Function at 0x402720
Capabilities:
Accept command line arguments
Check if file exists
Move file
Query environment variable

Disassembly:
push rbp
sub rsp, 0x8c0
lea rbp, [rsp + 0x80]
call fcn.00404070
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
call rax
mov rcx, rax
lea rax, [rbp + 0x7b4]
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call rax
mov qword [rbp + 0x7b8], rax
cmp qword [rbp + 0x7b8], 0
jne 0x402771
lea rcx, str.Error_parsing_commandline_options__n
call fcn.00401560
mov eax, dword [rbp + 0x7b4]
cmp eax, 3
jg 0x402795
mov rax, qword [rbp + 0x7b8]
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.Usage:__S__options..__nOptions:_n____crt__________________CreateRemoteThread_injection_n____apc__________________QueueUserAPC_injection_n____free_________________Do_not_inject_our_monitor_n____dll__dll_____________DLL_to_inject_n____app__app_____________Path_to_application_to_start_n____args__args___________Command_line_arguments_n_________________________Excluding_the_application_path__n____curdir__dirpath______Current_working_directory_n____maximize_____________Maximize_the_newly_created_GUI_n____pid__pid_____________Process_identifier_to_inject_n____process_name__name___Process_name_to_inject_n____tid__tid_____________Thread_identifier_to_inject_n____from__pid____________Inject_from_another_process_n____from_process__name___Inject_from_another_process__resolves_pid_n____only_start___________Start_the_application_and_print_pid_tid_n____resume_thread________Resume_the_thread_of_the_pid_tid_target_n____config__path_________Configuration_file_for_the_monitor_n____dbg__path____________Attach_debugger_to_target_process_n____dump__filepath_______Dump_process_memory_with___pid_to_filepath_n____dump_block__addr___length__Restrict_process_memory_dump_to_a_particular_block_n____verbose______________Verbose_switch_n
call fcn.00401560
mov qword [rbp + 0x838], 0
mov qword [rbp + 0x830], 0
lea rax, [0x00407884]
mov qword [rbp + 0x828], rax
mov qword [rbp + 0x820], 0
mov qword [rbp + 0x818], 0
mov qword [rbp + 0x810], 0
mov qword [rbp + 0x808], 0
mov qword [rbp + 0x800], 0
mov qword [rbp + 0x7f8], 0
mov dword [rbp + 0x7f4], 0
mov dword [rbp + 0x7b0], 0
mov dword [rbp + 0x7f0], 0
mov dword [rbp + 0x7ec], 0
mov dword [rbp + 0x7e8], 0
mov dword [rbp + 0x7e4], 1
mov dword [rbp + 0x7e0], 0
mov dword [rbp + 0x7dc], 0
mov qword [rbp + 0x7d0], 0
mov qword [rbp + 0x7c8], 0
mov dword [rbp + 0x7c4], 1
jmp 0x402fdf
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__crt
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4028af
mov dword [rbp + 0x7ec], 1
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__apc
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4028ee
mov dword [rbp + 0x7ec], 2
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__free
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x40292d
mov dword [rbp + 0x7ec], 3
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dll
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x40298d
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x838], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__app
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4029ed
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x830], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__args
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402a4d
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x828], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__curdir
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402aad
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x808], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__maximize
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402aec
mov dword [rbp + 0x7e4], 3
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__pid
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402b5e
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_wcstol
mov dword [rbp + 0x7f4], eax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__process_name
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402bbe
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x800], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__tid
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402c30
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_wcstol
