Function at 0x180003ba0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5b8
mov qword [rsp + 0x88], rcx
mov rax, qword [0x1800090c0]
xor rax, rsp
mov qword [rsp + 0x5b0], rax
movabs rcx, 0xb4f112ceac53d57e
movabs rsi, 0xb4821292ac20d509
movabs rdx, 0xaf722fa2b9c74b8e
movabs r9, 0xaf2e2f90b9f44be3
movabs r8, 0x5dfd02b17fc0b568
movabs r15, 0x5b4d7f9089eaa10c
movabs r12, 0x5b3a7fcc89d0a14f
movabs r13, 0x3057f3ed72f74c84
movabs r11, 0x3038f38972994ced
movabs rbp, 0x5d3952b5589b9b6
movabs r10, 0x5b6955f55fab9cf
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0x500], r15
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], r11
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rcx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], r10
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x520], rdx
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], r8
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0xf0], r12
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], r13
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xd0], rsi
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rbp
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xb0], r9
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], r8
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x500], r15
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], r11
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rcx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], r10
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x520], rdx
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], r8
mov rax, qword [rsp + 0x528]
movaps xmm0, xmmword [rsp + 0x500]
movaps xmm1, xmmword [rsp + 0x510]
movaps xmm2, xmmword [rsp + 0x520]
xorps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x500], xmm0
xorps xmm1, xmmword [rsp + 0xd0]
xorps xmm2, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x520], xmm2
movabs rbx, 0x300bf3dd72964cf0
movabs r14, 0x5d3955f55e5b9c3
lea rdi, [rsp + 0xf0]
lea rdx, [rsp + 0x500]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movabs rax, 0x5b4c7fa289b9a138
mov qword [rsp + 0x500], rax
mov rcx, qword [rsp + 0x500]
movabs rcx, 0x3032f3c372854ce1
mov qword [rsp + 0x508], rcx
mov rdx, qword [rsp + 0x508]
lea rdx, [rsi + 0x250068]
mov qword [rsp + 0x510], rdx
mov r8, qword [rsp + 0x510]
mov qword [rsp + 0x518], rbp
mov r8, qword [rsp + 0x518]
mov qword [rsp + 0xd0], r12
mov r8, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], r13
mov r8, qword [rsp + 0xd8]
mov qword [rsp + 0xb0], rsi
mov r8, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rbp
mov r8, qword [rsp + 0xb8]
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], rcx
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rdx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], rbp
mov rax, qword [rsp + 0x518]
movaps xmm0, xmmword [rsp + 0x500]
movaps xmm1, xmmword [rsp + 0x510]
xorps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x500], xmm0
xorps xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x510], xmm1
lea rdx, [rsp + 0x500]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movabs rdx, 0x5b697fa289b9a118
mov qword [rsp + 0x500], rdx
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], rbx
mov rax, qword [rsp + 0x508]
movabs rcx, 0xb4e312f4ac45d54d
mov qword [rsp + 0x510], rcx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], r14
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0xd0], r12
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], r13
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xb0], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rbp
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x500], rdx
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], rbx
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rcx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], r14
mov rax, qword [rsp + 0x518]
movaps xmm0, xmmword [rsp + 0x500]
movaps xmm1, xmmword [rsp + 0x510]
xorps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x500], xmm0
xorps xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x510], xmm1
mov qword [rsp + 0xd0], r15
mov rax, qword [rsp + 0xd0]
movabs rdx, 0x3038f38972994ced
mov qword [rsp + 0xd8], rdx
mov rax, qword [rsp + 0xd8]
movabs rcx, 0xb48212ceac53d57e
mov qword [rsp + 0xe0], rcx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rbp
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xb0], r12
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], r13
mov r13, rsi
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x90], rsi
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x98], rbp
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xd0], r15
mov r15, rdx
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], rdx
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rcx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rbp
mov rax, qword [rsp + 0xe8]
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0xe0]
xorps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xd0], xmm0
xorps xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xe0], xmm1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0xffffffff
mov qword [rsp + 0x30], 0
mov rcx, rdi
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x401
call fcn.180003440
mov ebx, 0xc0000001
test al, al
je 0x1800048e9
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xa8]
mov edx, 0x1e
mov r9d, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, eax
test eax, eax
js 0x1800048b5
mov dword [rsp + 0x6c], esi
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntdll.dll_NtRemoveProcessDebug]
mov rcx, qword [rsp + 0x90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x98]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x90]
call rsi
movabs rsi, 0x5b4d7f9089eaa10c
mov qword [rsp + 0x500], rsi
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], r15
mov rax, qword [rsp + 0x508]
movabs rcx, 0xb4f112ceac53d57e
mov qword [rsp + 0x510], rcx
mov rax, qword [rsp + 0x510]
movabs r9, 0x5b6955f55fab9cf
mov qword [rsp + 0x518], r9
mov rax, qword [rsp + 0x518]
movabs rdx, 0xaf722fa2b9c74b8e
mov qword [rsp + 0x520], rdx
mov rax, qword [rsp + 0x520]
movabs r8, 0x5dfd02b17fc0b568
mov qword [rsp + 0x528], r8
mov rax, qword [rsp + 0x528]
movabs r12, 0x5b3a7fcc89d0a14f
mov qword [rsp + 0xd0], r12
mov rax, qword [rsp + 0xd0]
movabs r14, 0x3057f3ed72f74c84
mov qword [rsp + 0xd8], r14
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xb0], r13
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rbp
mov rax, qword [rsp + 0xb8]
movabs rax, 0xaf2e2f90b9f44be3
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], r8
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x500], rsi
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], r15
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rcx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], r9
mov rax, qword [rsp + 0x518]
mov qword [rsp + 0x520], rdx
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x528], r8
mov rax, qword [rsp + 0x528]
movaps xmm0, xmmword [rsp + 0x500]
movaps xmm1, xmmword [rsp + 0x510]
xorps xmm0, xmmword [rsp + 0xd0]
movaps xmm2, xmmword [rsp + 0x520]
movaps xmmword [rsp + 0x500], xmm0
xorps xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x510], xmm1
xorps xmm2, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x520], xmm2
lea rdi, [rsp + 0xf0]
lea rdx, [rsp + 0x500]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movabs rax, 0x5b517fbf89b1a13b
mov qword [rsp + 0x500], rax
mov rcx, qword [rsp + 0x500]
movabs rcx, 0x3079f39f72904ce9
mov qword [rsp + 0x508], rcx
mov rdx, qword [rsp + 0x508]
movabs rdx, 0xb48212f7ac58d56c
mov qword [rsp + 0x510], rdx
mov r8, qword [rsp + 0x510]
mov qword [rsp + 0x518], rbp
mov r8, qword [rsp + 0x518]
mov qword [rsp + 0xd0], r12
mov r8, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], r14
mov r8, qword [rsp + 0xd8]
mov qword [rsp + 0xb0], r13
mov r8, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rbp
mov r8, qword [rsp + 0xb8]
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x508], rcx
mov rax, qword [rsp + 0x508]
mov qword [rsp + 0x510], rdx
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x518], rbp
mov rax, qword [rsp + 0x518]
movaps xmm0, xmmword [rsp + 0x500]
movaps xmm1, xmmword [rsp + 0x510]
xorps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x500], xmm0
xorps xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x510], xmm1
lea rdx, [rsp + 0x500]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], 0
movaps xmmword [rsp + 0x5a0], xmm0
movaps xmmword [rsp + 0x590], xmm0
movaps xmmword [rsp + 0x580], xmm0
movaps xmmword [rsp + 0x570], xmm0
movaps xmmword [rsp + 0x560], xmm0
movaps xmmword [rsp + 0x550], xmm0
movaps xmmword [rsp + 0x540], xmm0
movaps xmmword [rsp + 0x530], xmm0
movaps xmmword [rsp + 0x520], xmm0
movaps xmmword [rsp + 0x510], xmm0
movaps xmmword [rsp + 0x500], xmm0
movabs rdx, 0x5b697fa289b9a118
mov qword [rsp + 0xd0], rdx
mov rax, qword [rsp + 0xd0]
movabs r9, 0x300bf3dd72964cf0
mov qword [rsp + 0xd8], r9
mov rax, qword [rsp + 0xd8]
movabs rcx, 0xb4e312f4ac45d54d
mov qword [rsp + 0xe0], rcx
mov rax, qword [rsp + 0xe0]
movabs r8, 0x5d3955f55e5b9c3
mov qword [rsp + 0xe8], r8
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xb0], r12
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], r14
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], r13
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbp
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xd0], rdx
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xd8], r9
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rcx
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], r8
mov rax, qword [rsp + 0xe8]
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0xe0]
xorps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xd0], xmm0
xorps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xe0], xmm1
mov qword [rsp + 0xb0], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], r15
mov rax, qword [rsp + 0xb8]
movabs rcx, 0xb48212ceac53d57e
mov qword [rsp + 0xc0], rcx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rbp
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x50], r12
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], r14
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], r13
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rbp
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xb0], rsi
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], r15
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc0], rcx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rbp
mov rax, qword [rsp + 0xc8]
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
xorps xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0xb0], xmm0
xorps xmm1, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0xc0], xmm1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0xffffffff
mov qword [rsp + 0x30], 0
mov rcx, rdi
mov rdx, rdi
mov r8d, 1
mov r9d, 0x401
call fcn.180003440
test al, al
je 0x1800048e9
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_DbgUiSetThreadDebugObject]
lea rcx, [rsp + 0x500]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
test eax, eax
je 0x1800048e5
mov rsi, qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
lea r14, [rsp + 0x500]
mov rdi, qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
jmp 0x1800047e8
mov ecx, dword [rsp + 0x504]
mov edx, dword [rsp + 0x508]
mov r8d, 0x10002
call rsi
mov rcx, r14
mov edx, 0xffffffff
call rdi
test eax, eax
je 0x1800048e5
cmp dword [rsp + 0x500], 3
jne 0x1800047c0
mov rbx, qword [rsp + 0x518]
test rbx, rbx
je 0x1800047c0
mov qword [rsp + 0xd0], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1fffff
lea r9, [rsp + 0xd0]
mov rcx, rbx
mov rdx, 0xffffffffffffffff
mov r8, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtDuplicateObject]
mov esi, eax
test eax, eax
js 0x18000486b
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0x88]
call fcn.180003950
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ntdll.dll_NtClose]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_DbgUiSetThreadDebugObject]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntdll.dll_NtClose]
mov qword [rsp + 0xa8], 0
mov rcx, rbx
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x98]
call rdi
mov rcx, qword [rsp + 0x90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1800048d3
mov rcx, qword [rsp + 0x90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
jmp 0x1800048e9
mov ebx, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1800048fc
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x5b0]
xor rcx, rsp
call fcn.1800049b0
mov eax, ebx
add rsp, 0x5b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret