Function at 0x402774
Capabilities:
Accept command line arguments
Check if file exists
Execute command
Move file
Query environment variable

Disassembly:
push rbp
sub rsp, 0x8c0
lea rbp, [rsp + 0x80]
call fcn.00403d30
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineW]
call rax
mov rcx, rax
lea rax, [rbp + 0x7b8]
mov rdx, rax
mov rax, qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call rax
mov qword [rbp + 0x7c0], rax
cmp qword [rbp + 0x7c0], 0
jne 0x4027c5
lea rcx, str.Error_parsing_commandline_options__n
call fcn.0040156c
mov eax, dword [rbp + 0x7b8]
cmp eax, 3
jg 0x4027e9
mov rax, qword [rbp + 0x7c0]
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.Usage:__S__options..__nOptions:_n____crt__________________CreateRemoteThread_injection_n____apc__________________QueueUserAPC_injection_n____free_________________Do_not_inject_our_monitor_n____dll__dll_____________DLL_to_inject_n____app__app_____________Path_to_application_to_start_n____args__args___________Command_line_arguments_n_________________________Excluding_the_application_path__n____curdir__dirpath______Current_working_directory_n____maximize_____________Maximize_the_newly_created_GUI_n____pid__pid_____________Process_identifier_to_inject_n____process_name__name___Process_name_to_inject_n____tid__tid_____________Thread_identifier_to_inject_n____from__pid____________Inject_from_another_process_n____from_process__name___Inject_from_another_process__resolves_pid_n____only_start___________Start_the_application_and_print_pid_tid_n____resume_thread________Resume_the_thread_of_the_pid_tid_target_n____config__path_________Configuration_file_for_the_monitor_n____dbg__path____________Attach_debugger_to_target_process_n____dump__filepath_______Dump_process_memory_with___pid_to_filepath_n____dump_block__addr___length__Restrict_process_memory_dump_to_a_particular_block_n____verbose______________Verbose_switch_n
call fcn.0040156c
mov qword [rbp + 0x838], 0
mov qword [rbp + 0x830], 0
lea rax, [0x00407894]
mov qword [rbp + 0x828], rax
mov qword [rbp + 0x820], 0
mov qword [rbp + 0x818], 0
mov qword [rbp + 0x810], 0
mov qword [rbp + 0x808], 0
mov qword [rbp + 0x800], 0
mov qword [rbp + 0x7f8], 0
mov dword [rbp + 0x7f4], 0
mov dword [rbp + 0x7b4], 0
mov dword [rbp + 0x7f0], 0
mov dword [rbp + 0x7ec], 0
mov dword [rbp + 0x7e8], 1
mov dword [rbp + 0x7e4], 0
mov dword [rbp + 0x7e0], 0
mov qword [rbp + 0x7d8], 0
mov qword [rbp + 0x7d0], 0
mov dword [rbp + 0x7cc], 1
jmp 0x403025
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__crt
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4028f9
mov dword [rbp + 0x7ec], 1
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__apc
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402938
mov dword [rbp + 0x7ec], 2
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__free
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402977
mov dword [rbp + 0x7ec], 3
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dll
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x4029d7
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x838], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__app
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402a37
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x830], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__args
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402a97
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x828], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__curdir
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402af7
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x808], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__maximize
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402b36
mov dword [rbp + 0x7e8], 3
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__pid
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402ba8
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_wcstol
mov dword [rbp + 0x7f4], eax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__process_name
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402c08
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x800], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__tid
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402c7a
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_wcstol
mov dword [rbp + 0x7b4], eax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__from
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402cec
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_wcstol
mov dword [rbp + 0x7f0], eax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__from_process
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402d4c
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x818], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__only_start
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402d95
mov dword [rbp + 0x7ec], 4
mov dword [rbp + 0x7e4], 1
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__resume_thread
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402dde
mov dword [rbp + 0x7ec], 4
mov dword [rbp + 0x7e0], 1
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__config
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402e3e
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x820], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dbg
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402e9e
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x810], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dump
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402efe
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp + 0x7f8], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__dump_block
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402fac
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call fcn.004051a0
mov qword [rbp + 0x7d8], rax
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov r8d, 0xa
mov edx, 0
mov rcx, rax
call fcn.004051a0
mov qword [rbp + 0x7d0], rax
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
lea rdx, str.__verbose
mov rcx, rax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x402fe8
mov dword [0x0040b040], 1
jmp 0x40301e
mov eax, dword [rbp + 0x7cc]
cdqe
lea rdx, [rax*8]
mov rax, qword [rbp + 0x7c0]
add rax, rdx
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.____Found_unsupported_argument:__S_n
call fcn.0040156c
mov eax, 1
jmp 0x4035f8
add dword [rbp + 0x7cc], 1
mov eax, dword [rbp + 0x7b8]
cmp dword [rbp + 0x7cc], eax
jl 0x4028ba
cmp qword [rbp + 0x7f8], 0
je 0x40307f
cmp dword [rbp + 0x7f4], 0
je 0x40307f
mov rax, qword [rbp + 0x7d0]
mov r8d, eax
mov rcx, qword [rbp + 0x7d8]
mov rdx, qword [rbp + 0x7f8]
mov eax, dword [rbp + 0x7f4]
mov r9d, r8d
mov r8, rcx
mov ecx, eax
call fcn.0040247c
mov eax, 0
jmp 0x4035f8
cmp dword [rbp + 0x7ec], 0
jne 0x403094
lea rcx, str.____No_injection_method_has_been_provided__n
call fcn.0040156c
cmp dword [rbp + 0x7ec], 1
jne 0x4030c6
cmp dword [rbp + 0x7f4], 0
jne 0x4030c6
cmp qword [rbp + 0x800], 0
jne 0x4030c6
cmp qword [rbp + 0x830], 0
jne 0x4030c6
lea rcx, str.____No_injection_target_has_been_provided__n
call fcn.0040156c
cmp dword [rbp + 0x7ec], 2
jne 0x4030f9
mov eax, dword [rbp + 0x7b4]
test eax, eax
jne 0x4030f9
cmp qword [rbp + 0x800], 0
jne 0x4030f9
cmp qword [rbp + 0x830], 0
jne 0x4030f9
lea rcx, str.____No_injection_target_has_been_provided__n
call fcn.0040156c
cmp dword [rbp + 0x7ec], 3
jne 0x403118
cmp qword [rbp + 0x830], 0
jne 0x403118
lea rcx, str.____An_app_path_is_required_when_not_injecting__n
call fcn.0040156c
cmp dword [rbp + 0x7f4], 0
je 0x403137
cmp qword [rbp + 0x800], 0
je 0x403137
lea rcx, str.____Both_pid_and_process_name_were_set__n
call fcn.0040156c
cmp dword [rbp + 0x7ec], 3
jne 0x403169
cmp qword [rbp + 0x838], 0
jne 0x40315d
mov eax, dword [rbp + 0x7b4]
test eax, eax
jne 0x40315d
cmp dword [rbp + 0x7f4], 0
je 0x403169
lea rcx, str.____Unused___tid___pid___dll_provided_in___free_mode__n
call fcn.0040156c
cmp dword [rbp + 0x7ec], 4
je 0x403208
cmp dword [rbp + 0x7ec], 3
je 0x403208
mov rax, qword [rbp + 0x838]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call rax
test eax, eax
jne 0x4031a6
lea rcx, str.____Invalid_DLL_filepath_has_been_provided_n
call fcn.0040156c
mov rax, qword [rbp + 0x838]
mov r9d, 0
lea r8, [0x0040b080]
mov edx, 0x7fff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call rax
test eax, eax
jne 0x4031db
lea rcx, str.____Invalid_DLL_filepath_has_been_provided_n
call fcn.0040156c
mov r8d, 0x7fff
lea rdx, [0x0040b080]
lea rcx, [0x0040b080]
mov rax, qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call rax
test eax, eax
jne 0x403208
lea rcx, str.____Error_obtaining_the_dll_long_path_name_n
call fcn.0040156c
cmp dword [rbp + 0x7f0], 0
je 0x403227
cmp qword [rbp + 0x818], 0
je 0x403227
