Function at 0x1402e8547
Capabilities:
Terminate process

Disassembly:
enter pe_nt_image_headers64, 0
sub rsp, 0x1d0
lea r13, [rbp - 0x1cc]
mov dword [rbp - 0x1cc], 0x130
mov qword [rbp - 0x8c], 0
mov rcx, 0x40
mov rdx, 0x7ffc
call qword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov qword [rbp - 0x9c], rax
mov rcx, 0
mov rdx, rax
mov r8, 0x7ffc
call qword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov r10, 0xffffffffa8c94af9
mov ecx, 2
xor edx, edx
call fcn.1402e991e
mov r15, rax
mov r10, 0xffffffff817841c4
mov rcx, r15
mov rdx, r13
call fcn.1402e991e
test eax, eax
je 0x1402e884f
mov r10, 0xffffffffaae80e4c
lea rcx, [r13 + 0x2c]
lea rdx, [r12 + 0x194]
call fcn.1402e991e
test rax, rax
jne 0x1402e8838
mov eax, dword [r13 + 8]
mov r10, 0x512870c5
mov ecx, 0x1f0fff
xor edx, edx
mov r8, rax
call fcn.1402e991e
cmp rax, 0
je 0x1402e8838
mov qword [rbp - 0x68], rax
mov r10, 0x72f5d8c9
mov rcx, qword [rbp - 0x68]
xor edx, edx
mov r8d, 0x1000
mov r9d, 0x1000
mov qword [rsp + 0x20], 4
call fcn.1402e991e
cmp rax, 0
jne 0x1402e864b
jmp 0x1402e8838
mov qword [rbp - 0x84], rax
mov r10, 0x72f5d8c9
mov rcx, qword [rbp - 0x68]
xor edx, edx
lea r8, [0x1140]
mov r9d, 0x1000
mov qword [rsp + 0x20], 4
call fcn.1402e991e
cmp rax, 0
jne 0x1402e8686
jmp 0x1402e870d
mov qword [rbp - 0x7c], rax
mov r10, 0x3075954d
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x84]
mov r8, qword [rbp - 0x9c]
mov r9d, 0x1000
and qword [rsp + 0x20], 0
call fcn.1402e991e
cmp rax, 0
jne 0x1402e86bc
jmp 0x1402e86eb
mov r10, 0x3075954d
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x7c]
lea r8, [0x1402e889e]
lea r9, [0x1140]
and qword [rsp + 0x20], 0
call fcn.1402e991e
cmp rax, 0
jne 0x1402e8735
mov r10, 0xffffffffe383c343
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x7c]
lea r8, [0x1140]
mov r9d, 0x8000
call fcn.1402e991e
mov r10, 0xffffffffe383c343
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x84]
mov r8d, 0x1000
mov r9d, 0x8000
call fcn.1402e991e
jmp 0x1402e8838
mov r10, 0x4bedce55
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x7c]
lea r8, [0x1140]
mov r9d, 0x20
lea rax, [rbp - 0x94]
mov qword [rsp + 0x20], rax
call fcn.1402e991e
mov r10, 0x46035708
mov rcx, qword [rbp - 0x68]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r8
mov r9, qword [rbp - 0x7c]
mov rax, qword [rbp - 0x84]
mov qword [rsp + 0x20], rax
call fcn.1402e991e
mov qword [rbp - 0x70], rax
cmp rax, 0
jne 0x1402e8801
call qword [sym.imp.KERNEL32.DLL_GetLastError]
cmp rax, 8
jne 0x1402e87fc
mov r10, 0x3fd9858d
lea rcx, [rbp - 0x70]
mov edx, 0x1fffff
xor r8d, r8d
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], r8
mov r9, qword [rbp - 0x68]
mov rax, qword [rbp - 0x7c]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x84]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x30], 0
call fcn.1402e991e
cmp qword [rbp - 0x70], 0
je 0x1402e87fc
jmp 0x1402e8801
jmp 0x1402e86eb
mov r10, 0x2d176b1c
mov ecx, 0xd32
call fcn.1402e991e
mov r10, 0x41813d69
mov rcx, qword [rbp - 0x70]
lea rdx, [rbp - 0x74]
call fcn.1402e991e
cmp dword [rbp - 0x74], 0x103
jne 0x1402e8838
inc qword [rbp - 0x8c]
jmp 0x1402e884f
mov r10, 0xffffffffb17c1fbd
mov rcx, r15
mov rdx, r13
call fcn.1402e991e
jmp 0x1402e85c8
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp qword [rbp - 0x8c], 0
jne 0x1402e8884
mov rcx, 0
lea rdx, str.ERROR___
lea r8, str.ERROR___
mov r9, 0
call qword [sym.imp.user32.dll_MessageBoxA]
mov rcx, qword [rbp - 0x9c]
call qword [sym.imp.KERNEL32.DLL_GlobalFree]
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]