Function at 0x14002be00
Capabilities:
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400b5200]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov rbx, rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp + 0x158], rcx
xor edi, edi
lea rax, str.File
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 4
lea rcx, [rbp + 0x10]
call fcn.14002d420
mov word [rsp + 0x68], ax
movzx ecx, byte [0x1400b5108]
cmp ax, cx
jne 0x14002be96
lea rdx, str.Cant_parse_file_type_in_get_all_file_handles
mov ecx, 1
call fcn.1400296a0
mov rcx, rbx
call fcn.14002a6a0
mov rax, rbx
jmp 0x14002c115
lea rcx, [rbp + 0x100]
call fcn.14002bb90
nop
mov ecx, dword [0x1400bf6f0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400b7fc8], ecx
jg 0x14002d39e
lea rcx, [rbp + 0x220]
call fcn.14002d870
nop
mov rdx, 0xffffffffff676980
lea rcx, [rbp + 0x300]
call fcn.14002f040
nop
mov r14d, 0x10000
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rdi
lea r8, [rsp + 0x40]
mov edx, r14d
lea rcx, [rbp - 0x50]
call fcn.140028860
mov r12, qword [rbp - 0x50]
mov r15, r12
xor r9d, r9d
mov r8d, r14d
mov rdx, r12
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rsi, r12
mov rdi, r12
mov rbx, r12
mov r13, qword [rbp - 0x40]
cmp eax, 0xc0000004
jne 0x14002bfe2
mov rdx, r12
mov r8, r12
mov rdi, qword [rbp - 0x48]
nop dword [rax + rax]
lea eax, [r14 + r14]
mov r14d, eax
mov ebx, eax
mov rcx, rdi
sub rcx, rsi
cmp r14, rcx
jae 0x14002bf6a
lea rdi, [rdx + rax]
jmp 0x14002bfa9
jbe 0x14002bfad
mov rax, r13
sub rax, r8
cmp rbx, rax
jbe 0x14002bf96
lea r8, [rsp + 0x40]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140028860
mov r13, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x48]
mov r12, qword [rbp - 0x50]
jmp 0x14002bfad
sub rbx, rcx
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.140087b80
add rdi, rbx
mov qword [rbp - 0x48], rdi
mov r15, r12
mov rsi, r12
xor r9d, r9d
mov r8d, r14d
mov rdx, r12
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x50], eax
mov rdx, r12
mov r8, r12
cmp eax, 0xc0000004
je 0x14002bf50
mov rdi, r12
mov rbx, r12
test eax, eax
jns 0x14002c145
lea rdx, str.Error_on_NtQuerySystemInformation
mov ecx, 1
call fcn.1400296a0
mov rcx, qword [rbp - 0x80]
call fcn.14002a6a0
nop
test rsi, rsi
je 0x14002c03e
sub r13, rdi
cmp r13, 0x1000
jb 0x14002c032
add r13, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x14002d40b
mov rbx, rcx
mov rdx, r13
mov rcx, rbx
call fcn.14005e4dc
nop
lea rcx, [rbp + 0x300]
call fcn.14002f080
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 7
jbe 0x14002c091
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c08c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d411
call fcn.14005e4dc
xor ebx, ebx
mov qword [rbp + 0x230], rbx
mov qword [rbp + 0x238], 7
mov word [rbp + 0x220], bx
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x14002c102
mov rdx, qword [rbp + 0x128]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c0eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d398
call fcn.14005e4dc
mov qword [rbp + 0x118], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
mov rdi, qword [rbp - 0x80]
lea rcx, [rbp + 0x108]
call fcn.14002a930
mov rax, rdi
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14005e480
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
nop
mov ebx, eax
mov dword [rsp + 0x48], eax
mov dword [rbp - 0x30], 0
xor esi, esi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
mov ecx, 0x90
call fcn.14005e4a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x18], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], 7
mov qword [rbp + 8], 8
mov dword [rbp - 0x30], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rbp - 0x18]
call fcn.140021bf0
nop
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov ecx, 0x20
call fcn.14005e4a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x70], rax
mov dword [rbp + 0x70], esi
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rsi
mov ecx, 0x20
call fcn.14005e4a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], 7
mov qword [rbp + 0xa8], 8
mov dword [rbp + 0x70], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rbp + 0x88]
call fcn.140021bf0
nop
mov r8, r12
lea rdx, [0x14008e798]
mov ecx, 3
call fcn.140029870
mov edi, esi
mov dword [rsp + 0x44], esi
cmp qword [r12], rdi
jbe 0x14002d0a3
mov eax, esi
movabs r9, 0xcbf29ce484222325
movabs r8, 0x100000001b3
nop dword [rax + rax]
lea r14, [rax + rax*4]
movzx eax, word [rsp + 0x68]
cmp word [r12 + r14*8 + 0x2e], ax
jne 0x14002d092
lea r15, [r14 + 3]
lea r15, [r12 + r15*8]
mov rdx, qword [r15]
mov eax, ebx
cmp rdx, rax
je 0x14002d08f
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x14002c2d7
nop word [rax + rax]
cmp dword [rax + 0x1c], edx
jae 0x14002c2cb
mov rax, qword [rax + 0x10]
jmp 0x14002c2d1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14002c2c0
cmp byte [rcx + 0x19], 0
jne 0x14002c2e6
cmp edx, dword [rcx + 0x1c]
jae 0x14002d08f
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], rsi
mov dword [rbp + 0x160], 0x30
mov qword [rbp + 0x168], rsi
mov dword [rbp + 0x178], esi
mov qword [rbp + 0x170], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rsp + 0x58], rsi
movzx ecx, byte [r15]
xor rcx, r9
imul rcx, r8
movzx eax, byte [r15 + 1]
xor rcx, rax
imul rcx, r8
movzx eax, byte [r15 + 2]
xor rcx, rax
imul rcx, r8
movzx eax, byte [r15 + 3]
xor rcx, rax
imul rcx, r8
movzx eax, byte [r15 + 4]
xor rcx, rax
imul rcx, r8
movzx eax, byte [r15 + 5]
xor rcx, rax
imul rcx, r8
movzx eax, byte [r15 + 6]
xor rcx, rax
imul rcx, r8
movzx eax, byte [r15 + 7]
xor rcx, rax
imul rcx, r8
mov r8, qword [rbp + 0xa0]
and r8, rcx
add r8, r8
mov rcx, qword [rbp + 0x88]
mov rax, qword [rcx + r8*8 + 8]
mov r9, qword [rbp + 0x78]
cmp rax, r9
je 0x14002c3c1
mov rcx, qword [rcx + r8*8]
cmp rdx, qword [rax + 0x10]
je 0x14002c3c4
nop dword [rax]
cmp rax, rcx
je 0x14002c3c1
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14002c3b0
jmp 0x14002c3c4
mov rax, rsi
mov rcx, r9
test rax, rax
cmovne rcx, rax
cmp rcx, r9
je 0x14002c3e1
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x14002c46b
lea r9, [rbp + 0xc8]
lea r8, [rbp + 0x160]
mov edx, 0x440
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov dword [rsp + 0x50], eax
test eax, eax
js 0x14002cf65
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002cf65
call fcn.14002d820
test eax, eax
jne 0x14002cf65
mov rax, qword [r15]
mov qword [rbp + 0x10], rax
mov rax, qword [rsp + 0x58]
cmp rax, 0xffffffffffffffff
cmove rax, rsi
mov qword [rbp + 0x18], rax
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x198]
lea rcx, [rbp + 0x70]
call fcn.140029090
nop
mov rcx, qword [rbp + 0x18]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002c46b
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbp + 0x18], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], rsi
mov dword [rbp + 0x1d8], esi
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], si
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], si
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x48]
call fcn.14002b210
nop
cmp byte [rbp + 0x68], 0
jne 0x14002c5e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, str._error_code:
mov r8, r15
lea rdx, str.Error_GetModuleFileNameExW_with_pid:
mov ecx, 1
call fcn.14002a260
nop
cmp byte [rbp + 0x68], 0
je 0x14002c51c
lea rcx, [rbp + 0x48]
call fcn.140001a60
nop
mov r8, qword [rbp + 0x218]
cmp r8, 7
jbe 0x14002c53c
mov rdx, qword [rbp + 0x200]
lea rcx, [rbp + 0x200]
call fcn.140001d90
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], si
mov r8, qword [rbp + 0x1f8]
cmp r8, 7
jbe 0x14002c575
mov rdx, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x1e0]
call fcn.140001d90
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], si
mov rbx, qword [rbp + 0x1c0]
test rbx, rbx
je 0x14002c5df
mov rdi, qword [rbp + 0x1c8]
cmp rbx, rdi
je 0x14002c5be
mov rcx, rbx
call fcn.140001a60
add rbx, 0x20
cmp rbx, rdi
jne 0x14002c5a6
mov rbx, qword [rbp + 0x1c0]
mov r8, qword [rbp + 0x1d0]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x1c0]
call fcn.140004300
mov edi, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x48]
jmp 0x14002d07b
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova rdx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x58]
lea rcx, [rbp + 0x1e0]
call fcn.14000d0a0
lea rdi, [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1e0]
mov r8, qword [rbp + 0x1f8]
cmp r8, 7
cmova rdi, rdx
lea rax, [rbp + 0x1e0]
cmova rax, rdx
mov rcx, qword [rbp + 0x1f0]
lea rsi, [rax + rcx*2]
lea rbx, [rbp + 0x1e0]
cmova rbx, rdx
cmp rbx, rsi
je 0x14002c67a
sub rdi, rbx
nop dword [rax]
movzx ecx, word [rbx]
call fcn.14006c2b0
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x14002c650
mov r8, qword [rbp + 0x1f8]
mov rcx, qword [rbp + 0x1f0]
mov rdx, qword [rbp + 0x1e0]
lea r11, [rbp + 0x220]
cmp qword [rbp + 0x238], 7
cmova r11, qword [rbp + 0x220]
lea rdi, [rbp + 0x1e0]
cmp r8, 7
cmova rdi, rdx
mov rbx, qword [rbp + 0x230]
cmp rbx, rcx
ja 0x14002c861
sub rcx, rbx
test rbx, rbx
je 0x14002c744
inc rcx
lea rsi, [rdi + rcx*2]
mov rcx, rdi
movzx r10d, word [r11]
nop word [rax + rax]
mov rax, rsi
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14002c6fc
cmp word [rcx], r10w
je 0x14002c6f9
cmp rax, 1
je 0x14002c6fc
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x14002c6e6
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14002c861
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x14002c738
mov r9, rcx
sub r9, r11
nop dword [rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14002c7bc
add rdx, 2
sub r8, 1
jne 0x14002c720
sub rcx, rdi
sar rcx, 1
jne 0x14002c861
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, str._with_path:
mov r8, r15
lea rdx, str.blacklist_pid:
mov ecx, 3
call fcn.140029490
mov eax, dword [r15]
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x1a8]
lea rcx, [rsp + 0x70]
call fcn.140029390
mov rdx, r15
lea rcx, [rbp + 0x70]
call fcn.140028150
mov rcx, qword [rbp + 0xa0]
and rcx, rax
add rcx, rcx
mov rdx, qword [rbp + 0x88]
mov rbx, qword [rdx + rcx*8 + 8]
mov r9, qword [rbp + 0x78]
cmp rbx, r9
jne 0x14002c7c5
xor esi, esi
mov ebx, esi
jmp 0x14002c7e3
add rcx, 2
jmp 0x14002c6d0
mov r8, qword [rdx + rcx*8]
mov rax, qword [r15]
cmp rax, qword [rbx + 0x10]
je 0x14002c7e1
cmp rbx, r8
je 0x14002c7b6
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x14002c7d2
xor esi, esi
test rbx, rbx
je 0x14002ceca
mov rax, qword [rdx + rcx*8]
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x14002c812
cmp rax, rbx
jne 0x14002c807
mov qword [rdx + rcx*8], r9
mov qword [rdx + rcx*8 + 8], r9
jmp 0x14002c81e
mov r9, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], r9
jmp 0x14002c81e
cmp rax, rbx
jne 0x14002c81e
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rdx, qword [rbx]
dec qword [rbp + 0x80]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov rcx, qword [rbx + 0x18]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002c84f
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rbx + 0x18], rsi
mov edx, 0x20
mov rcx, rbx
call fcn.14005e4dc
jmp 0x14002ceca
xor esi, esi
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x60]
mov r8, 0xffffffffffffffff
mov rdx, qword [r12 + r14*8 + 0x20]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x14002c8dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, str._last_error_code:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, str._process_id:
lea r8, [rsp + 0x50]
lea rdx, str.Cant_duplicate_object__status:
mov ecx, 1
call fcn.140029c10
jmp 0x14002ceb0
mov byte [rbp + 0x40], 0
lea rax, [rbp + 0x20]
mov qword [rbp + 0xd8], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0xe0], rax
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_1db40617bf27e77869a92dae17c13850___void___.0
mov qword [rbp + 0x2c0], rax
movups xmm0, xmmword [rbp + 0xd8]
movups xmmword [rbp + 0x2c8], xmm0
lea rax, [rbp + 0x2c0]
mov qword [rbp + 0x2f8], rax
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x300]
call fcn.14002f100
movzx ebx, al
mov byte [rsp + 0x40], al
mov rcx, qword [rbp + 0x2f8]
test rcx, rcx
je 0x14002c95f
mov rdx, qword [rcx]
mov r8, qword [rdx + 0x20]
lea rax, [rbp + 0x2c0]
cmp rcx, rax
setne dl
call r8
test bl, bl
je 0x14002ce76
cmp byte [rbp + 0x40], 0
je 0x14002ce76
mov rbx, qword [0x1400b7fb8]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x14002ca49
nop word [rax + rax]
lea r9, [rbx + 0x20]
lea rdi, [r9 + 0x20]
mov rsi, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 7
jbe 0x14002c9a6
mov r9, qword [r9]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, qword [rbp + 0x30]
call fcn.1400289c0
test rax, rax
jne 0x14002c9ee
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14002c9d8
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x20]
call fcn.14002d640
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14002ca1a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14002ca15
cmp rbx, qword [rax + 0x10]
jne 0x14002ca15
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14002ca02
mov rbx, rax
jmp 0x14002ca3f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14002ca3f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14002ca30
cmp byte [rbx + 0x19], 0
je 0x14002c990
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x100]
call fcn.1400213e0
mov rbx, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xf0]
cmp rbx, rdi
je 0x14002caca
mov rax, qword [rbp + 0x1c8]
nop dword [rax]
lea r8, [rbx + 0x30]
cmp rax, qword [rbp + 0x1d0]
je 0x14002caac
mov rdx, r8
mov rcx, rax
call fcn.140001ad0
mov rax, qword [rbp + 0x1c8]
add rax, 0x20
mov qword [rbp + 0x1c8], rax
jmp 0x14002cac2
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140028390
mov rax, qword [rbp + 0x1c8]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14002ca80
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
lea rcx, [rbp + 0x200]
call fcn.14000d0a0
mov eax, dword [r15]
mov dword [rbp + 0x1d8], eax
lea rdi, [rbp + 0x200]
mov r8, qword [rbp + 0x200]
cmp qword [rbp + 0x218], 7
cmova rdi, r8
lea rcx, [rbp + 0x200]
cmova rcx, r8
mov rax, qword [rbp + 0x210]
lea rsi, [rcx + rax*2]
lea rbx, [rbp + 0x200]
cmova rbx, r8
cmp rbx, rsi
je 0x14002cb49
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.14006c2b0
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x14002cb34
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x240]
call fcn.140001ad0
nop
lea rax, [rbp + 0x260]
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x260], xmm0
xor esi, esi
mov qword [rbp + 0x270], rsi
mov rdi, qword [rbp + 0x1c8]
sub rdi, qword [rbp + 0x1c0]
sar rdi, 5
test rdi, rdi
je 0x14002cc78
movabs rax, 0x7ffffffffffffff
cmp rdi, rax
ja 0x14002d3f3
shl rdi, 5
test rdi, rdi
jne 0x14002cbb7
mov ebx, esi
jmp 0x14002cbf4
cmp rdi, 0x1000
jb 0x14002cbe9
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14002d3ed
call fcn.14005e4a0
test rax, rax
je 0x14002d3e7
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14002cbf4
mov rcx, rdi
call fcn.14005e4a0
mov rbx, rax
mov qword [rbp + 0x260], rbx
mov qword [rbp + 0x268], rbx
lea rcx, [rdi + rbx]
mov qword [rbp + 0x270], rcx
lea rax, [rbp + 0x260]
mov qword [rsp + 0x50], rax
mov rdi, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1c8]
mov qword [rbp + 0x140], rbx
mov qword [rbp + 0x148], rbx
lea rax, [rbp + 0x260]
mov qword [rbp + 0x150], rax
cmp rdi, rsi
je 0x14002cc6f
nop dword [rax + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140001ad0
add rbx, 0x20
mov qword [rbp + 0x148], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x14002cc50
mov qword [rbp + 0x268], rbx
xor esi, esi
mov eax, dword [rbp + 0x1d8]
mov dword [rbp + 0x278], eax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x280]
call fcn.140001ad0
nop
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x2a0]
call fcn.140001ad0
nop
lea r8, [rbp + 0x240]
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x30]
call fcn.140028ab0
nop
lea rcx, [rbp + 0x2a0]
call fcn.140001a60
lea rcx, [rbp + 0x280]
call fcn.140001a60
mov rbx, qword [rbp + 0x260]
test rbx, rbx
je 0x14002cd3b
mov rdi, qword [rbp + 0x268]
cmp rbx, rdi
je 0x14002cd0c
mov rcx, rbx
call fcn.140001a60
add rbx, 0x20
cmp rbx, rdi
jne 0x14002ccf4
mov rbx, qword [rbp + 0x260]
mov r8, qword [rbp + 0x270]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x260]
call fcn.140004300
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rsi
lea rcx, [rbp + 0x240]
call fcn.140001a60
nop
cmp byte [rbp + 0x40], 0
je 0x14002cd58
lea rcx, [rbp + 0x20]
call fcn.140001a60
nop
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002cd72
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], rsi
cmp byte [rbp + 0x68], 0
je 0x14002cd82
lea rcx, [rbp + 0x48]
call fcn.140001a60
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 7
jbe 0x14002cdc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002cdc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d3f9
call fcn.14005e4dc
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], si
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 7
jbe 0x14002ce27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ce22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d3f9
call fcn.14005e4dc
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], si
mov rbx, qword [rbp + 0x1c0]
test rbx, rbx
je 0x14002c5db
mov rdi, qword [rbp + 0x1c8]
cmp rbx, rdi
je 0x14002c5be
mov rcx, rbx
call fcn.140001a60
add rbx, 0x20
cmp rbx, rdi
jne 0x14002ce60
jmp 0x14002c5b7
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, str._func_run_status:
lea r8, [rbp + 0x1e0]
lea rdx, str.Cant_parse_handle_name_from_process:
mov ecx, 1
call fcn.14002a050
nop
cmp byte [rbp + 0x40], 0
je 0x14002ceb0
lea rcx, [rbp + 0x20]
call fcn.140001a60
nop
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14002ceca
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0x60], rsi
cmp byte [rbp + 0x68], 0
je 0x14002ceda
lea rcx, [rbp + 0x48]
call fcn.140001a60
nop
mov r8, qword [rbp + 0x218]
cmp r8, 7
jbe 0x14002cefa
mov rdx, qword [rbp + 0x200]
lea rcx, [rbp + 0x200]
call fcn.140001d90
mov r8, qword [rbp + 0x1f8]
mov qword [rbp + 0x210], rsi
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], si
cmp r8, 7
jbe 0x14002cf33
mov rdx, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x1e0]
call fcn.140001d90
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], si
lea rcx, [rbp + 0x1c0]
call fcn.140004200
mov edi, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x48]
jmp 0x14002d07b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x70], eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, str._last_error_code:
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, str._ntstatus:
mov r8, r15
lea rdx, str.Bad_process
mov ecx, 1
call fcn.14002a460
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002cfb8
call qword [sym.imp.ntdll.dll_NtClose]
mov edi, dword [r15]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx + 8]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], esi
cmp byte [rax + 0x19], 0
jne 0x14002cff6
mov qword [rbp - 0x70], rax
cmp dword [rax + 0x1c], edi
jae 0x14002cfe3
mov dword [rbp - 0x68], esi
mov rax, qword [rax + 0x10]
jmp 0x14002cff0
mov dword [rbp - 0x68], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14002cfd1
cmp byte [rcx + 0x19], 0
jne 0x14002d001
cmp edi, dword [rcx + 0x1c]
jae 0x14002d077
movabs rax, 0x7ffffffffffffff
cmp qword [rsp + 0x78], rax
je 0x14002d3ff
mov rbx, qword [rsp + 0x70]
lea rax, [rsp + 0x70]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rsi
mov ecx, 0x20
call fcn.14005e4a0
nop
mov dword [rax + 0x1c], edi
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], 0
mov qword [rbp + 0xc0], rsi
movups xmm0, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x70], xmm0
mov r8, rax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.14000bd20
mov edi, dword [rsp + 0x44]
mov ebx, dword [rsp + 0x48]
jmp 0x14002d07b
mov edi, dword [rsp + 0x44]
movabs r9, 0xcbf29ce484222325
movabs r8, 0x100000001b3
mov r15, r12
inc edi
mov dword [rsp + 0x44], edi
mov eax, edi
cmp rax, qword [r15]
jb 0x14002c280
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x58]
lea rdx, str.Total_handles_parsed:
mov ecx, 2
call fcn.140029a40
mov eax, dword [rbp - 0x30]
mov rdi, qword [rbp - 0x80]
mov dword [rdi], eax
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov ecx, 0x90
call fcn.14005e4a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x20], rsi
mov qword [rdi + 0x28], rsi
mov r8, qword [rdi + 8]
mov edx, 0x10
lea rcx, [rdi + 0x18]
call fcn.140021bf0
mov rcx, qword [rdi + 8]
mov rax, qword [rbp - 0x28]
mov qword [rdi + 8], rax
mov qword [rbp - 0x28], rcx
mov rcx, qword [rdi + 0x10]
mov rax, qword [rbp - 0x20]
mov qword [rdi + 0x10], rax
mov qword [rbp - 0x20], rcx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rbp - 0x18]
mov qword [rdi + 0x18], rax
mov qword [rbp - 0x18], rcx
mov rcx, qword [rdi + 0x20]
mov rax, qword [rbp - 0x10]
mov qword [rdi + 0x20], rax
mov qword [rbp - 0x10], rcx
mov rcx, qword [rdi + 0x28]
mov rax, qword [rbp - 8]
mov qword [rdi + 0x28], rax
mov qword [rbp - 8], rcx
mov rax, qword [rbp]
mov qword [rbp], 7
mov qword [rdi + 0x30], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 8], 8
mov qword [rdi + 0x38], rax
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14002d1d4
mov rax, qword [rbp + 0x98]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d1bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d3e1
call fcn.14005e4dc
mov qword [rbp + 0x88], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x90], xmm0
lea rcx, [rbp + 0x78]
call fcn.14002a9b0
nop
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x14002d21e
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140028570
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005e4dc
cmp byte [rbx + 0x19], 0
je 0x14002d1f0
mov rcx, qword [rsp + 0x70]
mov edx, 0x20
call fcn.14005e4dc
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14002d27b
mov rax, qword [rbp - 8]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d26a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d405
call fcn.14005e4dc
mov qword [rbp - 0x18], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
call fcn.140020bb0
mov edx, 0x90
mov rcx, qword [rbp - 0x28]
call fcn.14005e4dc
nop
test r12, r12
je 0x14002d2d1
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x14002d2c5
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d40b
mov rdx, r13
mov rcx, r12
call fcn.14005e4dc
nop
lea rcx, [rbp + 0x300]
call fcn.14002f080
nop
mov rdx, qword [rbp + 0x238]
cmp rdx, 7
jbe 0x14002d324
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d31f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d411
call fcn.14005e4dc
mov qword [rbp + 0x230], rsi
mov qword [rbp + 0x238], 7
mov word [rbp + 0x220], si
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x14002c106
mov rdx, qword [rbp + 0x128]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d37c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d398
call fcn.14005e4dc
mov qword [rbp + 0x118], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
jmp 0x14002c106
call fcn.1400645e4
nop
lea rcx, [0x1400b7fc8]
call fcn.14005e5b8
cmp dword [0x1400b7fc8], 0xffffffff
jne 0x14002beca
lea rcx, [0x1400b7fb8]
call fcn.14002b3e0
lea rcx, [0x14008c210]
call fcn.14005e928
nop
lea rcx, [0x1400b7fc8]
call fcn.14005e54c
jmp 0x14002beca
call fcn.1400645e4
nop
call fcn.1400645e4
int3
call fcn.140001240
int3
call fcn.140006630
nop
call fcn.1400645e4
int3
call fcn.14000b800
nop
call fcn.1400645e4
nop
call fcn.1400645e4
nop
call fcn.1400645e4
int3