Function at 0x140002600
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x14000a020]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rsi, rcx
mov qword [rbp - 0x38], rcx
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140002652
mov rbx, qword [rcx]
add rdi, rbx
jmp 0x140002658
add rdi, rsi
mov rbx, rsi
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov ecx, r14d
mov qword [rbp - 0x20], rcx
mov r8d, 7
mov qword [rbp - 0x18], r8
mov word [rbp - 0x30], r14w
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x140002695
lea rcx, [rbp - 0x30]
call fcn.140004a20
mov ecx, r14d
mov qword [rbp - 0x20], rcx
mov r8, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x60], rax
cmp rbx, rdi
je 0x1400026e9
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x1400026ce
lea rax, [rcx + 1]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
cmp r8, 8
cmovae rax, qword [rbp - 0x30]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r14w
jmp 0x1400026d7
lea rcx, [rbp - 0x30]
call fcn.140004c00
inc rbx
cmp rbx, rdi
je 0x1400026e9
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
jmp 0x1400026a3
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x58], r14
mov dword [rbp - 0x60], 8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
lea rcx, [rbp - 0x10]
call fcn.140004180
mov rcx, rax
call fcn.140001990
mov r14, rax
lea rdx, [0x140007900]
lea rcx, [rbp - 0x10]
call fcn.140004260
mov rcx, rax
call fcn.140001990
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x10]
call fcn.140004420
mov rcx, rax
call fcn.140001990
mov rbx, rax
mov qword [rbp - 0x80], rax
lea rdx, [0x140007a00]
lea rcx, [rbp - 0x10]
call fcn.140004260
mov rcx, rax
call fcn.140001990
mov r12, rax
mov qword [rsp + 0x78], rax
lea rcx, [rbp - 0x10]
call fcn.1400040a0
mov rcx, rax
call fcn.140001990
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x10]
call fcn.140004180
mov rcx, rax
call fcn.140003e30
mov r15d, eax
lea rdx, [0x140007900]
lea rcx, [rbp - 0x10]
call fcn.140004260
mov rcx, rax
call fcn.140003e30
mov dword [rsp + 0x68], eax
lea rcx, [rbp - 0x10]
call fcn.140004420
mov rcx, rax
call fcn.140003e30
mov dword [rsp + 0x6c], eax
lea rdx, [0x140007a00]
lea rcx, [rbp - 0x10]
call fcn.140004260
mov rcx, rax
call fcn.140003e30
mov dword [rsp + 0x70], eax
lea rcx, [rbp - 0x10]
call fcn.1400040a0
mov rcx, rax
call fcn.140003e30
mov dword [rsp + 0x44], eax
mov rcx, r14
call fcn.140004da0
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x60]
mov r8d, dword [rbp - 0x60]
mov rdx, r13
mov ecx, 0x10
call fcn.140004e5a
mov edi, eax
cmp eax, 0xc0000004
jne 0x14000289a
test r13, r13
je 0x140002845
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400028f7
mov rcx, r14
call fcn.140004da0
mov dword [rsp + 0x20], r15d
lea r9, [rbp - 0x60]
mov r8d, dword [rbp - 0x60]
mov rdx, r13
mov ecx, 0x10
call fcn.140004e5a
mov edi, eax
cmp eax, 0xc0000004
je 0x140002832
mov rbx, qword [rbp - 0x80]
test edi, edi
jns 0x1400029c8
test r13, r13
je 0x1400028b5
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140002937
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002932
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002932
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140002937
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002932
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400028f0
call fcn.14000521c
xor edi, edi
mov word [rbp - 0x30], di
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rdi
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14000297f
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14000297a
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400029c1
mov rcx, r8
call fcn.14000521c
mov qword [rsi + 0x10], rdi
mov rax, rbx
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140004ea0
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001b50
nop
mov edx, eax
mov dword [rsp + 0x40], eax
xor r15d, r15d
mov dword [rsp + 0x50], r15d
cmp dword [r13], r15d
jbe 0x140002f44
lea rax, [r13 + 8]
mov qword [rsp + 0x48], rax
nop
movups xmm1, xmmword [rax]
movups xmmword [rbp - 0x78], xmm1
movsd xmm0, qword [rax + 0x10]
movsd qword [rbp - 0x68], xmm0
mov eax, r15d
movd ecx, xmm1
test cx, cx
sete al
cmp eax, edx
je 0x140002d1e
cmp dword [rbp - 0x68], 0x10
jb 0x140002d1e
mov dword [rbp + 0x18], 0x30
mov qword [rbp + 0x20], r15
mov dword [rbp + 0x30], r15d
mov qword [rbp + 0x28], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x38], xmm0
movzx eax, cx
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r15
mov rcx, qword [rsp + 0x60]
call fcn.140004da0
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x48]
lea r8, [rbp + 0x18]
mov edx, 0x40
lea rcx, [rbp - 0x50]
call fcn.140004dde
mov edi, eax
test eax, eax
js 0x140002d1a
cmp qword [rbp - 0x50], 0
je 0x140002d1a
mov rcx, rbx
call fcn.140004da0
movzx edx, word [rbp - 0x72]
mov eax, dword [rsp + 0x6c]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 0x1fffff
lea r9, [rbp - 0x58]
mov r8, 0xffffffffffffffff
mov rcx, qword [rbp - 0x50]
call fcn.140004df0
mov edi, eax
test eax, eax
js 0x140002d1a
cmp qword [rbp - 0x58], 0
je 0x140002d1a
mov dword [rbp - 0x5c], 8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rcx, r12
call fcn.140004da0
mov r14d, dword [rsp + 0x70]
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x5c]
mov r8, rbx
mov edx, 2
mov rcx, qword [rbp - 0x58]
call fcn.140004e02
mov edi, eax
cmp eax, 0xc0000004
jne 0x140002b9d
nop dword [rax]
test rbx, rbx
je 0x140002b43
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rbp - 0x5c]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, ebx
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140002d49
mov rcx, r12
call fcn.140004da0
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x5c]
mov r8, rbx
mov edx, 2
mov rcx, qword [rbp - 0x58]
call fcn.140004e02
mov edi, eax
cmp eax, 0xc0000004
je 0x140002b30
test edi, edi
js 0x140002ee1
mov rcx, r15
mov rdx, qword [rbx + 8]
lea r8, str.Process
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140002d1a
cmp rcx, 8
jne 0x140002bb3
mov dword [rbp + 0x10], 0x104
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140002d1a
mov qword [rbp - 0x10], r15
mov qword [rbp], r15
mov qword [rbp + 8], 7
lea rax, [rbp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002c10
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.1400037f0
lea r11, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r11, qword [rbp - 0x30]
lea r10, [rbp - 0x10]
mov rbx, qword [rbp - 0x10]
mov r12, qword [rbp + 8]
cmp r12, 8
cmovae r10, rbx
mov r14, qword [rbp - 0x20]
test r14, r14
jne 0x140002c65
mov r9, 0xffffffffffffffff
cmp qword [rbp], r9
cmovb r9, qword [rbp]
jmp 0x140002ccd
mov rcx, qword [rbp]
cmp r14, rcx
ja 0x140002cd7
sub rcx, r14
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r9, [r10 + rax*2]
movzx r15d, word [r11]
mov r8, r9
sub r8, r11
nop dword [rax]
cmp word [r9], r15w
jne 0x140002cb5
mov rdx, r14
mov rax, r11
test r14, r14
je 0x140002cc4
movzx ecx, word [rax]
cmp word [rax + r8], cx
jne 0x140002cb5
add rax, 2
sub rdx, 1
jmp 0x140002c9f
cmp r9, r10
je 0x140002cd7
sub r9, 2
sub r8, 2
jmp 0x140002c90
sub r9, r10
sar r9, 1
xor r15d, r15d
cmp r9, 0xffffffffffffffff
jne 0x140002de1
cmp r12, 8
jb 0x140002d12
lea rdx, [r12*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002d0a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002eda
mov rcx, rbx
call fcn.14000521c
xor r15d, r15d
mov r12, qword [rsp + 0x78]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x50]
inc ecx
mov dword [rsp + 0x50], ecx
mov rax, qword [rsp + 0x48]
add rax, 0x18
mov qword [rsp + 0x48], rax
cmp ecx, dword [r13]
jae 0x140002f44
mov rbx, qword [rbp - 0x80]
jmp 0x1400029f0
mov rbx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140002d8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f36
call fcn.14000521c
mov word [rbp - 0x30], r15w
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], r15
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140002dd8
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140002dd3
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002f3d
mov rcx, r8
call fcn.14000521c
mov qword [rsi + 0x10], r15
jmp 0x140002983
mov rcx, qword [rsp + 0x58]
call fcn.140004da0
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140002dfd
mov edx, dword [rsp + 0x44]
call fcn.140004e6c
mov rdi, qword [rbp - 0x58]
cmp r12, 8
jb 0x140002e3d
lea rdx, [r12*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002e34
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002eda
mov rcx, rbx
call fcn.14000521c
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140002e80
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000521c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140002ec7
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140002ec2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002ed3
mov rcx, r8
call fcn.14000521c
mov qword [rsi + 0x10], r15
mov rax, rdi
jmp 0x140002986
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140002d8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rsp + 0x58]
call fcn.140004da0
mov rcx, qword [rbp - 0x50]
mov r14d, dword [rsp + 0x44]
test rcx, rcx
je 0x140002f64
mov edx, r14d
call fcn.140004e6c
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140002f75
mov edx, r14d
call fcn.140004e6c
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3