Function at 0x1400794e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
movaps xmmword [rsp + 0xaa0], xmm6
mov rax, qword [0x1404fa650]
xor rax, rsp
mov qword [rbp + 0x990], rax
movzx r13d, r9b
mov byte [rsp + 0x44], r9b
mov qword [rbp - 0x78], r8
mov r15, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x50], r14d
mov rax, qword [rcx]
movabs r10, 0x9f78a772785b8370
mov rax, qword [rax + 0x10]
call qword [case.0x140084480.0]
mov r12d, eax
mov dword [rsp + 0x4c], eax
test eax, eax
js 0x140079e1b
mov rbx, qword [rsi + 0xd0]
test rbx, rbx
je 0x140079575
lock inc dword [rbx + 8]
mov rbx, qword [rsi + 0xd0]
mov r8, qword [rsi + 0xc8]
movabs rcx, 0xcbf29ce484222325
movabs r9, 0x100000001b3
test r8, r8
je 0x14007a05d
mov r8, qword [r8 + 0x40]
mov rax, r8
shr rax, 8
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
imul rdx, r9
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x38
xor rdx, rax
imul rdx, r9
mov rcx, qword [r15 + 0x30]
and rcx, rdx
mov rdx, qword [r15 + 0x18]
mov rax, rcx
add rax, rax
mov rdi, qword [rdx + rax*8 + 8]
mov r9, qword [r15 + 8]
cmp rdi, r9
je 0x140079651
add rcx, rcx
mov rax, qword [rdx + rcx*8]
cmp r8, qword [rdi + 0x10]
je 0x140079656
cmp rdi, rax
jne 0x14007a136
mov rdi, r9
jmp 0x14007965b
test rdi, rdi
je 0x140079651
mov r14d, 0xffffffff
test rbx, rbx
je 0x140079677
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
je 0x14007a152
mov rax, qword [rdi + 0x58]
mov edi, dword [rax]
mov dword [rbp - 0x80], edi
cmp edi, dword [rsi + 0x158]
je 0x14007a304
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
xor ecx, ecx
mov word [rsp + 0x40], cx
mov ecx, dword [rsi + 0x118]
lea rax, [0x1404fc3a0]
cmp ecx, 2
jne 0x14007a263
cmp qword [0x140524960], 0
je 0x14007a3c7
mov rax, qword [0x140524968]
test rax, rax
je 0x1400796d0
lock inc dword [rax + 8]
movups xmm0, xmmword [0x140524960]
movups xmmword [rbp + 0x140], xmm0
mov dword [rsp + 0x48], 0x400
mov rbx, qword [0x140524960]
mov qword [rbp - 0x20], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp - 8], rdi
lea r8, [rsi + 0x120]
lea rdx, [rbp + 0x120]
mov rcx, rbx
call fcn.140089a90
mov r13, qword [rax]
mov qword [rbp + 0x20], r13
mov rbx, qword [rax + 8]
mov qword [rbp + 0x28], rbx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
movaps xmm6, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x110], xmm6
mov r12, qword [rbp + 0x128]
test r12, r12
je 0x14007976c
mov eax, r14d
lock xadd dword [r12 + 8], eax
cmp eax, 1
je 0x14007a178
test rdi, rdi
je 0x140079781
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
nop
test r13, r13
je 0x14007a092
test rbx, rbx
jne 0x14007a0b6
movdqa xmmword [rbp + 0x30], xmm6
lea rax, [rbp + 0x30]
mov edi, 0xc00
mov r12, qword [rax + 8]
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
bts edi, 0xd
mov dword [rsp + 0x48], edi
bt edi, 0xc
jb 0x14007a31f
bt edi, 0xb
jae 0x1400797dd
btr edi, 0xb
mov dword [rsp + 0x48], edi
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400797dd
call fcn.14008a1a0
nop
test rbx, rbx
je 0x1400797f7
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
je 0x14007a19f
mov edi, dword [rsp + 0x48]
test r13, r13
je 0x14007a089
mov r8, qword [r13 + 0x40]
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
mov rax, r8
shr rax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x38
xor rdx, rax
imul rdx, r9
mov rax, qword [r15 + 0x30]
and rax, rdx
mov rcx, qword [r15 + 0x18]
mov rbx, rax
add rbx, rbx
mov rbx, qword [rcx + rbx*8 + 8]
mov rdx, qword [r15 + 8]
