Function at 0x140008824
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1401c76e0]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor edi, edi
mov r14, rdx
mov qword [rsp + 0x40], rdx
mov dword [rsp + 0x38], edi
mov r13, rcx
call fcn.140017480
lea ebx, [rdi + 0xf]
or r15, 0xffffffffffffffff
cmp byte [reloc.WS2_32.dll_WSACleanup], dil
mov r12, rax
mov qword [rsp + 0x38], rax
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0xf8], rbx
mov byte [rbp + 0xe0], dil
lea rdx, [0x1400c8d98]
jne 0x1400088a3
mov r8d, edi
jmp 0x1400088af
mov r8, r15
inc r8
cmp byte [rdx + r8], dil
jne 0x1400088a6
lea rcx, [rbp + 0xe0]
call fcn.1400031f8
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0x120]
mov rcx, r14
call fcn.140017a04
cmp qword [rbp + 0xf8], 0x10
jb 0x1400088e7
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
lea r9, [rbp + 0x120]
lea rdx, str.StartProcessWithAccess
xor r8d, r8d
mov cl, 0x42
call fcn.14001d2b0
cmp byte [str.allow_no_sandbox_job], dil
mov qword [rbp + 0xf8], rbx
lea rbx, str.allow_no_sandbox_job
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
jne 0x140008929
mov r8, rdi
jmp 0x140008935
mov r8, r15
inc r8
cmp byte [rbx + r8], dil
jne 0x14000892c
lea rcx, [rbp + 0xe0]
mov rdx, rbx
call fcn.1400031f8
lea rdx, [rbp + 0xe0]
mov rcx, r12
mov esi, 1
call fcn.140017b94
test al, al
je 0x1400089b8
cmp byte [str.allow_no_sandbox_job], dil
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x110], rdi
mov byte [rbp + 0x100], dil
jne 0x140008983
mov r8, rdi
jmp 0x14000898f
mov r8, r15
inc r8
cmp byte [rbx + r8], dil
jne 0x140008986
lea rcx, [rbp + 0x100]
mov rdx, rbx
call fcn.1400031f8
lea rdx, [rbp + 0x100]
mov rcx, r14
mov esi, 3
call fcn.140017b94
mov bl, 1
test al, al
je 0x1400089bb
mov bl, dil
test sil, 2
je 0x1400089f3
and esi, 0xfffffffd
cmp qword [rbp + 0x118], 0x10
jb 0x1400089da
mov rcx, qword [rbp + 0x100]
call fcn.14009bc2c
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x110], rdi
mov byte [rbp + 0x100], dil
test sil, 1
je 0x140008a12
and esi, 0xfffffffe
cmp qword [rbp + 0xf8], 0x10
jb 0x140008a12
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
test bl, bl
je 0x140008a81
cmp byte [str.allow_no_sandbox_job], dil
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
lea rdx, str.allow_no_sandbox_job
jne 0x140008a44
mov r8, rdi
jmp 0x140008a50
mov r8, r15
inc r8
cmp byte [rdx + r8], dil
jne 0x140008a47
lea rcx, [rbp + 0xe0]
call fcn.1400031f8
lea rdx, [rbp + 0xe0]
mov rcx, r14
call fcn.140016e64
cmp qword [rbp + 0xf8], 0x10
jb 0x140008a81
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
mov rcx, r14
call fcn.140008268
cmp qword [rbp + 0x138], 0x10
lea rcx, [rbp + 0x120]
cmovae rcx, qword [rbp + 0x120]
cmp qword [rbp + 0x130], 0x7fffffff
jbe 0x140008ac4
bt esi, 8
jae 0x140008ac0
lea rcx, [rbp - 0x30]
btr esi, 8
call fcn.1400188b0
mov eax, edi
jmp 0x140008acf
mov edx, dword [rbp + 0x130]
call fcn.1400226a8
lea rdx, str._prefetch:_d
lea rcx, [rbp + 0xe0]
mov r8d, eax
call fcn.140015dc8
mov rcx, r14
mov rdx, rax
call fcn.140016de8
cmp qword [rbp + 0xf8], 0x10
jb 0x140008b06
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
test r13, r13
je 0x140008b1d
mov rax, qword [r13]
mov rcx, r13
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x140008bd7
cmp byte [str.no_sandbox], dil
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
lea rbx, str.no_sandbox
jne 0x140008b4b
mov r8, rdi
jmp 0x140008b57
mov r8, r15
inc r8
cmp byte [rbx + r8], dil
jne 0x140008b4e
lea rcx, [rbp + 0xe0]
mov rdx, rbx
call fcn.1400031f8
lea rdx, [rbp + 0xe0]
mov rcx, r12
or esi, 4
call fcn.140017b94
test al, al
jne 0x140008bd7
cmp byte [str.no_sandbox], dil
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x110], rdi
mov byte [rbp + 0x100], dil
jne 0x140008ba3
mov r8, rdi
jmp 0x140008baf
mov r8, r15
inc r8
cmp byte [rbx + r8], dil
jne 0x140008ba6
lea rcx, [rbp + 0x100]
mov rdx, rbx
call fcn.1400031f8
lea rdx, [rbp + 0x100]
mov rcx, r14
or esi, 8
call fcn.140017b94
mov bl, dil
test al, al
je 0x140008bd9
mov bl, 1
test sil, 8
je 0x140008c11
and esi, 0xfffffff7
cmp qword [rbp + 0x118], 0x10
jb 0x140008bf8
mov rcx, qword [rbp + 0x100]
call fcn.14009bc2c
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x110], rdi
mov byte [rbp + 0x100], dil
test sil, 4
je 0x140008c49
and esi, 0xfffffffb
cmp qword [rbp + 0xf8], 0x10
jb 0x140008c30
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
test bl, bl
je 0x140008c90
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x38], rdi
call fcn.140023144
lea r8, [rsp + 0x38]
mov rcx, r14
mov rdx, rax
call fcn.1400234b8
lea rcx, [rbp - 0x80]
call sym.nacl64.exe__ovly_debug_event
mov rcx, qword [0x1401c9908]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdi, qword [rsp + 0x38]
jmp 0x140009241
mov rcx, qword [0x1401c9908]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r12d, 0x67
mov r14, rax
call fcn.140023dd8
lea rcx, str.renderer
cmp eax, 5
jl 0x140008d56
cmp byte [str.renderer], dil
jne 0x140008cc9
mov rax, rdi
jmp 0x140008cd5
mov rax, r15
inc rax
cmp byte [rcx + rax], dil
jne 0x140008ccc
mov r8, qword [rbp + 0x130]
mov r9, rcx
lea rcx, [rbp + 0x120]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140003444
test eax, eax
jne 0x140008d56
cmp byte [str.enable_win32k_renderer_lockdown], dil
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
lea rdx, str.enable_win32k_renderer_lockdown
jne 0x140008d24
mov r8, rdi
jmp 0x140008d30
mov r8, r15
inc r8
cmp byte [rdx + r8], dil
jne 0x140008d27
lea rcx, [rbp + 0xe0]
call fcn.1400031f8
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp + 0xe0]
or esi, 0x10
call fcn.140017b94
mov bl, 1
test al, al
jne 0x140008d59
mov bl, dil
test sil, 0x10
je 0x140008d78
and esi, 0xffffffef
cmp qword [rbp + 0xf8], 0x10
jb 0x140008d78
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
test bl, bl
je 0x140008da1
mov rax, qword [r14]
xor r9d, r9d
mov rcx, r14
lea edx, [r9 + 6]
lea r8d, [r9 + 0xd]
call qword [rax + 0xb8]
test eax, eax
jne 0x140009241
mov r12d, 0x267
mov rax, qword [r14]
mov rdx, r12
mov rcx, r14
call qword [rax + 0x80]
test eax, eax
jne 0x140009241
mov rax, qword [r14]
movabs rdx, 0x100000100
mov rcx, r14
call qword [rax + 0x90]
test eax, eax
jne 0x140009241
mov r12, qword [rsp + 0x40]
mov r9, r14
xor r8d, r8d
mov rcx, r12
xor edx, edx
call fcn.140008554
lea rcx, [rbp + 0x140]
mov byte [rsp + 0x31], dil
call fcn.140010298
test r13, r13
je 0x140008e17
mov rax, qword [r13]
lea r8, [rbp + 0x140]
lea rdx, [rsp + 0x31]
mov rcx, r13
call qword [rax + 0x18]
cmp byte [rsp + 0x31], dil
jne 0x140008e2e
mov rcx, r14
call fcn.140007c18
test al, al
je 0x140009235
cmp byte [str.renderer], dil
lea r9, str.renderer
jne 0x140008e43
mov rax, rdi
jmp 0x140008e4f
mov rax, r15
inc rax
cmp byte [r9 + rax], dil
jne 0x140008e46
mov r8, qword [rbp + 0x130]
lea rcx, [rbp + 0x120]
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.140003444
test eax, eax
jne 0x140008f42
call fcn.1400086c4
test al, al
je 0x140008e92
xor edx, edx
mov r9d, 1
mov qword [rsp + 0x20], r14
lea ecx, [rdx + 0x74]
mov r8b, r9b
call fcn.140007998
mov ebx, reloc.WS2_32.dll_ntohs
cmp qword [rbp + 0x150], rdi
je 0x140009004
cmp qword [rbp + 0x158], 8
mov rax, qword [r14]
lea r9, [rbp + 0x140]
cmovae r9, qword [rbp + 0x140]
mov rcx, r14
xor r8d, r8d
xor edx, edx
call qword [rax + 0xb8]
test eax, eax
jne 0x140009235
lea rax, [0x1400c79b0]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x140]
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
call fcn.1400104a8
cmp qword [rbp + 0xf8], 8
mov rax, qword [r14]
lea r9, [rbp + 0xe0]
mov rcx, r14
cmovae r9, qword [rbp + 0xe0]
xor r8d, r8d
xor edx, edx
call qword [rax + 0xb8]
lea rcx, [rbp + 0xe0]
test eax, eax
je 0x140008fff
call fcn.14000f514
jmp 0x140009235
mov ebx, reloc.WS2_32.dll_ntohs
lea rdx, str.___typerenderer
lea rcx, [rbp + 0x100]
lea r8d, [rbx + 2]
mov qword [rbp + 0x110], rdi
mov byte [rbp + 0x100], dil
mov qword [rbp + 0x118], rbx
call fcn.1400031f8
lea r8d, [rbx - 8]
lea rdx, str.ignored
lea rcx, [rbp + 0xe0]
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
call fcn.1400031f8
lea r8, [rbp + 0x100]
lea rdx, [rbp + 0xe0]
mov rcx, r12
call fcn.140016ebc
cmp qword [rbp + 0xf8], 0x10
jb 0x140008fcb
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
cmp qword [rbp + 0x118], 0x10
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
jb 0x140008e97
mov rcx, qword [rbp + 0x100]
call fcn.14009bc2c
jmp 0x140008e97
call fcn.14000f514
mov rcx, r14
call fcn.140007b80
test al, al
jne 0x140009028
test sil, 0x20
je 0x140009235
lea rcx, [rbp - 0x30]
call fcn.1400188b0
jmp 0x140009235
cmp byte [0x1400c8630], dil
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0xf0], rdi
mov byte [rbp + 0xe0], dil
lea rdx, [0x1400c8630]
jne 0x140009052
mov r15, rdi
jmp 0x14000905b
inc r15
cmp byte [rdx + r15], dil
jne 0x140009052
lea rcx, [rbp + 0xe0]
mov r8, r15
call fcn.1400031f8
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp + 0xe0]
call fcn.140017b94
cmp qword [rbp + 0xf8], 0x10
mov bl, al
jb 0x140009093
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
test bl, bl
je 0x1400090cb
mov rbx, qword [r14]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, r14
mov rdx, rax
call qword [rbx + 0xa8]
mov rbx, qword [r14]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, r14
mov rdx, rax
call qword [rbx + 0xb0]
test r13, r13
je 0x1400090f2
mov rax, qword [r13]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r13
mov byte [rsp + 0x30], 1
call qword [rax + 0x20]
cmp byte [rsp + 0x30], dil
je 0x140009235
lea rdx, str.StartProcessWithAccess::LAUNCHPROCESS
xor r9d, r9d
xor r8d, r8d
mov cl, 0x42
call fcn.14001d190
xor eax, eax
lea rdx, [rbp + 0xe0]
mov rcx, r12
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call fcn.14001779c
cmp qword [rax + 0x18], 8
mov rbx, rax
jb 0x140009133
mov rbx, qword [rax]
lea rdx, [rbp + 0x100]
mov rcx, r12
call fcn.1400178e0
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x14000914f
mov rdx, qword [rax]
mov rcx, qword [0x1401c9908]
lea r8, [rsp + 0x68]
mov r9, r14
mov rax, qword [rcx]
mov qword [rsp + 0x20], r8
mov r8, rbx
call qword [rax + reloc.WS2_32.dll_recv]
lea rcx, [rbp + 0x100]
mov ebx, eax
call fcn.14000f514
cmp qword [rbp + 0xf8], 8
jb 0x140009190
mov rcx, qword [rbp + 0xe0]
call fcn.14009bc2c
mov r8, qword [r14]
mov rcx, r14
call qword [rreloc.WS2_32.dll_htonl + 8]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1400236f4
lea rdx, str.StartProcessWithAccess::LAUNCHPROCESS
xor r9d, r9d
xor r8d, r8d
mov cl, 0x45
call fcn.14001d190
test ebx, ebx
je 0x1400091e7
cmp ebx, 1
jne 0x1400091d7
test sil, 0x40
je 0x14000922b
lea rcx, [rbp - 0x30]
call fcn.140018b4c
jmp 0x14000922b
test sil, sil
jns 0x14000922b
lea rcx, [rbp - 0x30]
call fcn.1400188b0
jmp 0x14000922b
test r13, r13
je 0x1400091fb
mov rax, qword [r13]
mov rdx, qword [rsp + 0x50]
mov rcx, r13
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea r9, [rbp + 0x120]
lea rdx, str.StartProcessWithAccess
xor r8d, r8d
mov cl, 0x45
call fcn.14001d2b0
lea rcx, [rsp + 0x50]
call fcn.140023a54
mov rdi, rax
lea rcx, [rsp + 0x50]
call fcn.140023718
lea rcx, [rbp + 0x140]
call fcn.14000f514
cmp qword [rbp + 0x138], 0x10
jb 0x140009257
mov rcx, qword [rbp + 0x120]
call fcn.14009bc2c
mov rax, rdi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14009c5b0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret