Function at 0x140009500
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140055008]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r14, rdx
lea rcx, [rsp + 0x70]
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x40], rbx
call sub.msvcrt.dll_memset
cmp dword [0x140055944], ebx
lea r12d, [rbx + 7]
mov qword [rsp + 0x30], rbx
mov esi, ebx
mov dword [0x1400551a8], ebx
je 0x140009576
lea r8, str._Looking_for_tracing_DLL_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
lea rdx, [rsp + 0x70]
call fcn.14000b280
mov edi, eax
test eax, eax
jns 0x140009648
mov r8d, 0x114f
lea r10, [0x14003c070]
nop word [rax + rax]
mov ecx, ebx
mov rdx, rdi
add rcx, rcx
mov r9d, ebx
mov eax, dword [r10 + rcx*8]
sub rdx, rax
je 0x1400095d4
mov ecx, r8d
sub ecx, ebx
shr ecx, 1
add ecx, ebx
test rdx, rdx
mov eax, ecx
cmovns eax, r8d
cmovns ebx, ecx
inc ebx
mov r8d, eax
cmp eax, ebx
jae 0x1400095a0
jmp 0x1400095dc
add r9, r9
mov rsi, qword [r10 + r9*8 + 8]
cmp dword [0x140055944], 0
je 0x140009b3c
lea rax, str.GetDetoursDllPath__L_mfdetours.dll___pszDetoursDllFullPath___sizeof_RtlpNumberOf_pszDetoursDllFullPath_____
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, edi
mov qword [rsp + 0x20], rsi
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], 0
je 0x140009b3c
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracedprocess.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xd0
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009b3c
mov rax, qword [0x140055158]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x2d0], r15
lea r8, [0x140055160]
cmp dword [rax - 0x10], edx
cmovne rdx, rax
xor ecx, ecx
call fcn.14000d3d0
mov edi, eax
mov r15d, 1
test eax, eax
jns 0x140009745
mov r8d, 0x114f
lea r10, [0x14003c070]
mov r11, rbx
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
mov rdx, rdi
add rax, rax
mov ecx, ebx
mov eax, dword [r10 + rax*8]
sub rdx, rax
je 0x1400096d3
mov ecx, r8d
sub ecx, ebx
shr ecx, 1
add ecx, ebx
test rdx, rdx
mov eax, ecx
cmovns eax, r8d
cmovns ebx, ecx
inc ebx
mov r8d, eax
cmp eax, ebx
jae 0x1400096a0
jmp 0x1400096db
add rcx, rcx
mov r11, qword [r10 + rcx*8 + 8]
cmp dword [0x140055944], esi
je 0x140009a8a
lea rax, str.CETWManager::CreateInstance__0____m_strFilenameOut.IsEmpty_____0_:__LPCWSTR_m_strFilenameOut____m_mapProviderStates__petwManager__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov r9d, edi
mov qword [rsp + 0x20], r11
mov ecx, 0xfffffff4
call fcn.1400085c0
cmp dword [0x140055944], esi
je 0x140009a8a
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracedprocess.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xd7
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009a8a
lea r9, [rsp + 0x30]
mov rdx, r14
lea r8, [rsp + 0x70]
call fcn.140009b70
mov edi, eax
test eax, eax
jns 0x1400097da
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
mov ecx, eax
call fcn.140008520
cmp dword [0x140055944], ebx
je 0x1400097d0
lea rax, str.StartProcess__pszCmdLine__pszDetoursDllFullPath__hProcess__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x50]
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], ebx
je 0x1400097d0
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracedprocess.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xd9
mov ecx, 0xfffffff4
call fcn.1400085c0
mov rsi, qword [rsp + 0x30]
jmp 0x140009a8a
mov qword [rsp + 0x2c0], r13
mov r15d, ebx
mov r13, qword [rsp + 0x40]
nop word [rax + rax]
mov ecx, 0x1f4
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
mov rsi, qword [r13 + 0x8d8]
test rsi, rsi
je 0x1400098b1
mov eax, dword [rsi + 0xc]
mov edi, eax
sub edi, dword [rsi + 0x10]
mov dword [rsi + 0x10], eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [rsi + 0x14]
mov dword [rsi + 0x14], eax
je 0x140009834
imul eax, edi, 0x3e8
xor edx, edx
div ecx
mov esi, eax
jmp 0x140009839
mov esi, 0xffffffff
cmp dword [0x140055944], ebx
je 0x140009859
mov r9d, esi
movzx edx, r12w
lea r8, str._Event_incoming_rate:__i_s_n
mov ecx, 0xfffffff4
call fcn.1400085c0
mov rcx, qword [rsp + 0x40]
mov eax, 1
test esi, esi
cmovne r15d, eax
call fcn.14000edd0
mov edi, eax
test eax, eax
js 0x14000993f
mov r14, qword [r13 + 0x8d8]
test r14, r14
je 0x140009894
mov ecx, 1
call fcn.140017060
cmp qword [r14 + 0x28], rax
je 0x1400098a3
mov edx, esi
lea rcx, str.Event_incoming_rate:__i_s______________r
call qword [sym.imp.msvcrt.dll_printf_s]
test r15d, r15d
je 0x1400098ac
test esi, esi
je 0x1400098b1
mov r14d, ebx
jmp 0x1400098b7
mov r14d, 1
mov eax, dword [0x1400551a8]
test eax, eax
jne 0x140009a5a
mov rsi, qword [rsp + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
test eax, eax
jne 0x1400098e2
test r14d, r14d
jne 0x1400099bf
cmp qword [r13 + 0x8d8], rbx
je 0x140009934
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x38]
call fcn.14000e1a0
mov edi, eax
test eax, eax
js 0x1400099e5
cmp dword [rsp + 0x38], ebx
je 0x1400097f0
cmp dword [0x140055944], ebx
je 0x140009a7c
lea r8, str._Exiting:_end_of_tracing_reached_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009a7c
mov dword [rsp + 0x38], ebx
mov edi, ebx
jmp 0x1400097f0
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rbx
mov ecx, edi
call fcn.140008520
cmp dword [0x140055944], ebx
je 0x140009a77
lea rax, str.petwManager__Flush__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x58]
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], ebx
je 0x140009a77
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracedprocess.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0xed
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009a77
cmp dword [0x140055944], ebx
je 0x140009a7c
lea r8, str._Exiting:_traced_process_has_exited_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009a7c
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
mov ecx, edi
call fcn.140008520
cmp dword [0x140055944], ebx
je 0x140009a7c
lea rax, str.petwManager__IsEndOfTracing__bEndOfTracing__
movzx edx, r12w
mov qword [rsp + 0x28], rax
lea r8, str._hr0x_08X__s_from__s_n
mov rax, qword [rsp + 0x60]
mov r9d, edi
mov ecx, 0xfffffff4
mov qword [rsp + 0x20], rax
call fcn.1400085c0
cmp dword [0x140055944], ebx
je 0x140009a7c
lea r9, str.avcoremf_samplesmf360mftracemftracelibmftracedprocess.cpp
movzx edx, r12w
lea r8, str.___at__s:_i_n
mov dword [rsp + 0x20], 0x10d
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009a7c
cmp dword [0x140055944], ebx
je 0x140009a77
lea r8, str._Exiting:_stop_user_request_received_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
mov rsi, qword [rsp + 0x30]
mov r13, qword [rsp + 0x2c0]
mov r15d, 1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140009aa1
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x1400185c0]
test rsi, rsi
je 0x140009b34
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140009ad6
mov edx, r15d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetExitCodeProcess]
test eax, eax
je 0x140009b0d
cmp dword [0x140055944], 0
je 0x140009b2b
mov r9d, dword [rsp + 0x48]
lea r8, str._Process_exit_code:__08X_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
jmp 0x140009b2b
cmp dword [0x140055944], 0
je 0x140009b2b
lea r8, str._Failed_to_get_the_process_exit_code_n
movzx edx, r12w
mov ecx, 0xfffffff4
call fcn.1400085c0
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov r15, qword [rsp + 0x2d0]
mov eax, edi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140016790
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x290
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret