Function at 0x14001173a
Capabilities:
Resume thread

Disassembly:
jmp 0x1400234d0
push rbp
push rsi
push rdi
mov eax, 0x1510
call fcn.1400111b8
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3b8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140038040]
xor rax, rbp
mov qword [rbp + 0x14d8], rax
lea rcx, [0x14003f101]
call fcn.140011a73
nop
mov edx, 8
lea rcx, [rbp + 0x28]
call fcn.14001179e
lea rcx, [rbp + 0x28]
call fcn.140011636
nop
mov edx, 8
lea rcx, [rbp + 0x48]
call fcn.14001179e
lea rcx, [rbp + 0x48]
call fcn.140011636
nop
lea rax, [rbp + 0xa48]
mov qword [rbp + 0xa88], rax
lea rax, [rbp + 0xaa4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14b8], rax
lea rcx, [rbp + 0x28]
call fcn.140011348
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0xa88]
lea rcx, [rbp + 0xaa4]
call fcn.14001b9f0
mov qword [rbp + 0x14c8], rax
mov r8, qword [rbp + 0x14b8]
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [rbp + 0x14c8]
call fcn.140011640
mov dword [rbp + 0x14d0], eax
mov eax, dword [rbp + 0x14d0]
mov dword [rbp + 4], eax
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
cmp qword [rax], 0xffffffffffffffff
jne 0x14002365f
lea rax, [rbp + 0xb34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xb58]
lea rcx, [rbp + 0xb34]
call fcn.14001c8b0
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x14c0]
lea rcx, [rbp + 0xad0]
call fcn.140011050
nop
lea rdx, [0x140037570]
lea rcx, [rbp + 0xad0]
call fcn.140011b4a
nop
lea rcx, [rbp + 0xb58]
call fcn.140011933
nop
lea rax, [rbp + 0xb94]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xbb8]
lea rcx, [rbp + 0xb94]
call fcn.14001d0e0
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011609
mov qword [rbp + 0x14c8], rax
lea rdx, [0x140011532]
mov rcx, qword [rbp + 0x14c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xbb8]
call fcn.140011933
nop
mov ecx, dword [rbp + 4]
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x14002375c
lea rax, [rbp + 0xc64]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xc88]
lea rcx, [rbp + 0xc64]
call fcn.14001d6e0
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x14c0]
lea rcx, [rbp + 0xc00]
call fcn.140011050
nop
lea rdx, [0x140037570]
lea rcx, [rbp + 0xc00]
call fcn.140011b4a
nop
lea rcx, [rbp + 0xc88]
call fcn.140011933
nop
lea rax, [rbp + 0xcc4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xce8]
lea rcx, [rbp + 0xcc4]
call fcn.14001d980
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011609
mov qword [rbp + 0x14c8], rax
mov edx, dword [rbp + 4]
mov rcx, qword [rbp + 0x14c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0x14d0], rax
lea rdx, [0x140011532]
mov rcx, qword [rbp + 0x14d0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xce8]
call fcn.140011933
nop
lea rcx, [rbp + 0x28]
call fcn.140011348
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140023888
lea rax, [rbp + 0xd94]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xdb8]
lea rcx, [rbp + 0xd94]
call fcn.14001dc40
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x14c0]
lea rcx, [rbp + 0xd30]
call fcn.140011050
nop
lea rdx, [0x140037570]
lea rcx, [rbp + 0xd30]
call fcn.140011b4a
nop
lea rcx, [rbp + 0xdb8]
call fcn.140011933
nop
mov qword [rbp + 0x68], 0
mov dword [rbp + 0x154], 1
cmp dword [rbp + 0x154], 0
je 0x140023f49
mov edx, 0xffffffff
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
nop
mov eax, dword [rbp + 0x90]
mov dword [rbp + 0x14b4], eax
cmp dword [rbp + 0x14b4], 6
je 0x1400238d4
jmp 0x140023f2b
xor r9d, r9d
mov r8d, 0x104
lea rdx, [rbp + 0x180]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
je 0x140023f1d
lea rax, [rbp + 0xe14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xe38]
lea rcx, [rbp + 0xe14]
call fcn.14001dea0
mov qword [rbp + 0x14b8], rax
lea rdx, [rbp + 0x180]
mov rcx, qword [rbp + 0x14b8]
call fcn.140011109
test eax, eax
jne 0x140023949
mov dword [rbp + 0x14c0], 1
jmp 0x140023953
mov dword [rbp + 0x14c0], 0
movzx eax, byte [rbp + 0x14c0]
mov byte [rbp + 0xdf4], al
lea rcx, [rbp + 0xe38]
call fcn.140011933
movzx eax, byte [rbp + 0xdf4]
test eax, eax
je 0x140023f1d
lea rax, [rbp + 0xe74]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xe98]
lea rcx, [rbp + 0xe74]
call fcn.14001e150
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011609
mov qword [rbp + 0x14c8], rax
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0x14c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov qword [rbp + 0x14d0], rax
lea rdx, [0x140011532]
mov rcx, qword [rbp + 0x14d0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xe98]
call fcn.140011933
nop
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14b8], rax
mov rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x14b8]
mov rcx, qword [rax]
call fcn.1400113bb
mov dword [rbp + 0x14c0], eax
mov eax, dword [rbp + 0x14c0]
mov qword [rbp + 0x3a8], rax
lea rax, [rbp + 0xed4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xef8]
lea rcx, [rbp + 0xed4]
call fcn.14001e380
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011609
mov qword [rbp + 0x14c8], rax
mov rdx, qword [rbp + 0x3a8]
mov rcx, qword [rbp + 0x14c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov qword [rbp + 0x14d0], rax
lea rdx, [0x140011532]
mov rcx, qword [rbp + 0x14d0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xef8]
call fcn.140011933
nop
lea rax, [rbp + 0xf34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0xf58]
lea rcx, [rbp + 0xf34]
call fcn.14001a940
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14c8], rax
mov r8, qword [rbp + 0x14c0]
mov rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x14c8]
mov rcx, qword [rax]
call fcn.14001114f
mov qword [rbp + 0x14d0], rax
mov rax, qword [rbp + 0x14d0]
mov qword [rbp + 0x3c8], rax
lea rcx, [rbp + 0xf58]
call fcn.1400111bd
nop
mov edx, 0x20
lea rcx, [rbp + 0x3e8]
call fcn.1400110a0
mov byte [rbp + 0x14a4], 0x48
mov byte [rbp + 0x14a5], 0x31
mov byte [rbp + 0x14a6], 0xc0
lea rax, [rbp + 0x14a7]
mov r8, rax
lea rdx, [rbp + 0x14a4]
lea rcx, [rbp + 0xfb8]
call fcn.140011479
lea rcx, [rbp + 0x1430]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0xf94]
call fcn.1400114f6
mov r8, rax
lea rdx, [rbp + 0x1430]
lea rcx, [rbp + 0x3e8]
call fcn.140011852
mov qword [rbp + 0x14b8], rax
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14b8], rax
lea rcx, [rbp + 0x3e8]
call fcn.140011460
mov qword [rbp + 0x14c0], rax
lea rcx, [rbp + 0x3e8]
call fcn.140011b40
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x14c0]
mov r9, rcx
mov r8, rax
mov rdx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x14b8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140023cc0
lea rax, [rbp + 0x1054]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1078]
lea rcx, [rbp + 0x1054]
call fcn.14001aab0
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x14c0]
lea rcx, [rbp + 0xff0]
call fcn.140011050
nop
lea rdx, [0x140037570]
lea rcx, [rbp + 0xff0]
call fcn.140011b4a
nop
lea rcx, [rbp + 0x1078]
call fcn.140011933
nop
lea rax, [rbp + 0x10b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x10d8]
lea rcx, [rbp + 0x10b4]
call fcn.14001ad80
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14c8], rax
mov r8, qword [rbp + 0x14c0]
mov rdx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x14c8]
mov rcx, qword [rax]
call fcn.14001114f
mov qword [rbp + 0x14d0], rax
mov rax, qword [rbp + 0x14d0]
mov qword [rbp + 0x3c8], rax
lea rcx, [rbp + 0x10d8]
call fcn.1400111bd
nop
mov byte [rbp + 0x1484], 0xb8
mov byte [rbp + 0x1485], 0x57
mov byte [rbp + 0x1486], 0
mov byte [rbp + 0x1487], 7
mov byte [rbp + 0x1488], 0x80
mov byte [rbp + 0x1489], 0xc3
lea rax, [rbp + 0x148a]
mov r8, rax
lea rdx, [rbp + 0x1484]
lea rcx, [rbp + 0x1118]
call fcn.140011479
lea rcx, [rbp + 0x1460]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x1460]
lea rcx, [rbp + 0x3e8]
call fcn.14001146a
nop
lea rcx, [rbp + 0x48]
call fcn.140011348
mov qword [rbp + 0x14b8], rax
lea rcx, [rbp + 0x3e8]
call fcn.140011460
mov qword [rbp + 0x14c0], rax
lea rcx, [rbp + 0x3e8]
call fcn.140011b40
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x14c0]
mov r9, rcx
mov r8, rax
mov rdx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x14b8]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140023e8f
lea rax, [rbp + 0x11b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x11d8]
lea rcx, [rbp + 0x11b4]
call fcn.14001af00
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x14c0]
lea rcx, [rbp + 0x1150]
call fcn.140011050
nop
lea rdx, [0x140037570]
lea rcx, [rbp + 0x1150]
call fcn.140011b4a
nop
lea rcx, [rbp + 0x11d8]
call fcn.140011933
nop
lea rax, [rbp + 0x1214]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1238]
lea rcx, [rbp + 0x1214]
call fcn.14001b1b0
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011609
mov qword [rbp + 0x14c8], rax
lea rdx, [0x140011532]
mov rcx, qword [rbp + 0x14c8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x1238]
call fcn.140011933
nop
mov dword [rbp + 0x154], 0
lea rcx, [rbp + 0x3e8]
call fcn.1400112f8
nop
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8d, 0x10002
mov edx, dword [rbp + 0x98]
mov ecx, dword [rbp + 0x94]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
nop
jmp 0x14002389a
mov ecx, dword [rbp + 4]
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
test eax, eax
jne 0x140023fcf
lea rax, [rbp + 0x12e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1308]
lea rcx, [rbp + 0x12e4]
call fcn.14001b3d0
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, qword [rbp + 0x14c0]
lea rcx, [rbp + 0x1280]
call fcn.140011050
nop
lea rdx, [0x140037570]
lea rcx, [rbp + 0x1280]
call fcn.140011b4a
nop
lea rcx, [rbp + 0x1308]
call fcn.140011933
nop
jmp 0x140023fef
lea rax, [rbp + 0x13a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x13c8]
lea rcx, [rbp + 0x13a4]
call fcn.14001b680
mov qword [rbp + 0x14b8], rax
mov rax, qword [rbp + 0x14b8]
mov qword [rbp + 0x14c0], rax
mov rdx, qword [rbp + 0x14c0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011609
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140011532]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x13c8]
call fcn.140011933
nop
mov dword [rbp + 0x1404], 0
lea rcx, [rbp + 0x48]
call fcn.140011ab9
nop
lea rcx, [rbp + 0x28]
call fcn.140011ab9
mov eax, dword [rbp + 0x1404]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140030160]
call fcn.1400118e8
mov rax, rdi
mov rcx, qword [rbp + 0x14d8]
xor rcx, rbp
call fcn.140011523
lea rsp, [rbp + 0x14e0]
pop rdi
pop rsi
pop rbp
ret