Function at 0x140003150
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14d, ecx
call fcn.1400070e0
mov rdi, qword [0x14001e6d8]
mov rsi, rax
test rdi, rdi
jne 0x140003196
mov rcx, qword [rax + 0x30]
lea edx, [rdi + 1]
call fcn.140004100
mov rdi, rax
mov qword [0x14001e6d8], rax
mov rbx, qword [0x14001e6c8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x60], r15
test rbx, rbx
jne 0x1400031f1
mov rcx, qword [rsi + 0x50]
call fcn.140002920
test rax, rax
je 0x14000343d
xor edx, edx
mov rcx, rax
call fcn.140004100
mov rdx, qword [rdi + 0x10]
mov rcx, rax
mov rbx, rax
mov qword [0x14001e6c8], rax
call fcn.140003ee0
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
call fcn.140004240
xor r13d, r13d
test eax, eax
jne 0x14000320c
mov ebp, r13d
jmp 0x140003219
mov edx, eax
mov rcx, rbx
call fcn.140003e50
mov rbp, rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
call fcn.140004240
test eax, eax
jne 0x140003231
mov rbx, r13
jmp 0x14000323e
mov edx, eax
mov rcx, rdi
call fcn.140003e50
mov rbx, rax
mov rdx, rbp
mov rsi, r13
sub rdx, rbx
mov r15, rbx
nop word [rax + rax]
movzx ecx, byte [rdx + r15]
cmp byte [r15], cl
jne 0x14000326e
inc rsi
inc r15
cmp rsi, 0x18
jb 0x140003250
mov rax, rbx
jmp 0x140003409
mov rdx, rbx
lea rcx, [rsi + rbp]
sub rdx, rbp
mov r8, rsi
nop dword [rax + rax]
cmp rsi, 0x18
jae 0x140003295
movzx eax, byte [rcx + 1]
inc rcx
inc rsi
cmp byte [rdx + rcx], al
jne 0x140003280
sub rsi, r8
jne 0x1400032a2
mov rax, rbx
jmp 0x140003409
cmp r14d, 3
jne 0x14000339f
xorps xmm0, xmm0
lea r12, [r15 + rsi]
sub r15, rbx
lea r8d, [r14 + 0x2d]
lea rdx, [rsp + 0x20]
xor ecx, ecx
add r15, rbp
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000343d
cmp dword [rsp + 0x40], 0x1000
jne 0x140003375
mov ecx, dword [rsp + 0x44]
lea eax, [rcx - 0x10]
test eax, 0xffffffcf
jne 0x140003375
cmp ecx, 0x30
je 0x140003375
mov rbp, qword [rsp + 0x38]
mov r14, qword [rsp + 0x20]
test rbp, rbp
je 0x14000337a
mov rdi, rbp
test r14, r14
je 0x140003375
test rbp, rbp
je 0x140003375
test r15, r15
je 0x140003375
mov rbx, r14
cmp rbp, rsi
jb 0x140003375
nop dword [rax]
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000334f
inc rbx
dec rdi
cmp rdi, rsi
jae 0x140003330
jmp 0x140003375
test rbx, rbx
je 0x140003375
lea rcx, [rbx + rsi]
call fcn.140003460
cmp rax, r12
je 0x14000329a
sub r14, rbx
dec r14
add rbp, r14
lea r14, [rbx + 1]
jne 0x140003312
mov rbp, qword [rsp + 0x38]
add r13, rbp
lea rdx, [rsp + 0x20]
mov rcx, r13
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000343d
jmp 0x1400032e2
cmp r14d, 2
jne 0x140003407
lea r9d, [r14 + 2]
mov r8d, 0x3000
lea rdx, [rsi + 0xe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140003448
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x25ff
lea r9, [rsp + 0x50]
mov word [rdi + rsi], ax
lea r8d, [r14 + 0x1e]
lea rax, [rsi + rbx]
mov dword [rdi + rsi + 2], r13d
lea rdx, [rsi + 0xe]
mov qword [rdi + rsi + 6], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rdi
jmp 0x140003409
xor eax, eax
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008f20
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3