Function at 0x16003e7c8
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa00
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x160270bd8]
xor rax, rsp
mov qword [rsp + 0x9f8], rax
mov rbp, rcx
lea rbx, [rcx + 0x140]
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop
xor r13d, r13d
mov esi, r13d
lea r15, [rbp + 0x1048]
mov rax, qword [r15]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x16003e942
test dword [0x160274340], 0x800
jne 0x160094942
mov r14d, 1
mov dword [rsp + 0x50], r13d
mov edi, 0x7530
cmp dword [rbp + 0xfa4], r13d
jne 0x16009495b
lea rdx, [rsp + 0x50]
mov rcx, qword [rbp + 0x1038]
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x16003e884
cmp dword [rsp + 0x50], r13d
cmovne r14d, r13d
lea r12, [rbp + 0x1038]
mov edx, 0x20
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
mov rcx, qword [rbp + 0x1058]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
mov edx, edi
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
mov edi, eax
test eax, eax
jne 0x160094975
cmp edi, 0x102
je 0x16009499b
test r14d, r14d
je 0x16003e8da
cmp edi, 0x102
je 0x1600949c4
mov rcx, qword [rbp + 0x1058]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ResetEvent]
test eax, eax
je 0x160094a7c
xor edx, edx
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_core_job_l2_1_0.dll_TerminateJobObject]
test eax, eax
je 0x160094a9a
lea rcx, [rbp + 0x1040]
xor edx, edx
call fcn.1600161cc
xor edx, edx
mov rcx, r12
call fcn.1600161cc
xor edx, edx
mov rcx, r15
call fcn.1600161cc
mov dword [rbp + 0x10ac], r13d
mov dword [rbp + 0x10a4], r13d
test dword [0x160274340], 0x800
jne 0x160094ab8
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
mov eax, esi
mov rcx, qword [rsp + 0x9f8]
xor rcx, rsp
call fcn.16006e590
lea r11, [rsp + 0xa00]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8d, dword [rbp + 0x10ac]
lea rdx, [0x1601f9368]
call fcn.1600c260c
nop
jmp 0x16003e848
mov r14d, r13d
mov eax, dword [rbp + 0xfa8]
neg eax
sbb edi, edi
not edi
and edi, 0x1388
jmp 0x16003e884
cmp edi, 0x102
je 0x16009499b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x16003e8bd
movzx esi, ax
or esi, 0x80070000
jmp 0x16003e8bd
test dword [0x160274340], 0x800
je 0x16003e8c9
mov r8d, dword [rbp + 0x10ac]
lea rdx, [0x1601f9068]
call fcn.1600c260c
nop
jmp 0x16003e8c9
call fcn.160105180
test eax, eax
jne 0x16003e8da
lea rdi, [rbp + 0x10ac]
mov r9d, dword [rdi]
lea r8, [0x1601d65a4]
lea edx, [rax + 0xb]
lea rcx, [rsp + 0x9e0]
call fcn.160059e34
mov rdx, qword [rbp + 0x180]
lea rcx, [rsp + 0x70]
call fcn.1600c0044
nop
xor r9d, r9d
lea r8, [rsp + 0x9e0]
mov edx, 0x80002728
lea rcx, [rsp + 0x70]
call fcn.160106504
mov dword [rsp + 0x40], r13d
lea rax, [0x160274d48]
mov qword [rsp + 0x38], rax
lea rax, [0x160203cb4]
mov qword [rsp + 0x30], rax
lea rax, str.SearchFilterHost
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r8, rdi
mov rdx, r12
mov ecx, 0x209
call fcn.1600cacf4
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop
lea rcx, [rsp + 0x70]
call fcn.1600c0898
nop
jmp 0x16003e8da
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x16003e8ef
movzx esi, ax
or esi, 0x80070000
jmp 0x16003e8ef
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test eax, eax
jle 0x16003e902
movzx esi, ax
or esi, 0x80070000
jmp 0x16003e902
xor r8d, r8d
lea rdx, [0x1601f9508]
call fcn.1600c260c
nop
jmp 0x16003e942