Function at 0x14000eb00
Capabilities:
Continue service
Delete service
Pause service
Resume thread
Start service
Suspend thread
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x438]
sub rsp, 0x538
mov rax, qword gs:[0x30]
xor r15d, r15d
mov esi, 1
mov qword [rsp + 0x28], r15
mov r9d, esi
mov r8d, esi
mov ebx, r15d
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x20]
lea rcx, [rsp + 0x78]
movzx eax, word [rdx + 0x70]
mov qword [rsp + 0x78], rax
mov rax, qword [rdx + 0x78]
lea rdx, [0x140152bc8]
mov qword [rbp - 0x80], rax
lea rax, [0x14000eaf0]
mov qword [rsp + 0x20], rax
call sym.ProcessJacker.exe_PhParseCommandLine
mov rcx, qword [0x14015f300]
lea rax, str.process
movzx r8d, sil
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xe
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f522
mov r9, qword [0x14015f308]
test r9, r9
je 0x14000ec79
mov r8, qword [r9]
mov ecx, r15d
shr r8, 1
je 0x14000ebd9
mov rdx, qword [r9 + 8]
nop
movzx eax, word [rdx]
sub ax, 0x30
cmp ax, 0xa
jae 0x14000ebd9
inc rcx
add rdx, 2
cmp rcx, r8
jb 0x14000ebc0
cmp rcx, r8
jne 0x14000ec8e
movups xmm0, xmmword [r9]
xor r14b, r14b
movq r9, xmm0
movups xmmword [rsp + 0x40], xmm0
mov r10, qword [rsp + 0x48]
test r9, r9
je 0x14000ec1b
movzx eax, word [r10]
cmp ax, 0x2d
je 0x14000ec0f
cmp ax, 0x2b
jne 0x14000ec1b
jmp 0x14000ec13
movzx r14d, sil
add r10, 2
sub r9, 2
shr r9, 1
movzx r11d, sil
mov rdi, r15
mov rdx, r15
je 0x14000ec6c
mov qword [rsp + 0x530], r12
lea r12, [0x140136080]
nop dword [rax]
movzx eax, byte [r10 + rdx*2]
mov r8d, dword [r12 + rax*4]
cmp r8d, 0xa
jae 0x14000ec59
lea rcx, [rdi + rdi*4]
lea rdi, [r8 + rcx*2]
jmp 0x14000ec5c
xor r11b, r11b
inc rdx
cmp rdx, r9
jb 0x14000ec40
mov r12, qword [rsp + 0x530]
test r14b, r14b
je 0x14000ec74
neg rdi
test r11b, r11b
jne 0x14000ecf1
mov eax, 0xc000000d
add rsp, 0x538
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 5
lea rcx, [rsp + 0x50]
call sym.ProcessJacker.exe_PhEnumProcessesEx
mov ebx, eax
test eax, eax
js 0x14000fa24
mov r14, qword [rsp + 0x50]
mov rdx, qword [0x14015f308]
mov rcx, r14
call sym.ProcessJacker.exe_PhFindProcessInformationByImageName
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
xor edx, edx
mov r8, r14
test rax, rax
jne 0x14000ece7
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, 0xc0000225
add rsp, 0x538
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rax + 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [0x14015f310]
lea rax, str.terminate
movzx r8d, sil
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x78], 0x12
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000ed8d
xorps xmm0, xmm0
mov dword [rbp + 0x1f8], 0x30
lea r9, [rbp - 0x68]
mov qword [rbp + 0x200], r15
lea r8, [rbp + 0x1f8]
mov dword [rbp + 0x210], r15d
mov edx, esi
mov qword [rbp + 0x208], r15
lea rcx, [rbp + 0x488]
mov qword [rbp - 0x68], rdi
movdqu xmmword [rbp + 0x218], xmm0
mov qword [rbp - 0x60], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rbp + 0x488]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.suspend
movzx r8d, sil
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x58]
mov qword [rbp - 0x58], 0xe
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000ee2a
xorps xmm0, xmm0
mov dword [rbp + 0x228], 0x30
lea r9, [rbp - 0x48]
mov qword [rbp + 0x230], r15
lea r8, [rbp + 0x228]
mov dword [rbp + 0x240], r15d
mov edx, 0x800
mov qword [rbp + 0x238], r15
lea rcx, [rbp + 0x488]
mov qword [rbp - 0x48], rdi
movdqu xmmword [rbp + 0x248], xmm0
mov qword [rbp - 0x40], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.ntdll.dll_NtSuspendProcess]
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.resume
movzx r8d, sil
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x38]
mov qword [rbp - 0x38], 0xc
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000eec7
xorps xmm0, xmm0
mov dword [rbp + 0x258], 0x30
lea r9, [rbp - 0x28]
mov qword [rbp + 0x260], r15
lea r8, [rbp + 0x258]
mov dword [rbp + 0x270], r15d
mov edx, 0x800
mov qword [rbp + 0x268], r15
lea rcx, [rbp + 0x488]
mov qword [rbp - 0x28], rdi
movdqu xmmword [rbp + 0x278], xmm0
mov qword [rbp - 0x20], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rbp + 0x488]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.priority
movzx r8d, sil
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
mov qword [rbp - 0x18], 0x10
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f0b7
mov rcx, qword [0x14015f318]
test rcx, rcx
je 0x14000ec79
lea rax, str.idle
mov qword [rbp - 8], 8
movzx r8d, sil
mov qword [rbp], rax
lea rdx, [rbp - 8]
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
jne 0x14000f026
mov rcx, qword [0x14015f318]
lea rax, str.normal
movzx r8d, sil
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 8]
mov qword [rbp + 8], 0xc
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000ef61
mov sil, 2
jmp 0x14000f026
mov rcx, qword [0x14015f318]
lea rax, str.high
movzx r8d, sil
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov qword [rbp + 0x18], 8
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000ef94
mov sil, 3
jmp 0x14000f026
mov rcx, qword [0x14015f318]
lea rax, str.realtime
movzx r8d, sil
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x28]
mov qword [rbp + 0x28], 0x10
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000efc4
mov sil, 4
jmp 0x14000f026
mov rcx, qword [0x14015f318]
lea rax, str.abovenormal
movzx r8d, sil
mov qword [rbp + 0x40], rax
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x38], 0x16
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000eff4
mov sil, 6
jmp 0x14000f026
mov rcx, qword [0x14015f318]
lea rax, str.belownormal
movzx r8d, sil
mov qword [rbp + 0x50], rax
lea rdx, [rbp + 0x48]
mov qword [rbp + 0x48], 0x16
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000ec79
mov sil, 5
xorps xmm0, xmm0
mov dword [rbp + 0x288], 0x30
lea r9, [rbp + 0x58]
mov qword [rbp + 0x290], r15
lea r8, [rbp + 0x288]
mov dword [rbp + 0x2a0], r15d
mov edx, 0x200
mov qword [rbp + 0x298], r15
lea rcx, [rbp + 0x488]
mov qword [rbp + 0x58], rdi
movdqu xmmword [rbp + 0x2a8], xmm0
mov qword [rbp + 0x60], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rbp + 0x488]
lea r8, [rbp + 0x470]
mov r9d, 2
mov byte [rbp + 0x470], r15b
mov byte [rbp + 0x471], sil
lea edx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.iopriority
movzx r8d, sil
mov qword [rbp + 0x70], rax
lea rdx, [rbp + 0x68]
mov qword [rbp + 0x68], 0x14
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f263
mov rcx, qword [0x14015f318]
test rcx, rcx
je 0x14000ec79
lea rax, str.verylow
mov qword [rbp + 0x78], 0xe
movzx r8d, sil
mov qword [rbp + 0x80], rax
lea rdx, [rbp + 0x78]
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f125
mov esi, r15d
jmp 0x14000f1d1
mov rcx, qword [0x14015f318]
lea rax, [0x140126ad8]
movzx r8d, sil
mov qword [rbp + 0x90], rax
lea rdx, [rbp + 0x88]
mov qword [rbp + 0x88], 6
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
jne 0x14000f1d1
mov rcx, qword [0x14015f318]
lea rax, str.normal
movzx r8d, sil
mov qword [rbp + 0xa0], rax
lea rdx, [rbp + 0x98]
mov qword [rbp + 0x98], 0xc
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f194
mov esi, 2
jmp 0x14000f1d1
mov rcx, qword [0x14015f318]
lea rax, str.high
movzx r8d, sil
mov qword [rbp + 0xb0], rax
lea rdx, [rbp + 0xa8]
mov qword [rbp + 0xa8], 8
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000ec79
mov esi, 3
xorps xmm0, xmm0
mov dword [rbp + 0x2b8], 0x30
lea r9, [rbp + 0xb8]
mov qword [rbp + 0x2c0], r15
lea r8, [rbp + 0x2b8]
mov dword [rbp + 0x2d0], r15d
mov edx, 0x200
mov qword [rbp + 0x2c8], r15
lea rcx, [rbp + 0x488]
mov qword [rbp + 0xb8], rdi
movdqu xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0xc0], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rbp + 0x488]
lea r8, [rbp + 0x478]
mov r9d, 4
mov dword [rbp + 0x478], esi
lea edx, [r9 + 0x1d]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.pagepriority