cmp rbx, rdx
je 0x1400798cc
add rax, rax
mov rcx, qword [rcx + rax*8]
cmp r8, qword [rbx + 0x10]
je 0x1400798d1
cmp rbx, rcx
jne 0x14007a13f
mov rbx, rdx
jmp 0x1400798d6
test rbx, rbx
je 0x1400798cc
test r12, r12
je 0x1400798f0
lock xadd dword [r12 + 8], r14d
cmp r14d, 1
je 0x14007a1c5
mov edi, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x140079901
call fcn.14008a1a0
mov rax, qword [rbx + 0x58]
mov r12, qword [rax]
movzx eax, byte [rsp + 0x44]
xor al, 1
mov byte [rsp + 0x44], al
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
bts edi, 0x13
mov dword [rsp + 0x48], edi
test r12, r12
je 0x14007a673
mov rbx, qword [0x140525078]
test rbx, rbx
je 0x14007a6ba
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rbp - 0x70], rbx
mov eax, 1
mov word [rsp + 0x40], ax
lea rcx, [rbx + 0x38]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x160]
call fcn.140078958
mov r14, qword [rax]
mov qword [rbp + 0x40], r14
mov r13, qword [rax + 8]
mov qword [rbp + 0x48], r13
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
movaps xmm6, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x60], xmm6
mov rcx, qword [rbp + 0x168]
test rcx, rcx
jne 0x14007a148
test r14, r14
je 0x14007a511
mov r14, qword [rsp + 0x60]
test byte [r14 + 0x184], 4
je 0x14007a0d4
xor r14d, r14d
mov word [rsp + 0x40], r14w
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
bts edi, 0x14
mov dword [rsp + 0x48], edi
test rbx, rbx
jne 0x14007a0bf
mov edi, dword [rbp - 0x80]
movdqa xmmword [rsp + 0x70], xmm6
mov rbx, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x4c]
mov rcx, qword [rbp - 0x78]
test rbx, rbx
je 0x14007a066
cmp qword [rbx + 0x60], rcx
ja 0x14007a730
movzx r9d, byte [rsi + 0xc2]
mov r8b, 5
lea rdx, [rbp + 0x270]
mov rcx, rsi
call fcn.14007bd70
nop
mov byte [rbp + 0x2c8], 0
cmp qword [0x140524960], 0
je 0x14007a364
call fcn.14007b77c
movups xmm0, xmmword [0x140524960]
movups xmmword [rbp], xmm0
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayGetDim
movq rdi, xmm0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rbx, [rdi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp - 0x70], rbx
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x198]
mov rcx, rdi
call fcn.140089a90
mov rcx, qword [rax]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x58], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp + 0x198]
call fcn.140071e50
nop
lea rcx, [rbp - 0x70]
call fcn.140079170
lea rcx, [rsp + 0x60]
call fcn.14007b7a0
test al, al
je 0x14007a2e4
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b8]
call fcn.140078f60
nop
mov ebx, 0x30
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14007b190
bts ebx, 7
test bl, 0x40
jne 0x14007a30b
test bl, 0x20
je 0x140079b24
lea rcx, [rbp + 0x1b8]
call fcn.140071e50
nop
lea rcx, [rsp + 0x60]
call fcn.140071e50
nop
lea rcx, [rbp]
call fcn.1400846a0
nop
lea rcx, [rbp + 0x60]
call fcn.14007b37c
lea rdx, [rbp + 0x250]
mov rcx, rax
call fcn.140089ee0
nop
lea r8, [0x1403bade0]
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.14007b7b0
nop
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140078fb0
nop
lea rcx, [rbp + 0x230]
call fcn.14007bc80
nop
lea rcx, [rbp + 0x250]
call fcn.14007bc80
nop
lea rcx, [rbp + 0x60]
call fcn.140071e50
movzx edx, word [rsp + 0x40]
lea rcx, [rbp + 0x270]
call fcn.14007b9f4
lea rcx, [rbp + 0x270]
call fcn.14007b9e8
mov rbx, rax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x270]
call fcn.140089440
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x7f0]
call fcn.14007b388
nop
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14007b590
nop
lea r8, [rbp + 0x650]
lea rdx, [rbp + 0x1f0]
mov rcx, r15
call fcn.140086580
nop
lea rcx, [rbp + 0x650]
call fcn.14007b1d0
nop
lea rcx, [rbp + 0x7f0]
call fcn.1400800c0
nop
lea rcx, [rbp + 0x1c8]
call fcn.140071e50
mov r8b, 1
lea rdx, [rbp + 0x330]
mov rcx, rsi
call fcn.14007bd40
nop
lea rcx, [rsp + 0x70]
call fcn.140078adc
mov r13, rax
lea rdx, [rax + 0x30]
lea rcx, [rbp + 0x330]
call fcn.1400806e8
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x330]
call fcn.14007bcf4
cmp word [rbp + 0x342], 0
jne 0x140079c87
mov eax, 0x300
mov word [rbp + 0x342], ax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x330]
call fcn.140089440
nop
lea r8, [rbp + 0x330]
mov rdx, rax
lea rcx, [rbp + 0x8c0]
call fcn.140079198
nop
mov rdx, rax
lea rcx, [rbp + 0x720]
call fcn.14007b590
nop
lea r8, [rbp + 0x720]
lea rdx, [rbp - 0x58]
mov rcx, r15
call fcn.140086580
nop
lea rcx, [rbp + 0x720]
call fcn.14007b1d0
nop
lea rcx, [rbp + 0x8c0]
call fcn.1400800c0
nop
lea rcx, [rbp + 0x1d8]
call fcn.140071e50
mov dword [rsp + 0x50], 8
lea rdx, [rbp + 0x80]
lea rcx, [rsi + 0x140]
call fcn.140078f9c
mov r8, qword [rax]
lea rdx, [rbp + 0x88]
lea rcx, [rsi + 0x140]
call fcn.14007b1bc
lea r9, [rsp + 0x50]
mov rdx, qword [rax]
lea rcx, [rbp - 0x18]
call fcn.14007b164
lea rdx, [rbp + 0x90]
lea rcx, [rsi + 0x140]
call fcn.140078f9c
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14007bd2c
test al, al
jne 0x14007a76c
lea rcx, [rsi + 0x140]
call fcn.14007b370
mov rdi, rax
lea rcx, [rsi + 0x140]
call fcn.140078f90
mov rbx, rax
cmp rax, rdi
je 0x140079daf
lea rcx, [rsp + 0x70]
call fcn.140078adc
mov r14, rax
mov r9, r15
mov r8d, dword [rbx]
mov rdx, r14
mov rcx, rsi
call fcn.14007a85c
add rbx, 4
cmp rbx, rdi
jne 0x140079d95
mov rcx, r13
call fcn.14007b9d4
test al, al
je 0x140079dc1
mov r12d, 0x80070490
lea rcx, [rbp + 0x330]
call fcn.140081f40
nop
lea rcx, [rbp + 0x270]
call fcn.140081f40
nop
lea rcx, [rsp + 0x70]
call fcn.140084a34
mov eax, r12d
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.140157600
mov rbx, qword [rsp + 0xb00]
movaps xmm6, xmmword [rsp + 0xaa0]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [0x140524960], r14
je 0x14007a46c
mov rax, qword [0x140524968]
test rax, rax
je 0x140079e38
lock inc dword [rax + 8]
movups xmm0, xmmword [0x140524960]
movups xmmword [rbp + 0xf0], xmm0
mov dword [rsp + 0x48], 2
mov rbx, qword [0x140524960]
mov qword [rbp - 0x80], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
lea r13, [rbx + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp + 0x190], r13
lea r8, [rsi + 0x88]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call fcn.140089a90
mov rbx, qword [rax]
mov qword [rbp + 0x70], rbx
mov rdi, qword [rax + 8]
mov qword [rbp + 0x78], rdi
mov qword [rax], r14
mov qword [rax + 8], r14
movaps xmm6, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0xc0], xmm6
mov r14d, 0xffffffff
mov r12, qword [rbp + 0xd8]
test r12, r12
je 0x140079edb
mov eax, r14d
lock xadd dword [r12 + 8], eax
cmp eax, 1
je 0x14007a216
test r13, r13
je 0x140079ef0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
nop
test rbx, rbx
je 0x14007a108
test rdi, rdi
jne 0x14007a12d
movdqa xmmword [rbp + 0x10], xmm6
lea rax, [rbp + 0x10]
mov r12d, 6
mov qword [rbp - 0x68], rbx
mov r13, qword [rax + 8]
mov qword [rbp - 0x60], r13
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
or r12d, 0x10
mov dword [rsp + 0x48], r12d
test r12b, 8
jne 0x14007a341
test r12b, 4
je 0x140079f4e
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140079f4e
call fcn.14008a1a0
nop
test rdi, rdi
je 0x140079f6c
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
je 0x14007a23d
mov rbx, qword [rbp - 0x68]
mov r13, qword [rbp - 0x60]
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x140079f7e
call fcn.14008a1a0
nop
test rbx, rbx
je 0x14007a0dc
movzx r8d, byte [rsi + 9]
mov edi, dword [rsp + 0x4c]
mov edx, edi
lea rcx, [rbp + 0x3f0]
call fcn.140078ae8
nop
lea rdx, [rbp + 0x210]
mov rcx, rbx
call fcn.140089ee0
nop
mov rdx, rax
lea rcx, [rbp + 0x408]
call fcn.140078bc0
nop
lea rcx, [rbp + 0x210]
call fcn.14007bc80
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x4b0]
call fcn.140078f60
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x4c0]
call fcn.140078d80
nop
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x580]
call fcn.14007b590
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x200]
mov rcx, r15
call fcn.140086580
nop
lea rcx, [rbp + 0x588]
call fcn.140081f40
nop
lea rcx, [rbp + 0x4b0]
call fcn.1400800c0
nop
lea rcx, [rbp + 0x3f0]
call fcn.140081f40
nop
test r13, r13
je 0x14007a056
lock xadd dword [r13 + 8], r14d
cmp r14d, 1
je 0x14007a1ec
mov eax, edi
jmp 0x140079de8
mov rdi, qword [r15 + 8]
jmp 0x14007965b
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
lea rax, vtable.sense::GenericETW::MissingProcessException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1404c5d68]
lea rcx, [rbp - 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
mov rbx, qword [r15 + 8]
jmp 0x1400798d6
lea r8, [rsi + 0x120]
lea rdx, [rbp + 0x130]
mov rcx, qword [rbp - 0x20]
call fcn.140089fc0
mov edi, 0x1400
mov r13, qword [rax]
jmp 0x1400797a1
lock inc dword [rbx + 8]
jmp 0x140079793
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
jmp 0x1400799ed
xor r14d, r14d
jmp 0x1400799d3
lea rdx, str.targetFieldName_is_null
lea rcx, [rbp - 0x58]
call fcn.140086f9c
lea rax, vtable.std::invalid_argument.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1404c5870]
lea rcx, [rbp - 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea r8, [rsi + 0x88]
lea rdx, [rbp + 0xe0]
mov rcx, qword [rbp - 0x80]
call fcn.140089fc0
mov r12d, 0xa
mov rbx, qword [rax]
jmp 0x140079f11
lock inc dword [rdi + 8]
jmp 0x140079f02
mov rdi, qword [rdi + 8]
jmp 0x140079642
mov rbx, qword [rbx + 8]
jmp 0x1400798bd
call fcn.14008a1a0
jmp 0x1400799ae
mov rax, qword [rbx]
movabs r10, 0xa545274f70dcb170
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, rbx
call fcn.140084460
jmp 0x140079677
mov rax, qword [r12]
movabs r10, 0xa545274f70dcb170
mov rcx, r12
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, r12
call fcn.140084460
jmp 0x14007976c
mov rax, qword [rbx]
movabs r10, 0xa545274f70dcb170
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, rbx
call fcn.140084460
jmp 0x1400797f3
mov rax, qword [r12]
movabs r10, 0xa545274f70dcb170
mov rcx, r12
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, r12
call fcn.140084460
jmp 0x1400798ec
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
movabs r10, 0xa545274f70dcb170
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, rbx
call fcn.140084460
jmp 0x14007a056
mov rax, qword [r12]
movabs r10, 0xa545274f70dcb170
mov rcx, r12
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, r12
call fcn.140084460
jmp 0x140079edb
mov rax, qword [rdi]
movabs r10, 0xa545274f70dcb170
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x140084480.0]
mov rcx, rdi
call fcn.140084460
jmp 0x140079f64
test ecx, ecx
je 0x14007a5f1
cmp ecx, 1
jne 0x14007a066
lea r8, [rsi + 0x120]
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.1400ab000
mov rcx, qword [rax]
mov rax, qword [rcx + 0x58]
xor r13b, 1
mov byte [rsp + 0x20], r13b
lea r9, [rsp + 0x40]
mov r8, qword [rax]
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.14006f108
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
xor r14d, r14d
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rbp - 0x30], r14
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x28], r14
mov qword [rsp + 0x78], rcx
lea rcx, [rbp - 0x30]
call fcn.1400788e0
lea rcx, [rbp - 0x40]
call fcn.1400788e0
jmp 0x140079a00
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x1a8]
mov rcx, rdi
call fcn.140089fc0
mov ebx, 0x50
jmp 0x140079af9
xor eax, eax
jmp 0x140079de8
and ebx, 0xffffffbf
lea rcx, [rbp + 0x1a8]
call fcn.140071e50
jmp 0x140079b12
btr edi, 0xc
mov dword [rsp + 0x48], edi
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x1400797c0
call fcn.14008a1a0
jmp 0x1400797c0
and r12d, 0xfffffff7
mov dword [rsp + 0x48], r12d
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x140079f39
call fcn.14008a1a0
jmp 0x140079f39
lea rdi, [0x1404fc3a0]
mov qword [rbp - 0x70], rdi
mov rcx, rdi
call fcn.1400edb3c
nop
cmp qword [0x140524960], 0
jne 0x14007a3b3
mov ecx, 0x48
call fcn.140157bbc
mov rbx, rax
mov qword [rbp - 8], rax
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rbx
call fcn.1400edc28
nop
mov rdx, rax
call fcn.1400edb6c
nop
mov rcx, rdi
call qword [sym.imp.msvcp_win.dll__Mtx_unlock]
nop dword [rax + rax]
jmp 0x140079a47
mov qword [rbp + 0x1e8], rax
mov rcx, rax
call fcn.1400edb3c
nop
cmp qword [0x140524960], 0
jne 0x14007a454
mov ecx, 0x48
call fcn.140157bbc
mov rbx, rax
mov qword [rbp - 0x20], rax
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rbx
call fcn.1400edc28
nop
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400edbc0
mov rdx, qword [rax]
mov rcx, qword [0x140524960]
mov qword [rax], rcx
mov qword [0x140524960], rdx
mov rdx, qword [rax + 8]
mov rcx, qword [0x140524968]
mov qword [rax + 8], rcx
mov qword [0x140524968], rdx
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x14007a454
call fcn.14008a1a0
nop
lea rcx, [0x1404fc3a0]
call qword [sym.imp.msvcp_win.dll__Mtx_unlock]
nop dword [rax + rax]
jmp 0x1400796c0
lea rdi, [0x1404fc3a0]
mov qword [rbp - 0x10], rdi
mov rcx, rdi
call fcn.1400edb3c
nop
cmp qword [0x140524960], 0
jne 0x14007a4fd
mov ecx, 0x48
call fcn.140157bbc
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rbx
call fcn.1400edc28
nop
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400edbc0
mov rdx, qword [rax]
mov rcx, qword [0x140524960]
mov qword [rax], rcx
mov qword [0x140524960], rdx
mov rdx, qword [rax + 8]
mov rcx, qword [0x140524968]
mov qword [rax + 8], rcx
mov qword [0x140524968], rdx
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x14007a4fd
call fcn.14008a1a0
nop
mov rcx, rdi
call qword [sym.imp.msvcp_win.dll__Mtx_unlock]
nop dword [rax + rax]
jmp 0x140079e28
mov eax, 4
mov word [rsp + 0x40], ax
lea rcx, [rbx + 0x288]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x170]
call fcn.140078958
mov r14, qword [rax]
mov rcx, qword [rax + 8]
xor edx, edx
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rbp - 0x40], rdx
mov qword [rsp + 0x60], r14
mov qword [rbp - 0x38], r13
mov qword [rsp + 0x68], rcx
lea rcx, [rbp - 0x40]
call fcn.1400788e0
lea rcx, [rbp + 0x170]
call fcn.1400788e0
test r14, r14
jne 0x14007a725
test rbx, rbx
je 0x14007a588
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x28], al
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov edi, dword [rbp - 0x80]
mov r9d, edi
mov r8, r12
lea rdx, [rbp + 0x180]
mov rcx, rbx
call fcn.1401306b0
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14006f4b8
lea rcx, [rbp + 0x180]
call fcn.1400788e0
movaps xmm6, xmmword [rsp + 0x60]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.1400788e0
jmp 0x1400799f0
xor r13b, 1
mov byte [rsp + 0x20], r13b
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.14006f108
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14006f4b8
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14007a628
call fcn.14008a1a0
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14007a066
mov rax, qword [rbx + 0x68]
mov rcx, qword [rbp - 0x78]
test rax, rax
je 0x14007a66b
cmp rax, rcx
jae 0x14007a66b
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
lea rax, vtable.sense::GenericETW::MissingProcessException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1404c5d68]
lea rcx, [rbp - 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
xor r14d, r14d
jmp 0x140079a04
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edi, dword [rbp - 0x80]
mov edx, edi
lea rcx, [rbp + 0x150]
call fcn.14006f108
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14006f4b8
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x14007a6ad
call fcn.14008a1a0
movdqa xmm6, xmmword [rbp - 0x30]
xor r14d, r14d
jmp 0x1400799f0
lea rbx, [0x140522328]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
mov qword [rsp + 0x50], rbx
cmp qword [0x140525078], 0
jne 0x14007a70f
mov ecx, 0x4f0
call fcn.140157bbc
mov qword [rbp - 8], rax
mov rcx, rax
call fcn.140310de8
nop
mov rdx, qword [0x140525078]
mov qword [0x140525078], rax
test rdx, rdx
je 0x14007a70f
call fcn.140311324
nop
lea rcx, [rsp + 0x50]
call fcn.14010cda0
mov rbx, qword [0x140525078]
jmp 0x14007993c
movdqa xmm6, xmmword [rsp + 0x60]
jmp 0x1400799bc
mov ebx, dword [rbx + 0x184]
lea rcx, [rbp]
call fcn.140129c50
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14006f4b8
lea rcx, [rbp]
call fcn.1400788e0
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x58], edi
bts ebx, 0xc
mov dword [rax + 0x184], ebx
jmp 0x140079a17
mov rcx, r13
call fcn.14007b9d4
test al, al
jne 0x140079d65
mov eax, dword [r13 + 0xac]
cmp eax, 0xffffffff
je 0x140079d65
cmp eax, 0x3000
jb 0x140079d65
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x4c]
mov rdx, qword [r13 + 0x60]
mov ecx, dword [r13 + 0x58]
call fcn.14016eb88
test al, al
je 0x14007a7d9
mov eax, dword [rsp + 0x4c]
cmp dword [r13 + 0x98], eax
je 0x140079d65
mov dword [r13 + 0xe8], eax
mov rax, qword [rbp - 0x10]
mov qword [r13 + 0xf0], rax
jmp 0x140079d65
call fcn.1400abd44
mov r10, rax
cmp dword [rax], 5
jbe 0x140079d65
xor edx, edx
mov rcx, rax
call fcn.140004c20
test al, al
je 0x140079d65
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x98]
call fcn.1400048cc
mov r9, rax
lea rdx, [r13 + 0x58]
lea rcx, [rbp - 0x78]
call fcn.1400048bc
mov r8, rax
lea rdx, str.QueryProcessData::TryCreate_wasnt_able_to_query_the_process_data
lea rcx, [rbp + 0xa0]
call fcn.140003db4
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
lea rdx, [0x14045ea80]
mov rcx, r10
call fcn.140006cc4
jmp 0x140079d65