in___SystemRoot___folder_n
call fcn.14001f7a0
lea rcx, str._peonly__yesno_________________________include_regions_that_contain_PE_images_only_n
call fcn.14001f7a0
lea rcx, str._compress__yesno_______________________compress_dumps_while_upload_n
call fcn.14001f7a0
lea rcx, str._protect__yesno________________________enable_disable_process_protection_n
call fcn.14001f7a0
lea rcx, str._hide__yesno___________________________enable_disable_process_hide_n
call fcn.14001f7a0
lea rcx, str._size_limit__size_in_KB_________________exclude_regions_which_size_is_greater_then_specified_n
call fcn.14001f7a0
lea rcx, str._ssdeep_treshold__value_________________duplicate_dump_ssdeep_treshold_n
call fcn.14001f7a0
lea rcx, str._count_limit__value_____________________stop_dumping_after_process_count_is_reached_n
call fcn.14001f7a0
lea rcx, str._whitelist_yara__file_path______________yara_rules_for_content__that_will_not_be_dumped_n
call fcn.14001f7a0
lea rcx, str._whitelist_dlls__file_path______________dump_DLLs_that_are_not_in_list_n
call fcn.14001f7a0
lea rcx, str._triggers_yara__file_path_______________yara_rules_for_host_control_notifications_n
call fcn.14001f7a0
lea rcx, str._config_yara__file_path_________________yara_rules_for_data_regions_dump_n
call fcn.14001f7a0
lea rcx, str._predetect_yara__file_path______________yara_rules_for_malware_predetect_n
call fcn.14001f7a0
lea rcx, str._whitelist_ssdeep__file_path____________ssdeep_list_of_files__that_will_not_be_dumped_n
call fcn.14001f7a0
lea rcx, str._upload_delay__time_in_seconds__________minimum_time_between_uploads_n
call fcn.14001f7a0
lea rcx, str._rounds__number_rounds__________________number_of_monitoring_rounds_n
call fcn.14001f7a0
lea rcx, str._dump_period__number_rounds_____________dump_period_since_start_of_the_process_n
call fcn.14001f7a0
lea rcx, str._dump_schedule__comma_separated_delays__list_of_delays_between_process_dumping_n
call fcn.14001f7a0
lea rcx, str._network_timeout_multiplier_____________set_multiplier_for_network_timeouts_n
call fcn.14001f7a0
xor r8d, r8d
lea rdx, str.Invalid_command_line
lea rcx, [rsp + 0x2b0]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x2b0]
call fcn.140049b34
xor r8d, r8d
lea rdx, str.Yara_init_failed
lea rcx, [rsp + 0x2d0]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x2d0]
call fcn.140049b34
mov r8b, 1
lea rdx, str.AcuireDebugPriviledge__:_OpenProcessToken_for_adjust_priviledge_failed
lea rcx, [rsp + 0x2f0]
call fcn.1400011b0
lea rdx, [0x1400a15f0]
lea rcx, [rsp + 0x2f0]
call fcn.140049b34
mov r8b, 1
lea rdx, str.AcuireDebugPriviledge__:_LookupPrivilegeValue_for_SE_DEBUG_NAME_failed
lea rcx, [rsp + 0x310]
call fcn.1400011b0
lea rdx, [0x1400a15f0]
lea rcx, [rsp + 0x310]
call fcn.140049b34
mov r8b, 1
lea rdx, str.AcuireDebugPriviledge__:_AdjustTokenPrivileges_for_SE_DEBUG_NAME_failed
lea rcx, [rsp + 0x330]
call fcn.1400011b0
lea rdx, [0x1400a15f0]
lea rcx, [rsp + 0x330]
call fcn.140049b34
nop
xor r8d, r8d
lea rdx, str.FileSaver_not_initialized
lea rcx, [rsp + 0x290]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x290]
call fcn.140049b34
nop
mov r8b, 1
lea rdx, str.BasePipeServer::Listen__:_Can_not_create_UploadServiceFinishEvent
lea rcx, [rsp + 0x350]
call fcn.1400011b0
lea rdx, [0x1400a1260]
lea rcx, [rsp + 0x350]
call fcn.140049b34
mov r8b, 1
lea rdx, str.BasePipeServer::Listen__:_Can_not_create_PipeListenThread
lea rcx, [rsp + 0x110]
call fcn.1400011b0
lea rdx, [0x1400a1260]
lea rcx, [rsp + 0x110]
call fcn.140049b34
mov r8b, 1
lea rdx, [0x140091650]
lea rcx, [rsp + 0x130]
call fcn.1400011b0
lea rdx, [0x1400a1590]
lea rcx, [rsp + 0x130]
call fcn.140049b34
mov r8b, 1
lea rdx, str.NwStatMonitor::Listen__:_Can_not_create_PipeListenThread
lea rcx, [rsp + 0x150]
call fcn.1400011b0
lea rdx, [0x1400a1590]
lea rcx, [rsp + 0x150]
call fcn.140049b34
nop
mov r8b, 1
lea rdx, str.WaitForInitalMalwareProcess__:_Can_not_create_shared_memory
lea rcx, [rsp + 0x170]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x170]
call fcn.140049b34
mov r8b, 1
lea rdx, str.WaitForInitalMalwareProcess__:_Can_not_map_shared_memory
lea rcx, [rsp + 0x190]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x190]
call fcn.140049b34
nop
mov r8b, 1
lea rdx, str.RegMonitor::Start__:_Can_not_create_RegmonFinishEvent
lea rcx, [rsp + 0x1b0]
call fcn.1400011b0
lea rdx, [0x1400a1650]
lea rcx, [rsp + 0x1b0]
call fcn.140049b34
mov r8b, 1
lea rdx, str.RegMonitor::Start__:_Can_not_create_RegMonitorThread
lea rcx, [rsp + 0x1d0]
call fcn.1400011b0
lea rdx, [0x1400a1650]
lea rcx, [rsp + 0x1d0]
call fcn.140049b34
nop
mov r8b, 1
lea rdx, str.ScreenshotMaker::Start__:_Can_not_create_m_hFinishEvent
lea rcx, [rsp + 0x1f0]
call fcn.1400011b0
lea rdx, [0x1400a1728]
lea rcx, [rsp + 0x1f0]
call fcn.140049b34
mov r8b, 1
lea rdx, str.ScreenshotMaker::Start__:_Can_not_create_ScreenshotThread
lea rcx, [rsp + 0x210]
call fcn.1400011b0
lea rdx, [0x1400a1728]
lea rcx, [rsp + 0x210]
call fcn.140049b34
xor r8d, r8d
lea rdx, str.RegMonitor::Stop__:_WaitForSingleObject_hMonitorThread__INFINITE____WAIT_OBJECT_0
lea rcx, [rsp + 0x230]
call fcn.1400011b0
lea rdx, [0x1400a1650]
lea rcx, [rsp + 0x230]
call fcn.140049b34
xor r8d, r8d
lea rdx, str.ScreenshotMaker::Stop__:_WaitForSingleObject___WAIT_OBJECT_0
lea rcx, [rsp + 0x250]
call fcn.1400011b0
lea rdx, [0x1400a1728]
lea rcx, [rsp + 0x250]
call fcn.140049b34
nop
mov r8b, 1
lea rdx, str.WaitForInitalMalwareProcess__:_Can_not_create_sync_events
lea rcx, [rsp + 0x270]
call fcn.140002360
lea rdx, [0x1400a14d0]
lea rcx, [rsp + 0x270]
call fcn.140049b34
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
int3