Function at 0x14002bcd0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x320
movaps xmmword [rsp + 0x310], xmm6
mov rax, qword [0x1400a3020]
xor rax, rsp
mov qword [rsp + 0x308], rax
mov rbx, r9
mov qword [rsp + 0x50], r8
mov r12, rcx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x60], rdx
xor ecx, ecx
call fcn.1400011d0
mov r13, rax
mov qword [rsp + 0x58], rax
mov eax, 4
mov rdx, qword gs:[0x58]
mov r8, qword [rdx]
mov edx, dword [rax + r8]
cmp dword [0x1400a66fc], edx
jle 0x14002bd66
lea rcx, [0x1400a66fc]
call fcn.140047980
cmp dword [0x1400a66fc], 0xffffffff
jne 0x14002bd66
mov byte [0x1400a66f8], 0
lea rcx, [0x1400a66fc]
call fcn.140047920
cmp byte [0x1400a66f8], 0
je 0x14002bd83
lea rdx, str.CMemDumper::CreateProcessInfo___process_info_upload_cancelled_due_to_instant_shutdown
mov rcx, r13
call fcn.140022090
jmp 0x14002dac8
xor esi, esi
mov qword [rsp + 0x220], rsi
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], 7
mov word [rsp + 0x220], si
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x210], rsi
mov qword [rsp + 0x218], 7
mov word [rsp + 0x200], si
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], si
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x240], xmm1
mov qword [rsp + 0x250], rsi
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1e0]
lea r8, [rsp + 0x200]
lea rdx, [rsp + 0x220]
mov rdi, qword [rsp + 0x60]
mov ecx, dword [rdi + 8]
call fcn.140029960
xorps xmm0, xmm0
movups xmmword [rsp + 0x178], xmm0
movups xmmword [rsp + 0x188], xmm0
movups xmmword [rsp + 0x198], xmm0
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x180], rsi
lea ecx, [rsi + 0x48]
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x198], rsi
mov qword [rsp + 0x1a0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x188], sil
mov dword [rsp + 0xf0], 6
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], sil
lea r8d, [rsi + 3]
lea rdx, [0x140092edc]
lea rcx, [rsp + 0x100]
call fcn.140006ac0
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov r14d, 1
mov dword [rsp + 0xf0], r14d
lea ecx, [rsi + 0x20]
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002bf61
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002bfa5
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002bf9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002daf3
call fcn.1400477f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], esi
mov eax, dword [rdi + 8]
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
movsd qword [rsp + 0xf8], xmm0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], 6
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
mov r8d, 4
lea rdx, str.ppid
lea rcx, [rsp + 0x100]
call fcn.140006ac0
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002c0d6
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002c11a
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c114
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002daf3
call fcn.1400477f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], esi
mov rax, qword [rsp + 0x60]
mov ecx, dword [rax + 0x20]
xorps xmm0, xmm0
cvtsi2sd xmm0, rcx
movsd qword [rsp + 0xf8], xmm0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
lea rdx, str.cmdline
lea rcx, [rsp + 0x38]
call fcn.140025210
nop
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x38]
call fcn.140008f70
lea rcx, [rsp + 0x220]
mov rax, qword [rsp + 0x230]
cmp qword [rsp + 0x238], 8
jb 0x14002c1ee
mov rdx, qword [rsp + 0x220]
lea r8, [rdx + rax*2]
jmp 0x14002c1fa
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x220]
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
lea rcx, [rsp + 0x100]
call fcn.14001f290
nop
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002c2a5
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002c30c
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c307
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002daf9
call fcn.1400477f0
mov dword [rsp + 0xf0], 6
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
mov r8d, 9
lea rdx, str.imagepath
lea rcx, [rsp + 0x100]
call fcn.140006ac0
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002c3c4
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002c408
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c402
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002daff
call fcn.1400477f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
lea rcx, [rsp + 0x200]
mov rax, qword [rsp + 0x210]
cmp qword [rsp + 0x218], 8
jb 0x14002c454
mov rdx, qword [rsp + 0x200]
lea r8, [rdx + rax*2]
jmp 0x14002c460
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x200]
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x1b8], rsi
mov qword [rsp + 0x1c0], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1a8], 0
lea rcx, [rsp + 0x1a8]
call fcn.14001f290
nop
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x1a8]
cmp rax, rcx
je 0x14002c50b
lea rdx, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0x10
cmovae rdx, qword [rsp + 0x1a8]
mov r8, qword [rsp + 0x1b8]
mov rcx, rax
call fcn.140006ac0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
nop
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0x10
jb 0x14002c572
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c56d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002daff
call fcn.1400477f0
lea rdx, str.currdir
lea rcx, [rsp + 0x38]
call fcn.140025210
nop
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x38]
call fcn.140008f70
lea rcx, [rsp + 0x1e0]
mov rax, qword [rsp + 0x1f0]
cmp qword [rsp + 0x1f8], 8
jb 0x14002c5c8
mov rdx, qword [rsp + 0x1e0]
lea r8, [rdx + rax*2]
jmp 0x14002c5d4
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x1e0]
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
lea rcx, [rsp + 0x100]
call fcn.14001f290
nop
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002c67f
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002c6e6
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c6e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db05
call fcn.1400477f0
mov r15, qword [rsp + 0x388]
mov rdi, qword [rsp + 0x380]
test rbx, rbx
jne 0x14002c709
test r15, r15
jne 0x14002c709
test rdi, rdi
je 0x14002cc62
mov rax, qword [r13 + 0x48]
mov qword [rsp + 0x150], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
movups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rsi
mov ecx, 0x48
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x130], rsi
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x130], 0
test rbx, rbx
je 0x14002c84b
lea rdx, str.absolute_start_time
lea rcx, [rsp + 0x38]
call fcn.140025210
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x38]
call fcn.140008f70
sub rbx, qword [rsp + 0x150]
xorps xmm0, xmm0
js 0x14002c7d1
cvtsi2ss xmm0, rbx
jmp 0x14002c7e6
mov rax, rbx
shr rax, 1
and ebx, 1
or rax, rbx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm6, dword [0x140095730]
divss xmm0, xmm6
cvttss2si ebx, xmm0
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], esi
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movsd qword [rsp + 0xf8], xmm0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
jmp 0x14002c853
movss xmm6, dword [0x140095730]
test r15, r15
je 0x14002c909
lea rdx, str.relative_start_time
lea rcx, [rsp + 0x38]
call fcn.140025210
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x38]
call fcn.140008f70
xorps xmm0, xmm0
test r15, r15
js 0x14002c898
cvtsi2ss xmm0, r15
jmp 0x14002c8ae
mov rax, r15
shr rax, 1
and r15d, 1
or rax, r15
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, xmm6
cvttss2si ebx, xmm0
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], esi
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movsd qword [rsp + 0xf8], xmm0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
test rdi, rdi
je 0x14002cab5
mov dword [rsp + 0xf0], 6
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
mov r8d, ntohs
lea rdx, str.terminate_time
lea rcx, [rsp + 0x100]
call fcn.140006ac0
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002c9ca
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002ca0e
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ca08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db0b
call fcn.1400477f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
sub rdi, qword [rsp + 0x150]
xorps xmm0, xmm0
js 0x14002ca45
cvtsi2ss xmm0, rdi
jmp 0x14002ca5a
mov rax, rdi
shr rax, 1
and edi, 1
or rax, rdi
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, xmm6
cvttss2si ebx, xmm0
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], esi
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movsd qword [rsp + 0xf8], xmm0
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
lea rdx, str.timings
lea rcx, [rsp + 0x38]
call fcn.140025210
nop
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x38]
call fcn.140008f70
mov dword [rsp + 0xf0], 6
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xf0]
call fcn.140008170
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x158]
call fcn.1400067b0
nop
lea r8, [rsp + 0xf0]
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.14000adb0
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 0x10
jb 0x14002cb75
inc rdx
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cb70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db11
call fcn.1400477f0
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x158], 0
lea rcx, [rsp + 0xf0]
call fcn.140008f70
lea rax, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rax, qword [rsp + 0x188]
mov qword [rsp + 0x198], rsi
mov byte [rax], 0
lea rcx, [rsp + 0x120]
call fcn.14000b010
mov rdx, qword [rsp + 0x148]
cmp rdx, 0x10
jb 0x14002cc13
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cc0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db17
call fcn.1400477f0
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x130], 0
mov r8, qword [rsp + 0x120]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x120]
call fcn.14000f950
mov edx, 0x48
mov rcx, qword [rsp + 0x120]
call fcn.1400477f0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1c8], xmm1
mov r15, rsi
mov qword [rsp + 0x1d8], rsi
mov rbx, qword [rsp + 0x240]
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x150], rax
cmp rbx, rax
je 0x14002ce3a
mov rdi, qword [rsp + 0x1d0]
cmp qword [rbx + 0x18], 8
jb 0x14002ccb6
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx]
lea r8, [rax + rcx*2]
jmp 0x14002ccc3
mov rax, qword [rbx + 0x10]
lea r8, [rbx + rax*2]
mov rdx, rbx
jb 0x14002ccc6
mov rdx, qword [rbx]
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
lea rcx, [rsp + 0x100]
call fcn.14001f290
nop
mov dword [rsp + 0xf0], 6
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002cd71
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov ecx, 0x10
call fcn.140047d0c
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rdx, [rsp + 0xf0]
mov rcx, rax
call fcn.14000b360
nop
mov qword [rsp + 0x30], rax
cmp rdi, r15
je 0x14002cdb2
mov qword [rdi], rax
add rdi, 8
mov qword [rsp + 0x1d0], rdi
jmp 0x14002cdd7
lea r8, [rsp + 0x30]
mov rdx, rdi
lea rcx, [rsp + 0x1c8]
call fcn.14000f860
mov r15, qword [rsp + 0x1d8]
mov rdi, qword [rsp + 0x1d0]
lea rcx, [rsp + 0xf0]
call fcn.140008f70
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002ce28
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ce23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db1d
call fcn.1400477f0
add rbx, 0x20
cmp rbx, qword [rsp + 0x150]
jne 0x14002cca2
mov dword [rsp + 0xf0], 6
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
mov r8d, 3
lea rdx, [0x140092f50]
lea rcx, [rsp + 0x100]
call fcn.140006ac0
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002cef2
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002cf36
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cf30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db23
call fcn.1400477f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], 6
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0xf0]
call fcn.1400080f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x178]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1a8], xmm1
mov qword [rsp + 0x1b8], rsi
mov rax, qword [rsp + 0x50]
mov rdi, qword [rax]
mov r15, qword [rax + 8]
cmp rdi, r15
je 0x14002d3e5
lea rbx, [rdi + 0x230]
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
movups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], rsi
mov ecx, 0x48
call fcn.140047d0c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x130], rsi
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x130], 0
mov dword [rsp + 0xf0], 6
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x100], 0
mov r8d, 8
lea rdx, str.filename
lea rcx, [rsp + 0x100]
call fcn.140006ac0
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov dword [rsp + 0xf0], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x100]
cmp rax, rcx
je 0x14002d0fa
lea rdx, [rsp + 0x100]
cmp qword [rsp + 0x118], 0x10
cmovae rdx, qword [rsp + 0x100]
mov r8, qword [rsp + 0x110]
mov rcx, rax
call fcn.140006ac0
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x14002d13e
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db29
call fcn.1400477f0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0xf0]
call fcn.140008f70
mov edx, 0x104
mov rcx, rbx
call fcn.14005b74c
add rax, 0x118
lea r8, [rdi + rax*2]
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x90], 0
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.14001f290
nop
mov dword [rsp + 0x68], 6
lea rcx, [rsp + 0x68]
call fcn.140008f70
mov dword [rsp + 0x68], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x90]
cmp rax, rcx
je 0x14002d21a
lea rdx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 0x10
cmovae rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
mov rcx, rax
call fcn.140006ac0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x68]
call fcn.140008f70
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x14002d27b
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d276
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002db29
call fcn.1400477f0
mov dword [rsp + 0x80], 6
mov qword [rsp + 0x158], rsi
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x158], 0
mov r8d, 4
lea rdx, str.addr
lea rcx, [rsp + 0x158]
call fcn.140006ac0
nop
lea rcx, [rsp + 0x80]
call fcn.140008f70
mov dword [rsp + 0x80], r14d
mov ecx, 0x20
call fcn.140047d0c
mov qword [rax], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x158]
mov rcx, rax
call fcn.14000c790
nop
lea rcx, [rsp + 0x158]
call fcn.1400066f0
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x120]
call fcn.14000ae70
nop
lea rcx, [rsp + 0x80]
call fcn.140008f70
mov rax, qword [rbx - 0x218]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x120]
call fcn.140021860
lea rdx, str.size
lea rcx, [rsp + 0x120]
call fcn.140021750
mov ecx, dword [rbx - 0x210]
mov qword [rsp + 0x30], rcx
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140021860
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xb0]
call fcn.14000ecb0
nop
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1a8]
call fcn.14000b2e0
nop
lea rcx, [rsp + 0xb0]
call fcn.140008f70
nop
lea rcx, [rsp + 0x120]
call fcn.140008c60
add rdi, 0x438
add rbx, 0x438
cmp rdi, r15
jne 0x14002cfd0
lea rdx, str.modules
lea rcx, [rsp + 0x178]
call fcn.140024f60
lea rdx, [rsp + 0x1a8]
mov rcx, rax
call fcn.140024fa0
mov rax, qword [r12]
mov ecx, dword [rax + 0x134]
mov rdi, qword [rsp + 0x60]
cmp dword [rdi + 8], ecx
je 0x14002d8d6
lea rcx, [rsp + 0xf0]
call fcn.1400201e0
mov ecx, 0x18
call fcn.140047d0c
mov rcx, rax
call fcn.140001800
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov rdx, rcx
lea rcx, [rsp + 0xf0]
call fcn.140020f80
nop
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x200]
call fcn.140022ba0
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x100]
call fcn.140022a10
nop
lea rcx, [rsp + 0x178]
call fcn.14003aad0
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.1400218e0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x100]
call fcn.14001eed0
mov rbx, qword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x100]
call fcn.14001eef0
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x158]
call fcn.140020ff0
nop
lea rdx, str..file
lea rcx, [rsp + 0x158]
call fcn.1400024a0
mov r8, qword [rsp + 0xf0]
lea rdx, [rsp + 0x158]
mov rcx, qword [r12 + 0x50]
call fcn.140042b60
test al, al
jne 0x14002d552
mov r10, qword [r12 + 0x68]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x38]
call fcn.1400061a0
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x158]
mov rcx, r10
call fcn.1400201f0
mov r8d, dword [rdi + 8]
lea rdx, str.CMemDumper::CreateProcessInfo__:_process__d_file_queued
mov rcx, r13
call fcn.140022090
nop
lea rcx, [rsp + 0x158]
call fcn.140001140
nop
lea rcx, [rsp + 0x100]
call fcn.1400066f0
nop
lea rcx, [rsp + 0xf0]
call fcn.140006150
nop
jmp 0x14002d58e
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x100]
call fcn.140001800
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x110], rsi
mov dword [rsp + 0x150], esi
lea rcx, [rsp + 0x220]
call fcn.140002490
mov rcx, rax
lea rdx, [rsp + 0x150]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14002d8c9
mov dword [rsp + 0x48], r14d
cmp r14d, dword [rsp + 0x150]
jge 0x14002d89b
lea rcx, [rsp + 0xf0]
call fcn.1400201e0
mov ecx, 0x18
call fcn.140047d0c
mov rcx, rax
call fcn.140001800
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov rdx, rcx
lea rcx, [rsp + 0xf0]
call fcn.140020f80
nop
movsxd rdx, r14d
mov rdx, qword [r15 + rdx*8]
lea rcx, [rsp + 0x158]
call fcn.1400024c0
nop
mov rdi, qword [rsp + 0xf0]
mov rdx, rdi
lea rcx, [rsp + 0x158]
call fcn.140022ba0
nop
jmp 0x14002d685
mov rdx, rdi
lea rcx, [rsp + 0x298]
call fcn.140022a10
nop
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x298]
call fcn.14001eed0
mov rbx, qword [rax]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x298]
call fcn.14001eef0
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x278]
call fcn.140020ff0
nop
lea rdx, str..file
lea rcx, [rsp + 0x278]
call fcn.1400024a0
mov r8, rdi
lea rdx, [rsp + 0x278]
mov rcx, qword [r12 + 0x50]
call fcn.140042b60
test al, al
jne 0x14002d823
mov r10, qword [r12 + 0x68]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.1400061a0
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x278]
mov rcx, r10
call fcn.1400201f0
lea rcx, [rsp + 0x158]
call fcn.140002490
mov r8, rax
lea rdx, str.CMemDumper::CreateProcessInfo__:_cmdline_file__s_queued
mov rcx, r13
call fcn.140022090
lea rcx, [rsp + 0x2d8]
call fcn.140004820
lea rcx, [rsp + 0x2d8]
call fcn.140008bd0
nop
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x2d8]
call fcn.1400218e0
mov rdi, rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x158]
call fcn.140017c60
mov rbx, qword [rax]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x158]
call fcn.140017e70
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rsp + 0x120]
call fcn.14001efb0
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400218e0
nop
lea rcx, [rsp + 0x120]
call fcn.1400066f0
lea rdx, [rsp + 0x2d8]
lea rcx, [rsp + 0x38]
call fcn.14000ecb0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x100]
call fcn.14000b2e0
nop
lea rcx, [rsp + 0x38]
call fcn.140008f70
inc dword [rsp + 0x50]
lea rcx, [rsp + 0x2d8]
call fcn.140008c60
nop
lea rcx, [rsp + 0x278]
call fcn.140001140
nop
lea rcx, [rsp + 0x298]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x158]
call fcn.140001140
nop
lea rcx, [rsp + 0xf0]
call fcn.140006150
inc r14d
jmp 0x14002d5e9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsp + 0x50], 0
jle 0x14002d8c9
lea rcx, [rsp + 0x178]
call fcn.14003ac30
lea rdx, [rsp + 0x100]
mov rcx, rax
call fcn.140024fa0
nop
lea rcx, [rsp + 0x100]
call fcn.140009360
lea rdx, [rsp + 0x2b8]
lea rcx, [rsp + 0x178]
call fcn.14000a990
nop
mov r14, qword [rsp + 0x60]
mov r9d, dword [r14 + 8]
lea r8, str._d.pinfo
xor edx, edx
xor ecx, ecx
call fcn.14003c340
test eax, eax
js 0x14002db2f
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x268], rsi
mov qword [rsp + 0x270], 7
mov word [rsp + 0x258], si
movsxd rbx, eax
xor r8d, r8d
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x258]
call fcn.140022120
xor edx, edx
lea rcx, [rsp + 0x258]
call fcn.1400227f0
mov r9d, dword [r14 + 8]
lea r8, str._d.pinfo
mov rdx, qword [rsp + 0x268]
mov rcx, rax
call fcn.14003c340
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x258]
call fcn.140022120
lea rcx, [rsp + 0xf0]
call fcn.1400201e0
mov ecx, 0x18
call fcn.140047d0c
mov rdi, rax
mov qword [rsp + 0x68], rax
mov rcx, rax
call fcn.140001800
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x2b8]
call fcn.14001eed0
mov rbx, qword [rax]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x2b8]
call fcn.14001eef0
mov r8, rbx
mov rdx, qword [rax]
mov rcx, rdi
call fcn.1400216d0
nop
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140020f80
nop
mov r10, qword [r12 + 0x68]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.1400061a0
mov r9b, 1
mov r8, rax
lea rdx, [rsp + 0x258]
mov rcx, r10
call fcn.1400201f0
mov r8d, dword [r14 + 8]
lea rdx, str.CMemDumper::CreateProcessInfo__:_process__d_info_queued
mov rcx, r13
call fcn.140022090
nop
lea rcx, [rsp + 0xf0]
call fcn.140006150
nop
lea rcx, [rsp + 0x258]
call fcn.140001140
nop
lea rcx, [rsp + 0x2b8]
call fcn.1400066f0
nop
lea rcx, [rsp + 0x1a8]
call fcn.140009360
nop
lea rcx, [rsp + 0x1c8]
call fcn.140009360
nop
lea rcx, [rsp + 0x178]
call fcn.140008c60
nop
lea rcx, [rsp + 0x240]
call fcn.140017c80
nop
lea rcx, [rsp + 0x1e0]
call fcn.140001140
nop
lea rcx, [rsp + 0x200]
call fcn.140001140
nop
lea rcx, [rsp + 0x220]
call fcn.140001140
mov rcx, qword [rsp + 0x308]
xor rcx, rsp
call fcn.1400477d0
movaps xmm6, xmmword [rsp + 0x310]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14004e14c
nop
call fcn.14004e14c
int3
call fcn.14004e14c
int3
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
nop
call fcn.14004e14c
int3
call fcn.14004e14c
nop
call fcn.14004e14c
nop
xor r8d, r8d
lea rdx, str.CMemDumper::CreateProcessInfo__:_making_proc_param_filename_failed
lea rcx, [rsp + 0xd0]
call fcn.1400011b0
lea rdx, [0x1400a15f0]
lea rcx, [rsp + 0xd0]
call fcn.140049b34
int3