movzx r8d, sil
mov qword [rbp + 0xd0], rax
lea rdx, [rbp + 0xc8]
mov qword [rbp + 0xc8], 0x18
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f350
mov rcx, qword [0x14015f318]
test rcx, rcx
je 0x14000ec79
lea r8, [rsp + 0x58]
mov edx, 0xa
call sym.ProcessJacker.exe_PhStringToInteger64
mov eax, dword [rsp + 0x58]
lea r9, [rbp + 0xd8]
xorps xmm0, xmm0
mov dword [rbp + 0x480], eax
lea r8, [rbp + 0x2e8]
mov dword [rbp + 0x2e8], 0x30
mov edx, 0x200
mov qword [rbp + 0x2f0], r15
lea rcx, [rbp + 0x488]
mov dword [rbp + 0x300], r15d
movdqu xmmword [rbp + 0x308], xmm0
mov qword [rbp + 0x2f8], r15
mov qword [rbp + 0xd8], rdi
mov qword [rbp + 0xe0], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rbp + 0x488]
lea r8, [rbp + 0x480]
mov r9d, 4
lea edx, [r9 + 0x23]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.injectdll
movzx r8d, sil
mov qword [rbp + 0xf0], rax
lea rdx, [rbp + 0xe8]
mov qword [rbp + 0xe8], 0x12
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f42c
cmp qword [0x14015f318], r15
je 0x14000ec79
mov edx, dword [sym.ProcessJacker.exe_ProcessQueryAccess]
lea r9, [rbp + 0xf8]
xorps xmm0, xmm0
mov dword [rbp + 0x318], 0x30
or edx, 0x3a
mov qword [rbp + 0x320], r15
lea r8, [rbp + 0x318]
mov dword [rbp + 0x330], r15d
lea rcx, [rbp + 0x488]
mov qword [rbp + 0x328], r15
movdqu xmmword [rbp + 0x338], xmm0
mov qword [rbp + 0xf8], rdi
mov qword [rbp + 0x100], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rdx, qword [0x14015f318]
lea r8, [rsp + 0x60]
mov rcx, qword [rbp + 0x488]
mov qword [rsp + 0x60], 0xfffffffffd050f80
mov rdx, qword [rdx + 8]
call sym.ProcessJacker.exe_PhInjectDllProcess
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1a
mov rcx, qword [0x14015f310]
lea rax, str.unloaddll
movzx r8d, sil
mov qword [rbp + 0x110], rax
lea rdx, [rbp + 0x108]
mov qword [rbp + 0x108], 0x12
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000fa22
cmp qword [0x14015f318], r15
je 0x14000ec79
mov edx, dword [sym.ProcessJacker.exe_ProcessQueryAccess]
lea r9, [rbp + 0x118]
xorps xmm0, xmm0
mov dword [rbp + 0x348], 0x30
or edx, 0x3a
mov qword [rbp + 0x350], r15
lea r8, [rbp + 0x348]
mov dword [rbp + 0x360], r15d
lea rcx, [rbp + 0x488]
mov qword [rbp + 0x358], r15
movdqu xmmword [rbp + 0x368], xmm0
mov qword [rbp + 0x118], rdi
mov qword [rbp + 0x120], r15
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rdx, qword [0x14015f318]
lea r8, [rsp + 0x70]
mov rcx, qword [rbp + 0x488]
call fcn.14000fb80
mov ebx, eax
test eax, eax
js 0x14000f516
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
mov rcx, qword [rbp + 0x488]
mov qword [rsp + 0x68], 0xfffffffffd050f80
call sym.ProcessJacker.exe_PhUnloadDllProcess
mov ebx, eax
mov rcx, qword [rbp + 0x488]
jmp 0x14000fa1c
mov rcx, qword [0x14015f300]
lea rax, str.service
movzx r8d, sil
mov qword [rbp + 0x130], rax
lea rdx, [rbp + 0x128]
mov qword [rbp + 0x128], 0xe
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f7c1
cmp qword [0x14015f308], rbx
je 0x14000ec79
mov rcx, qword [0x14015f310]
lea rax, str.start
movzx r8d, sil
mov qword [rbp + 0x140], rax
lea rdx, [rbp + 0x138]
mov qword [rbp + 0x138], 0xa
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f5f1
mov rcx, qword [0x14015f308]
mov edx, 0x10
mov rcx, qword [rcx + 8]
call sym.ProcessJacker.exe_PhOpenService
mov rdi, rax
test rax, rax
jne 0x14000f5de
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x14000fa24
movzx eax, ax
or eax, 0xc0070000
add rsp, 0x538
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x14000f79a
mov rcx, qword [0x14015f310]
lea rax, str.continue
movzx r8d, sil
mov qword [rbp + 0x150], rax
lea rdx, [rbp + 0x148]
mov qword [rbp + 0x148], 0x10
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f660
mov rcx, qword [0x14015f308]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessJacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f5b8
lea r8, [rbp + 0x408]
mov edx, 3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14000f79a
mov rcx, qword [0x14015f310]
lea rax, str.pause
movzx r8d, sil
mov qword [rbp + 0x160], rax
lea rdx, [rbp + 0x158]
mov qword [rbp + 0x158], 0xa
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f6cf
mov rcx, qword [0x14015f308]
mov edx, 0x40
mov rcx, qword [rcx + 8]
call sym.ProcessJacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f5b8
lea r8, [rbp + 0x408]
mov edx, 2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14000f79a
mov rcx, qword [0x14015f310]
lea rax, str.stop
movzx r8d, sil
mov qword [rbp + 0x170], rax
lea rdx, [rbp + 0x168]
mov qword [rbp + 0x168], 8
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f738
mov rcx, qword [0x14015f308]
mov edx, 0x20
mov rcx, qword [rcx + 8]
call sym.ProcessJacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f5b8
lea r8, [rbp + 0x408]
mov edx, esi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x14000f79a
mov rcx, qword [0x14015f310]
lea rax, [0x14010ceb8]
movzx r8d, sil
mov qword [rbp + 0x180], rax
lea rdx, [rbp + 0x178]
mov qword [rbp + 0x178], 0xc
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000fa22
mov rcx, qword [0x14015f308]
mov edx, 0x10000
mov rcx, qword [rcx + 8]
call sym.ProcessJacker.exe_PhOpenService
mov rdi, rax
test rax, rax
je 0x14000f5b8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x14000f7b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x14000f7b3
movzx ebx, ax
or ebx, 0xc0070000
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14000fa22
mov rcx, qword [0x14015f300]
lea rax, str.thread
movzx r8d, sil
mov qword [rbp + 0x190], rax
lea rdx, [rbp + 0x188]
mov qword [rbp + 0x188], 0xc
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000fa22
mov rcx, qword [0x14015f308]
test rcx, rcx
je 0x14000ec79
lea r8, [rsp + 0x38]
mov edx, 0xa
call sym.ProcessJacker.exe_PhStringToInteger64
test al, al
je 0x14000ec79
mov rcx, qword [0x14015f310]
lea rax, str.terminate
movzx r8d, sil
mov qword [rbp + 0x1a0], rax
lea rdx, [rbp + 0x198]
mov qword [rbp + 0x198], 0x12
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f8c8
mov rax, qword [rsp + 0x38]
lea r9, [rbp + 0x1a8]
xorps xmm0, xmm0
mov qword [rbp + 0x1b0], rax
lea r8, [rbp + 0x378]
mov qword [rbp + 0x1a8], r15
mov edx, esi
mov dword [rbp + 0x378], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x380], r15
movdqu xmmword [rbp + 0x398], xmm0
mov dword [rbp + 0x390], r15d
mov qword [rbp + 0x388], r15
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtTerminateThread]
jmp 0x14000fa15
mov rcx, qword [0x14015f310]
lea rax, str.suspend
movzx r8d, sil
mov qword [rbp + 0x1c0], rax
lea rdx, [rbp + 0x1b8]
mov qword [rbp + 0x1b8], 0xe
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000f973
mov rax, qword [rsp + 0x38]
lea r9, [rbp + 0x1c8]
xorps xmm0, xmm0
mov qword [rbp + 0x1d0], rax
lea r8, [rbp + 0x3a8]
mov qword [rbp + 0x1c8], r15
mov edx, 2
mov dword [rbp + 0x3a8], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x3b0], r15
movdqu xmmword [rbp + 0x3c8], xmm0
mov dword [rbp + 0x3c0], r15d
mov qword [rbp + 0x3b8], r15
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtSuspendThread]
jmp 0x14000fa15
mov rcx, qword [0x14015f310]
lea rax, str.resume
movzx r8d, sil
mov qword [rbp + 0x1e0], rax
lea rdx, [rbp + 0x1d8]
mov qword [rbp + 0x1d8], 0xc
call sym.ProcessJacker.exe_PhEqualStringRef
test al, al
je 0x14000fa22
mov rax, qword [rsp + 0x38]
lea r9, [rbp + 0x1e8]
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], rax
lea r8, [rbp + 0x3d8]
mov qword [rbp + 0x1e8], r15
mov edx, 2
mov dword [rbp + 0x3d8], 0x30
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x3e0], r15
movdqu xmmword [rbp + 0x3f8], xmm0
mov dword [rbp + 0x3f0], r15d
mov qword [rbp + 0x3e8], r15
call qword [sym.imp.ntdll.dll_NtOpenThread]
mov ebx, eax
test eax, eax
js 0x14000fa22
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtResumeThread]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
add rsp, 0x538
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret