Function at 0x1400cccc0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov r12, r9
mov r13d, edx
mov qword [rsp + 0x30], rcx
mov rsi, qword [rsp + 0xf0]
mov rax, qword [0x140213038]
xor rax, rsp
mov qword [rsp + 0x80], rax
test r8, r8
jne 0x1400cce31
test r13b, 4
je 0x1400cd601
mov eax, 0x40
mov ecx, 0x40
test r12, r12
je 0x1400ccd22
bsr rcx, r12
xor rcx, 0x3f
sub rax, rcx
lea rcx, [0x1401db720]
mov cl, byte [rax + rcx]
mov rdx, r12
shr rdx, cl
and edx, 7
lea rcx, [0x1401db770]
mov rcx, qword [rcx + rax*8]
and rcx, r12
lea rax, [rdx + rax*8]
cmp rcx, 1
sbb rax, 0xffffffffffffffff
lea rcx, [0x1401db978]
movzx ebp, word [rcx + rax*2 + 0x400]
mov byte [rsp + 0x70], 0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 2], 0
je 0x1400cde00
mov esi, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test ebx, ebx
jne 0x1400cd929
cmp rsi, 1
jbe 0x1400cdeb0
add qword [rsi + 0x298], 1
cmp bp, 0x29
jae 0x1400cd280
mov rdi, rbp
shl rdi, 4
lea rbx, [rsi + rdi]
cmp qword [rsi + rdi], 0
je 0x1400cd4eb
add qword [rsi + 0x2a0], 1
mov r15, qword [rbx]
mov rax, qword [r15]
test rax, rax
je 0x1400ccdeb
mov rcx, rax
not rcx
cmp qword [r15 + 8], rcx
jne 0x1400ce7d3
add byte [rsi + rdi + 8], 0xff
bswap rax
mov qword [rbx], rax
lea rax, [rsi + rdi]
add rax, 0xa
test r15, r15
je 0x1400cd28e
movzx edi, word [rax]
test r13b, 2
je 0x1400cd259
cmp byte [rsp + 0x70], 0
jne 0x1400cd259
mov rcx, r15
xor edx, edx
mov r8, rdi
call fcn.140103d70
jmp 0x1400cd259
mov qword [rsp + 0x40], r8
test r12, r12
je 0x1400cd7a5
cmp r12, 0x7fe00001
jae 0x1400cdf3e
mov dword [rsp + 0x2c], r13d
test r13b, 4
sete al
movabs rdx, 0xaaaaaaaaaaaaaaaa
mov r13b, byte [0x140221f80]
mov rcx, rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
and r13b, al
mov qword [rsp + 0x38], r12
jne 0x1400cdfb1
mov rcx, qword [rsp + 0x40]
mov rax, rcx
and rax, 0xffffffffffe00000
shr rcx, 9
and ecx, 0xfe0
lea rsi, [rax + rcx]
add rsi, 0x1000
movzx eax, word [rax + rcx + 0x101e]
mov r15, rax
neg r15
shl rax, 5
mov rbp, rsi
sub rbp, rax
mov rax, rbp
and rax, 0xfffffffffffff000
mov rbx, qword [rax]
lea r14, [rbx + 8]
mov edi, 1
mov dword [rsp + 0x4c], 0
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r14
call r12
test al, al
jne 0x1400ccf1f
jmp 0x1400cd792
pause
dec eax
jne 0x1400ccef2
mov edx, dword [rsp + 0x4c]
add edx, edi
add edi, edi
cmp edi, 0x40
mov ecx, 0x40
cmovge edi, ecx
mov dword [rsp + 0x4c], edx
cmp edx, 0x3e8
jl 0x1400ccee3
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
shl r15, 5
cmp byte [rsi + r15 + 0x1d], 0
jne 0x1400cdfcd
mov rax, qword [rsi + r15 + 0x10]
mov eax, dword [rax + 0x18]
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rax, qword [rsi + r15 + 0x10]
cmp byte [rax + 0x1c], 0
je 0x1400cdf50
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, 0x40
mov ecx, 0x40
test r12, r12
je 0x1400ccf70
bsr rcx, r12
xor rcx, 0x3f
sub rax, rcx
lea rcx, [0x1401db720]
mov cl, byte [rax + rcx]
mov rdx, r12
shr rdx, cl
and edx, 7
lea rcx, [0x1401db770]
mov rcx, qword [rcx + rax*8]
and rcx, r12
lea rax, [rdx + rax*8]
cmp rcx, 1
sbb rax, 0xffffffffffffffff
lea rcx, [0x1401db978]
movzx eax, word [rcx + rax*2 + 0x400]
lea rax, [rax + rax*4]
cmp byte [rbx + rax*8 + 0x2c], 0
je 0x1400cdf9e
mov eax, dword [rbx + rax*8 + 0x28]
movzx ecx, word [rsi + 0x1e]
shl rcx, 5
neg rcx
mov rcx, qword [rsi + rcx + 0x10]
mov ecx, dword [rcx + 0x18]
cmp rax, rcx
je 0x1400cd408
mov r13d, dword [rsp + 0x2c]
test r13b, 4
je 0x1400cdacb
mov eax, 0x40
mov ecx, 0x40
test r12, r12
je 0x1400cd004
bsr rcx, r12
xor rcx, 0x3f
sub rax, rcx
lea rcx, [0x1401db720]
mov cl, byte [rax + rcx]
mov rdx, r12
shr rdx, cl
and edx, 7
lea rcx, [0x1401db770]
mov rcx, qword [rcx + rax*8]
and rcx, r12
lea rax, [rdx + rax*8]
cmp rcx, 1
sbb rax, 0xffffffffffffffff
lea rcx, [0x1401db978]
movzx esi, word [rcx + rax*2 + 0x400]
mov byte [rsp + 0x70], 0
mov rax, qword [rsp + 0x30]
cmp byte [rax + 2], 0
je 0x1400cda15
mov ebp, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test ebx, ebx
jne 0x1400cd957
cmp rbp, 1
jbe 0x1400ce075
add qword [rbp + 0x298], 1
cmp si, 0x29
jae 0x1400cd346
mov rdi, rsi
shl rdi, 4
lea rbx, [rdi + rbp]
cmp qword [rbp + rdi], 0
je 0x1400cd768
inc qword [rbp + 0x2a0]
mov r15, qword [rbx]
mov rax, qword [r15]
test rax, rax
je 0x1400cd0cd
mov rcx, rax
not rcx
cmp qword [r15 + 8], rcx
jne 0x1400ce7d3
dec byte [rbp + rdi + 8]
bswap rax
mov qword [rbx], rax
lea rax, [rdi + rbp]
add rax, 0xa
test r15, r15
je 0x1400cd354
movzx edi, word [rax]
test r13b, 2
je 0x1400cd0fc
cmp byte [rsp + 0x70], 0
je 0x1400ce115
test r15, r15
je 0x1400cdf3e
mov rax, qword [rsp + 0x58]
cmp rax, r12
ja 0x1400cd112
mov r12, rax
mov rcx, r15
mov rsi, qword [rsp + 0x40]
mov rdx, rsi
mov r8, r12
call fcn.140103960
mov al, byte [0x140221f80]
test al, 1
je 0x1400cd147
mov rcx, rsi
call fcn.1400f9e90
mov rcx, rsi
call fcn.1400f9ea0
test al, al
jne 0x1400cd259
mov rax, rsi
and rax, 0xffffffffffe00000
shr rsi, 9
and esi, 0xfe0
lea r14, [rax + rsi]
add r14, 0x1000
movzx ecx, word [rax + rsi + 0x101e]
mov rdi, rcx
neg rdi
shl rcx, 5
mov r13, r14
sub r13, rcx
mov rcx, r13
and rcx, 0xfffffffffffff000
mov r12, qword [rcx]
cmp byte [r12], 2
je 0x1400cdfd6
cmp byte [r12 + 2], 0
je 0x1400cd42a
mov rax, rdi
shl rax, 5
mov rsi, qword [r14 + rax + 0x10]
cmp byte [rsi + 0x1c], 0
je 0x1400cd42a
mov ebp, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test ebx, ebx
jne 0x1400cd964
cmp rbp, 2
jb 0x1400cd42a
sub rsi, r12
add rsi, 0xfffffffffffffff0
sar rsi, 3
movabs rax, 0xcccccccccccccccd
imul rax, rsi
add qword [rbp + 0x2c0], 1
cmp rax, 0x28
ja 0x1400cd423
shl rax, 4
mov rcx, qword [rbp + rax]
bswap rcx
mov rdx, qword [rsp + 0x40]
mov qword [rdx], rcx
not rcx
mov qword [rdx + 8], rcx
mov qword [rbp + rax], rdx
add byte [rbp + rax + 8], 1
add qword [rbp + 0x2c8], 1
movzx r8d, byte [rbp + rax + 9]
cmp byte [rbp + rax + 8], r8b
jae 0x1400ce0ff
mov al, byte [rbp + 0x290]
test al, 1
jne 0x1400cdc34
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401013e0
mov rax, r15
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
inc qword [rsi + 0x2b8]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
lea rbx, [rbp*4]
add rbx, rbp
mov rax, qword [rsp + 0x30]
lea rbp, [rax + rbx*8]
add rbp, 0x10
lea rsi, [rax + 8]
mov edi, 1
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, rsi
call r15
test al, al
jne 0x1400cd2ef
jmp 0x1400cd948
pause
dec eax
jne 0x1400cd2c8
add r14d, edi
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
cmp r14d, 0x3e8
jl 0x1400cd2b9
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov r15, qword [rax]
test r15, r15
je 0x1400cd58b
mov byte [rsp + 0x70], 0
mov rcx, qword [rsp + 0x30]
mov edi, dword [rcx + rbx*8 + 0x28]
mov rcx, qword [r15]
test rcx, rcx
je 0x1400cd325
mov rdx, rcx
not rdx
cmp qword [r15 + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test r15, r15
jne 0x1400cce0a
jmp 0x1400cd921
inc qword [rbp + 0x2b8]
inc qword [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
lea rbx, [rsi + rsi*4]
mov rax, qword [rsp + 0x30]
lea rbp, [rax + rbx*8]
add rbp, 0x10
lea rsi, [rax + 8]
mov edi, 1
xor r14d, r14d
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, rsi
call r15
test al, al
jne 0x1400cd3ae
jmp 0x1400cd980
pause
dec eax
jne 0x1400cd387
add r14d, edi
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
cmp r14d, 0x3e8
jl 0x1400cd378
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov r15, qword [rax]
test r15, r15
je 0x1400cd515
mov byte [rsp + 0x70], 0
mov rcx, qword [rsp + 0x30]
mov edi, dword [rcx + rbx*8 + 0x28]
mov rcx, qword [r15]
test rcx, rcx
je 0x1400cd3e4
mov rdx, rcx
not rdx
cmp qword [r15 + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test r15, r15
jne 0x1400cd0eb
xor r15d, r15d
jmp 0x1400cd0fc
lea rax, [rsi + r15]
add rax, 0x1d
cmp byte [rax], 0
jne 0x1400ce127
mov r15, qword [rsp + 0x40]
jmp 0x1400cd259
inc qword [rbp + 0x2d0]
add r12, 8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov ebx, 1
xor ebp, ebp
mov rsi, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r12
call rsi
test al, al
jne 0x1400cd477
jmp 0x1400cd9b1
pause
dec eax
jne 0x1400cd452
add ebp, ebx
add ebx, ebx
cmp ebx, 0x40
mov eax, 0x40
cmovge ebx, eax
cmp ebp, 0x3e8
jl 0x1400cd444
mov rcx, r12
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r13]
mov rcx, qword [rsp + 0x40]
cmp rax, rcx
je 0x1400ce130
bswap rax
mov qword [rcx], rax
not rax
mov qword [rcx + 8], rax
mov qword [r13], rcx
shl rdi, 5
movzx eax, word [r14 + rdi + 0x18]
dec eax
mov word [r14 + rdi + 0x18], ax
test ax, ax
jle 0x1400cd936
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsp + 0x70], 0
je 0x1400cd259
lea rcx, [rsp + 0x70]
call fcn.140098180
jmp 0x1400cd259
inc qword [rsi + 0x2b0]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rsi
mov rdx, rbp
call fcn.1400f6e90
mov r15, qword [rbx]
test r15, r15
jne 0x1400ccdd3
jmp 0x1400cd28e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, r13d
mov r9, r12
call fcn.1400cea80
test rax, rax
je 0x1400ce142
mov r15, rax
and rax, 0xffffffffffe00000
mov rcx, r15
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400cdabd
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov edi, dword [rax + 0x18]
jmp 0x1400cd3ee
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, r13d
mov r9, r12
call fcn.1400cea80
test rax, rax
je 0x1400ce154
mov r15, rax
and rax, 0xffffffffffe00000
mov rcx, r15
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce166
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov edi, dword [rax + 0x18]
jmp 0x1400cd32f
mov qword [rsp + 0x70], 0
mov r15b, byte [0x140221f80]
test r15b, 1
jne 0x1400ce17b
mov eax, 0x40
mov ecx, 0x40
test r12, r12
je 0x1400cd632
bsr rcx, r12
xor rcx, 0x3f
mov dword [rsp + 0x2c], r13d
sub rax, rcx
lea rcx, [0x1401db720]
mov cl, byte [rax + rcx]
mov rdx, r12
shr rdx, cl
and edx, 7
lea rcx, [0x1401db770]
mov rcx, qword [rcx + rax*8]
mov qword [rsp + 0x38], r12
and rcx, r12
lea rax, [rdx + rax*8]
cmp rcx, 1
sbb rax, 0xffffffffffffffff
lea rcx, [0x1401db978]
movzx r14d, word [rcx + rax*2 + 0x400]
mov byte [rsp + 0x60], 0
mov rcx, qword [rsp + 0x30]
cmp byte [rcx + 2], 0
jne 0x1400ce1a6
lea rax, [r14 + r14*4]
lea rbp, [rcx + rax*8]
add rbp, 0x10
lea rsi, [rcx + 8]
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r13d, 0x40
mov rcx, rsi
call r12
test al, al
jne 0x1400cd6e4
jmp 0x1400cdc41
pause
dec eax
jne 0x1400cd6c3
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r13d
cmp ebx, 0x3e8
jl 0x1400cd6b4
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400cdc5f
mov byte [rsp + 0x60], 0
lea rcx, [r14 + r14*4]
mov rdx, qword [rsp + 0x30]
mov ebp, dword [rdx + rcx*8 + 0x28]
mov rcx, qword [rbx]
test rcx, rcx
mov edi, dword [rsp + 0x2c]
je 0x1400cd722
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test rbx, rbx
je 0x1400ce174
test dil, 2
je 0x1400cd74f
cmp byte [rsp + 0x60], 0
je 0x1400ce30f
mov qword [rsp + 0x70], rbx
test r15b, 1
jne 0x1400ce244
mov r15, qword [rsp + 0x70]
jmp 0x1400cd259
inc qword [rbp + 0x2b0]
inc qword [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rbp
mov rdx, rsi
call fcn.1400f6e90
mov r15, qword [rbx]
test r15, r15
jne 0x1400cd0b5
jmp 0x1400cd354
mov eax, edi
test edi, edi
jg 0x1400ccef2
mov edx, dword [rsp + 0x4c]
jmp 0x1400ccefe
mov al, byte [0x140221f80]
test al, 1
jne 0x1400cd98f
mov rcx, qword [rsp + 0x40]
mov rax, rcx
and rax, 0xffffffffffe00000
shr rcx, 9
and ecx, 0xfe0
lea r14, [rax + rcx]
add r14, 0x1000
movzx ecx, word [r14 + 0x1e]
mov rdi, rcx
neg rdi
shl rcx, 5
mov r15, r14
sub r15, rcx
mov rcx, r15
and rcx, 0xfffffffffffff000
mov r13, qword [rcx]
cmp byte [r13], 2
je 0x1400ce25e
cmp byte [r13 + 2], 0
je 0x1400cd874
mov rax, rdi
shl rax, 5
mov rsi, qword [r14 + rax + 0x10]
cmp byte [rsi + 0x1c], 0
je 0x1400cd874
mov ebx, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test ebp, ebp
jne 0x1400cdd58
cmp rbx, 2
jb 0x1400cd874
sub rsi, r13
add rsi, 0xfffffffffffffff0
sar rsi, 3
movabs rax, 0xcccccccccccccccd
imul rax, rsi
inc qword [rbx + 0x2c0]
cmp rax, 0x28
jbe 0x1400cd9c0
inc qword [rbx + 0x2d0]
add r13, 8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov ebx, 1
xor ebp, ebp
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov esi, 0x40
mov rcx, r13
call r12
test al, al
jne 0x1400cd8c2
jmp 0x1400cdc50
pause
dec eax
jne 0x1400cd8a2
add ebp, ebx
add ebx, ebx
cmp ebx, 0x40
cmovge ebx, esi
cmp ebp, 0x3e8
jl 0x1400cd893
mov rcx, r13
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [r15]
mov rcx, qword [rsp + 0x40]
cmp rax, rcx
je 0x1400ce2fd
bswap rax
mov qword [rcx], rax
not rax
mov qword [rcx + 8], rax
mov qword [r15], rcx
shl rdi, 5
movzx eax, word [r14 + rdi + 0x18]
dec eax
mov word [r14 + rdi + 0x18], ax
test ax, ax
jle 0x1400cd971
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsp + 0x70], 0
jne 0x1400ce300
xor r15d, r15d
jmp 0x1400cd259
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400ccd96
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.1400f7260
jmp 0x1400cd4bd
mov eax, edi
test edi, edi
jg 0x1400cd2c8
jmp 0x1400cd2d1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cd078
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cd1d8
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.1400f7260
jmp 0x1400cd902
mov eax, edi
test edi, edi
jg 0x1400cd387
jmp 0x1400cd390
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1400f9e90
mov rcx, rsi
call fcn.1400f9ea0
test al, al
je 0x1400cd7b3
jmp 0x1400cd921
mov eax, ebx
test ebx, ebx
jg 0x1400cd452
jmp 0x1400cd45a
shl rax, 4
mov rcx, qword [rbx + rax]
bswap rcx
mov rdx, qword [rsp + 0x40]
mov qword [rdx], rcx
not rcx
mov qword [rdx + 8], rcx
mov qword [rbx + rax], rdx
inc byte [rbx + rax + 8]
inc qword [rbx + 0x2c8]
movzx r8d, byte [rbx + rax + 9]
cmp byte [rbx + rax + 8], r8b
jae 0x1400ce397
mov al, byte [rbx + 0x290]
test al, 1
je 0x1400cd921
mov rcx, rbx
call fcn.1400f71e0
jmp 0x1400cd921
lea rax, [rsi + rsi*4]
mov rcx, qword [rsp + 0x30]
lea rbp, [rcx + rax*8]
add rbp, 0x10
lea r14, [rcx + 8]
mov edi, 1
xor ebx, ebx
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r14
call r15
test al, al
jne 0x1400cda71
jmp 0x1400cdde2
pause
dec eax
jne 0x1400cda47
add ebx, edi
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
cmp ebx, 0x3e8
mov r13d, dword [rsp + 0x2c]
jl 0x1400cda38
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov r15, qword [rax]
test r15, r15
je 0x1400cdcdd
mov byte [rsp + 0x70], 0
lea rcx, [rsi + rsi*4]
mov rdx, qword [rsp + 0x30]
mov edi, dword [rdx + rcx*8 + 0x28]
mov rcx, qword [r15]
test rcx, rcx
je 0x1400cdaab
mov rdx, rcx
not rdx
cmp qword [r15 + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, r14
jmp 0x1400cd3f1
shl rcx, 5
mov rdi, qword [rbp + rcx + 0x20]
jmp 0x1400cd3ee
mov qword [rsp + 0x70], 0
mov bl, byte [0x140221f80]
test bl, 1
jne 0x1400ce401
mov eax, 0x40
mov ecx, 0x40
test r12, r12
je 0x1400cdafa
bsr rcx, r12
xor rcx, 0x3f
mov byte [rsp + 0x4c], bl
sub rax, rcx
lea rcx, [0x1401db720]
mov cl, byte [rax + rcx]
mov rdx, r12
shr rdx, cl
and edx, 7
lea rcx, [0x1401db770]
mov rcx, qword [rcx + rax*8]
and rcx, r12
lea rax, [rdx + rax*8]
cmp rcx, 1
sbb rax, 0xffffffffffffffff
lea rcx, [0x1401db978]
movzx r15d, word [rcx + rax*2 + 0x400]
mov byte [rsp + 0x60], 0
mov rcx, qword [rsp + 0x30]
cmp byte [rcx + 2], 0
jne 0x1400ce42b
mov r14, r15
lea rax, [r15 + r15*4]
lea rbp, [rcx + rax*8]
add rbp, 0x10
lea rsi, [rcx + 8]
mov edi, 1
xor ebx, ebx
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r12d, 0x40
mov rcx, rsi
call r15
test al, al
jne 0x1400cdbae
jmp 0x1400cddf1
pause
dec eax
jne 0x1400cdb88
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r12d
cmp ebx, 0x3e8
mov r13d, dword [rsp + 0x2c]
jl 0x1400cdb79
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400cdd65
mov byte [rsp + 0x60], 0
lea rcx, [r14 + r14*4]
mov rdx, qword [rsp + 0x30]
mov edi, dword [rdx + rcx*8 + 0x28]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400cdbe8
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test rbx, rbx
je 0x1400ce3fa
test r13b, 2
je 0x1400cdc15
cmp byte [rsp + 0x60], 0
je 0x1400ce52f
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x70], rbx
test byte [rsp + 0x4c], 1
jne 0x1400ce4ca
mov r15, qword [rsp + 0x70]
jmp 0x1400cd0fc
mov rcx, rbp
call fcn.1400f71e0
jmp 0x1400cd259
mov eax, edi
test edi, edi
jg 0x1400cd6c3
jmp 0x1400cd6cb
mov eax, ebx
test ebx, ebx
jg 0x1400cd8a2
jmp 0x1400cd8aa
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2c]
mov r9, qword [rsp + 0x38]
call fcn.1400cea80
test rax, rax
je 0x1400ce541
mov rbx, rax
and rax, 0xffffffffffe00000
mov rcx, rbx
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce552
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov ebp, dword [rax + 0x18]
mov edi, dword [rsp + 0x2c]
jmp 0x1400cd72c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, r13d
mov r9, r12
call fcn.1400cea80
test rax, rax
je 0x1400ce560
mov r15, rax
and rax, 0xffffffffffe00000
mov rcx, r15
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce577
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov edi, dword [rax + 0x18]
mov r13d, dword [rsp + 0x2c]
jmp 0x1400cdab5
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400cd83d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, r13d
mov r9, qword [rsp + 0x38]
call fcn.1400cea80
test rax, rax
je 0x1400ce592
mov rbx, rax
and rax, 0xffffffffffe00000
mov rcx, rbx
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce5a8
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov edi, dword [rax + 0x18]
mov r13d, dword [rsp + 0x2c]
jmp 0x1400cdbf2
mov eax, edi
test edi, edi
jg 0x1400cda47
jmp 0x1400cda4f
mov eax, edi
test edi, edi
jg 0x1400cdb88
jmp 0x1400cdb90
lea rax, [rbp*4]
add rax, rbp
mov rcx, qword [rsp + 0x30]
lea rsi, [rcx + rax*8]
add rsi, 0x10
lea r14, [rcx + 8]
mov edi, 1
xor ebx, ebx
mov r15, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r14
call r15
test al, al
jne 0x1400cde5e
jmp 0x1400ce133
pause
dec eax
jne 0x1400cde39
add ebx, edi
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
cmp ebx, 0x3e8
jl 0x1400cde2a
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rsi]
mov r15, qword [rax]
test r15, r15
je 0x1400ce321
mov byte [rsp + 0x70], 0
lea rcx, [rbp*4]
add rcx, rbp
mov rdx, qword [rsp + 0x30]
mov edi, dword [rdx + rcx*8 + 0x28]
mov rcx, qword [r15]
test rcx, rcx
je 0x1400cde9e
mov rdx, rcx
not rdx
cmp qword [r15 + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, r14
jmp 0x1400cd332
je 0x1400cd28e
mov qword [rsp + 0x38], r12
