Function at 0x7ff34450e90
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x358
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x3d0]
xor r13d, r13d
mov r15, r9
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x3d8]
mov r14, r8
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x3e0]
lea r12d, [r13 + 0x30]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x3e8]
lea r9, [r11 - 0x308]
mov qword [rsp + 0x70], rax
lea eax, [r13 + 1]
lea r8, [r11 - 0x268]
mov rbx, rdx
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], rcx
mov edi, eax
mov dword [rsp + 0x78], eax
mov esi, r13d
mov dword [rsp + 0x64], r12d
mov qword [r11 - 0x308], r13
mov qword [r11 - 0x2f8], r13
mov byte [rsp + 0x60], r13b
call fcn.7ff344749f8
test rbx, rbx
cmovne r13, qword [rsp + 0x90]
mov ebp, eax
test eax, eax
js 0x7ff34450f98
and qword [rsp + 0x30], rsi
and qword [rsp + 0x28], rsi
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0x64]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x130]
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.7ff344760b8
mov edi, dword [rsp + 0x78]
mov r12d, dword [rsp + 0x64]
mov ebp, eax
call fcn.7ff34450bac
mov edx, 1
mov ecx, ebp
test al, al
movzx eax, bp
mov ebx, ebp
cmove edi, edx
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
test ebp, ebp
js 0x7ff34451301
test r12b, 0x20
mov eax, 0x80070005
cmovne ebp, eax
test ebp, ebp
js 0x7ff34451301
test edi, edi
je 0x7ff344512ee
cmp edi, edx
je 0x7ff3445127e
jle 0x7ff34451274
cmp edi, 4
jg 0x7ff34451274
lea rcx, [rsp + 0x130]
call sub.iertutil.dll_Ordinal_45
mov rbp, qword [rsp + 0x68]
mov r9, r15
mov r8, r14
mov rdx, r13
test eax, eax
jne 0x7ff34451042
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rcx
jmp 0x7ff344512b2
mov eax, dword [rsp + 0x3c8]
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x30], rcx
or eax, 4
lea rcx, [rsp + 0x130]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3c0]
mov dword [rsp + 0x20], eax
call fcn.7ff34450cc0
mov esi, eax
test eax, eax
je 0x7ff344510ae
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x7ff344510c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x2e4
je 0x7ff344512f8
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edi, eax
test eax, eax
jns 0x7ff344510da
cmp eax, 0x80010106
jne 0x7ff34451251
xor r14d, r14d
test eax, eax
lea rcx, [rsp + 0x130]
setns r14b
xor esi, esi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, r13
mov rbp, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0x80]
mov r12, rax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, qword [rsp + 0x68]
or dword [rsp + 0x64], 0xffffffff
lea rcx, [rsp + 0xc0]
lea r8d, [rsi + 0x68]
mov rdx, rbx
mov r13, rax
call sub.msvcrt.dll_memcpy
and qword [rsp + 0x128], rsi
bt dword [rsp + 0x3c8], 0x13
jae 0x7ff34451155
mov rcx, qword [rbx + 0x68]
mov esi, 0x80000
mov qword [rsp + 0x128], rcx
lea rcx, [rsp + 0x88]
call sub.iertutil.dll_Ordinal_58
mov edi, eax
test eax, eax
js 0x7ff34451226
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x64]
xor r8d, r8d
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x18]
mov edi, eax
test eax, eax
js 0x7ff34451226
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov r11, qword [rsp + 0x88]
mov rbx, qword [r11]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rsp + 0x88]
mov edx, eax
mov rax, qword [rsp + 0x70]
mov r9, r12
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
mov r8, rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], esi
call qword [rbx + 0x20]
mov rcx, qword [rsp + 0x88]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp edi, 0x800704c7
jne 0x7ff34451226
lea rcx, [rsp + 0x130]
mov edx, 0x5c
call sub.msvcrt.dll_wcsrchr
test rax, rax
je 0x7ff34451226
lea rcx, [rsp + 0x130]
mov rdx, rax
call fcn.7ff344768f8
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r14d, r14d
je 0x7ff3445124c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rbp, qword [rsp + 0x68]
mov ecx, edi
movzx eax, di
mov ebx, edi
and ecx, 0x1fff0000
cmp ecx, 0x70000
cmove ebx, eax
xor esi, esi
test edi, edi
setns sil
jmp 0x7ff344512f8
mov ebx, 0x80004001
jmp 0x7ff34451375
mov rax, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov r9, r15
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov r8, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov rdx, r13
mov eax, dword [rsp + 0x3c8]
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3c0]
lea rcx, [rsp + 0x130]
mov dword [rsp + 0x20], eax
call fcn.7ff34450cc0
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x7ff344512f8
mov rbp, qword [rsp + 0x68]
mov ebx, 5
cmp byte [rsp + 0x60], 0
jne 0x7ff34451375
jmp 0x7ff34451306
mov rbp, qword [rsp + 0x68]
cmp ebx, 0x2e4
jne 0x7ff34451375
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x3c8]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
call fcn.7ff3444caf4
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x7ff34451361
lea rdx, [0x7ff34444128]
lea ecx, [rax + 3]
call fcn.7ff3446a4dc
jmp 0x7ff34451375
lea rdx, [0x7ff34444158]
mov r8d, eax
mov ecx, 1
call fcn.7ff3446a4dc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x7ff3445138f
call fcn.7ff3444f5a0
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x7ff344513a1
call fcn.7ff3444f5a0
mov eax, esi
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.7ff344779c0
add rsp, 0x358
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret