Function at 0x10003f9c0
Capabilities:
Terminate process

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r13d, ecx
mov r8d, ecx
lea rdx, [0x10001c0f0]
mov ecx, 0x10
call fcn.1000660b0
xor r14d, r14d
cmp byte [0x1000bb01d], r14b
je 0x10003fa1b
mov rcx, qword [0x1000bb048]
cmp rcx, r14
je 0x10003fa1b
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x1000bafc8]
cmp rcx, r14
je 0x10003fa39
call sub.WTSAPI32.dll_WTSUnRegisterSessionNotification
mov rcx, qword [0x1000bafc8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.USER32.dll_ShowCursor]
mov rcx, qword [0x1000baff8]
call sub.msvcrt.dll_free
mov qword [0x1000baff8], r14
mov rcx, qword [0x1000bafb0]
cmp rcx, r14
je 0x10003fa6c
call sub.gdiplus.dll_GdiplusShutdown
cmp dword [0x1000b8904], r15d
jne 0x10003fa80
mov ecx, 0x21
call qword [sym.imp.WINMM.dll_timeEndPeriod]
mov rcx, qword [0x1000bafd8]
cmp rcx, r14
je 0x10003faa5
int3
mov qword [0x1000bafd8], r14
mov rbx, qword [0x1000bb010]
cmp rbx, r14
je 0x10003fac8
mov rcx, rbx
call fcn.100044a34
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x1000bb010], r14
mov rbx, qword [0x1000bb038]
cmp rbx, r14
je 0x10003fb18
lea rcx, [rbx + 0x30]
int3
mov qword [0x1000bb038], r14
mov rcx, qword [0x1000bb0e8]
cmp rcx, r14
je 0x10003fb33
mov edx, r15d
call fcn.10003fe64
mov qword [0x1000bb0e8], r14
mov rbx, qword [0x1000bb020]
mov qword [rsp + 0x68], rbx
cmp rbx, r14
je 0x10003fb75
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x10003fb5e
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x10], r14
mov rcx, qword [rbx + 0x30]
cmp rcx, r14
je 0x10003fb6d
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x1000bb020], r14
mov rbx, qword [0x1000bb028]
mov qword [rsp + 0x68], rbx
cmp rbx, r14
je 0x10003fbf0
mov ebp, r14d
cmp dword [rbx], r14d
jbe 0x10003fbd9
mov rsi, r14
mov rax, qword [rbx + 0x10]
mov rdi, qword [rsi + rax]
cmp rdi, r14
je 0x10003fbce
mov r12, qword [rdi + 8]
cmp r12, r14
je 0x10003fbbe
mov rcx, r12
call fcn.10006d08c
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, qword [rdi]
call sub.msvcrt.dll_free
mov rcx, rdi
call sub.msvcrt.dll_free
add ebp, r15d
add rsi, 8
cmp ebp, dword [rbx]
jb 0x10003fb98
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x10003fbe8
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x1000bb028], r14
mov rbx, qword [0x1000bb000]
mov qword [rsp + 0x68], rbx
cmp rbx, r14
je 0x10003fc80
mov rcx, qword [rbx + 0x2810]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
int3
mov qword [0x1000bb000], r14
mov ebp, r14d
cmp dword [0x1000bb938], r14d
jbe 0x10003fd5c
mov rdi, r14
mov ebx, dword [0x1000bb950]
mov rax, qword [0x1000bb930]
mov rcx, qword [rdi + rax]
mov edx, dword [rcx + 0x10]
cmp edx, r14d
je 0x10003fd22
mov r9d, ebx
xor r8d, r8d
lea rcx, [0x1000bb940]
call fcn.100049e90
movsxd r11, eax
mov rdx, r11
lea ecx, [rbx - 1]
cmp r11d, ecx
jae 0x10003fd1a
mov r8, rdx
shl r8, 3
mov r9, rdx
shl r9, 2
mov rdx, qword [0x1000bb940]
mov ecx, dword [r9 + rdx + 4]
mov dword [r9 + rdx], ecx
mov rcx, qword [0x1000bb948]
mov rax, qword [r8 + rcx + 8]
mov qword [r8 + rcx], rax
add r11d, r15d
add r9, 4
add r8, 8
mov ebx, dword [0x1000bb950]
lea eax, [rbx - 1]
cmp r11d, eax
jb 0x10003fce1
dec ebx
mov dword [0x1000bb950], ebx
mov rax, qword [0x1000bb930]
mov rsi, qword [rdi + rax]
cmp rsi, r14
je 0x10003fd49
mov rcx, qword [rsi + 8]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov ebx, dword [0x1000bb950]
add ebp, r15d
add rdi, 8
cmp ebp, dword [0x1000bb938]
jb 0x10003fca0
xor edx, edx
lea rcx, [0x1000bb928]
call fcn.1000519b8
mov edi, r14d
cmp dword [0x1000bb950], r14d
jbe 0x10003fdc7
mov rbx, r14
mov rax, qword [0x1000bb948]
mov rcx, qword [rbx + rax]
mov rcx, qword [rcx + 0x220]
cmp rcx, 0xffffffffffffffff
je 0x10003fd97
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1000bb948]
mov rsi, qword [rbx + rax]
cmp rsi, r14
je 0x10003fdb8
mov rcx, qword [rsi + 8]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
add edi, r15d
add rbx, 8
cmp edi, dword [0x1000bb950]
jb 0x10003fd79
mov dword [0x1000bb950], r14d
mov edi, r14d
cmp dword [0x1000b6e70], r14d
jbe 0x10003fe0d
mov rbx, r14
mov rcx, qword [0x1000b6e80]
mov rcx, qword [rbx + rcx]
call qword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov rcx, qword [0x1000b6e80]
mov rcx, qword [rbx + rcx]
call sub.msvcrt.dll_free
add edi, r15d
add rbx, 8
cmp edi, dword [0x1000b6e70]
jb 0x10003fddd
mov dword [0x1000b6e70], r14d
mov rcx, qword [0x1000bafb8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov cl, byte [0x1000bb01d]
call fcn.100067fdc
mov rcx, qword [0x1000bafe8]
cmp rcx, r14
je 0x10003fe4d
lea rax, [0x100015508]
mov qword [rcx], rax
call sub.msvcrt.dll_free
mov qword [0x1000bafe8], r14
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]