Function at 0x14002c200
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
lea rcx, str.Loading_needed_NT_functions
call fcn.14002d320
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [0x140054618], rax
mov qword [rbp + 0x67], rax
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ebx, 8
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c293
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c293
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
xor r15d, r15d
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtdll.dll___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0xf
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtOpenProcess
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054620], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c344
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c344
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtOpenProcess___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x13
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtQueryVirtualMemory
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054570], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c3f2
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c3f2
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtQueryVirtualMemory___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1a
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtProtectVirtualMemory
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054578], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c4a0
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c4a0
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtProtectVirtualMemory___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1c
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054588], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c54e
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c54e
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtAllocateVirtualMemory___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1d
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtFreeVirtualMemory
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054580], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c5fc
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c5fc
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtFreeVirtualMemory___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x19
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtMapViewOfSection
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054598], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c6aa
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c6aa
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtMapViewOfSection___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x18
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtUnmapViewOfSection
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054590], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c758
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c758
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtUnmapViewOfSection___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1a
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtCreateSection
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545a0], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c806
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c806
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtCreateSection___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x15
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtSetInformationProcess
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545e8], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c8b4
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c8b4
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtSetInformationProcess___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1d
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtOpenSection
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054628], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002c962
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002c962
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtOpenSection___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x13
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtOpenFile
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054630], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002ca10
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002ca10
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtOpenFile___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x10
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtCreateThreadEx
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054638], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002cabe
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002cabe
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtCreateThreadEx___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x16
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545e0], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002cb6c
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002cb6c
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtQueryInformationProcess___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1f
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.RtlDosApplyFileIsolationRedirection_Ustr
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545d8], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002cc1a
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002cc1a
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tRtlDosApplyFileIsolationRedirection_Ustr___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x2e
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545d0], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002ccc8
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002ccc8
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tRtlInitUnicodeString___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1a
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.RtlFreeUnicodeString
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545c8], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002cd76
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002cd76
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tRtlFreeUnicodeString___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x1a
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtSuspendProcess
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054640], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002ce24
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002ce24
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtSuspendProcess___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x16
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtResumeProcess
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140054648], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002ced2
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002ced2
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtResumeProcess___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x15
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtQueryObject
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545c0], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002cf80
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002cf80
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtQueryObject___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x13
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtQueryInformationWorkerFactory
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545b8], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002d02e
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002d02e
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtQueryInformationWorkerFactory___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x25
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, [0x1400451a0]
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545b0], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002d0dc
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002d0dc
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtWorkerFactoryWorkerReady___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x20
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
lea rdx, str.NtSetInformationWorkerFactory
mov rcx, qword [0x140054618]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400545a8], rax
mov qword [rbp + 0x67], rax
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002d18a
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002d18a
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov qword [rbp - 0x61], r15
mov qword [rbp - 0x69], r15
mov qword [rbp - 0x59], r15
lea rax, str._tNtSetInformationWorkerFactory___
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], 0x23
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp - 0x39], xmm0
movsd xmm1, qword [rbp - 0x59]
movsd qword [rbp - 0x29], xmm1
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x49]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140054548]
call fcn.140029960
mov eax, dword [rbx + rdi]
cmp dword [0x140054360], eax
jle 0x14002d219
lea rcx, [0x140054360]
call fcn.14003a1f0
cmp dword [0x140054360], 0xffffffff
jne 0x14002d219
call fcn.14001d9c0
lea rcx, [0x14003e140]
call fcn.14003a4a0
nop
lea rcx, [0x140054360]
call fcn.14003a184
mov rbx, qword [0x140054548]
lea rax, str.Local_NT_functions_loaded
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], 0x19
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x29], r15
mov eax, dword [rbx + 0x40]
cmp eax, 2
setle r14b
movzx esi, byte [rbx + 0xd8]
jle 0x14002d25b
test sil, sil
je 0x14002d2f6
lea rcx, [rbx + 8]
cmp qword [rbx + 0x20], 0x10
jb 0x14002d26a
mov rcx, qword [rbx + 8]
mov qword [rbp - 0x49], rcx
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x41], rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
movups xmm0, xmmword [rbp - 0x49]
movaps xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 2
mov qword [rbp - 1], rax
mov ecx, 0x18
mov eax, dword [rcx + rdi]
mov edx, 0x10
test al, 1
jne 0x14002d2b6
or eax, 1
mov dword [rcx + rdi], eax
add rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rdi], rax
jmp 0x14002d2b9
add rdi, rdx
mov rax, qword [rdi]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], r15
movups xmm0, xmmword [rbp - 0x39]
movups xmmword [rbp + 0x1f], xmm0
movsd xmm1, qword [rbp - 0x29]
movsd qword [rbp + 0x2f], xmm1
movups xmm0, xmmword [rbp - 0x69]
movaps xmmword [rbp + 0x37], xmm0
movzx r9d, sil
movzx r8d, r14b
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.1400017b0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret