Function at 0x1400797c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9b0]
sub rsp, 0xab0
movaps xmmword [rsp + 0xaa0], xmm6
mov rax, qword [0x1404fd7f0]
xor rax, rsp
mov qword [rbp + 0x990], rax
movzx r13d, r9b
mov byte [rsp + 0x44], r9b
mov qword [rbp - 0x78], r8
mov r15, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x50], r14d
mov rax, qword [rcx]
movabs r10, 0x9f78a772785b8370
mov rax, qword [rax + 0x10]
call qword [case.0x140084760.0]
mov r12d, eax
mov dword [rsp + 0x4c], eax
test eax, eax
js 0x14007a0fb
mov rbx, qword [rsi + 0xd0]
test rbx, rbx
je 0x140079855
lock inc dword [rbx + 8]
mov rbx, qword [rsi + 0xd0]
mov r8, qword [rsi + 0xc8]
movabs rcx, 0xcbf29ce484222325
movabs r9, 0x100000001b3
test r8, r8
je 0x14007a33d
mov r8, qword [r8 + 0x40]
mov rax, r8
shr rax, 8
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
imul rdx, r9
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x38
xor rdx, rax
imul rdx, r9
mov rcx, qword [r15 + 0x30]
and rcx, rdx
mov rdx, qword [r15 + 0x18]
mov rax, rcx
add rax, rax
mov rdi, qword [rdx + rax*8 + 8]
mov r9, qword [r15 + 8]
cmp rdi, r9
je 0x140079931
add rcx, rcx
mov rax, qword [rdx + rcx*8]
cmp r8, qword [rdi + 0x10]
je 0x140079936
cmp rdi, rax
jne 0x14007a416
mov rdi, r9
jmp 0x14007993b
test rdi, rdi
je 0x140079931
mov r14d, 0xffffffff
test rbx, rbx
je 0x140079957
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
je 0x14007a432
mov rax, qword [rdi + 0x58]
mov edi, dword [rax]
mov dword [rbp - 0x80], edi
cmp edi, dword [rsi + 0x158]
je 0x14007a5e4
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
xor ecx, ecx
mov word [rsp + 0x40], cx
mov ecx, dword [rsi + 0x118]
lea rax, [0x1404ff520]
cmp ecx, 2
jne 0x14007a543
cmp qword [0x140527cb0], 0
je 0x14007a6a7
mov rax, qword [0x140527cb8]
test rax, rax
je 0x1400799b0
lock inc dword [rax + 8]
movups xmm0, xmmword [0x140527cb0]
movups xmmword [rbp + 0x140], xmm0
mov dword [rsp + 0x48], 0x400
mov rbx, qword [0x140527cb0]
mov qword [rbp - 0x20], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp - 8], rdi
lea r8, [rsi + 0x120]
lea rdx, [rbp + 0x120]
mov rcx, rbx
call fcn.140089d70
mov r13, qword [rax]
mov qword [rbp + 0x20], r13
mov rbx, qword [rax + 8]
mov qword [rbp + 0x28], rbx
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
movaps xmm6, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x110], xmm6
mov r12, qword [rbp + 0x128]
test r12, r12
je 0x140079a4c
mov eax, r14d
lock xadd dword [r12 + 8], eax
cmp eax, 1
je 0x14007a458
test rdi, rdi
je 0x140079a61
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
nop
test r13, r13
je 0x14007a372
test rbx, rbx
jne 0x14007a396
movdqa xmmword [rbp + 0x30], xmm6
lea rax, [rbp + 0x30]
mov edi, 0xc00
mov r12, qword [rax + 8]
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
bts edi, 0xd
mov dword [rsp + 0x48], edi
bt edi, 0xc
jb 0x14007a5ff
bt edi, 0xb
jae 0x140079abd
btr edi, 0xb
mov dword [rsp + 0x48], edi
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140079abd
call fcn.14008a480
nop
test rbx, rbx
je 0x140079ad7
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
je 0x14007a47f
mov edi, dword [rsp + 0x48]
test r13, r13
je 0x14007a369
mov r8, qword [r13 + 0x40]
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
mov rax, r8
shr rax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x38
xor rdx, rax
imul rdx, r9
mov rax, qword [r15 + 0x30]
and rax, rdx
mov rcx, qword [r15 + 0x18]
mov rbx, rax
add rbx, rbx
mov rbx, qword [rcx + rbx*8 + 8]
mov rdx, qword [r15 + 8]
cmp rbx, rdx
je 0x140079bac
add rax, rax
mov rcx, qword [rcx + rax*8]
cmp r8, qword [rbx + 0x10]
je 0x140079bb1
cmp rbx, rcx
jne 0x14007a41f
mov rbx, rdx
jmp 0x140079bb6
test rbx, rbx
je 0x140079bac
test r12, r12
je 0x140079bd0
lock xadd dword [r12 + 8], r14d
cmp r14d, 1
je 0x14007a4a5
mov edi, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x140079be1
call fcn.14008a480
mov rax, qword [rbx + 0x58]
mov r12, qword [rax]
movzx eax, byte [rsp + 0x44]
xor al, 1
mov byte [rsp + 0x44], al
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
bts edi, 0x13
mov dword [rsp + 0x48], edi
test r12, r12
je 0x14007a953
mov rbx, qword [0x1405283c8]
test rbx, rbx
je 0x14007a99a
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rbp - 0x70], rbx
mov eax, 1
mov word [rsp + 0x40], ax
lea rcx, [rbx + 0x38]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x160]
call fcn.140078c38
mov r14, qword [rax]
mov qword [rbp + 0x40], r14
mov r13, qword [rax + 8]
mov qword [rbp + 0x48], r13
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
movaps xmm6, xmmword [rbp + 0x40]
movdqa xmmword [rsp + 0x60], xmm6
mov rcx, qword [rbp + 0x168]
test rcx, rcx
jne 0x14007a428
test r14, r14
je 0x14007a7f1
mov r14, qword [rsp + 0x60]
test byte [r14 + 0x184], 4
je 0x14007a3b4
xor r14d, r14d
mov word [rsp + 0x40], r14w
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
bts edi, 0x14
mov dword [rsp + 0x48], edi
test rbx, rbx
jne 0x14007a39f
mov edi, dword [rbp - 0x80]
movdqa xmmword [rsp + 0x70], xmm6
mov rbx, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x4c]
mov rcx, qword [rbp - 0x78]
test rbx, rbx
je 0x14007a346
cmp qword [rbx + 0x60], rcx
ja 0x14007aa10
movzx r9d, byte [rsi + 0xc2]
mov r8b, 5
lea rdx, [rbp + 0x270]
mov rcx, rsi
call fcn.14007c050
nop
mov byte [rbp + 0x2c8], 0
cmp qword [0x140527cb0], 0
je 0x14007a644
call fcn.14007ba5c
movups xmm0, xmmword [0x140527cb0]
movups xmmword [rbp], xmm0
mov dword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayGetDim
movq rdi, xmm0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rbx, [rdi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp - 0x70], rbx
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x198]
mov rcx, rdi
call fcn.140089d70
mov rcx, qword [rax]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x58], rcx
mov qword [rax], r14
mov qword [rax + 8], r14
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp + 0x198]
call fcn.140072130
nop
lea rcx, [rbp - 0x70]
call fcn.140079450
lea rcx, [rsp + 0x60]
call fcn.14007ba80
test al, al
je 0x14007a5c4
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b8]
call fcn.140079240
nop
mov ebx, 0x30
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14007b470
bts ebx, 7
test bl, 0x40
jne 0x14007a5eb
test bl, 0x20
je 0x140079e04
lea rcx, [rbp + 0x1b8]
call fcn.140072130
nop
lea rcx, [rsp + 0x60]
call fcn.140072130
nop
lea rcx, [rbp]
call fcn.140084980
nop
lea rcx, [rbp + 0x60]
call fcn.14007b65c
lea rdx, [rbp + 0x250]
mov rcx, rax
call fcn.14008a1c0
nop
lea r8, [0x1403bcfe0]
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.14007ba90
nop
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140079290
nop
lea rcx, [rbp + 0x230]
call fcn.14007bf60
nop
lea rcx, [rbp + 0x250]
call fcn.14007bf60
nop
lea rcx, [rbp + 0x60]
call fcn.140072130
movzx edx, word [rsp + 0x40]
lea rcx, [rbp + 0x270]
call fcn.14007bcd4
lea rcx, [rbp + 0x270]
call fcn.14007bcc8
mov rbx, rax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x270]
call fcn.140089720
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x7f0]
call fcn.14007b668
nop
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14007b870
nop
lea r8, [rbp + 0x650]
lea rdx, [rbp + 0x1f0]
mov rcx, r15
call fcn.140086860
nop
lea rcx, [rbp + 0x650]
call fcn.14007b4b0
nop
lea rcx, [rbp + 0x7f0]
call fcn.1400803a0
nop
lea rcx, [rbp + 0x1c8]
call fcn.140072130
mov r8b, 1
lea rdx, [rbp + 0x330]
mov rcx, rsi
call fcn.14007c020
nop
lea rcx, [rsp + 0x70]
call fcn.140078dbc
mov r13, rax
lea rdx, [rax + 0x30]
lea rcx, [rbp + 0x330]
call fcn.1400809c8
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x330]
call fcn.14007bfd4
cmp word [rbp + 0x342], 0
jne 0x140079f67
mov eax, 0x300
mov word [rbp + 0x342], ax
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x330]
call fcn.140089720
nop
lea r8, [rbp + 0x330]
mov rdx, rax
lea rcx, [rbp + 0x8c0]
call fcn.140079478
nop
mov rdx, rax
lea rcx, [rbp + 0x720]
call fcn.14007b870
nop
lea r8, [rbp + 0x720]
lea rdx, [rbp - 0x58]
mov rcx, r15
call fcn.140086860
nop
lea rcx, [rbp + 0x720]
call fcn.14007b4b0
nop
lea rcx, [rbp + 0x8c0]
call fcn.1400803a0
nop
lea rcx, [rbp + 0x1d8]
call fcn.140072130
mov dword [rsp + 0x50], 8
lea rdx, [rbp + 0x80]
lea rcx, [rsi + 0x140]
call fcn.14007927c
mov r8, qword [rax]
lea rdx, [rbp + 0x88]
lea rcx, [rsi + 0x140]
call fcn.14007b49c
lea r9, [rsp + 0x50]
mov rdx, qword [rax]
lea rcx, [rbp - 0x18]
call fcn.14007b444
lea rdx, [rbp + 0x90]
lea rcx, [rsi + 0x140]
call fcn.14007927c
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.14007c00c
test al, al
jne 0x14007aa4c
lea rcx, [rsi + 0x140]
call fcn.14007b650
mov rdi, rax
lea rcx, [rsi + 0x140]
call fcn.140079270
mov rbx, rax
cmp rax, rdi
je 0x14007a08f
lea rcx, [rsp + 0x70]
call fcn.140078dbc
mov r14, rax
mov r9, r15
mov r8d, dword [rbx]
mov rdx, r14
mov rcx, rsi
call fcn.14007ab3c
add rbx, 4
cmp rbx, rdi
jne 0x14007a075
mov rcx, r13
call fcn.14007bcb4
test al, al
je 0x14007a0a1
mov r12d, 0x80070490
lea rcx, [rbp + 0x330]
call fcn.140082220
nop
lea rcx, [rbp + 0x270]
call fcn.140082220
nop
lea rcx, [rsp + 0x70]
call fcn.140084d14
mov eax, r12d
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.140156340
mov rbx, qword [rsp + 0xb00]
movaps xmm6, xmmword [rsp + 0xaa0]
add rsp, 0xab0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [0x140527cb0], r14
je 0x14007a74c
mov rax, qword [0x140527cb8]
test rax, rax
je 0x14007a118
lock inc dword [rax + 8]
movups xmm0, xmmword [0x140527cb0]
movups xmmword [rbp + 0xf0], xmm0
mov dword [rsp + 0x48], 2
mov rbx, qword [0x140527cb0]
mov qword [rbp - 0x80], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xc0], xmm0
lea r13, [rbx + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
nop dword [rax + rax]
mov qword [rbp + 0x190], r13
lea r8, [rsi + 0x88]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call fcn.140089d70
mov rbx, qword [rax]
mov qword [rbp + 0x70], rbx
mov rdi, qword [rax + 8]
mov qword [rbp + 0x78], rdi
mov qword [rax], r14
mov qword [rax + 8], r14
movaps xmm6, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0xc0], xmm6
mov r14d, 0xffffffff
mov r12, qword [rbp + 0xd8]
test r12, r12
je 0x14007a1bb
mov eax, r14d
lock xadd dword [r12 + 8], eax
cmp eax, 1
je 0x14007a4f6
test r13, r13
je 0x14007a1d0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
nop
test rbx, rbx
je 0x14007a3e8
test rdi, rdi
jne 0x14007a40d
movdqa xmmword [rbp + 0x10], xmm6
lea rax, [rbp + 0x10]
mov r12d, 6
mov qword [rbp - 0x68], rbx
mov r13, qword [rax + 8]
mov qword [rbp - 0x60], r13
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
or r12d, 0x10
mov dword [rsp + 0x48], r12d
test r12b, 8
jne 0x14007a621
test r12b, 4
je 0x14007a22e
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14007a22e
call fcn.14008a480
nop
test rdi, rdi
je 0x14007a24c
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
je 0x14007a51d
mov rbx, qword [rbp - 0x68]
mov r13, qword [rbp - 0x60]
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x14007a25e
call fcn.14008a480
nop
test rbx, rbx
je 0x14007a3bc
movzx r8d, byte [rsi + 9]
mov edi, dword [rsp + 0x4c]
mov edx, edi
lea rcx, [rbp + 0x3f0]
call fcn.140078dc8
nop
lea rdx, [rbp + 0x210]
mov rcx, rbx
call fcn.14008a1c0
nop
mov rdx, rax
lea rcx, [rbp + 0x408]
call fcn.140078ea0
nop
lea rcx, [rbp + 0x210]
call fcn.14007bf60
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x4b0]
call fcn.140079240
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x4c0]
call fcn.140079060
nop
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x580]
call fcn.14007b870
nop
lea r8, [rbp + 0x580]
lea rdx, [rbp + 0x200]
mov rcx, r15
call fcn.140086860
nop
lea rcx, [rbp + 0x588]
call fcn.140082220
nop
lea rcx, [rbp + 0x4b0]
call fcn.1400803a0
nop
lea rcx, [rbp + 0x3f0]
call fcn.140082220
nop
test r13, r13
je 0x14007a336
lock xadd dword [r13 + 8], r14d
cmp r14d, 1
je 0x14007a4cc
mov eax, edi
jmp 0x14007a0c8
mov rdi, qword [r15 + 8]
jmp 0x14007993b
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
lea rax, vtable.sense::GenericETW::MissingProcessException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1404c8c80]
lea rcx, [rbp - 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
mov rbx, qword [r15 + 8]
jmp 0x140079bb6
lea r8, [rsi + 0x120]
lea rdx, [rbp + 0x130]
mov rcx, qword [rbp - 0x20]
call fcn.14008a2a0
mov edi, 0x1400
mov r13, qword [rax]
jmp 0x140079a81
lock inc dword [rbx + 8]
jmp 0x140079a73
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
jmp 0x140079ccd
xor r14d, r14d
jmp 0x140079cb3
lea rdx, str.targetFieldName_is_null
lea rcx, [rbp - 0x58]
call fcn.14008727c
lea rax, vtable.std::invalid_argument.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1404c8788]
lea rcx, [rbp - 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea r8, [rsi + 0x88]
lea rdx, [rbp + 0xe0]
mov rcx, qword [rbp - 0x80]
call fcn.14008a2a0
mov r12d, 0xa
mov rbx, qword [rax]
jmp 0x14007a1f1
lock inc dword [rdi + 8]
jmp 0x14007a1e2
mov rdi, qword [rdi + 8]
jmp 0x140079922
mov rbx, qword [rbx + 8]
jmp 0x140079b9d
call fcn.14008a480
jmp 0x140079c8e
mov rax, qword [rbx]
movabs r10, 0xa545274f70dcb170
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, rbx
call fcn.140084740
jmp 0x140079957
mov rax, qword [r12]
movabs r10, 0xa545274f70dcb170
mov rcx, r12
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, r12
call fcn.140084740
jmp 0x140079a4c
mov rax, qword [rbx]
movabs r10, 0xa545274f70dcb170
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, rbx
call fcn.140084740
jmp 0x140079ad3
mov rax, qword [r12]
movabs r10, 0xa545274f70dcb170
mov rcx, r12
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, r12
call fcn.140084740
jmp 0x140079bcc
mov rbx, qword [rbp - 0x60]
mov rax, qword [rbx]
movabs r10, 0xa545274f70dcb170
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, rbx
call fcn.140084740
jmp 0x14007a336
mov rax, qword [r12]
movabs r10, 0xa545274f70dcb170
mov rcx, r12
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, r12
call fcn.140084740
jmp 0x14007a1bb
mov rax, qword [rdi]
movabs r10, 0xa545274f70dcb170
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x140084760.0]
mov rcx, rdi
call fcn.140084740
jmp 0x14007a244
test ecx, ecx
je 0x14007a8d1
cmp ecx, 1
jne 0x14007a346
lea r8, [rsi + 0x120]
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.1400aad90
mov rcx, qword [rax]
mov rax, qword [rcx + 0x58]
xor r13b, 1
mov byte [rsp + 0x20], r13b
lea r9, [rsp + 0x40]
mov r8, qword [rax]
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.14006f3e8
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
xor r14d, r14d
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rbp - 0x30], r14
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x28], r14
mov qword [rsp + 0x78], rcx
lea rcx, [rbp - 0x30]
call fcn.140078bc0
lea rcx, [rbp - 0x40]
call fcn.140078bc0
jmp 0x140079ce0
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x1a8]
mov rcx, rdi
call fcn.14008a2a0
mov ebx, 0x50
jmp 0x140079dd9
xor eax, eax
jmp 0x14007a0c8
and ebx, 0xffffffbf
lea rcx, [rbp + 0x1a8]
call fcn.140072130
jmp 0x140079df2
btr edi, 0xc
mov dword [rsp + 0x48], edi
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x140079aa0
call fcn.14008a480
jmp 0x140079aa0
and r12d, 0xfffffff7
mov dword [rsp + 0x48], r12d
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x14007a219
call fcn.14008a480
jmp 0x14007a219
lea rdi, [0x1404ff520]
mov qword [rbp - 0x70], rdi
mov rcx, rdi
call fcn.1400e809c
nop
cmp qword [0x140527cb0], 0
jne 0x14007a693
mov ecx, 0x48
call fcn.1401568fc
mov rbx, rax
mov qword [rbp - 8], rax
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rbx
call fcn.1400e8188
nop
mov rdx, rax
call fcn.1400e80cc
nop
mov rcx, rdi
call qword [sym.imp.msvcp_win.dll__Mtx_unlock]
nop dword [rax + rax]
jmp 0x140079d27
mov qword [rbp + 0x1e8], rax
mov rcx, rax
call fcn.1400e809c
nop
cmp qword [0x140527cb0], 0
jne 0x14007a734
mov ecx, 0x48
call fcn.1401568fc
mov rbx, rax
mov qword [rbp - 0x20], rax
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rbx
call fcn.1400e8188
nop
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400e8120
mov rdx, qword [rax]
mov rcx, qword [0x140527cb0]
mov qword [rax], rcx
mov qword [0x140527cb0], rdx
mov rdx, qword [rax + 8]
mov rcx, qword [0x140527cb8]
mov qword [rax + 8], rcx
mov qword [0x140527cb8], rdx
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x14007a734
call fcn.14008a480
nop
lea rcx, [0x1404ff520]
call qword [sym.imp.msvcp_win.dll__Mtx_unlock]
nop dword [rax + rax]
jmp 0x1400799a0
lea rdi, [0x1404ff520]
mov qword [rbp - 0x10], rdi
mov rcx, rdi
call fcn.1400e809c
nop
cmp qword [0x140527cb0], 0
jne 0x14007a7dd
mov ecx, 0x48
call fcn.1401568fc
mov rbx, rax
mov qword [rbp - 0x18], rax
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov rcx, rbx
call fcn.1400e8188
nop
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400e8120
mov rdx, qword [rax]
mov rcx, qword [0x140527cb0]
mov qword [rax], rcx
mov qword [0x140527cb0], rdx
mov rdx, qword [rax + 8]
mov rcx, qword [0x140527cb8]
mov qword [rax + 8], rcx
mov qword [0x140527cb8], rdx
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x14007a7dd
call fcn.14008a480
nop
mov rcx, rdi
call qword [sym.imp.msvcp_win.dll__Mtx_unlock]
nop dword [rax + rax]
jmp 0x14007a108
mov eax, 4
mov word [rsp + 0x40], ax
lea rcx, [rbx + 0x288]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x170]
call fcn.140078c38
mov r14, qword [rax]
mov rcx, qword [rax + 8]
xor edx, edx
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov qword [rbp - 0x40], rdx
mov qword [rsp + 0x60], r14
mov qword [rbp - 0x38], r13
mov qword [rsp + 0x68], rcx
lea rcx, [rbp - 0x40]
call fcn.140078bc0
lea rcx, [rbp + 0x170]
call fcn.140078bc0
test r14, r14
jne 0x14007aa05
test rbx, rbx
je 0x14007a868
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x28], al
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov edi, dword [rbp - 0x80]
mov r9d, edi
mov r8, r12
lea rdx, [rbp + 0x180]
mov rcx, rbx
call fcn.140130010
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14006f798
lea rcx, [rbp + 0x180]
call fcn.140078bc0
movaps xmm6, xmmword [rsp + 0x60]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call fcn.140078bc0
jmp 0x140079cd0
xor r13b, 1
mov byte [rsp + 0x20], r13b
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, edi
lea rcx, [rbp - 0x40]
call fcn.14006f3e8
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14006f798
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14007a908
call fcn.14008a480
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x14007a346
mov rax, qword [rbx + 0x68]
mov rcx, qword [rbp - 0x78]
test rax, rax
je 0x14007a94b
cmp rax, rcx
jae 0x14007a94b
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
lea rax, vtable.sense::GenericETW::MissingProcessException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1404c8c80]
lea rcx, [rbp - 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
xor r14d, r14d
jmp 0x140079ce4
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edi, dword [rbp - 0x80]
mov edx, edi
lea rcx, [rbp + 0x150]
call fcn.14006f3e8
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.14006f798
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x14007a98d
call fcn.14008a480
movdqa xmm6, xmmword [rbp - 0x30]
xor r14d, r14d
jmp 0x140079cd0
lea rbx, [0x140525670]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
mov qword [rsp + 0x50], rbx
cmp qword [0x1405283c8], 0
jne 0x14007a9ef
mov ecx, 0x4f0
call fcn.1401568fc
mov qword [rbp - 8], rax
mov rcx, rax
call fcn.140313358
nop
mov rdx, qword [0x1405283c8]
mov qword [0x1405283c8], rax
test rdx, rdx
je 0x14007a9ef
call fcn.140313894
nop
lea rcx, [rsp + 0x50]
call fcn.14010baf0
mov rbx, qword [0x1405283c8]
jmp 0x140079c1c
movdqa xmm6, xmmword [rsp + 0x60]
jmp 0x140079c9c
mov ebx, dword [rbx + 0x184]
lea rcx, [rbp]
call fcn.1401295b0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14006f798
lea rcx, [rbp]
call fcn.140078bc0
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x58], edi
bts ebx, 0xc
mov dword [rax + 0x184], ebx
jmp 0x140079cf7
mov rcx, r13
call fcn.14007bcb4
test al, al
jne 0x14007a045
mov eax, dword [r13 + 0xac]
cmp eax, 0xffffffff
je 0x14007a045
cmp eax, 0x3000
jb 0x14007a045
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x4c]
mov rdx, qword [r13 + 0x60]
mov ecx, dword [r13 + 0x58]
call fcn.14016da98
test al, al
je 0x14007aab9
mov eax, dword [rsp + 0x4c]
cmp dword [r13 + 0x98], eax
je 0x14007a045
mov dword [r13 + 0xe8], eax
mov rax, qword [rbp - 0x10]
mov qword [r13 + 0xf0], rax
jmp 0x14007a045
call fcn.1400abad4
mov r10, rax
cmp dword [rax], 5
jbe 0x14007a045
xor edx, edx
mov rcx, rax
call fcn.140004c20
test al, al
je 0x14007a045
lea rdx, [r13 + 0x60]
lea rcx, [rbp + 0x98]
call fcn.1400048cc
mov r9, rax
lea rdx, [r13 + 0x58]
lea rcx, [rbp - 0x78]
call fcn.1400048bc
mov r8, rax
lea rdx, str.QueryProcessData::TryCreate_wasnt_able_to_query_the_process_data
lea rcx, [rbp + 0xa0]
call fcn.140003db4
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
lea rdx, [0x140461278]
mov rcx, r10
call fcn.140006cc4
jmp 0x14007a045