Function at 0x140003890
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14d, ecx
call fcn.1400081c0
mov rdi, qword [0x140021b98]
mov rsi, rax
test rdi, rdi
jne 0x1400038d6
mov rcx, qword [rax + 0x30]
lea edx, [rdi + 1]
call fcn.1400051b0
mov rdi, rax
mov qword [0x140021b98], rax
mov rbx, qword [0x140021b88]
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0x70], r15
test rbx, rbx
jne 0x140003931
mov rcx, qword [rsi + 0x50]
call fcn.140002a20
test rax, rax
je 0x140003b76
xor edx, edx
mov rcx, rax
call fcn.1400051b0
mov rdx, qword [rdi + 0x20]
mov rcx, rax
mov rbx, rax
mov qword [0x140021b88], rax
call fcn.140004d00
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
call fcn.140005380
xor r13d, r13d
test eax, eax
jne 0x14000394c
mov ebp, r13d
jmp 0x140003959
mov edx, eax
mov rcx, rbx
call fcn.140004c70
mov rbp, rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
call fcn.140005380
test eax, eax
jne 0x140003971
mov rbx, r13
jmp 0x14000397e
mov edx, eax
mov rcx, rdi
call fcn.140004c70
mov rbx, rax
mov rdx, rbp
mov rsi, r13
sub rdx, rbx
mov r15, rbx
nop word [rax + rax]
movzx ecx, byte [rdx + r15]
cmp byte [r15], cl
jne 0x1400039ae
inc rsi
inc r15
cmp rsi, 0x18
jb 0x140003990
mov rax, rbx
jmp 0x140003b42
mov rdx, rbx
lea rcx, [rsi + rbp]
sub rdx, rbp
mov r8, rsi
nop dword [rax + rax]
cmp rsi, 0x18
jae 0x1400039d5
movzx eax, byte [rcx + 1]
inc rcx
inc rsi
cmp byte [rdx + rcx], al
jne 0x1400039c0
sub rsi, r8
jne 0x1400039e2
mov rax, rbx
jmp 0x140003b42
cmp r14d, 3
jne 0x140003adf
xorps xmm0, xmm0
lea r12, [r15 + rsi]
sub r15, rbx
lea r8d, [r14 + 0x2d]
lea rdx, [rsp + 0x30]
xor ecx, ecx
add r15, rbp
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003b76
cmp dword [rsp + 0x50], 0x1000
jne 0x140003ab5
mov ecx, dword [rsp + 0x54]
lea eax, [rcx - 0x10]
test eax, 0xffffffcf
jne 0x140003ab5
cmp ecx, 0x30
je 0x140003ab5
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x30]
test rbp, rbp
je 0x140003aba
mov rdi, rbp
test r14, r14
je 0x140003ab5
test rbp, rbp
je 0x140003ab5
test r15, r15
je 0x140003ab5
mov rbx, r14
cmp rbp, rsi
jb 0x140003ab5
nop dword [rax]
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003a8f
inc rbx
dec rdi
cmp rdi, rsi
jae 0x140003a70
jmp 0x140003ab5
test rbx, rbx
je 0x140003ab5
lea rcx, [rbx + rsi]
call fcn.140003b90
cmp rax, r12
je 0x1400039da
sub r14, rbx
dec r14
add rbp, r14
lea r14, [rbx + 1]
jne 0x140003a52
mov rbp, qword [rsp + 0x48]
add r13, rbp
lea rdx, [rsp + 0x30]
mov rcx, r13
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003b76
jmp 0x140003a22
cmp r14d, 2
jne 0x140003b40
lea r9d, [r14 + 2]
mov r8d, 0x3000
lea rdx, [rsi + 0xe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140003b81
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x25ff
lea rax, [rsi + rbx]
mov dword [rdi + rsi + 2], r13d
lea r9, [rsp + 0x60]
lea r8d, [r14 + 0x1e]
mov qword [rdi + rsi + 6], rax
lea rdx, [rsi + 0xe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rdi
jmp 0x140003b42
xor eax, eax
mov r15, qword [rsp + 0x70]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140009ae0
add rsp, 0x78
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3