Function at 0x140004010
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140094010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [section..data]
xor ebp, ebp
mov qword [r11 - 0x30], rax
lea rax, [0x1400033e0]
mov qword [r11 - 0x28], rax
mov r9, rdx
mov qword [r11 - 0x20], rbp
mov r8d, ebp
mov qword [r11 - 0x18], rbp
lea ebx, [rbp + 1]
mov qword [0x1400968d0], rbp
test ecx, ecx
jle 0x1400040ef
mov r10d, ecx
lea r11, str.__debug
lea esi, [rbp + 0x2d]
lea edi, [rbp + 0x6e]
nop dword [rax + rax]
mov rdx, qword [r9]
mov rcx, rbp
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r11 + rcx - 1]
jne 0x1400040a6
cmp rcx, 8
jne 0x140004090
jmp 0x1400040b7
cmp byte [rdx], sil
jne 0x1400040c0
cmp byte [rdx + 1], 0x64
jne 0x1400040c0
cmp byte [rdx + 2], bpl
jne 0x1400040c0
mov dword [0x1400968d0], ebx
mov rdx, qword [r9]
movzx ecx, byte [rdx]
sub ecx, esi
jne 0x1400040d9
movzx ecx, byte [rdx + 1]
sub ecx, edi
jne 0x1400040d9
movzx ecx, byte [rdx + 2]
movzx eax, bpl
sub ecx, eax
test ecx, ecx
cmove r8d, ebx
add r9, 8
mov dword [0x1400968d4], r8d
sub r10, rbx
jne 0x140004080
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [0x140094c00]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x140004128
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, dword [0x140094c00]
lea rdx, str.Current_Session_ID___lu_for_Process_ID__u_n
mov r9d, eax
xor ecx, ecx
call fcn.140004c70
jmp 0x140004140
lea r8, str.SetGSessionId
mov ecx, 2
lea rdx, str._s_Failed_to_lookup_session_ID._n
call fcn.140004c70
cmp dword [0x1400968d4], ebp
jne 0x14000415b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x1400041f2
call fcn.140002a60
cmp dword [0x1400968d4], ebp
je 0x14000419e
call fcn.140002dd0
test al, al
je 0x140004195
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x14000418e
mov edx, dword [0x140094c00]
lea rcx, str.Session__lu__VM3DService_user_mode_started._n
call fcn.140004600
call fcn.1400035b0
jmp 0x1400041f2
lea rdx, str.VM3DService_user_mode_window_creation_failed._n
jmp 0x1400041eb
cmp dword [0x1400968d0], ebp
mov dword [0x140094c10], ebx
jne 0x1400041bd
lea rcx, str.This_should_run_as_a_Windows_service._n
call fcn.1400173b0
jmp 0x140004340
call fcn.140002dd0
cmp al, bl
jne 0x1400041e4
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x1400041dd
lea rcx, str.VM3DService_debug_console_mode_started._n
call fcn.140004600
call fcn.1400035b0
jmp 0x1400041f2
lea rdx, str.VM3DService_debug_mode_window_creation_failed._n
xor ecx, ecx
call fcn.140004c70
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x14000420f
mov edx, dword [0x140094c00]
lea rcx, str.__d__ServiceExit._n
call fcn.140004600
mov rcx, qword [0x140094c08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x1400966a0]
lea rsi, [0x1400966a0]
mov qword [0x140094c08], rbp
cmp rbx, rsi
je 0x14000428a
nop word [rax + rax]
mov rdi, qword [rbx]
mov ecx, 6
call fcn.140004c40
test al, al
je 0x140004260
mov edx, dword [rbx + 0x20]
lea rcx, str.Terminating_process__u_n
call fcn.140004600
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rax, qword [rbx + 8]
mov rcx, rbx
mov rdx, qword [rbx]
mov qword [rax], rdx
mov qword [rdx + 8], rax
call fcn.140017560
mov rbx, rdi
cmp rdi, rsi
jne 0x140004240
mov eax, dword [0x1400966c0]
test eax, eax
je 0x1400042da
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x20]
mov rax, qword [0x140096768]
call qword [0x14007b5a0]
mov ebx, eax
test eax, eax
jns 0x1400042d4
xor ecx, ecx
call fcn.140004c40
test al, al
je 0x1400042d4
lfence
mov r8d, ebx
lea rdx, str.ServiceExit
lea rcx, str._s:_CloseAdapter_failed:_0x_08x_n
call fcn.140004600
mov dword [0x1400966c0], ebp
mov rcx, qword [0x1400968e8]
test rcx, rcx
je 0x1400042f3
call qword [sym.imp.USER32.dll_UnregisterPowerSettingNotification]
mov qword [0x1400968e8], rbp
mov rcx, qword [0x1400966d0]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
lea rcx, [0x1400966d0]
mov r8d, 0x1b8
call fcn.1400074f0
mov rcx, qword [0x1400968e0]
mov byte [0x1400966cc], bpl
test rcx, rcx
je 0x14000432d
call qword [sym.imp.USER32.dll_UnhookWinEvent]
call fcn.140004a60
lea rdx, str.VM3DService_terminated.
xor ecx, ecx
call fcn.140004c70
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140006280
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret