Function at 0x140031a30
Capabilities:
Hash data with md5
Terminate process

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x160
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x98], 0xfffffffffffffffe
mov qword [rbp + 0x178], rbx
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rdi
mov rax, qword [0x14017c430]
xor rax, rbp
mov qword [rbp + 0x130], rax
movzx r13d, dl
mov r15d, ecx
mov rdi, qword [0x1401835b8]
lea rcx, [rbp + 0x40]
call fcn.1400308a0
nop
lea rcx, [rdi + 0x10]
lea r8, [rbp + 0x40]
mov edx, r15d
call fcn.140030bb0
test eax, eax
jne 0x140031aa8
jmp 0x14003219a
mov rcx, qword [rbp + 0x50]
add rcx, 0xffffffffffffffe8
call fcn.140001d80
add rax, 0x18
mov qword [rbp + 8], rax
cmp dword [rax - 8], 1
jle 0x140031ad3
mov edx, dword [rax - 0x10]
lea rcx, [rbp + 8]
call fcn.140001fb0
mov rax, qword [rbp + 8]
lea rdx, [rax + 2]
or r14, 0xffffffffffffffff
xor ebx, ebx
test rdx, rdx
jne 0x140031ae6
mov ecx, ebx
jmp 0x140031af7
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp + 8]
call fcn.140002120
mov rdx, qword [rbp + 8]
movsxd rsi, dword [rdx - 0x10]
test esi, esi
jns 0x140031b1a
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rax, qword [rbp + 8]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, esi
or eax, ecx
jge 0x140031b3a
mov edx, esi
lea rcx, [rbp + 8]
call fcn.1400020c0
lea eax, [rsi + 1]
movsxd rdx, eax
mov rdi, qword [rbp + 8]
mov rcx, rdi
call fcn.1400d912c
cmp esi, dword [rdi - 0xc]
jg 0x14003218f
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], bx
mov qword [rbp], rbx
mov ecx, 0x208
call fcn.1400d5224
mov qword [rbp + 0x18], rax
test r13b, r13b
je 0x140031b85
test rax, rax
je 0x140031b83
mov rcx, rax
call fcn.140024320
mov rbx, rax
jmp 0x140031b95
test rax, rax
je 0x140031b95
mov rcx, rax
call fcn.140024630
mov rbx, rax
mov qword [rbp], rbx
mov dword [rbx + 8], r15d
lea rdx, [rbx + 0xc]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
lea rsi, [rbx + 0x10]
mov rdx, qword [rbp + 0x48]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rcx, rdi
je 0x140031c0b
cmp dword [rdi + 0x10], 0
jl 0x140031bff
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140031bff
call fcn.140001d80
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140031bf2
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [rbx + 0x18]
mov qword [rsi], rax
mov rbx, qword [rbp]
jmp 0x140031c0b
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.140002120
lea r12, [rbx + 0x20]
mov rdx, qword [rbp + 0x50]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x140031c6e
cmp dword [rdi + 0x10], 0
jl 0x140031c62
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140031c62
call fcn.140001d80
mov rsi, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140031c54
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [rsi + 0x18]
mov qword [r12], rax
mov rbx, qword [rbp]
jmp 0x140031c6e
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.140002120
lea rsi, [rbx + 0x28]
mov rdx, qword [rbp + 0x68]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rcx, rdi
je 0x140031ccf
cmp dword [rdi + 0x10], 0
jl 0x140031cc3
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140031cc3
call fcn.140001d80
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140031cb6
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [rbx + 0x18]
mov qword [rsi], rax
mov rbx, qword [rbp]
jmp 0x140031ccf
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.140002120
lea rsi, [rbx + 0x18]
mov rdx, qword [rbp + 0x60]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rcx, rdi
je 0x140031d30
cmp dword [rdi + 0x10], 0
jl 0x140031d24
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140031d24
call fcn.140001d80
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140031d17
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [rbx + 0x18]
mov qword [rsi], rax
mov rbx, qword [rbp]
jmp 0x140031d30
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.140002120
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
lea rsi, [rcx + rbx + 0x78]
mov rdx, qword [rbp + 0x70]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsi]
sub rdi, 0x18
cmp rcx, rdi
je 0x140031d99
cmp dword [rdi + 0x10], 0
jl 0x140031d8d
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140031d8d
call fcn.140001d80
mov rbx, rax
mov ecx, r14d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140031d80
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
lea rax, [rbx + 0x18]
mov qword [rsi], rax
mov rbx, qword [rbp]
jmp 0x140031d99
mov r8d, dword [rdx - 0x10]
mov rcx, rsi
call fcn.140002120
test r13b, r13b
je 0x140032134
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
xor eax, eax
lea rdi, str.SYSTEM
mov rsi, qword [rcx + rbx + 0x78]
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
je 0x140031dc6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
xor r13d, r13d
test al, al
je 0x140032137
mov qword [rbp + 0xb0], r13
mov dword [rbp + 0xa0], 0x67452301
mov dword [rbp + 0xa4], 0xefcdab89
mov dword [rbp + 0xa8], 0x98badcfe
mov dword [rbp + 0xac], 0x10325476
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x10], rax
mov rdi, qword [r12]
test rdi, rdi
jne 0x140031e2c
mov edx, r13d
jmp 0x140031e89
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x140031e43
mov rdx, r13
jmp 0x140031e89
lea r8d, [rax + rax]
cdqe
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140031e5f
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400e2af0
sub rsp, rcx
lea rcx, [rsp + 0x20]
mov r9d, 3
mov rdx, rdi
call fcn.140034900
mov rdx, rax
test rax, rax
jne 0x140031e8e
mov ecx, r13d
jmp 0x140031e9e
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rbp + 0x10]
call fcn.1400147e0
mov rdx, qword [rbp + 0x10]
cmp dword [rdx - 8], 1
jle 0x140031ec4
mov edx, dword [rdx - 0x10]
lea rcx, [rbp + 0x10]
call fcn.140002b80
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0xa0]
call fcn.140030390
mov rsi, rax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp + 0x20], rdi
test rsi, rsi
je 0x140031f1a
test rsi, 0xffffffffffff0000
jne 0x140031f1a
movzx esi, si
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x140031f2a
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400029f0
jmp 0x140031f26
mov rdx, rsi
lea rcx, [rbp + 0x20]
call fcn.140035240
mov rdi, qword [rbp + 0x20]
mov rbx, qword [0x1401835b0]
add rbx, 0x1638
lea r12, vtable.CLockMgr_class_CMutexWrapper_.0
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], rbx
mov dword [rbp + 0x38], 1
or esi, 0xffffffff
cmp qword [rbx], 0
je 0x140031f73
call qword [sym.imp.USER32.dll_InSendMessage]
mov ecx, 0x2710
test eax, eax
cmovne esi, ecx
mov edx, esi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [0x1401835b0]
mov rax, qword [rcx + 0x208]
mov rcx, qword [rcx + 0x210]
cmp rax, rcx
je 0x1400320e0
movzx edx, byte [rax + 0x14]
test edx, edx
jne 0x140032045
cmp rax, rcx
je 0x1400320e0
nop word [rax + rax]
mov r8, qword [rax + 8]
mov edx, r13d
test r8, r8
setne dl
test edx, edx
je 0x14003203a
mov rdx, rdi
sub r8, rdi
nop word [rax + rax]
movzx esi, word [rdx]
cmp si, word [rdx + r8]
jne 0x140031fe8
add rdx, 2
test si, si
jne 0x140031fd0
mov edx, r13d
jmp 0x140031fed
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x140031fff
add rax, 0x18
cmp rax, rcx
jne 0x140031fb0
jmp 0x1400320e0
mov r8d, r15d
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400320d9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400320d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400320e0
mov ecx, 0x80004005
call fcn.1400022b0
int3
cmp rax, rcx
je 0x1400320a7
nop word [rax + rax]
mov r8, qword [rax + 8]
mov edx, r13d
test r8, r8
setne dl
test edx, edx
je 0x14003209c
mov rdx, rdi
sub r8, rdi
nop word [rax + rax]
movzx esi, word [rdx]
cmp si, word [rdx + r8]
jne 0x140032088
add rdx, 2
test si, si
jne 0x140032070
mov edx, r13d
jmp 0x14003208d
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
je 0x1400320e0
add rax, 0x18
cmp rax, rcx
jne 0x140032050
jmp 0x1400320a7
mov ecx, 0x80004005
call fcn.1400022b0
int3
mov r8d, r15d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400320d9
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400320d9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400320e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov qword [rbp + 0x28], r12
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400320f3
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003210f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp + 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14003212e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rbp]
jmp 0x140032137
xor r13d, r13d
mov qword [rbp], r13
mov qword [rbp + 0x18], rbx
lea rax, [rbp + 0x18]
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x18]
test rax, rax
je 0x140032169
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov rax, qword [rcx]
mov edx, 1
call qword [rax + VariantCopy]
nop
mov qword [rbp], r13
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x14003218d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
jmp 0x14003219a
mov ecx, 0x80070057
call fcn.1400022b0
nop
lea rcx, [rbp + 0x40]
call fcn.140031290
mov rcx, qword [rbp + 0x130]
xor rcx, rbp
call fcn.1400d4d90
mov rbx, qword [rbp + 0x178]
mov rsi, qword [rbp + 0x180]
mov rdi, qword [rbp + 0x188]
lea rsp, [rbp + 0x140]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret