Function at 0x1400010b0
Capabilities:
Accept command line arguments
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400090d8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x1a0], r15
mov dword [rsp + 0x54], r9d
call fcn.140001df0
test byte [0x1400098c0], 1
je 0x1400010f2
call fcn.140005634
lea rcx, [0x1400097f0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x140009018]
lea r9, [0x140009030]
mov dword [rsp + 0x44], 1
lea r8, [0x140009010]
xorps xmm1, xmm1
mov byte [rsp + 0x40], 0
lea rdx, [0x140001e70]
movups xmm0, xmmword [rax - 0x10]
lea rcx, [rbp - 0x40]
movdqu xmmword [0x140009038], xmm1
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_EventRegister]
test eax, eax
jne 0x140001164
mov r8, qword [0x140009018]
lea edx, [rax + 2]
mov rcx, qword [0x140009030]
movzx r9d, word [r8]
call qword [sym.imp.ADVAPI32.dll_EventSetInformation]
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1e0], rdi
call qword [sym.imp.iertutil.dll_Ordinal_798]
test eax, eax
js 0x140001cb4
lea rcx, [rbp - 0x50]
movaps xmmword [rsp + 0x190], xmm6
call qword [sym.imp.api_ms_win_downlevel_ole32_l1_1_0.dll_CoCreateGuid]
test eax, eax
jns 0x1400011ad
movups xmm6, xmmword [0x1400065c0]
movaps xmmword [rbp - 0x50], xmm6
jmp 0x1400011b1
movaps xmm6, xmmword [rbp - 0x50]
call qword [sym.imp.msIso.dll_Ordinal_207]
movups xmmword [rax], xmm6
call qword [sym.imp.msIso.dll_Ordinal_207]
mov byte [rax + 0x10], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
movaps xmm6, xmmword [rsp + 0x190]
lea rsi, str.ETW0
mov dword [rsp + 0x60], eax
xor r15d, r15d
mov rax, qword gs:[0x58]
movabs rbx, 0x400000000000
mov edi, 1
add rdi, qword [rax]
cmp dword [0x140009010], 5
mov qword [rsp + 0x78], rdi
mov byte [rdi], 1
jbe 0x14000132e
test qword [0x140009020], rbx
je 0x14000132e
mov rax, qword [0x140009028]
and rax, rbx
cmp rax, qword [0x140009028]
jne 0x14000132e
mov ecx, 0x10000003
call qword [sym.imp.iertutil.dll_Ordinal_796]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x10
call qword [sym.imp.msIso.dll_Ordinal_207]
mov qword [rbp + 0x50], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x58], 0x10
mov byte [rsp + 0x48], 1
mov qword [rbp + 0x68], 1
mov qword [rbp + 0x78], 4
movzx eax, word [0x140006da2]
mov dword [rbp - 0x74], eax
mov rax, qword [0x140009018]
mov qword [rbp + 0x20], rax
mov qword [rbp - 0x70], rbx
mov ebx, r15d
mov dword [rbp - 0x78], 0xb000000
movzx eax, word [rax]
mov dword [rbp + 0x28], eax
lea rax, [0x140006dac]
mov qword [rbp + 0x30], rax
lea rax, [0x140006eac]
sub eax, esi
mov dword [rbp + 0x2c], 2
mov dword [rbp + 0x38], 0x5d
mov dword [rbp + 0x3c], 1
mov dword [rsp + 0x4c], eax
cmp byte [rdi], r15b
jne 0x1400012fc
mov ecx, 0x20000019
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
je 0x1400012f7
call fcn.14000579c
test al, al
je 0x1400012fc
mov ebx, 2
mov rcx, qword [0x140009030]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x78]
mov dword [rsp + 0x30], 6
mov r9d, ebx
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_EventWriteEx]
xor r8d, r8d
mov byte [rdi], r15b
lea rcx, [0x140006948]
lea edx, [r8 + 1]
call qword [sym.imp.iertutil.dll_Ordinal_797]
test eax, eax
js 0x140001c34
mov qword [rsp + 0x1b8], r12
lea rdx, [0x140001f20]
mov qword [rsp + 0x1b0], r13
lea rcx, [0x1400097e0]
xor r9d, r9d
mov qword [rsp + 0x1a8], r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
cmp dword [0x140009750], 2
jne 0x1400013df
cmp dword [0x140009744], 6
jne 0x1400013df
cmp dword [0x140009748], 1
jne 0x1400013df
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], r15d
call qword [sym.imp.msvcrt.dll_rand_s]
test eax, eax
jne 0x1400013df
movzx eax, byte [rsp + 0x50]
mov ebx, r15d
add eax, 1
mov dword [rsp + 0x50], eax
je 0x1400013df
nop
xor ecx, ecx
mov edx, 0x10000
mov r8d, 0x2000
lea r9d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
inc ebx
cmp ebx, dword [rsp + 0x50]
jb 0x1400013c0
mov rcx, qword [0x1400090a8]
test rcx, rcx
je 0x140001408
call qword [sym.imp.iertutil.dll_Ordinal_701]
test eax, eax
js 0x140001451
mov ecx, r15d
sete cl
mov dword [0x1400090b0], ecx
mov qword [0x1400090a8], r15
mov eax, dword [0x1400090b0]
test eax, eax
je 0x140001451
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001444
lea rdx, str.SetSearchPathMode
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001444
mov ecx, 1
call qword [0x1400064c0]
lea rcx, [0x1400065d0]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8d, 0x27
lea rcx, str.28fb17e0_d393_439d_9a21_9474a070473a
mov rdx, rax
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
je 0x140001486
mov dword [rsp + 0x4c], r15d
jmp 0x140001492
mov dword [rsp + 0x4c], 1
add rbx, 0x4e
movzx eax, word [rbx]
cmp ax, 0x22
jne 0x1400014c0
nop dword [rax + rax]
movzx eax, word [rbx + 2]
mov rcx, rbx
add rbx, 2
test ax, ax
je 0x1400014f6
cmp ax, 0x22
jne 0x1400014a0
movzx eax, word [rcx + 4]
lea rbx, [rcx + 4]
jmp 0x1400014de
cmp ax, 0x20
jbe 0x1400014de
nop word [rax + rax]
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x20
ja 0x1400014d0
test ax, ax
je 0x1400014f6
cmp ax, 0x20
ja 0x1400014f6
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400014e3
mov r14, 0xffffffffffffffff
mov r12, r14
inc r12
cmp word [rbx + r12*2], r15w
jne 0x140001500
inc r12d
mov ecx, 0x40
mov esi, r12d
lea rdx, [r12 + r12]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov r13d, 5
test rax, rax
je 0x1400016ef
lea rcx, [r12 - 1]
mov edx, 0x7ffffffe
cmp rcx, rdx
mov eax, r15d
mov r8d, 0x80070057
cmova eax, r8d
test eax, eax
js 0x140001599
mov rcx, rdi
test r12d, r12d
je 0x14000157f
sub rdx, rsi
sub rbx, rdi
nop dword [rax]
lea rax, [rdx + rsi]
test rax, rax
je 0x14000157f
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14000157f
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x140001560
test rsi, rsi
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov eax, 0x8007007a
cmovne eax, r15d
jmp 0x1400015a2
test r12d, r12d
je 0x1400015a2
mov word [rdi], r15w
test eax, eax
js 0x1400016ef
mov r14d, 0xffdf
lea rdx, str._eval
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140001612
mov rcx, r13
call fcn.14000305c
movsxd rdx, eax
movzx eax, word [rsi + rdx*2]
lea r8, [rsi + rdx*2]
test r14w, ax
jne 0x140001612
cmp rsi, rdi
je 0x1400015ed
cmp word [rsi - 2], 0x20
jne 0x140001612
cmp ax, 0x20
jne 0x1400016cd
nop word [rax + rax]
add r8, 2
inc edx
cmp word [r8], 0x20
je 0x140001600
jmp 0x1400016cd
lea rdx, str._new
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x14000166f
mov ecx, 4
call fcn.14000305c
movsxd rdx, eax
movzx eax, word [rsi + rdx*2]
lea r8, [rsi + rdx*2]
test r14w, ax
jne 0x14000166f
cmp rsi, rdi
je 0x140001651
cmp word [rsi - 2], 0x20
jne 0x14000166f
cmp ax, 0x20
jne 0x1400016cd
nop word [rax + rax]
add r8, 2
inc edx
cmp word [r8], 0x20
je 0x140001660
jmp 0x1400016cd
lea rdx, str._nowait
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400016e8
mov ecx, 7
call fcn.14000305c
movsxd rdx, eax
movzx eax, word [rsi + rdx*2]
lea r8, [rsi + rdx*2]
test r14w, ax
jne 0x1400016e8
cmp rsi, rdi
je 0x1400016ae
cmp word [rsi - 2], 0x20
jne 0x1400016e8
cmp ax, 0x20
jne 0x1400016cd
nop dword [rax]
nop dword [rax + rax]
add r8, 2
inc edx
cmp word [r8], 0x20
je 0x1400016c0
mov eax, r12d
mov rcx, rsi
sub eax, edx
mov edx, eax
mov ebx, eax
call fcn.1400050c0
mov word [rdi + rbx*2], r15w
jmp 0x1400015b0
mov r14, 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.140001d90
mov ecx, 0x10000031
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
lea rdx, str.Microsoft.InternetExplorer.Default
lea rcx, str.Microsoft.InternetExplorer.Preview
cmove rcx, rdx
call qword [sym.imp.api_ms_win_downlevel_shell32_l1_1_0.dll_SetCurrentProcessExplicitAppUserModelID]
mov rbx, r14
nop
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x140001730
lea rdx, str._ResetDestinationList
mov rcx, rdi
inc ebx
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400017c3
mov ecx, 0x15
call fcn.14000305c
movsxd rcx, eax
mov r12d, 0xffdf
lea r8, [rsi + rcx*2]
movzx ecx, word [rsi + rcx*2]
test r12w, cx
jne 0x1400017c9
cmp rsi, rdi
je 0x140001781
cmp word [rsi - 2], 0x20
jne 0x1400017c9
cmp cx, 0x20
jne 0x14000179d
nop word [rax + rax]
add r8, 2
inc eax
cmp word [r8], 0x20
je 0x140001790
sub ebx, eax
mov rcx, rsi
mov edx, ebx
call fcn.1400050c0
mov word [rdi + rbx*2], r15w
call fcn.1400034b8
call qword [sym.imp.IEFRAME.dll_Ordinal_212]
mov dword [rsp + 0x44], r15d
jmp 0x140001c06
mov r12d, 0xffdf
mov rcx, r14
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x1400017d0
inc rcx
call fcn.14000308c
lea rdx, str._newtab
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rbx, rax
test rax, rax
je 0x140001955
mov ecx, 7
call fcn.14000305c
movsxd rcx, eax
test word [rbx + rcx*2], r12w
jne 0x140001955
cmp rbx, rdi
je 0x140001826
cmp word [rbx - 2], 0x20
jne 0x140001955
mov rbx, r15
mov esi, 0x80004005
nop
xor r9d, r9d
lea r8, str.IEFrame
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400018c4
lea rdx, [rsp + 0x64]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, rbx
mov esi, 0x800700aa
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1400018ba
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400018ba
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x190
mov edx, 0x80da
mov rcx, rbx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
cmovne esi, dword [rsp + 0x70]
test esi, esi
js 0x140001830
jmp 0x1400018d0
test esi, esi
js 0x140001955
nop dword [rax]
inc r14
cmp word [rdi + r14*2], r15w
jne 0x1400018d0
lea rdx, str._newtab
mov rcx, rdi
inc r14d
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140001c06
mov ecx, 7
call fcn.14000305c
movsxd rcx, eax
lea r8, [rsi + rcx*2]
movzx ecx, word [rsi + rcx*2]
test r12w, cx
jne 0x140001c06
cmp rsi, rdi
je 0x140001928
cmp word [rsi - 2], 0x20
jne 0x140001c06
cmp cx, 0x20
jne 0x14000193d
nop
add r8, 2
inc eax
cmp word [r8], 0x20
je 0x140001930
sub r14d, eax
mov rcx, rsi
mov edx, r14d
call fcn.1400050c0
mov word [rdi + r14*2], r15w
jmp 0x140001c06
mov rcx, qword [0x140009098]
test rcx, rcx
je 0x14000197e
call qword [sym.imp.iertutil.dll_Ordinal_701]
test eax, eax
js 0x14000198f
mov ecx, r15d
sete cl
mov dword [0x1400090a0], ecx
mov qword [0x140009098], r15
mov eax, dword [0x1400090a0]
mov rcx, 0xfffffffffffffffe
test eax, eax
jne 0x140001996
mov rcx, 0xfffffffffffffffc
call qword [sym.imp.USER32.dll_SetProcessDpiAwarenessContext]
mov r8d, 7
lea rdx, str.SCODEF:
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
jne 0x140001b70
movzx ecx, word [rdi + 0xe]
lea rbx, [rdi + 0xe]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x1400019e8
nop dword [rax]
cmp word [rbx], r15w
je 0x1400019e8
movzx ecx, word [rbx + 2]
add rbx, 2
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
je 0x1400019d0
movzx ecx, word [rbx]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
je 0x140001a12
nop word [rax + rax]
movzx ecx, word [rbx + 2]
add rbx, 2
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140001a00
mov r8d, 7
lea rdx, str.CREDAT:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
jne 0x140001b70
cmp dword [rsp + 0x4c], r15d
jne 0x140001b63
cmp dword [0x140009010], r13d
mov rbx, qword [rsp + 0x78]
mov byte [rbx], 1
jbe 0x140001b4b
movabs rsi, 0x400000000000
test qword [0x140009020], rsi
je 0x140001b4b
mov rax, qword [0x140009028]
and rax, rsi
cmp rax, qword [0x140009028]
jne 0x140001b4b
mov ecx, 0x10000003
call qword [sym.imp.iertutil.dll_Ordinal_796]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x10
call qword [sym.imp.msIso.dll_Ordinal_207]
mov qword [rbp], rax
lea rax, [rsp + 0x49]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], 0x10
mov byte [rsp + 0x49], 1
mov qword [rbp + 0x18], 1
movzx eax, word [0x140006cda]
lea rcx, str.ETW0
mov dword [rbp - 0x64], eax
mov rax, qword [0x140009018]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x68], 0xb000000
mov qword [rbp - 0x60], rsi
movzx eax, word [rax]
mov dword [rbp - 0x28], eax
lea rax, [0x140006ce4]
mov qword [rbp - 0x20], rax
lea rax, [0x140006eac]
sub eax, ecx
mov dword [rbp - 0x24], 2
mov dword [rbp - 0x18], 0x4e
mov dword [rbp - 0x14], 1
mov dword [rsp + 0x5c], eax
call fcn.140003144
mov rcx, qword [0x140009030]
lea rdx, [rbp - 0x68]
mov r9d, eax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_EventWriteEx]
mov edx, dword [rsp + 0x54]
mov rcx, rdi
mov byte [rbx], r15b
mov byte [rsp + 0x40], 1
call qword [sym.imp.IEFRAME.dll_Ordinal_251]
mov r13d, eax
mov dword [rsp + 0x44], r13d
jmp 0x140001c06
cmp word [rdi + r14*2 + 2], r15w
lea r14, [r14 + 1]
jne 0x140001b70
lea rcx, [r14 + 1]
call fcn.14000308c
lea rdx, str._embedding
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rbx, rax
test rax, rax
je 0x140001bea
mov ecx, 0xa
call fcn.14000305c
movsxd rcx, eax
test word [rbx + rcx*2], r12w
jne 0x140001bea
cmp rbx, rdi
je 0x140001bbd
cmp word [rbx - 2], 0x20
jne 0x140001bea
lea rdx, str._startmanager
mov rcx, rdi
call fcn.140002040
test al, al
je 0x140001bea
mov r9d, dword [rsp + 0x4c]
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.IEFRAME.dll_Ordinal_258]
jmp 0x140001c02
mov r9d, dword [rsp + 0x4c]
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.IEFRAME.dll_Ordinal_255]
mov dword [rsp + 0x44], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1b8]
cmp byte [rsp + 0x40], r15b
jne 0x140001cbc
jmp 0x140001c39
mov dword [rsp + 0x44], r15d
mov rcx, qword [0x140006140]
lea r9, [rsp + 0x6c]
mov edx, 1
mov qword [rsp + 0x30], r15
mov r8d, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
call qword [sym.imp.iertutil.dll_Ordinal_650]
mov rcx, qword [0x140006148]
lea r9, [rsp + 0x68]
mov edx, 1
mov qword [rsp + 0x30], r15
mov r8d, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
call qword [sym.imp.iertutil.dll_Ordinal_650]
mov ecx, dword [rsp + 0x68]
lea rdx, [rbp - 0x80]
mov eax, dword [rsp + 0x6c]
shl rcx, 0x20
or rcx, rax
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x44]
call fcn.140003390
jmp 0x140001cbc
xor r15d, r15d
mov dword [rsp + 0x44], r15d
lea rcx, [0x1400097f0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.140001e30
mov rcx, qword [0x140009030]
call qword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_EventUnregister]
lea rax, [rsp + 0x5c]
mov qword [0x140009030], r15
mov qword [rsp + 0x30], rax
lea r8, str.TerminateOnShutdown
lea rax, [rsp + 0x58]
mov dword [0x140009010], r15d
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
mov r9d, 0x10
mov qword [rsp + 0x20], r15
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x5c], 4
call qword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
cmp dword [rsp + 0x58], 0
mov r15, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1d0]
je 0x140001d6a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140002500
add rsp, 0x1c0
pop rbp
ret