mov dword [rbp + 0x7b0], eax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__from
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402ca2
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_wcstol
mov dword [rbp + 0x7f0], eax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__from_process
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402d02
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x818], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__only_start
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402d4d
mov dword [rbp + 0x7e0], 1
mov eax, dword [rbp + 0x7e0]
mov dword [rbp + 0x7e8], eax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__resume_thread
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402d98
mov dword [rbp + 0x7dc], 1
mov eax, dword [rbp + 0x7dc]
mov dword [rbp + 0x7e8], eax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__config
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402df8
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x820], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dbg
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402e58
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x810], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dump
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402eb8
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x7f8], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dump_block
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402f66
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call fcn.004054b0
mov qword [rbp + 0x7d0], rax
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call fcn.004054b0
mov qword [rbp + 0x7c8], rax
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__verbose
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402fa2
mov dword [0x0040b040], 1
jmp 0x402fd8
mov eax, dword [rbp + 0x7c4]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7b8]
add rax, rdx
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.____Found_unsupported_argument:__S_n
call fcn.00401560
mov eax, 1
jmp 0x403592
add dword [rbp + 0x7c4], 1
mov eax, dword [rbp + 0x7b4]
cmp dword [rbp + 0x7c4], eax
jl 0x402870
cmp qword [rbp + 0x7f8], 0
je 0x403039
cmp dword [rbp + 0x7f4], 0
je 0x403039
mov rax, qword [rbp + 0x7c8]
mov r8d, eax
mov rcx, qword [rbp + 0x7d0]
mov rdx, qword [rbp + 0x7f8]
mov eax, dword [rbp + 0x7f4]
mov r9d, r8d
mov r8, rcx
mov ecx, eax
call fcn.00402428
mov eax, 0
jmp 0x403592
cmp dword [rbp + 0x7ec], 0
jne 0x403057
cmp dword [rbp + 0x7e8], 0
jne 0x403057
lea rcx, str.____No_injection_method_has_been_provided__n
call fcn.00401560
cmp dword [rbp + 0x7ec], 1
jne 0x403089
cmp dword [rbp + 0x7f4], 0
jne 0x403089
cmp qword [rbp + 0x800], 0
jne 0x403089
cmp qword [rbp + 0x830], 0
jne 0x403089
lea rcx, str.____No_injection_target_has_been_provided__n
call fcn.00401560
cmp dword [rbp + 0x7ec], 2
jne 0x4030bc
mov eax, dword [rbp + 0x7b0]
test eax, eax
jne 0x4030bc
cmp qword [rbp + 0x800], 0
jne 0x4030bc
cmp qword [rbp + 0x830], 0
jne 0x4030bc
lea rcx, str.____No_injection_target_has_been_provided__n
call fcn.00401560
cmp dword [rbp + 0x7ec], 3
jne 0x4030e4
cmp qword [rbp + 0x830], 0
jne 0x4030e4
cmp dword [rbp + 0x7f4], 0
jne 0x4030e4
lea rcx, str.____An_app_path_is_required_when_not_injecting__n
call fcn.00401560
cmp dword [rbp + 0x7f4], 0
je 0x403103
cmp qword [rbp + 0x800], 0
je 0x403103
lea rcx, str.____Both_pid_and_process_name_were_set__n
call fcn.00401560
cmp dword [rbp + 0x7ec], 3
jne 0x40313e
cmp dword [rbp + 0x7e8], 0
jne 0x40313e
cmp qword [rbp + 0x838], 0
jne 0x403132
mov eax, dword [rbp + 0x7b0]
test eax, eax
jne 0x403132
cmp dword [rbp + 0x7f4], 0
je 0x40313e
lea rcx, str.____Unused___tid___pid___dll_provided_in___free_mode__n
call fcn.00401560
cmp dword [rbp + 0x7ec], 0
je 0x4031dd
cmp dword [rbp + 0x7ec], 3
je 0x4031dd
mov rax, qword [rbp + 0x838]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call rax
test eax, eax
jne 0x40317b
lea rcx, str.____Invalid_DLL_filepath_has_been_provided_n
call fcn.00401560
mov rax, qword [rbp + 0x838]
mov r9d, 0
lea r8, [0x0040b080]
mov edx, 0x7fff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call rax
test eax, eax
jne 0x4031b0
lea rcx, str.____Invalid_DLL_filepath_has_been_provided_n
call fcn.00401560
mov r8d, 0x7fff
lea rdx, [0x0040b080]
lea rcx, [0x0040b080]
mov rax, qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call rax
test eax, eax
jne 0x4031dd
lea rcx, str.____Error_obtaining_the_dll_long_path_name_n
call fcn.00401560
cmp dword [rbp + 0x7f0], 0
je 0x4031fc
cmp qword [rbp + 0x818], 0
je 0x4031fc
lea rcx, str.____Both___from_and___from_process_are_specified_n
call fcn.00401560
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
call fcn.00402216
cmp qword [rbp + 0x830], 0
je 0x4033b7
cmp qword [rbp + 0x818], 0
je 0x403239
mov rax, qword [rbp + 0x818]
mov rcx, rax
call fcn.00402327
mov dword [rbp + 0x7f0], eax
cmp dword [rbp + 0x7f0], 0
jne 0x403251
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x7f0], eax
mov rax, qword [rbp + 0x830]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call rax
test eax, eax
jne 0x403274
lea rcx, str.____Invalid_app_filepath_has_been_provided_n
call fcn.00401560
cmp qword [rbp + 0x808], 0
je 0x4032be
mov rax, qword [rbp + 0x808]
mov r8d, 0x7fff
lea rdx, [0x0041b080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call rax
test eax, eax
jne 0x4032ae
lea rcx, str.____Error_expanding_environment_variables_n
call fcn.00401560
lea rax, [0x0041b080]
mov qword [rbp + 0x808], rax
jmp 0x4032e4
lea rcx, str.TEMP
mov rax, qword [sym.imp.msvcrt.dll__wgetenv]
call rax
mov rdx, rax
lea rcx, [0x0041b080]
call sub.msvcrt.dll_wcscpy
mov qword [rbp + 0x808], rax
mov r8d, 0x7fff
lea rdx, [0x0041b080]
lea rcx, [0x0041b080]
mov rax, qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call rax
test eax, eax
jne 0x403311
lea rcx, str.____Error_obtaining_the_curdir_long_path_name_n
call fcn.00401560
mov rax, qword [rbp + 0x830]
mov r9d, 0
lea r8, [0x0042b080]
mov edx, 0x7fff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call rax
test eax, eax
jne 0x403346
lea rcx, str.____Invalid_app_filepath_has_been_provided_n
call fcn.00401560
mov r8d, 0x7fff
lea rdx, [0x0042b080]
lea rcx, [0x0042b080]
mov rax, qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call rax
test eax, eax
jne 0x403373
lea rcx, str.____Error_obtaining_the_app_long_path_name_n
call fcn.00401560
mov edx, dword [rbp + 0x7e4]
mov r8, qword [rbp + 0x808]
mov rcx, qword [rbp + 0x828]
mov eax, dword [rbp + 0x7f0]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x7b0]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, [0x0042b080]
mov ecx, eax
call fcn.00401b4d
mov dword [rbp + 0x7f4], eax
cmp dword [rbp + 0x7f4], 0
jne 0x4033df
cmp qword [rbp + 0x800], 0
je 0x4033df
mov rax, qword [rbp + 0x800]
mov rcx, rax
call fcn.00402327
mov dword [rbp + 0x7f4], eax
cmp qword [rbp + 0x820], 0
je 0x40343e
mov eax, dword [rbp + 0x7f4]
mov r8d, eax
lea rdx, str.C:cuckoo__d.ini
lea rcx, [0x0043b080]
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov rax, qword [rbp + 0x820]
lea rdx, [0x0043b080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileW]
call rax
test eax, eax
jne 0x40343e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rcx, str.____Error_dropping_configuration_file:__ld_n
call fcn.00401560
cmp dword [rbp + 0x7e0], 0
je 0x40346e
mov edx, dword [rbp + 0x7b0]
mov eax, dword [rbp + 0x7f4]
mov r8d, edx
mov edx, eax
lea rcx, str._d__d
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x403592
mov eax, dword [rbp + 0x7ec]
cmp eax, 2
je 0x403499
cmp eax, 3
je 0x4034cb
cmp eax, 1
jne 0x4034b5
mov eax, dword [rbp + 0x7f4]
lea rdx, [0x0040b080]
mov ecx, eax
call fcn.00401f55
jmp 0x4034cc
mov edx, dword [rbp + 0x7b0]
mov eax, dword [rbp + 0x7f4]
lea r8, [0x0040b080]
mov ecx, eax
call fcn.004020a8
jmp 0x4034cc
mov eax, dword [rbp + 0x7ec]
mov edx, eax
lea rcx, str.____Unhandled_injection_mode:__d_n
call fcn.00401560
jmp 0x4034cc
nop
cmp qword [rbp + 0x810], 0
je 0x403546
mov ecx, dword [rbp + 0x7f4]
mov rdx, qword [rbp + 0x810]
lea rax, [rbp - 0x50]
mov r9d, ecx
mov r8, rdx
lea rdx, str.__s___p__d
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x810]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
call fcn.00401b4d
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp qword [rbp + 0x830], 0
jne 0x403559
cmp dword [rbp + 0x7dc], 0
je 0x403570
mov eax, dword [rbp + 0x7b0]
test eax, eax
je 0x403570
mov eax, dword [rbp + 0x7b0]
mov ecx, eax
call fcn.004021d8
mov edx, dword [rbp + 0x7b0]
mov eax, dword [rbp + 0x7f4]
mov r8d, edx
mov edx, eax
lea rcx, str._d__d
call sub.msvcrt.dll_printf
mov eax, 0
add rsp, 0x8c0
pop rbp
ret