lea rcx, str.____Both___from_and___from_process_are_specified_n
call fcn.0040156c
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
call fcn.0040226a
cmp qword [rbp + 0x830], 0
je 0x4033e2
cmp qword [rbp + 0x818], 0
je 0x403264
mov rax, qword [rbp + 0x818]
mov rcx, rax
call fcn.0040237b
mov dword [rbp + 0x7f0], eax
cmp dword [rbp + 0x7f0], 0
jne 0x40327c
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x7f0], eax
mov rax, qword [rbp + 0x830]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call rax
test eax, eax
jne 0x40329f
lea rcx, str.____Invalid_app_filepath_has_been_provided_n
call fcn.0040156c
cmp qword [rbp + 0x808], 0
je 0x4032e9
mov rax, qword [rbp + 0x808]
mov r8d, 0x7fff
lea rdx, [0x0041b080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call rax
test eax, eax
jne 0x4032d9
lea rcx, str.____Error_expanding_environment_variables_n
call fcn.0040156c
lea rax, [0x0041b080]
mov qword [rbp + 0x808], rax
jmp 0x40330f
lea rcx, str.TEMP
mov rax, qword [sym.imp.msvcrt.dll__wgetenv]
call rax
mov rdx, rax
lea rcx, [0x0041b080]
call sub.msvcrt.dll_wcscpy
mov qword [rbp + 0x808], rax
mov r8d, 0x7fff
lea rdx, [0x0041b080]
lea rcx, [0x0041b080]
mov rax, qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call rax
test eax, eax
jne 0x40333c
lea rcx, str.____Error_obtaining_the_curdir_long_path_name_n
call fcn.0040156c
mov rax, qword [rbp + 0x830]
mov r9d, 0
lea r8, [0x0042b080]
mov edx, 0x7fff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
call rax
test eax, eax
jne 0x403371
lea rcx, str.____Invalid_app_filepath_has_been_provided_n
call fcn.0040156c
mov r8d, 0x7fff
lea rdx, [0x0042b080]
lea rcx, [0x0042b080]
mov rax, qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call rax
test eax, eax
jne 0x40339e
lea rcx, str.____Error_obtaining_the_app_long_path_name_n
call fcn.0040156c
mov edx, dword [rbp + 0x7e8]
mov r8, qword [rbp + 0x808]
mov rcx, qword [rbp + 0x828]
mov eax, dword [rbp + 0x7f0]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x7b4]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, [0x0042b080]
mov ecx, eax
call fcn.00401ba1
mov dword [rbp + 0x7f4], eax
cmp dword [rbp + 0x7f4], 0
jne 0x40340a
cmp qword [rbp + 0x800], 0
je 0x40340a
mov rax, qword [rbp + 0x800]
mov rcx, rax
call fcn.0040237b
mov dword [rbp + 0x7f4], eax
cmp qword [rbp + 0x820], 0
je 0x4034ad
mov eax, dword [rbp + 0x7f4]
mov r8d, eax
lea rdx, str.C:cuckoo__d.ini
lea rcx, [0x0043b080]
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov rax, qword [rbp + 0x820]
lea rdx, [0x0043b080]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MoveFileW]
call rax
test eax, eax
jne 0x403485
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x7bc], eax
cmp dword [rbp + 0x7bc], 0xb7
je 0x403485
mov eax, dword [rbp + 0x7bc]
mov edx, eax
lea rcx, str.____Error_dropping_configuration_file:__ld_n
call fcn.0040156c
mov eax, dword [rbp + 0x7f4]
mov r8d, eax
lea rdx, str.icacls_C:cuckoo__d.ini__grant__everyone_:F
lea rcx, [0x0044b080]
call sub.msvcrt.dll_sprintf
lea rcx, [0x0044b080]
call sub.msvcrt.dll_system
cmp dword [rbp + 0x7e4], 0
je 0x4034dd
mov edx, dword [rbp + 0x7b4]
mov eax, dword [rbp + 0x7f4]
mov r8d, edx
mov edx, eax
lea rcx, str._d__d
call sub.msvcrt.dll_printf
mov eax, 0
jmp 0x4035f8
mov eax, dword [rbp + 0x7ec]
cmp eax, 2
je 0x403508
cmp eax, 3
je 0x40353a
cmp eax, 1
jne 0x403524
mov eax, dword [rbp + 0x7f4]
lea rdx, [0x0040b080]
mov ecx, eax
call fcn.00401fa9
jmp 0x40353b
mov edx, dword [rbp + 0x7b4]
mov eax, dword [rbp + 0x7f4]
lea r8, [0x0040b080]
mov ecx, eax
call fcn.004020fc
jmp 0x40353b
mov eax, dword [rbp + 0x7ec]
mov edx, eax
lea rcx, str.____Unhandled_injection_mode:__d_n
call fcn.0040156c
jmp 0x40353b
nop
cmp qword [rbp + 0x810], 0
je 0x4035b5
mov ecx, dword [rbp + 0x7f4]
mov rdx, qword [rbp + 0x810]
lea rax, [rbp - 0x50]
mov r9d, ecx
mov r8, rdx
lea rdx, str.__s___p__d
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov ecx, eax
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x810]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
call fcn.00401ba1
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp qword [rbp + 0x830], 0
jne 0x4035c8
cmp dword [rbp + 0x7e0], 0
je 0x4035df
mov eax, dword [rbp + 0x7b4]
test eax, eax
je 0x4035df
mov eax, dword [rbp + 0x7b4]
mov ecx, eax
call fcn.0040222c
mov eax, dword [rbp + 0x7f4]
mov edx, eax
lea rcx, [0x00407d58]
call sub.msvcrt.dll_printf
mov eax, 0
add rsp, 0x8c0
pop rbp
ret