Function at 0x140001190
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov ecx, 0xd
xor eax, eax
lea r8, [rsp + 0x20]
mov rdi, r8
rep stosq qword [rdi], rax
mov rdi, qword [0x140004460]
mov r9d, dword [rdi]
test r9d, r9d
jne 0x140001470
mov rax, qword gs:[0x30]
mov rbx, qword [0x1400043a0]
mov rsi, qword [rax + 8]
xor ebp, ebp
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011f9
cmp rsi, rax
je 0x140001410
mov ecx, 0x3e8
call r12
mov rax, rbp
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011e8
mov rsi, qword [0x1400043b0]
xor ebp, ebp
mov eax, dword [rsi]
cmp eax, 1
je 0x140001427
mov eax, dword [rsi]
test eax, eax
je 0x1400014a0
mov dword [0x140007008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000143c
test ebp, ebp
je 0x14000145d
mov rax, qword [0x140004350]
mov rax, qword [rax]
test rax, rax
je 0x14000125c
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140001ab0
lea rcx, [0x140001e00]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140004390]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140001810
mov rax, qword [0x140004360]
mov qword [0x140007188], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__acmdln
xor ecx, ecx
mov rax, qword [rax]
test rax, rax
jne 0x1400012c2
jmp 0x140001300
test dl, dl
je 0x1400012f9
and ecx, 1
je 0x1400012e0
mov ecx, 1
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x20
jle 0x1400012b0
mov r8d, ecx
xor r8d, 1
cmp dl, 0x22
cmove ecx, r8d
jmp 0x1400012be
test dl, dl
je 0x1400012f9
nop dword [rax]
movzx edx, byte [rax + 1]
add rax, 1
test dl, dl
je 0x1400012f9
cmp dl, 0x20
jle 0x1400012e8
mov qword [0x140007180], rax
mov r8d, dword [rdi]
test r8d, r8d
je 0x14000131e
mov eax, 0xa
test byte [rsp + 0x5c], 1
jne 0x140001400
mov dword [section..data], eax
mov ebx, dword [0x140007028]
lea r12d, [rbx + 1]
movsxd r12, r12d
shl r12, 3
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r13, qword [0x140007020]
mov rdi, rax
test ebx, ebx
jle 0x14000138b
lea ebp, [rbx - 1]
xor ebx, ebx
nop word [rax + rax]
mov rcx, qword [r13 + rbx*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rdi + rbx*8], rax
mov rdx, qword [r13 + rbx*8]
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rax, rbx
add rbx, 1
cmp rbp, rax
jne 0x140001350
lea rax, [rdi + r12 - 8]
mov qword [rax], 0
mov qword [0x140007020], rdi
call fcn.140001600
mov rax, qword [0x140004370]
mov r8, qword [0x140007018]
mov ecx, dword [0x140007028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140007020]
call fcn.140002a10
mov ecx, dword [0x14000700c]
mov dword [0x140007010], eax
test ecx, ecx
je 0x1400014be
mov edx, dword [0x140007008]
test edx, edx
je 0x140001480
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movzx eax, word [rsp + 0x60]
jmp 0x140001318
mov rsi, qword [0x1400043b0]
mov ebp, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x14000121a
mov ecx, 0x1f
call fcn.1400027b0
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001239
mov rdx, qword [0x1400043d0]
mov rcx, qword [0x1400043c0]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test ebp, ebp
jne 0x140001241
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001241
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
jmp 0x1400011c4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140007010]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [0x1400043f0]
mov rcx, qword [0x1400043e0]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000122e
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop word cs:[rax + rax]
sub rsp, 0x28
mov rax, qword [0x140004460]
mov dword [rax], 1
call fcn.140001190
nop
nop
add rsp, 0x28
ret