Function at 0x140001190
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rsi, qword [0x140004460]
mov ecx, 0xd
xor eax, eax
mov r9d, dword [rsi]
lea r8, [rsp + 0x20]
mov rdi, r8
rep stosq qword [rdi], rax
test r9d, r9d
jne 0x1400014a0
mov rax, qword gs:[0x30]
mov rbx, qword [0x1400043a0]
mov rdi, qword [rax + 8]
xor ebp, ebp
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011f9
cmp rdi, rax
je 0x140001440
mov ecx, 0x3e8
call r12
mov rax, rbp
lock cmpxchg qword [rbx], rdi
test rax, rax
jne 0x1400011e8
mov rdi, qword [0x1400043b0]
xor ebp, ebp
mov eax, dword [rdi]
cmp eax, 1
je 0x140001457
mov eax, dword [rdi]
test eax, eax
je 0x1400014d0
mov dword [0x140007008], 1
mov eax, dword [rdi]
cmp eax, 1
je 0x14000146c
test ebp, ebp
je 0x14000148d
mov rax, qword [0x140004350]
mov rax, qword [rax]
test rax, rax
je 0x14000125c
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140001af0
lea rcx, [0x140001e40]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140004390]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140001850
mov rax, qword [0x140004360]
mov qword [0x140007188], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__wcmdln
xor ecx, ecx
mov rax, qword [rax]
test rax, rax
jne 0x1400012c3
jmp 0x140001308
test dx, dx
je 0x1400012e0
and ecx, 1
je 0x1400012e0
mov ecx, 1
add rax, 2
movzx edx, word [rax]
cmp dx, 0x20
jbe 0x1400012b0
mov r8d, ecx
xor r8d, 1
cmp dx, 0x22
cmove ecx, r8d
jmp 0x1400012bf
sub edx, 1
cmp dx, 0x1f
ja 0x140001301
nop dword [rax]
movzx ebx, word [rax + 2]
add rax, 2
lea edx, [rbx - 1]
cmp dx, 0x1f
jbe 0x1400012f0
mov qword [0x140007180], rax
mov r8d, dword [rsi]
test r8d, r8d
je 0x140001326
mov eax, 0xa
test byte [rsp + 0x5c], 1
jne 0x140001430
mov dword [section..data], eax
mov ebx, dword [0x140007028]
lea r13d, [rbx + 1]
movsxd r13, r13d
shl r13, 3
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, qword [0x140007020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c5
xor esi, esi
lea r12d, [rbx - 1]
mov rax, qword [rdi + rsi*8]
cmp word [rax], 0
je 0x1400013b3
nop dword [rax]
mov r8d, 1
nop word cs:[rax + rax]
add r8, 1
cmp word [rax + r8*2 - 2], 0
jne 0x140001370
lea rbx, [r8 + r8]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rbx
mov qword [rbp + rsi*8], rax
mov rdx, qword [rdi + rsi*8]
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
lea rax, [rsi + 1]
cmp r12, rsi
je 0x1400013c0
mov rsi, rax
mov rax, qword [rdi + rsi*8]
cmp word [rax], 0
jne 0x140001360
mov ebx, 2
jmp 0x140001381
lea rax, [rbp + r13 - 8]
mov qword [rax], 0
mov qword [0x140007020], rbp
call fcn.140001640
mov rax, qword [0x140004370]
mov r8, qword [0x140007018]
mov ecx, dword [0x140007028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140007020]
call fcn.140001580
mov ecx, dword [0x14000700c]
mov dword [0x140007010], eax
test ecx, ecx
je 0x1400014ee
mov edx, dword [0x140007008]
test edx, edx
je 0x1400014b0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movzx eax, word [rsp + 0x60]
jmp 0x140001320
mov rdi, qword [0x1400043b0]
mov ebp, 1
mov eax, dword [rdi]
cmp eax, 1
jne 0x14000121a
mov ecx, 0x1f
call fcn.1400027f0
mov eax, dword [rdi]
cmp eax, 1
jne 0x140001239
mov rdx, qword [0x1400043d0]
mov rcx, qword [0x1400043c0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rdi], 2
test ebp, ebp
jne 0x140001241
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001241
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
jmp 0x1400011c4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140007010]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [0x1400043f0]
mov rcx, qword [0x1400043e0]
mov dword [rdi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000122e
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop word cs:[rax + rax]
sub rsp, 0x28
mov rax, qword [0x140004460]
mov dword [rax], 1
call fcn.140001190
nop
nop
add rsp, 0x28
ret