Function at 0x6620c100
Capabilities:
Terminate process

Disassembly:
sub esp, 0x828
call fcn.66206e30
test eax, eax
setne al
mov byte [esp + 3], al
mov edx, str.Nt0SafeUtil::RaiseHardError_PID
test al, al
jne 0x6620c122
mov edx, str.ThinApp_has_encountered_an_unexpected_error._Click_Abort_to_close_the_application__Retry_to_debug__or_Continue_to_ignore_the_error._Support_info:_PID
push ebx
push ebp
push esi
mov eax, edx
push edi
lea esi, [eax + 2]
jmp 0x6620c130
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c130
sub eax, esi
sar eax, 1
mov esi, eax
lea edi, [esi + esi]
push edi
push edx
lea eax, [esp + 0x40]
push eax
call fcn.6620e720
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x20]
push 0xa
push 0
lea ebp, [esp + edi + 0x4c]
push eax
mov edi, 0x400
push ebp
sub edi, esi
call fcn.6620bfb0
add esp, 0x1c
sub edi, eax
cmp dword [esp + 0x83c], 0
lea esi, [ebp + eax*2]
je 0x6620c24f
mov eax, 0x6621ad7c
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c190
sub eax, edx
sar eax, 1
mov ebx, eax
lea ebp, [ebx + ebx]
push ebp
push 0x6621ad7c
push esi
call fcn.6620e720
sub edi, ebx
mov ebx, dword [esp + 0x848]
push 0x5c
push ebx
add esi, ebp
call fcn.6620fdf0
add esp, 0x14
test eax, eax
je 0x6620c1d4
inc eax
mov dword [esp + 0x83c], eax
mov ebx, eax
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6620c1e0
sub eax, edx
mov ecx, eax
mov eax, 0
je 0x6620c200
movsx dx, byte [eax + ebx]
mov word [esi + eax*2], dx
inc eax
cmp eax, ecx
jb 0x6620c1f2
mov eax, 0x6621ad78
lea esi, [esi + ecx*2]
sub edi, ecx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c210
sub eax, edx
sar eax, 1
mov ebp, eax
lea ebx, [ebp + ebp]
push ebx
push 0x6621ad78
push esi
call fcn.6620e720
mov eax, dword [esp + 0x84c]
push 0xa
push 0
push eax
add esi, ebx
push esi
sub edi, ebp
call fcn.6620bfb0
add esp, 0x1c
lea esi, [esi + eax*2]
sub edi, eax
cmp dword [esp + 0x844], 0
je 0x6620c2ba
mov eax, 0x6621ad7c
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c261
sub eax, edx
sar eax, 1
mov ebp, eax
lea ebx, [ebp + ebp]
push ebx
push 0x6621ad7c
push esi
call fcn.6620e720
mov edx, dword [esp + 0x850]
add esi, ebx
mov eax, edx
add esp, 0xc
sub edi, ebp
lea ebx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c295
sub eax, ebx
sar eax, 1
cmp eax, edi
jbe 0x6620c2aa
mov eax, edi
lea edi, [eax + eax]
push edi
push edx
push esi
call fcn.6620e720
add esp, 0xc
add esi, edi
push 0
push 4
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x44]
push 0xc
sub esi, ecx
push 0xffffffffffffffff
sar esi, 1
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov edi, dword [sym.imp.ntdll.dll_NtSetInformationProcess]
test eax, eax
setge bl
test bl, bl
je 0x6620c30b
mov ecx, dword [esp + 0x18]
mov eax, ecx
or eax, 1
mov dword [esp + 0x14], eax
cmp eax, ecx
jne 0x6620c2f9
xor bl, bl
jmp 0x6620c30b
push 4
lea eax, [esp + 0x18]
push eax
push 0xc
push 0xffffffffffffffff
call edi
test eax, eax
setge bl
lea eax, [esi + esi]
mov word [esp + 0x20], ax
mov word [esp + 0x22], ax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x3c]
push 0
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x30]
push ecx
push 1
push 1
lea edx, [esp + 0x34]
push 0x40000015
mov dword [esp + 0x40], edx
call dword [sym.imp.ntdll.dll_NtRaiseHardError]
mov dword [esp + 0x1c], eax
test bl, bl
je 0x6620c358
push 4
lea edx, [esp + 0x1c]
push edx
push 0xc
push 0xffffffffffffffff
call edi
cmp byte [esp + 0x13], 0
je 0x6620c463
xor eax, eax
test esi, esi
jbe 0x6620c37d
lea esp, [esp]
mov cl, byte [esp + eax*2 + 0x38]
mov byte [esp + eax + 0x38], cl
inc eax
cmp eax, esi
jb 0x6620c370
mov eax, dword [str.__dml__]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c385
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [str._col_fg_errfg__bg_errbg__]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c3a0
sub eax, edx
sar eax, 1
mov ebx, eax
lea ebp, [ebx + edi]
push esi
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + ebp + 0x40]
push eax
mov dword [esp + 0x20], ebp
call fcn.6620eb80
add esp, 0xc
xor eax, eax
test edi, edi
jbe 0x6620c3e3
mov ecx, dword [str.__dml__]
mov dl, byte [ecx + eax*2]
mov byte [esp + eax + 0x38], dl
inc eax
cmp eax, edi
jb 0x6620c3d7
xor eax, eax
test ebx, ebx
jbe 0x6620c403
mov ebp, dword [str._col_fg_errfg__bg_errbg__]
lea edi, [esp + edi + 0x38]
mov cl, byte [ebp + eax*2]
mov byte [edi + eax], cl
inc eax
cmp eax, ebx
jb 0x6620c3f3
mov ebp, dword [esp + 0x14]
add esi, ebp
mov ebp, dword [str.__col_]
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x6620c410
sub eax, edx
sar eax, 1
mov ecx, 0
je 0x6620c43c
lea edi, [esp + esi + 0x38]
lea ebx, [ebx]
mov dl, byte [ebp + ecx*2]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x6620c430
lea ecx, [esp + 0x30]
push ecx
add esi, eax
push 2
mov byte [esp + esi + 0x40], 0xa
push 0
inc esi
lea eax, [esp + 0x44]
push 0x40010006
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], eax
call fcn.66206d90
cmp dword [esp + 0x1c], 0
pop edi
pop esi
pop ebp
pop ebx
jl 0x6620c484
mov eax, dword [esp + 0x1c]
cmp eax, 2
je 0x6620c484
cmp eax, 7
jne 0x6620c491
int3
push 0xc0000001
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtTerminateProcess]
add esp, 0x828
ret