Function at 0x1400037c0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xa0
mov rax, qword [0x14001c008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdx, qword [0x14001c6d8]
mov r14, rcx
test rdx, rdx
je 0x140003bd5
mov rax, qword [0x14001c6e0]
test rax, rax
je 0x140003bd5
cmp qword [0x14001c6e8], 0
je 0x140003bd5
mov qword [r11 + 0x10], rbx
lea rbx, [0x14001c048]
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
xor r12d, r12d
xor edi, edi
mov qword [r11 - 0x20], r13
mov dword [rsp + 0x20], edi
mov qword [r11 - 0x28], r15
mov qword [0x14001c048], rdx
mov qword [0x14001c078], rax
mov qword [rsp + 0x28], rbx
nop dword [rax + rax]
mov rdx, qword [rbx - 8]
lea rcx, str.____ObjectCallblacks__tEnumerating__s_object_callbacks_:__n
call fcn.140001430
mov rbx, qword [rbx]
call fcn.1400072a0
lea r8, [rsp + 0x48]
mov ecx, 8
lea rdx, [rbx + rax]
call fcn.140004cd0
mov r13, qword [0x14001c6e8]
lea r8, [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov ecx, 8
add r13, rbx
mov rdx, r13
call fcn.140004cd0
mov rbp, qword [rsp + 0x50]
cmp rbp, r13
je 0x140003b66
nop word [rax + rax]
cmp qword [r14], 0x100
jae 0x140003c2a
lea rdx, [rbp + 0x20]
mov ecx, 8
lea r8, [rsp + 0x58]
call fcn.140004cd0
cmp qword [rsp + 0x58], rbx
jne 0x140003c13
lea rdx, [rbp + 0x10]
mov ecx, 4
lea r8, [rsp + 0x40]
call fcn.140004cd0
mov eax, dword [rsp + 0x40]
sub eax, 1
je 0x140003917
sub eax, 1
je 0x14000390e
cmp eax, 1
jne 0x140003be5
lea r8, str.creations__duplications
jmp 0x14000391e
lea r8, str.duplications
jmp 0x14000391e
lea r8, str.creations
mov rdx, rbp
lea rcx, str.____ObjectCallblacks__t_tCallback_at__p_for_handle__s:_n
call fcn.140001430
lea r15, [rbp + 0x14]
mov ecx, 4
mov rdx, r15
lea r8, [rsp + 0x44]
call fcn.140004cd0
mov esi, dword [rsp + 0x44]
cmp esi, 1
ja 0x140003bfc
lea rax, str.Enabled
test esi, esi
lea rdx, str.Disabled
cmovne rdx, rax
lea rcx, str.____ObjectCallblacks__t_t_tStatus:__s_n
call fcn.140001430
lea rdx, [rbp + 0x28]
mov ecx, 8
lea r8, [rsp + 0x60]
call fcn.140004cd0
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140003a50
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140007340
mov r9, qword [rsp + 0x30]
lea rcx, str.____ObjectCallblacks__t_t_tPreoperation_at_0x_016llx___s__0x_llx__n
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.140001430
xor r10d, r10d
lea r9, str.360qpesv.sys
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400039e4
add rax, 2
test ecx, ecx
jne 0x1400039d0
test edx, edx
je 0x1400039fa
inc r10d
add r9, 8
cmp r10d, 0x3f7
jb 0x1400039c2
jmp 0x140003a50
lea rcx, str.____ObjectCallblacks__t_t_tCallback_belongs_to_an_EDR
call fcn.140001430
test esi, esi
je 0x140003a44
lea rcx, str.and_is_enabled_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
imul rax, qword [r14], 0x38
mov dword [rax + r14 + 8], 1
mov qword [rax + r14 + 0x10], rbx
mov dword [rax + r14 + 0x38], 0
mov qword [rax + r14 + 0x30], rdi
mov qword [rax + r14 + 0x18], r15
inc qword [r14]
or r12d, 1
jmp 0x140003a50
lea rcx, str.but_is_disabled.
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
lea rdx, [rbp + 0x30]
mov ecx, 8
lea r8, [rsp + 0x68]
call fcn.140004cd0
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140003b3d
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140007340
mov r9, qword [rsp + 0x38]
lea rcx, str.____ObjectCallblacks__t_t_tPostoperation_at_0x_016llx___s__0x_llx__n
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.140001430
test esi, esi
je 0x140003b3d
xor r10d, r10d
lea r9, str.360qpesv.sys
nop word [rax + rax]
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140003ad4
add rax, 2
test ecx, ecx
jne 0x140003ac0
test edx, edx
je 0x140003aea
inc r10d
add r9, 8
cmp r10d, 0x3f7
jb 0x140003ab0
jmp 0x140003b3d
lea rcx, str.____ObjectCallblacks__t_t_tCallback_belongs_to_an_EDR
call fcn.140001430
lea rcx, str.and_is_enabled_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov rax, qword [r14]
imul rcx, rax, 0x38
test rax, rax
je 0x140003b15
cmp qword [rcx + r14 - 0x20], r15
je 0x140003b3d
mov dword [r14 + rcx + 8], 1
mov qword [r14 + rcx + 0x10], rbx
mov dword [r14 + rcx + 0x38], 0
mov qword [r14 + rcx + 0x30], rdi
mov qword [r14 + rcx + 0x18], r15
inc qword [r14]
or r12d, 1
lea r8, [rsp + 0x70]
mov rdx, rbp
mov ecx, 8
call fcn.140004cd0
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x48]
cmp rbp, r13
jne 0x1400038b0
mov edi, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
inc edi
add rbx, 0x30
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x28], rbx
cmp edi, 2
jb 0x140003850
mov r13, qword [rsp + 0x88]
mov eax, r12d
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0xa0
pop r14
ret
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
xor eax, eax
jmp 0x140003bbe
lea rcx, str.Unexpected_value_in_callback_entry__Operations___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unexpected_value_in_callback_entry__Enabled___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unexpected_value_in_callback_entry__ObjectTypeField___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.____No_more_space_to_store_object_callbacks_____This_should_not_happen._Exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3