Function at 0x140112e50
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x68
mov rax, qword [0x140b29680]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rbx, rcx
mov qword [rbp - 0x48], rcx
mov rcx, qword [rcx]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14011303c
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rbx + 8]
cmp byte [rax], 0
jne 0x140113103
movdqa xmm1, xmmword [0x1401f2510]
mov r8b, reloc.WLDAP32.dll_Ordinal_45
movd r9d, xmm1
movzx ebx, r8b
movdqu xmmword [rbp - 0x40], xmm1
mov qword [rsp + 0x88], rsi
mov cl, 0x3d
xor byte [rbp - 0x3e], r9b
movdqa xmm0, xmm1
xor byte [rbp - 0x3d], r9b
xor cl, r9b
xor byte [rbp - 0x3c], r9b
xor bl, r9b
xor byte [rbp - 0x3b], r9b
mov dl, 0x26
xor byte [rbp - 0x3a], r9b
xor dl, r9b
xor byte [rbp - 0x39], r9b
mov r10b, Ordinal_50
xor byte [rbp - 0x38], r9b
xor r10b, r9b
xor byte [rbp - 0x37], r9b
mov r11b, gethostname
xor byte [rbp - 0x36], r9b
xor r11b, r9b
xor byte [rbp - 0x35], r9b
mov sil, reloc.WLDAP32.dll_Ordinal_60
xor byte [rbp - 0x34], r9b
xor sil, r9b
xor byte [rbp - 0x33], r9b
xor byte [rbp - 0x32], r9b
xor byte [rbp - 0x31], r9b
mov qword [rsp + 0x90], rdi
mov dil, Ordinal_45
mov qword [rsp + 0x98], r12
xor dil, r9b
mov qword [rsp + 0x60], r13
mov r12b, 0x24
mov qword [rsp + 0x58], r14
xor r12b, r9b
movzx r14d, r8b
psrldq xmm0, 1
xor r8b, r9b
movd eax, xmm0
xor r14b, r9b
mov qword [rsp + 0x50], r15
mov byte [rbp - 0x30], cl
mov r15b, Ordinal_45
xor al, r9b
mov byte [rbp - 0x2f], dl
xor r15b, r9b
mov byte [rbp - 0x2e], r8b
mov r13b, Ordinal_50
mov byte [rbp - 0x3f], al
xor r13b, r9b
mov byte [rbp - 0x2d], r10b
lea r9, [rbp - 0x3f]
mov byte [rbp - 0x2c], r11b
lea r8, [0x14022005c]
mov byte [rbp - 0x2b], bl
mov edx, 0x100
mov byte [rbp - 0x2a], dil
lea rcx, [0x140b32830]
mov byte [rbp - 0x29], sil
mov byte [rbp - 0x28], r14b
mov byte [rbp - 0x27], r15b
mov byte [rbp - 0x26], r12b
mov byte [rbp - 0x25], r13b
mov byte [rbp - 0x24], 0
call fcn.140003510
mov rcx, qword [rbp - 0x48]
lea rax, [0x1401f04e4]
mov qword [0x140b32930], rax
xor edx, edx
mov dword [0x140b32ad4], 0
mov dword [0x140b32ce8], 0
mov rcx, qword [rcx]
mov dword [0x140b32cec], 0x43160000
mov dword [0x140b32d34], 0
mov dword [0x140b32d30], 0x42200000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r15, qword [rsp + 0x50]
mov eax, 3
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
jmp 0x140113103
movdqa xmm1, xmmword [0x1401f1de0]
lea r9, [rbp - 0x3f]
movd ecx, xmm1
lea r8, [0x14022005c]
movdqu xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x2f], 0
mov dl, 0xa
xor byte [rbp - 0x3e], cl
movdqa xmm0, xmm1
xor byte [rbp - 0x3d], cl
xor dl, cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
xor byte [rbp - 0x39], cl
xor byte [rbp - 0x38], cl
xor byte [rbp - 0x37], cl
xor byte [rbp - 0x36], cl
xor byte [rbp - 0x35], cl
xor byte [rbp - 0x34], cl
xor byte [rbp - 0x33], cl
xor byte [rbp - 0x32], cl
xor byte [rbp - 0x31], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp - 0x30], dl
mov edx, 0x100
xor al, cl
lea rcx, [0x140b32830]
mov byte [rbp - 0x3f], al
call fcn.140003510
lea rax, [0x1401f04e4]
mov dword [0x140b32ad4], 0
mov qword [0x140b32930], rax
xor edx, edx
mov rcx, qword [rbx]
mov dword [0x140b32ce8], 0
mov dword [0x140b32cec], 0x43160000
mov dword [0x140b32d34], 0
mov rcx, qword [rcx]
mov dword [0x140b32d30], 0x42200000
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 4
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140148c30
add rsp, 0x68
pop rbx
pop rbp
ret