Function at 0x14003b790
Capabilities:
Encode data using xor
Get system information on windows
Hash data using fnv
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov r15, r9
mov r14, r8
mov r12, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
xor dil, dil
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp], r13d
je 0x14003b80d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x68], 1
sete sil
jmp 0x14003b832
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
movzx esi, dil
cmp dword [rsp + 0x68], r13d
mov eax, 1
cmove esi, eax
mov rdx, rbx
lea rcx, [rbp + 0x30]
call fcn.14002bc80
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], 5
mov qword [rbp + 0xc8], 0xf
mov eax, dword [str.usvfs]
mov dword [rbp + 0xb0], eax
movzx eax, byte [0x14009f940]
mov byte [rbp + 0xb4], al
mov byte [rbp + 0xb5], 0
call fcn.140021910
mov r11, rax
movabs rdx, 0xcbf29ce484222325
mov r8, r13
movabs rax, 0x100000001b3
nop
movzx ecx, byte [rbp + r8 + 0xb0]
xor rdx, rcx
imul rdx, rax
inc r8
cmp r8, 5
jb 0x14003b8a0
mov rcx, qword [r11 + 0x38]
and rcx, rdx
add rcx, rcx
mov rax, qword [r11 + 0x20]
mov r8, qword [rax + rcx*8 + 8]
mov r9, qword [r11 + 0x10]
cmp r8, r9
je 0x14003b92e
mov r10, qword [rax + rcx*8]
nop dword [rax]
lea rdx, [r8 + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003b8f2
mov rdx, qword [rdx]
cmp rax, 5
jne 0x14003b923
mov rax, r13
lea rbx, [rbp + 0xb0]
movzx ecx, byte [rbx + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x14003b91a
cmp rax, 5
jne 0x14003b902
mov eax, r13d
jmp 0x14003b91f
sbb eax, eax
or eax, 1
test eax, eax
je 0x14003b931
cmp r8, r10
je 0x14003b92e
mov r8, qword [r8 + 8]
jmp 0x14003b8e0
mov r8, r13
test r8, r8
cmovne r9, r8
cmp r9, qword [r11 + 0x10]
jne 0x14003b956
mov ebx, 8
mov qword [rbp + 0x98], r13
lea rcx, [rbp + 0x90]
mov rdi, r13
jmp 0x14003b986
mov ebx, 0x10
mov dword [rsp + 0x40], ebx
mov rax, qword [r9 + 0x38]
test rax, rax
je 0x14003b970
lock inc dword [rax + 8]
mov ebx, dword [rsp + 0x40]
mov rax, qword [r9 + 0x38]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x80]
mov rdi, qword [r9 + 0x30]
mov qword [rbp + 0xa0], rdi
mov rax, qword [rcx + 8]
mov qword [rbp + 0xa8], rax
mov qword [rcx], r13
mov qword [rcx + 8], r13
test bl, 0x10
je 0x14003b9f5
and ebx, 0xffffffef
mov dword [rsp + 0x40], ebx
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x14003b9f5
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003b9f1
mov rbx, qword [rbp + 0x88]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14003b9f1
mov rcx, qword [rbp + 0x88]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x40]
test bl, 8
je 0x14003ba4b
and ebx, 0xfffffff7
mov dword [rsp + 0x40], ebx
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x14003ba4b
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003ba47
mov rbx, qword [rbp + 0x98]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14003ba47
mov rcx, qword [rbp + 0x98]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x40]
or ebx, 4
mov dword [rsp + 0x40], ebx
lea rcx, str.same
lea rax, str.different
test sil, sil
cmovne rax, rcx
mov qword [rbp - 0x68], rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rbp + 8], eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
lea r8, str.injecting_to_process__with__bitness
mov edx, 2
mov rcx, rdi
call fcn.140037240
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x14003bae3
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14003badf
mov rbx, qword [rbp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14003badf
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov ebx, dword [rsp + 0x40]
lea rdx, [rbp + 0x30]
test sil, sil
je 0x14003bf70
lea rcx, [rsp + 0x70]
call fcn.14002bc80
lea rax, [rsp + 0x70]
mov qword [rbp - 0x68], rax
lea r8, [0x1400a0bca]
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0x70]
call fcn.140062b60
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x20], xmm1
or ebx, 0x20
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.14002bc80
nop
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp]
call fcn.140065540
cmp dword [rax], 1
seta dil
test dil, dil
jne 0x14003bc10
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.140063ce0
bts ebx, 7
or ebx, 1
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x14009fe00]
movdqu xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x40], r13w
mov r8d, 3
lea rdx, [0x1400a0cc0]
lea rcx, [rbp - 0x40]
call fcn.14003a630
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.140063350
mov esi, eax
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14003bc07
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bc02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c9c0
call fcn.140066cf4
test esi, esi
jne 0x14003bc10
mov sil, 1
jmp 0x14003bc13
xor sil, sil
test bl, 1
je 0x14003bc21
lea rcx, [rbp - 0x60]
call fcn.14001bb70
test sil, sil
je 0x14003bd70
lea rbx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rbx, qword [rbp + 0x30]
lea rcx, [rbp + 0x30]
call fcn.140064240
lea r8, [rbx + rax*2]
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
cmp rdx, r8
jne 0x14003bc76
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
jmp 0x14003bc85
sub r8, rdx
sar r8, 1
lea rcx, [rbp - 0x20]
call fcn.1400118b0
lea rax, [rbp - 0x20]
mov qword [rbp - 0x68], rax
lea r8, [0x1400a0cce]
lea rdx, [0x1400a0cc8]
lea rcx, [rbp - 0x20]
call fcn.140062b60
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r13w
lea rax, [rsp + 0x70]
mov qword [rbp - 0x68], rax
lea r8, [0x1400a0bca]
lea rdx, [0x1400a0bb0]
lea rcx, [rsp + 0x70]
call fcn.140062b60
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x48]
call fcn.140039440
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14003bd58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bd53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c9c6
call fcn.140066cf4
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x70]
call fcn.140065540
cmp dword [rax], 1
seta dil
test dil, dil
je 0x14003c9cc
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 5
mov qword [rbp - 0x78], 0xf
mov eax, dword [str.usvfs]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x14009f940]
mov byte [rsp + 0x74], al
mov byte [rsp + 0x75], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.14003b620
nop
mov rcx, qword [rax]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x68]
lea r8, str.dll_path:_
mov edx, 2
call fcn.1400373b0
nop
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x14003bded
call fcn.14001af00
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14003be29
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003be24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cab2
call fcn.140066cf4
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], 0x1d0
mov qword [rsp + 0x20], r12
lea r9, str.InitHooks
mov rdx, r15
mov rcx, r14
call fcn.1400968a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 5
mov qword [rbp - 0x78], 0xf
mov eax, dword [str.usvfs]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x14009f940]
mov byte [rsp + 0x74], al
mov byte [rsp + 0x75], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x118]
call fcn.14003b620
nop
mov rbx, qword [rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov dword [rsp + 0x68], eax
lea r9, [rsp + 0x68]
lea r8, str.injection_to_same_bitness_process__successful
mov edx, 2
mov rcx, rbx
call fcn.140015030
nop
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x14003bedf
call fcn.14001af00
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14003bf1c
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bf16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cab8
call fcn.140066cf4
nop
lea rcx, [rsp + 0x48]
call fcn.14001bb70
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14003c793
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003bf66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cabe
call fcn.140066cf4
jmp 0x14003c793
lea rcx, [rsp + 0x48]
call fcn.14002bc80
lea rax, [rsp + 0x48]
mov qword [rbp - 0x70], rax
lea r8, [0x1400a0c16]
lea rdx, str.usvfs_proxy_x86.exe
lea rcx, [rsp + 0x48]
call fcn.140062b60
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp - 0x30], xmm1
or ebx, 0x40
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.14002bc80
nop
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call fcn.140065540
cmp dword [rax], 1
seta dil
test dil, dil
jne 0x14003c09b
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.140063ce0
bts ebx, 0xb
or ebx, 2
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x14009fe00]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
mov r8d, 3
lea rdx, [0x1400a0cc8]
lea rcx, [rsp + 0x48]
call fcn.14003a630
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140063350
mov esi, eax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14003c092
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c08d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cac4
call fcn.140066cf4
test esi, esi
jne 0x14003c09b
mov sil, 1
jmp 0x14003c09e
xor sil, sil
test bl, 2
je 0x14003c0ac
lea rcx, [rbp - 0x60]
call fcn.14001bb70
test sil, sil
je 0x14003c1bf
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x30]
call fcn.1400228f0
mov rbx, rax
mov qword [rbp - 0x70], rax
lea r8, [0x1400a0cc6]
lea rdx, [0x1400a0cc0]
mov rcx, rax
call fcn.140062b60
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
lea rax, [rsp + 0x48]
mov qword [rbp - 0x70], rax
lea r8, [0x1400a0c16]
lea rdx, str.usvfs_proxy_x86.exe
lea rcx, [rsp + 0x48]
call fcn.140062b60
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp - 0x50], xmm1
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.140039440
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14003c1a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c1a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003caca
call fcn.140066cf4
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call fcn.140065540
cmp dword [rax], 1
seta dil
test dil, dil
jne 0x14003c28a
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.14002bc80
lea rax, [rsp + 0x48]
mov qword [rbp - 0x70], rax
lea r8, [0x1400a0d8e]
lea rdx, str.usvfs_proxy.exe
lea rcx, [rsp + 0x48]
call fcn.140062b60
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbp - 0x50], xmm1
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.140039440
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14003c26b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c266
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cad0
call fcn.140066cf4
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x50]
call fcn.140065540
cmp dword [rax], 1
seta al
test al, al
je 0x14003cad6
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 5
mov qword [rsp + 0x60], 0xf
mov eax, dword [str.usvfs]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x14009f940]
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], 0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x118]
call fcn.14003b620
nop
mov rdi, qword [rax]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x60]
call fcn.14002bc80
mov rbx, rax
mov qword [rbp + 0x50], rax
cmp qword [rax + 0x18], 8
jb 0x14003c2f1
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.14001c7a0
nop
mov rcx, rbx
call fcn.14001bb70
nop
lea r9, [rbp - 0x60]
lea r8, str.using_usvfs_proxy:_
mov edx, 2
mov rcx, rdi
call fcn.140015420
nop
lea rcx, [rbp - 0x60]
call fcn.1400040e0
nop
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x14003c34d
call fcn.14001af00
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14003c38a
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c385
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cbb3
call fcn.140066cf4
mov esi, 1
mov edx, esi
lea rcx, [rbp + 0x188]
call fcn.140038160
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
movdqa xmm1, xmmword [0x14009fe00]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
movdqu xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], r13
mov word [rbp + 0x2b8], 0
mov qword [rbp + 0x2c0], 0xffffffffffffffff
mov r8, qword [rbp - 0x80]
cmp r8, 0x104
ja 0x14003cbb9
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp + 0x198]
call fcn.140036cf0
nop
lea rdx, [0x14009fc74]
lea rcx, [rbp + 0x198]
call fcn.14002af80
mov rcx, rax
lea rdx, str.__instance
call fcn.14002b310
mov qword [rsp + 0x68], r12
lea r9, [rsi - 2]
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14001c9d0
nop
lea rdx, [0x14009fc74]
lea rcx, [rbp + 0x198]
call fcn.14002af80
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rax
call fcn.140036cf0
lea rdx, [0x14009fc74]
lea rcx, [rbp + 0x198]
call fcn.14002af80
mov rcx, rax
lea rdx, str.__pid
call fcn.14002b310
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ebx, eax
lea rdx, [0x14009fc74]
lea rcx, [rbp + 0x198]
call fcn.14002af80
mov edx, ebx
mov rcx, rax
call fcn.14002bf60
mov edx, esi
lea rcx, [rbp + 0x2d0]
call fcn.140038160
nop
movups xmm1, xmmword [rbp + 0x280]
movups xmmword [rbp + 0x3c8], xmm1
movups xmm0, xmmword [rbp + 0x290]
movups xmmword [rbp + 0x3d8], xmm0
movdqa xmm1, xmmword [0x14009fe00]
movdqu xmmword [rbp + 0x290], xmm1
mov word [rbp + 0x280], r13w
mov rax, qword [rbp + 0x2a0]
mov qword [rbp + 0x3e8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x3f0], rax
mov eax, dword [rbp + 0x2b0]
mov dword [rbp + 0x3f8], eax
mov eax, dword [rbp + 0x2b4]
mov dword [rbp + 0x3fc], eax
movzx eax, byte [rbp + 0x2b8]
mov byte [rbp + 0x400], al
mov byte [rbp + 0x401], 0
mov qword [rbp + 0x408], 0xffffffffffffffff
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2e0]
call fcn.140039760
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14003c5b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c5b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003cbee
call fcn.140066cf4
movdqa xmm0, xmmword [0x14009fe00]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
lea rcx, [rbp + 0x280]
call fcn.14001bb70
lea rcx, [rbp + 0x188]
call fcn.140039e30
cmp r15, 0xffffffffffffffff
je 0x14003c632
lea rdx, [0x14009fc74]
lea rcx, [rbp + 0x2e0]
call fcn.14002af80
mov rcx, rax
lea rdx, str.__tid
call fcn.14002af80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov ebx, eax
lea rdx, [0x14009fc74]
lea rcx, [rbp + 0x2e0]
call fcn.14002af80
mov edx, ebx
mov rcx, rax
call fcn.14002bf60
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x2d0]
call fcn.140039a80
nop
cmp byte [rbp + 0x410], 0
je 0x14003cbf4
mov edx, 0x3a98
mov rcx, qword [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14003c8ce
cmp eax, 0xffffffff
je 0x14003c7bd
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], 5
mov qword [rsp + 0x60], 0xf
mov eax, dword [str.usvfs]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x14009f940]
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], 0
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.14003b620
nop
lea r8, str.proxy_run_successful
mov edx, esi
mov rcx, qword [rax]
call fcn.140014df0
nop
lea rcx, [rbp + 0x10]
call fcn.140018f60
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14003c716
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c710
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ccf3
call fcn.140066cf4
nop
lea rcx, [rbp + 0x410]
call fcn.140019210
nop
mov r8, qword [rbp + 0x3e0]
cmp r8, 8
jb 0x14003c746
inc r8
mov rdx, qword [rbp + 0x3c8]
lea rcx, [rbp + 0x3c8]
call fcn.140004300
mov qword [rbp + 0x3d8], r13
mov qword [rbp + 0x3e0], 7
mov word [rbp + 0x3c8], r13w
lea rcx, [rbp + 0x2d0]
call fcn.140039e30
nop
lea rcx, [rsp + 0x70]
call fcn.14001bb70
nop
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x14003c793
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.140004300
nop
lea rcx, [rbp + 0x30]
call fcn.14001bb70
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.usvfs
lea rcx, [rbp - 0x60]
call fcn.140016690
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x10]
call fcn.14003b620
nop
mov rcx, rax
call fcn.140036a90
lea rdx, str.proxy_wait_failed
mov rcx, rax
call fcn.140036fb0
nop
lea rcx, [rbp + 0x10]
call fcn.140018f60
nop
lea rcx, [rbp - 0x60]
call fcn.1400040e0
mov edx, esi
mov rcx, qword [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x20], 0xd
lea r9, str.injectProcess
mov r8d, 0xaa
lea rdx, str.D:MO2_buildusvfs_srcusvfs_helperinject.cpp
lea rcx, [rbp + 0x10]
call fcn.140038d70
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
mov edx, esi
lea rcx, [rbp + 0xd0]
call fcn.140039100
mov rbx, rax
lea rdx, str.failed_to_wait_for_proxy_completion
lea rcx, [rbp + 0x60]
call fcn.140016690
nop
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140038300
nop
mov rdx, rax
mov rcx, rbx
call fcn.140036a70
mov rbx, rax
lea rdx, [rbp + 0x498]
lea rcx, [rbp - 0x20]
call fcn.1400382e0
nop
mov rdx, rax
mov rcx, rbx
call fcn.140036a80
mov rdx, rdi
mov rcx, rax
call fcn.140037870
nop
lea rdx, str.usvfs
lea rcx, [rbp - 0x60]
call fcn.140016690
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x10]
call fcn.14003b620
nop
mov rcx, rax
call fcn.140036a90
lea rdx, str.proxy_timeout
mov rcx, rax
call fcn.140036fb0
nop
lea rcx, [rbp + 0x10]
call fcn.140018f60
nop
lea rcx, [rbp - 0x60]
call fcn.1400040e0
mov edx, esi
mov rcx, qword [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x20], 0xd
lea r9, str.injectProcess
mov r8d, 0xa4
lea rdx, str.D:MO2_buildusvfs_srcusvfs_helperinject.cpp
lea rcx, [rbp - 0x20]
call fcn.140038d70
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
mov edx, esi
lea rcx, [rbp + 0xd0]
call fcn.140038f60
mov rbx, rax
lea rdx, str.proxy_didnt_complete_in_time
lea rcx, [rbp + 0x60]
call fcn.140016690
nop
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140038300
nop
mov rdx, rax
mov rcx, rbx
call fcn.140036a70
mov rdx, rdi
mov rcx, rax
call fcn.140037840
nop
call fcn.140075c54
nop
call fcn.140075c54
int3
mov dword [rsp + 0x20], 7
lea r9, str.injectProcess
mov r8d, 0x66
lea rdx, str.D:MO2_buildusvfs_srcusvfs_helperinject.cpp
lea rcx, [rbp - 0x20]
call fcn.140038d70
mov rdi, rax
call fcn.14003cdc0
mov rbx, rax
lea rcx, [rbp + 0x10]
call fcn.140024900
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14002bc80
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14002b900
nop
mov rcx, rax
call fcn.1400040d0
mov rbx, rax
lea rdx, str.dll_missing:
lea rcx, [rbp - 0x40]
call fcn.140016690
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400117d0
nop
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140038300
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rax
lea edx, [rax + 1]
lea rcx, [rbp + 0x140]
call fcn.140038cd0
nop
mov rdx, rbx
mov rcx, rax
call fcn.140036a70
mov rdx, rdi
mov rcx, rax
call fcn.140037810
nop
call fcn.140075c54
int3
call fcn.140075c54
nop
call fcn.140075c54
nop
call fcn.140075c54
nop
call fcn.140075c54
int3
call fcn.140075c54
int3
mov dword [rsp + 0x20], 7
lea r9, str.injectProcess
mov r8d, 0x8a
lea rdx, str.D:MO2_buildusvfs_srcusvfs_helperinject.cpp
lea rcx, [rbp - 0x20]
call fcn.140038d70
mov rdi, rax
call fcn.14003cdc0
mov rbx, rax
lea rcx, [rbp - 0x40]
call fcn.140024900
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14002bc80
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14002b900
mov rbx, rax
lea rdx, str.usvfs_proxy_not_found:
lea rcx, [rsp + 0x48]
call fcn.140016690
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140036aa0
nop
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140038300
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rax
lea edx, [rax + 1]
lea rcx, [rbp + 0x140]
call fcn.140038cd0
nop
mov rdx, rbx
mov rcx, rax
call fcn.140036a70
mov rdx, rdi
mov rcx, rax
call fcn.140037810
nop
call fcn.140075c54
nop
lea rdx, str.executable_filename_cant_be_longer_than_260_characters
lea rcx, [rbp + 0x60]
call fcn.140016690
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x118]
call fcn.140017c20
lea rdx, [0x1400c7ef8]
lea rcx, [rbp + 0x118]
call fcn.140067efc
nop
call fcn.140075c54
nop
mov dword [rsp + 0x20], 7
lea r9, str.injectProcess
mov r8d, 0x9a
lea rdx, str.D:MO2_buildusvfs_srcusvfs_helperinject.cpp
lea rcx, [rbp - 0x20]
call fcn.140038d70
mov rsi, rax
lea rdx, [rbp + 0x498]
lea rcx, [rbp + 0x10]
call fcn.1400382e0
mov rdi, rax
call fcn.14003cdc0
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.140024900
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14002bc80
mov r9, rbx
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14002b900
mov rbx, rax
lea rdx, str.failed_to_start_proxy
lea rcx, [rsp + 0x48]
call fcn.140016690
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.140036aa0
nop
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140038300
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rax
lea edx, [rax + 1]
lea rcx, [rbp + 0xd0]
call fcn.140039100
nop
mov rdx, rbx
mov rcx, rax
call fcn.140036a70
mov rdx, rdi
mov rcx, rax
call fcn.140036a80
mov rdx, rsi
mov rcx, rax
call fcn.140037870
nop
call fcn.140075c54
int3