Function at 0x140002994
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rbx, r9
mov rsi, r8
mov r15, rdx
mov r13, rcx
mov rax, qword [0x14030f948]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.140068910
mov rdi, rax
lea rdx, str.allow_no_sandbox_job
mov rcx, rax
call fcn.140068e10
test al, al
je 0x140002a28
lea rdx, str.allow_no_sandbox_job
mov rcx, r13
call fcn.140068e10
test al, al
jne 0x140002a28
lea rdx, str.allow_no_sandbox_job
lea rbp, [rsp + 0xb0]
mov rcx, rbp
call fcn.140003340
mov rcx, r13
mov rdx, rbp
call fcn.140069000
cmp byte [rbp + 0x17], 0
jns 0x140002a28
mov rcx, qword [rsp + 0xb0]
call fcn.140183668
mov r14, qword [rsp + 0x1c0]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ebp, eax
mov ecx, eax
call fcn.1400af0b8
test al, al
jne 0x140002a70
lea rdx, str.no_sandbox
mov rcx, r13
call fcn.140068e10
test al, al
jne 0x140002a70
lea rdx, str.no_sandbox
mov rcx, rdi
call fcn.140068e10
test al, al
je 0x140002b49
lea rcx, [rsp + 0xb0]
call fcn.140079070
lea rcx, [rsp + 0xd8]
cmp rcx, rsi
je 0x140002a96
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
call fcn.1400041cc
mov dword [rsp + 0x50], 1
cmp ebp, 7
jne 0x140002ae6
call fcn.140095ae0
cmp eax, 4
jg 0x140002ace
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x140002ae6
cmp dword [rsp + 0x50], 0
jne 0x140002ae6
mov rax, qword [0x140310e60]
test rax, rax
je 0x140002c36
mov qword [rsp + 0x100], rax
lea rsi, [rsp + 0x90]
lea r8, [rsp + 0xb0]
mov rcx, rsi
mov rdx, r13
call fcn.140092d00
mov rcx, r14
mov rdx, rsi
call fcn.140093630
mov rcx, rsi
call fcn.1400706e0
xor esi, esi
lea rcx, [rsp + 0xb0]
call fcn.1400790d0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140183a80
mov eax, esi
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [0x140310e58]
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsi]
mov rsi, qword [rsi + 8]
cmp rdi, rsi
je 0x140002b87
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0xd8]
add rdi, 8
cmp rsi, rdi
jne 0x140002b6a
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
mov edx, 0x2d1067
call qword [rax + 0x80]
mov esi, eax
test eax, eax
jne 0x140002c1a
lea rdx, str.allow_third_party_modules
mov rcx, r13
call fcn.140068e10
xor al, 1
movzx eax, al
shl rax, 0x11
lea rcx, [rax + 0x200]
or rax, 0x2200
cmp ebp, 0xa
cmove rcx, rax
cmp ebp, 7
cmove rcx, rax
lea rdx, [rcx + 0x100]
cmp ebp, 7
cmove rdx, rcx
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 0x90]
mov esi, eax
test eax, eax
jne 0x140002c1a
mov r9, qword [rsp + 0xa8]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.1400021f4
mov esi, eax
test eax, eax
je 0x140002cc0
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x140002b23
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140002b23
lea rsi, [rsp + 0x90]
mov rcx, rsi
call fcn.1400af6dc
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call fcn.1400af6fc
test eax, eax
je 0x140002c7d
lea rcx, [rsp + 0x90]
call fcn.140025dc2
mov esi, 0x2f
jmp 0x140002b16
lea rsi, [rsp + 0x90]
lea rdi, [rsp + 0x68]
mov rcx, rsi
mov rdx, rdi
call fcn.1400af8b8
mov rcx, rdi
call fcn.1400033d6
mov qword [0x140310e60], rax
mov rcx, rdi
call fcn.140004348
mov rcx, rsi
call fcn.140025dc2
mov rax, qword [0x140310e60]
jmp 0x140002ade
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x1400030e4
lea rcx, str.renderer
call fcn.1401a6660
movzx ecx, byte [r15 + 0x17]
test cl, cl
jns 0x140002cea
mov rcx, qword [r15 + 8]
cmp rax, rcx
jne 0x140002d10
mov qword [rsp + 0x20], rax
lea r9, str.renderer
mov rcx, r15
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.140065910
test eax, eax
je 0x140002d76
lea rdx, str.___typerenderer
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.140003340
lea rdx, str.ignored
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.140003340
mov rcx, r13
mov rdx, rdi
mov r8, rsi
call fcn.140069a40
cmp byte [rdi + 0x17], 0
jns 0x140002d5f
mov rcx, qword [rsp + 0x90]
call fcn.140183668
cmp byte [rsp + 0xc7], 0
jns 0x140002d76
mov rcx, qword [rsp + 0xb0]
call fcn.140183668
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rdi]
lea r9, str.__pipechrome.
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call qword [rax + 0xc0]
mov esi, eax
test eax, eax
jne 0x140002c1a
mov rax, qword [rdi]
lea r9, str..pipechrome.sync.
mov rcx, rdi
mov edx, 1
mov r8d, 4
call qword [rax + 0xc0]
mov esi, eax
test eax, eax
jne 0x140002c1a
xor esi, esi
lea r12, str.adialhk.dll
mov rcx, qword [rsi + r12]
mov dl, 1
mov r8, rdi
call fcn.140003415
add rsi, 8
cmp rsi, 0x280
jne 0x140002dd1
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
cmp ebp, 5
jne 0x140002e5e
call fcn.140095ae0
cmp eax, 9
jl 0x140002e5e
lea rcx, str.GpuAppContainer
call fcn.14006cf50
test al, al
je 0x140002e5e
mov rax, qword [rbx]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x140002e5e
mov r9, qword [rsp + 0xa8]
lea r8, [rsp + 0xb0]
mov rcx, r13
mov edx, 5
call fcn.1400023ac
mov esi, eax
test eax, eax
jne 0x140003278
lea rcx, str.renderer
call fcn.1401a6660
mov sil, byte [r15 + 0x17]
test sil, sil
mov rdi, qword [r15 + 8]
movzx ebp, sil
mov rcx, rbp
cmovs rcx, rdi
cmp rax, rcx
jne 0x140002eb6
mov qword [rsp + 0x20], rax
lea r9, str.renderer
mov rcx, r15
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.140065910
test eax, eax
je 0x140002f3b
mov sil, byte [r15 + 0x17]
mov rdi, qword [r15 + 8]
movzx ebp, sil
lea rcx, str.gpu_process
call fcn.1401a6660
test sil, sil
mov rcx, rbp
cmovs rcx, rdi
cmp rax, rcx
jne 0x140002efe
mov qword [rsp + 0x20], rax
lea r9, str.gpu_process
mov rcx, r15
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.140065910
test eax, eax
je 0x140002f3b
mov sil, byte [r15 + 0x17]
mov rdi, qword [r15 + 8]
movzx ebp, sil
lea rcx, str.utility
call fcn.1401a6660
test sil, sil
cmovs rbp, rdi
cmp rax, rbp
jne 0x140002fa1
mov qword [rsp + 0x20], rax
lea r9, str.utility
mov rcx, r15
xor edx, edx
mov r8, 0xffffffffffffffff
call fcn.140065910
test eax, eax
jne 0x140002fa1
call fcn.140070480
test al, al
je 0x140002fa1
mov rsi, qword [rsp + 0xa8]
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.140070490
xor ebp, ebp
cmp byte [rdi + 0x17], bpl
jns 0x140002f6c
mov rdi, qword [rsp + 0x90]
mov rax, qword [rsi]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rdi
call qword [rax + 0xc0]
mov esi, eax
cmp byte [rsp + 0xa7], bpl
jns 0x140002f99
mov rcx, qword [rsp + 0x90]
call fcn.140183668
test esi, esi
jne 0x140003278
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
mov esi, reloc.WS2_32.dll_send
test al, al
je 0x140003278
test byte [0x14030ec30], 0x19
jne 0x140003298
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
xor eax, eax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x88], eax
mov rsi, qword [0x140310e58]
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x80], rcx
test rcx, rcx
je 0x140003010
mov rax, qword [rcx]
call qword [rax]
xor r15d, r15d
lea rdi, [rsp + 0x68]
mov rcx, r13
mov rdx, rdi
xor r8d, r8d
call fcn.140069d10
cmp byte [rdi + 0x17], r15b
jns 0x140003031
mov rdi, qword [rsp + 0x68]
lea rbp, [rsp + 0x50]
mov rcx, r13
mov rdx, rbp
call fcn.140068db0
cmp byte [rbp + 0x17], r15b
mov rdx, rbp
jns 0x14000304f
mov rdx, qword [rsp + 0x50]
mov rax, qword [rsi]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x8c]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x80]
mov rcx, rsi
mov r8, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov esi, eax
mov rcx, rbp
call fcn.14006d240
cmp byte [rsp + 0x7f], r15b
jns 0x1400030a5
mov rcx, qword [rsp + 0x68]
call fcn.140183668
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x90]
call fcn.140094db0
test byte [0x14030ec30], 0x19
jne 0x1400032ec
test esi, esi
je 0x1400031b5
mov edx, dword [rsp + 0x88]
lea rcx, str.Process.Sandbox.Launch.Error
call fcn.1400753a0
jmp 0x14000326e
mov r12, qword [rsp + 0xa8]
call fcn.140095ae0
cmp eax, 5
jl 0x14000311b
mov rax, qword [r12]
lea rdx, [0x1401ba1da]
lea r8, str.DeviceDeviceApi
mov rcx, r12
call qword [rax + 0xd0]
mov esi, eax
test eax, eax
jne 0x140002c1a
mov rax, qword [r12]
mov rcx, r12
mov edx, 6
xor r8d, r8d
call qword [rax + reloc.WS2_32.dll_recv]
mov esi, eax
test eax, eax
jne 0x140002c1a
mov rax, qword [r12]
mov rcx, r12
mov edx, 6
call qword [rax + 0x70]
mov esi, eax
test eax, eax
jne 0x140002c1a
mov rax, qword [r12]
mov rcx, r12
mov edx, 4
call qword [rax + 0x60]
mov esi, eax
test eax, eax
jne 0x140002c1a
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0xe0]
mov rax, qword [r12]
mov rcx, r12
mov dl, 1
call qword [rax + 0x40]
test eax, eax
je 0x140002cd1
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rcx, str.Process.Sandbox.Launch.WarningResultCode
mov edx, esi
call fcn.1400753a0
lea rcx, str.Process.Sandbox.Launch.Warning
mov edx, edi
call fcn.1400753a0
jmp 0x140002cd1
mov rdi, qword [0x140342858]
test rdi, rdi
je 0x1400031f3
lea rbp, [rsp + 0x50]
mov rcx, r13
mov rdx, rbp
xor r8d, r8d
call fcn.140069d10
mov edx, dword [rsp + 0x78]
mov rcx, rdi
mov r8, rbp
call fcn.14006be80
cmp byte [rbp + 0x17], 0
jns 0x1400031f3
mov rcx, qword [rsp + 0x50]
call fcn.140183668
mov edx, dword [rsp + 0x8c]
test edx, edx
je 0x14000321f
mov edi, dword [rsp + 0x88]
lea rcx, str.Process.Sandbox.Launch.WarningResultCode
call fcn.1400753a0
lea rcx, str.Process.Sandbox.Launch.Warning
mov edx, edi
call fcn.1400753a0
mov rdx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x14000333d
lea rcx, [rsp + 0x68]
call fcn.140095150
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, rax
call fcn.140093550
mov rcx, r14
mov rdx, rdi
call fcn.140093630
mov rcx, rdi
call fcn.1400706e0
lea rcx, [rsp + 0x68]
call fcn.140094e60
cmp byte [rsp + 0xc7], 0
jns 0x140002c1a
mov rcx, qword [rsp + 0xb0]
call fcn.140183668
jmp 0x140002c1a
call sub.KERNEL32.dll_GetCurrentThreadId
mov esi, eax
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.140096de0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
lea rdx, [0x14030ec30]
lea r8, str.StartProcessWithAccess::LAUNCHPROCESS
mov cl, 0x42
xor r9d, r9d
call fcn.1400898b0
jmp 0x140002fcc
call sub.KERNEL32.dll_GetCurrentThreadId
mov edi, eax
lea rbp, [rsp + 0x50]
mov rcx, rbp
call fcn.140096de0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0
lea rdx, [0x14030ec30]
lea r8, str.StartProcessWithAccess::LAUNCHPROCESS
mov cl, 0x45
xor r9d, r9d
call fcn.1400898b0
jmp 0x1400030c4
int3