Function at 0x1400018c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x98
mov rax, qword [0x140066008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ecx, 0x84
call fcn.140002c10
lea rcx, [0x140062558]
mov qword [0x140078500], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, 0xffffffffffffffff
je 0x140001e3e
mov rcx, qword [0x140078500]
lea rdx, str.NtQuerySystemInformation
mov qword [rcx], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001e3e
mov rcx, qword [0x140078500]
lea rdx, str.NtWriteVirtualMemory
mov qword [rcx + 8], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001e3e
mov rcx, qword [0x140078500]
lea rdx, str.NtSetInformationFile
mov qword [rcx + 0x10], rax
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001e3e
mov rcx, qword [0x140078500]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0x90], rdi
mov qword [rcx + 0x28], rax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x78], r14
mov rcx, qword [rax + 0x60]
mov rax, qword [0x140078500]
mov qword [rax + 0x58], rcx
lea rsi, [rax + 0x60]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r14d, r14d
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov r9, rsi
mov dword [rsp + 0x20], r14d
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140001e3a
mov rsi, qword [0x140078500]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x68]
mov rcx, rax
mov dword [rsp + 0x28], r14d
mov r8, rdi
mov dword [rsp + 0x20], r14d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140001e3a
mov ebx, dword [0x140078508]
mov qword [rsp + 0x88], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, ebx
xor edx, edx
mov ecx, 0x400
mov esi, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12d, 0x14
mov rdi, rax
mov ecx, r12d
mov dword [rsp + 0x54], ecx
nop word [rax + rax]
mov edx, ecx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r10, qword [0x140078500]
lea r9, [rsp + 0x54]
mov r8d, dword [rsp + 0x54]
mov rdx, rax
mov ecx, 0x40
mov rbx, rax
call qword [r10 + 8]
cmp eax, 0xc0000004
jne 0x140001aba
mov ecx, dword [rsp + 0x54]
jmp 0x140001a80
test eax, eax
jne 0x140001e54
mov r8, qword [rbx]
test r8, r8
je 0x140001e54
mov qword [rsp + 0xa8], rbp
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x80], r13
mov edx, r14d
mov qword [rsp + 0x70], r15
nop word [rax + rax]
cmp qword [rcx - 8], rsi
jne 0x140001b01
mov eax, edi
cmp qword [rcx], rax
je 0x140001bc5
inc edx
add rcx, 0x28
movsxd rax, edx
cmp rax, r8
jb 0x140001af0
mov rax, r14
mov rbx, qword [0x140078500]
mov r13d, 0x1000
mov qword [rsp + 0x48], rbx
mov r15, r14
mov edi, r13d
mov rbp, qword [rbx + 0x68]
mov qword [rbx + 0x50], rax
mov rdx, rdi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x58]
mov r8d, r13d
mov rdx, rax
mov ecx, 0x40
mov rsi, rax
call qword [rbx + 8]
cmp eax, 0xc0000004
je 0x140001b65
test eax, eax
js 0x140001c06
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r13d, dword [rsp + 0x58]
mov ecx, 0x40
add r13d, 0x100
mov edi, r13d
mov edx, r13d
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [rsp + 0x58]
mov r8d, r13d
mov rdx, rax
mov ecx, 0x40
mov rsi, rax
call qword [rbx + 8]
test eax, eax
js 0x140001c06
xor edi, edi
cmp qword [rsi], rdi
jbe 0x140001c01
lea rcx, [rdi + rdi*4]
lea rbx, [rsi + rcx*8]
cmp bp, 4
jne 0x140001bd6
cmp dword [rbx + 0x18], 4
jmp 0x140001bdf
movsxd rax, edx
lea rcx, [rax + rax*4]
mov rax, qword [rbx + rcx*8 + 0x10]
jmp 0x140001b12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [rbx + 0x18]
jne 0x140001be7
cmp rbp, qword [rbx + 0x20]
je 0x140001bf2
inc edi
mov eax, edi
cmp rax, qword [rsi]
jb 0x140001bb1
jmp 0x140001bfc
mov r15, qword [rbx + 0x10]
mov r14d, 1
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
test rsi, rsi
je 0x140001c14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14d, r14d
je 0x140001b32
mov rax, qword [0x140078500]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xa8]
cmp qword [rax + 8], 0
mov qword [rax + 0x48], r15
mov r15, qword [rsp + 0x70]
je 0x140001e49
mov dword [rsp + 0x50], r12d
nop dword [rax]
mov edx, r12d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r10, qword [0x140078500]
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x50]
mov rdx, rax
mov ecx, 0x40
mov rbx, rax
call qword [r10 + 8]
cmp eax, 0xc0000004
jne 0x140001c8c
mov r12d, dword [rsp + 0x50]
jmp 0x140001c50
test eax, eax
jne 0x140001e49
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001e49
mov ecx, dword [rsp + 0x50]
lea rax, [rbx + 0x10]
nop dword [rax + rax]
cmp qword [rax + 8], 4
je 0x140001d3d
inc ecx
add rax, 0x28
mov dword [rsp + 0x50], ecx
cmp qword [rbx], 0
ja 0x140001cb0
xor r8d, r8d
mov ecx, r8d
mov rax, qword [0x140078500]
mov qword [rax + 0x40], rcx
mov rcx, qword [rax + 0x58]
movzx edx, word [rcx + 0x120]
cmp edx, 0x47ba
ja 0x140001d8d
je 0x140001db3
cmp edx, 0x3ad7
ja 0x140001d75
je 0x140001d27
cmp edx, 0x1db1
je 0x140001d5b
cmp edx, 0x23f0
je 0x140001d45
cmp edx, 0x2580
je 0x140001d45
cmp edx, 0x3839
jne 0x140001df0
mov dword [rax + 0x34], 0x358
mov dword [rax + 0x80], 1
jmp 0x140001de9
mov rcx, qword [rax]
xor r8d, r8d
jmp 0x140001cd1
mov dword [rax + 0x34], 0x348
mov dword [rax + 0x80], 1
jmp 0x140001de9
mov dword [rax + 0x30], 0x1f6
mov dword [rax + 0x34], 0x208
mov dword [rax + 0x80], 1
jmp 0x140001df0
cmp edx, 0x3fab
je 0x140001d27
cmp edx, 0x42ee
je 0x140001d27
cmp edx, 0x4563
jmp 0x140001d21
cmp edx, 0x4a64
ja 0x140001dc3
je 0x140001ddb
sub edx, 0x47bb
je 0x140001db3
sub edx, 0x2a6
je 0x140001ddb
sub edx, 1
je 0x140001ddb
cmp edx, 1
jne 0x140001df0
jmp 0x140001de2
mov dword [rax + 0x34], 0x360
mov dword [rax + 0x80], r8d
jmp 0x140001de9
cmp edx, 0x4f7c
je 0x140001ddb
cmp edx, 0x55f0
je 0x140001ddb
cmp edx, 0x585d
jne 0x140001df0
mov dword [rax + 0x80], r8d
mov dword [rax + 0x34], 0x4b8
mov dword [rax + 0x30], 0x232
mov ecx, dword [rax + 0x30]
add rcx, qword [rax + 0x48]
mov r12, qword [rsp + 0x88]
mov qword [rax + 0x38], rcx
mov eax, 1
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140002bf0
add rsp, 0x98
ret
xor eax, eax
jmp 0x140001e08
mov ecx, 1
call fcn.14000a970
int3
mov ecx, 1
call fcn.14000a970
int3
mov ecx, 1
call fcn.14000a970
int3