mov r14d, r13d
mov rdi, qword [rsp + 0x30]
mov byte [rdi + 2], 0
mov rcx, rdi
call fcn.1400f6c10
mov rsi, rax
mov byte [rdi + 2], 1
inc qword [rax + 0x298]
cmp bp, 0x29
jae 0x1400ce3ad
mov rdi, rbp
shl rdi, 4
lea rbx, [rsi + rdi]
cmp qword [rsi + rdi], 0
je 0x1400ce3c8
inc qword [rsi + 0x2a0]
mov r15, qword [rbx]
mov rax, qword [r15]
test rax, rax
je 0x1400cdf1f
mov rcx, rax
not rcx
cmp qword [r15 + 8], rcx
jne 0x1400ce7d3
dec byte [rsi + rdi + 8]
bswap rax
mov qword [rbx], rax
lea rax, [rsi + rdi]
add rax, 0xa
mov r13d, r14d
mov r12, qword [rsp + 0x38]
jmp 0x1400ccdfe
test r13b, 1
jne 0x1400cd921
mov rcx, r12
call fcn.14018df10
mov rcx, rbx
mov rdx, rbp
mov r8, r12
call fcn.140131110
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
test dil, dil
je 0x1400ccf59
test r13b, 1
je 0x1400cd419
mov r15, qword [rsp + 0x40]
mov rcx, r15
mov rdx, r15
mov r8, qword [rsp + 0x38]
mov r9, qword [rsp + 0xf0]
call fcn.1401a5300
jmp 0x1400cd259
lea rax, [r12 + 0xfff]
and rax, 0xfffffffffffff000
jmp 0x1400ccfc2
lea rcx, [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
call fcn.1401a5360
test al, al
je 0x1400cce84
jmp 0x1400ccfde
mov rax, qword [rbp + 0x20]
jmp 0x1400ccf37
mov rcx, rdi
shl rcx, 5
mov rdx, qword [r14 + rcx + 0x10]
cmp byte [rdx + 0x1c], 0
je 0x1400cd195
lea rdx, [r14 + rcx]
add rdx, 0x10
mov rbp, qword [0x140214000]
and ebp, 1
shl rbp, 0xe
add rbp, rax
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
shr rcx, 4
shr rbx, 7
and ebx, 0x3ff8
mov eax, 1
shl rax, cl
lock or qword [rbx + rbp + 0x4000], rax
mov rax, qword [rdx]
mov eax, dword [rax + 0x18]
mov rcx, rax
lock xadd qword [0x140213ff0], rcx
add rcx, rax
mov rax, qword [0x140213ff8]
cmp rcx, rax
jbe 0x1400cd259
mov al, byte [0x140214010]
test al, 1
jne 0x1400cd259
lea rcx, [0x140213f60]
mov edx, 1
call fcn.140131300
jmp 0x1400cd259
je 0x1400cd354
mov r14, r12
mov rdi, qword [rsp + 0x30]
mov byte [rdi + 2], 0
mov rcx, rdi
call fcn.1400f6c10
mov rbp, rax
mov byte [rdi + 2], 1
inc qword [rax + 0x298]
cmp si, 0x29
jae 0x1400ce4e2
mov rdi, rsi
shl rdi, 4
lea rbx, [rdi + rbp]
cmp qword [rbp + rdi], 0
je 0x1400ce4fd
inc qword [rbp + 0x2a0]
mov r15, qword [rbx]
mov rax, qword [r15]
test rax, rax
je 0x1400ce0e0
mov rcx, rax
not rcx
cmp qword [r15 + 8], rcx
jne 0x1400ce7d3
dec byte [rbp + rdi + 8]
bswap rax
mov qword [rbx], rax
lea rax, [rdi + rbp]
add rax, 0xa
mov r13d, dword [rsp + 0x2c]
mov r12, r14
jmp 0x1400cd0df
mov rdx, rbp
add rdx, rax
shr r8, 1
mov rcx, rbp
call fcn.1400f7020
jmp 0x1400cd24b
mov rcx, r15
xor edx, edx
mov r8, rdi
call fcn.140103d70
jmp 0x1400cd0fc
mov qword [rbp + 0x20], r12
jmp 0x1400cd419
int3
mov eax, edi
test edi, edi
jg 0x1400cde39
jmp 0x1400cde41
xor r15d, r15d
movabs rdi, 0xaaaaaaaaaaaaaaaa
jmp 0x1400cd3ee
movabs rdi, 0xaaaaaaaaaaaaaaaa
xor r15d, r15d
jmp 0x1400cd32f
shl rcx, 5
mov rdi, qword [rbp + rcx + 0x20]
jmp 0x1400cd32f
xor ebx, ebx
jmp 0x1400cd74f
lea rcx, [rsp + 0x70]
mov edx, r13d
mov r8, r12
mov r9, rsi
call fcn.1401a52d0
test al, al
je 0x1400cd61b
mov rcx, qword [rsp + 0x70]
mov rdx, r12
mov r8, rsi
jmp 0x1400ce254
mov esi, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test ebx, ebx
jne 0x1400ce585
cmp rsi, 1
jbe 0x1400ce5b6
inc qword [rsi + 0x298]
cmp r14w, 0x29
jae 0x1400ce5dc
mov rdi, r14
shl rdi, 4
lea rbp, [rsi + rdi]
cmp qword [rsi + rdi], 0
je 0x1400ce695
inc qword [rsi + 0x2a0]
mov rbx, qword [rbp]
mov rax, qword [rbx]
test rax, rax
je 0x1400ce21c
mov rcx, rax
not rcx
cmp qword [rbx + 8], rcx
jne 0x1400ce7d3
dec byte [rsi + rdi + 8]
bswap rax
mov qword [rbp], rax
lea rax, [rsi + rdi]
add rax, 0xa
test rbx, rbx
je 0x1400ce5ea
movzx ebp, word [rax]
mov edi, dword [rsp + 0x2c]
jmp 0x1400cd73e
mov rcx, rbx
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0xf0]
call fcn.1401a52c0
jmp 0x1400cd75e
mov rcx, rdi
shl rcx, 5
mov rdx, qword [r14 + rcx + 0x10]
cmp byte [rdx + 0x1c], 0
je 0x1400cd803
lea rdx, [r14 + rcx]
add rdx, 0x10
mov rbp, qword [0x140214000]
and ebp, 1
shl rbp, 0xe
add rbp, rax
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
shr rcx, 4
shr rbx, 7
and ebx, 0x3ff8
mov eax, 1
shl rax, cl
lock or qword [rbx + rbp + 0x4000], rax
mov rax, qword [rdx]
mov eax, dword [rax + 0x18]
mov rcx, rax
lock xadd qword [0x140213ff0], rcx
add rcx, rax
mov rax, qword [0x140213ff8]
cmp rcx, rax
jbe 0x1400cd921
mov al, byte [0x140214010]
test al, 1
jne 0x1400cd921
lea rcx, [0x140213f60]
mov edx, 1
call fcn.140131300
jmp 0x1400cd921
int3
lea rcx, [rsp + 0x70]
call fcn.140098180
jmp 0x1400cd921
mov rcx, rbx
xor edx, edx
mov r8, rbp
call fcn.140103d70
jmp 0x1400cd74f
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, qword [rsp + 0x30]
mov r8d, r13d
mov r9, r12
call fcn.1400cea80
test rax, rax
je 0x1400ce6cd
mov r15, rax
and rax, 0xffffffffffe00000
mov rcx, r15
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce6df
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov edi, dword [rax + 0x18]
jmp 0x1400cdea8
mov rdx, rbx
add rdx, rax
shr r8, 1
mov rcx, rbx
call fcn.1400f7020
jmp 0x1400cd9fa
inc qword [rsi + 0x2b8]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
mov r13d, r14d
mov r12, qword [rsp + 0x38]
jmp 0x1400cd28e
inc qword [rsi + 0x2b0]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rsi
mov rdx, rbp
call fcn.1400f6e90
mov r15, qword [rbx]
test r15, r15
mov r13d, r14d
mov r12, qword [rsp + 0x38]
jne 0x1400cdf07
jmp 0x1400cd28e
xor ebx, ebx
jmp 0x1400cdc15
lea rcx, [rsp + 0x70]
mov edx, r13d
mov r8, r12
mov r9, qword [rsp + 0xf0]
call fcn.1401a52d0
test al, al
je 0x1400cdae3
mov rcx, qword [rsp + 0x70]
jmp 0x1400ce4cd
mov esi, dword [0x140221510]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test ebx, ebx
jne 0x1400ce6c0
cmp rsi, 1
jbe 0x1400ce6ed
inc qword [rsi + 0x298]
cmp r15w, 0x29
jae 0x1400ce713
mov rdi, r15
shl rdi, 4
lea rbp, [rsi + rdi]
cmp qword [rsi + rdi], 0
je 0x1400ce7d8
inc qword [rsi + 0x2a0]
mov rbx, qword [rbp]
mov rax, qword [rbx]
test rax, rax
je 0x1400ce4a1
mov rcx, rax
not rcx
cmp qword [rbx + 8], rcx
jne 0x1400ce7d3
dec byte [rsi + rdi + 8]
bswap rax
mov qword [rbp], rax
lea rax, [rsi + rdi]
add rax, 0xa
test rbx, rbx
je 0x1400ce721
movzx edi, word [rax]
mov r13d, dword [rsp + 0x2c]
jmp 0x1400cdc04
mov rcx, rbx
mov rdx, r12
mov r8, qword [rsp + 0xf0]
call fcn.1401a52c0
jmp 0x1400cdc2a
inc qword [rbp + 0x2b8]
inc qword [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
mov r13d, dword [rsp + 0x2c]
mov r12, r14
jmp 0x1400cd354
inc qword [rbp + 0x2b0]
inc qword [rbp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rbp
mov rdx, rsi
call fcn.1400f6e90
mov r15, qword [rbx]
test r15, r15
mov r13d, dword [rsp + 0x2c]
mov r12, r14
jne 0x1400ce0c8
jmp 0x1400cd354
mov r8, rdi
mov rcx, rbx
xor edx, edx
call fcn.140103d70
jmp 0x1400cdc15
movabs rbp, 0xaaaaaaaaaaaaaaaa
xor ebx, ebx
jmp 0x1400cdcd4
shl rcx, 5
mov rbp, qword [rbp + rcx + 0x20]
jmp 0x1400cdcd4
xor r15d, r15d
mov r13d, dword [rsp + 0x2c]
movabs rdi, 0xaaaaaaaaaaaaaaaa
jmp 0x1400cdab5
shl rcx, 5
mov rdi, qword [rbp + rcx + 0x20]
jmp 0x1400cdd4e
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400ce1c7
xor ebx, ebx
mov r13d, dword [rsp + 0x2c]
movabs rdi, 0xaaaaaaaaaaaaaaaa
jmp 0x1400cdbf2
shl rcx, 5
mov rdi, qword [rbp + rcx + 0x20]
jmp 0x1400cddd8
je 0x1400ce5ea
mov rdi, qword [rsp + 0x30]
mov byte [rdi + 2], 0
mov rcx, rdi
call fcn.1400f6c10
mov rsi, rax
mov byte [rdi + 2], 1
inc qword [rax + 0x298]
jmp 0x1400ce1d8
inc qword [rsi + 0x2b8]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
lea rsi, [r14 + r14*4]
mov rax, qword [rsp + 0x30]
lea rbp, [rax + rsi*8]
add rbp, 0x10
lea r14, [rax + 8]
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r13d, 0x40
mov rcx, r14
call r12
test al, al
jne 0x1400ce643
jmp 0x1400ce803
pause
dec eax
jne 0x1400ce622
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r13d
cmp ebx, 0x3e8
jl 0x1400ce613
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400ce812
mov byte [rsp + 0x60], 0
mov rcx, qword [rsp + 0x30]
mov ebp, dword [rcx + rsi*8 + 0x28]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ce679
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, dword [rsp + 0x2c]
jmp 0x1400cd735
inc qword [rsi + 0x2b0]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rsi
mov rdx, r14
call fcn.1400f6e90
mov rbx, qword [rbp]
test rbx, rbx
jne 0x1400ce204
jmp 0x1400ce5ea
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400ce44c
movabs rdi, 0xaaaaaaaaaaaaaaaa
xor r15d, r15d
jmp 0x1400cdea8
shl rcx, 5
mov rdi, qword [rbp + rcx + 0x20]
jmp 0x1400cdea8
je 0x1400ce721
mov rdi, qword [rsp + 0x30]
mov byte [rdi + 2], 0
mov rcx, rdi
call fcn.1400f6c10
mov rsi, rax
mov byte [rdi + 2], 1
inc qword [rax + 0x298]
jmp 0x1400ce45d
inc qword [rsi + 0x2b8]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
lea rsi, [r15 + r15*4]
mov rax, qword [rsp + 0x30]
lea rbp, [rax + rsi*8]
add rbp, 0x10
lea r15, [rax + 8]
mov edi, 1
xor ebx, ebx
mov r12, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov r13d, 0x40
mov rcx, r15
call r12
test al, al
jne 0x1400ce77a
jmp 0x1400ce88c
pause
dec eax
jne 0x1400ce759
add ebx, edi
add edi, edi
cmp edi, 0x40
cmovge edi, r13d
cmp ebx, 0x3e8
jl 0x1400ce74a
mov rcx, r15
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rax, qword [rbp]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400ce89b
mov byte [rsp + 0x60], 0
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + rsi*8 + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ce7b1
mov rdx, rcx
not rdx
cmp qword [rbx + 8], rdx
jne 0x1400ce7d3
bswap rcx
mov qword [rax], rcx
inc word [rax + 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov r13d, dword [rsp + 0x2c]
mov rdi, qword [rsp + 0x50]
jmp 0x1400cdbfb
call 0x140131100
inc qword [rsi + 0x2b0]
inc qword [rsi + reloc.SHELL32.dll_IsUserAnAdmin]
mov rcx, rsi
mov rdx, r15
call fcn.1400f6e90
mov rbx, qword [rbp]
test rbx, rbx
jne 0x1400ce489
jmp 0x1400ce721
mov eax, edi
test edi, edi
jg 0x1400ce622
jmp 0x1400ce62a
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2c]
mov r9, qword [rsp + 0x38]
call fcn.1400cea80
test rax, rax
je 0x1400ce90a
mov rbx, rax
and rax, 0xffffffffffe00000
mov rcx, rbx
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce922
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov ebp, dword [rax + 0x18]
jmp 0x1400ce683
mov eax, edi
test edi, edi
jg 0x1400ce759
jmp 0x1400ce761
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x2c]
mov r9, qword [rsp + 0x38]
call fcn.1400cea80
test rax, rax
je 0x1400ce91b
mov rbx, rax
and rax, 0xffffffffffe00000
mov rcx, rbx
shr rcx, 9
and ecx, 0xfe0
lea rbp, [rax + rcx]
add rbp, 0x1000
movzx edx, word [rbp + 0x1e]
mov rcx, rdx
neg rcx
shl rdx, 5
mov rax, rbp
sub rax, rdx
cmp byte [rax + 0x1d], 0
jne 0x1400ce930
shl rcx, 5
mov rax, qword [rbp + rcx + 0x10]
mov eax, dword [rax + 0x18]
jmp 0x1400ce939
movabs rbp, 0xaaaaaaaaaaaaaaaa
xor ebx, ebx
jmp 0x1400ce683
xor ebx, ebx
jmp 0x1400ce7bb
shl rcx, 5
mov rbp, qword [rbp + rcx + 0x20]
jmp 0x1400ce683
shl rcx, 5
mov rax, qword [rbp + rcx + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x1400ce7bb