Function at 0x140005d08
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5d0
mov rax, qword [0x14000b110]
xor rax, rsp
mov qword [rsp + 0x5c0], rax
xor edi, edi
mov dword [rsp + 0x88], r9d
mov dword [rsp + 0x78], r8d
mov r12, rdx
mov qword [rsp + 0x90], rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rdi
mov r13, rdi
cmp dword [0x14000c7d4], edi
jne 0x140005d6b
call fcn.140006828
mov ebx, 1
cmp dword [0x14000c7b0], edi
je 0x140006223
cmp dword [rsp + 0x630], edi
je 0x140006223
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, edi
jne 0x14000621d
cmp byte [0x7ffe02d4], dil
jne 0x14000621d
lea rax, [rsp + 0x80]
lea r9, [0x140001760]
lea r8d, [rbx + 2]
lea rcx, [0x140002dd8]
xor edx, edx
mov r15, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
or rsi, 0xffffffffffffffff
cmp eax, edi
jl 0x14000605b
mov rcx, qword [rsp + 0x80]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, edi
jge 0x140005e0a
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x80], rdi
jmp 0x14000605b
lea rcx, [rsp + 0xb8]
xor edx, edx
mov r8d, 0x4c8
mov qword [rsp + 0xb0], rdi
call sub.msvcrt.dll_memset
mov dword [rsp + 0xe0], 0x100001
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0xb0]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x20]
mov r13, rax
cmp rax, rdi
je 0x14000605b
mov rax, qword [rax]
xor edx, edx
mov rcx, r13
call qword [rax + 0x20]
mov rdi, rax
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.1400080ec
xor r8d, r8d
mov rbp, rax
mov qword [rsp + 0xa0], rax
cmp rax, r8
je 0x140006059
mov word [rax], r8w
mov rax, qword [r13]
xor r9d, r9d
mov r8, rbp
mov rdx, rdi
mov rcx, r13
call qword [rax + 0x28]
xor edi, edi
cmp eax, edi
je 0x14000604a
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
xor edi, edi
not rcx
sub rcx, rbx
mov rbx, rcx
cmp r14, rdi
je 0x140005efa
mov rcx, rsi
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
dec rcx
add rbx, rcx
xor edi, edi
cmp r12, rdi
je 0x140005f15
xor eax, eax
mov rcx, rsi
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add rbx, rcx
xor edi, edi
mov ecx, 0x20a
call fcn.1400080ec
mov r14, rax
cmp rax, rdi
je 0x140005f48
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov word [r14 + 0x208], di
mov edx, eax
add rbx, rdx
lea rcx, [rbx + 0x200]
mov eax, 2
mov qword [rsp + 0x98], rcx
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400080ec
mov r15, rax
cmp rax, rdi
je 0x14000603d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r12, [0x140001ab4]
mov ebp, eax
mov rax, qword [rsp + 0x70]
lea rcx, [rsp + 0x580]
cmp rax, rdi
mov rbx, r12
cmovne rbx, rax
call qword [sym.imp.msvcrt.dll__wstrdate]
lea rcx, [rsp + 0x5a0]
mov rdi, rax
call qword [sym.imp.msvcrt.dll__wstrtime]
mov rdx, qword [rsp + 0x90]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsp + 0x98]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x48], esi
xor r8d, r8d
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebp
cmp r14, r8
mov rcx, r12
mov dword [rsp + 0x30], ebp
cmovne rcx, r14
cmp rdx, r8
lea r8, [0x140002890]
cmovne r12, rdx
mov qword [rsp + 0x28], rcx
mov rdx, rdi
mov r9, r12
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140003e48
mov rbp, qword [rsp + 0xa0]
mov rdx, rdi
mov r8, rbp
mov rcx, r15
call fcn.140003d7c
or rsi, 0xffffffffffffffff
xor edi, edi
cmp r14, rdi
je 0x14000604a
mov rcx, r14
call fcn.14000812c
mov rcx, rbp
call fcn.14000812c
cmp r15, rdi
jne 0x140006062
jmp 0x14000605b
xor edi, edi
lea r15, [0x140002440]
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
je 0x1400061f3
mov rcx, qword [rsp + 0x70]
mov r9d, 4
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x90]
lea edx, [r9 + 8]
mov dword [rsp + 0x78], r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x70]
cmp eax, edi
jne 0x1400060c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400061f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], rdi
cmp dword [rsp + 0x90], edi
je 0x1400061f3
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
mov r14, rax
cmp rax, rdi
je 0x1400061f3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov r12, rax
cmp rax, rdi
je 0x1400061f3
lea rcx, [0x140002db8]
xor edx, edx
mov r8d, 0x37f
call qword [sym.imp.USER32.dll_OpenWindowStationW]
mov rbp, rax
cmp rax, rdi
je 0x1400061f3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
cmp eax, edi
je 0x1400061f3
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
cmp rax, rdi
je 0x1400061f3
lea rcx, [0x140002dc8]
mov r9d, 0x182
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_OpenDesktopW]
mov rbx, rax
cmp rax, rdi
je 0x1400061f3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, edi
je 0x1400061f3
xor edx, edx
lea rcx, [0x1400024b8]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea r9, [0x140006b40]
xor r8d, r8d
mov edx, 0x259
mov rcx, rax
mov qword [rsp + 0x20], r15
mov rdi, rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
xor edi, edi
cmp eax, edi
je 0x1400061f3
mov rcx, r12
call qword [sym.imp.USER32.dll_SetThreadDesktop]
cmp eax, edi
je 0x1400061f3
mov rcx, rbp
call qword [sym.imp.USER32.dll_CloseWindowStation]
cmp eax, edi
je 0x1400061f3
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
cmp rsi, 0x25b
jne 0x140006202
call qword [sym.imp.KERNEL32.dll_DebugBreak]
lea rax, [0x140002440]
cmp r15, rax
je 0x140006216
mov rcx, r15
call fcn.14000812c
mov ebx, 1
jmp 0x140006223
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp dword [rsp + 0x88], edi
je 0x140006231
call fcn.140005c38
cmp dword [0x14000bcf4], edi
jne 0x14000624e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x7f0ea553
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
int3
mov eax, dword [0x14000c7d8]
cmp dword [0x14000c7dc], edi
mov rcx, qword [rsp + 0x80]
cmove eax, ebx
mov dword [0x14000bcf4], edi
mov dword [0x14000c7d8], eax
cmp rcx, rdi
je 0x140006284
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x80], rdi
cmp r13, rdi
je 0x140006293
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x5c0]
xor rcx, rsp
call fcn.1400084d0
mov rbx, qword [rsp + 0x628]
add rsp, 0x5d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret