Function at 0x140004600
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rbp
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xd8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdx, qword [0x14001f718]
mov r15, rcx
test rdx, rdx
je 0x140004aeb
mov rax, qword [0x14001f720]
test rax, rax
je 0x140004aeb
cmp qword [0x14001f728], 0
je 0x140004aeb
mov qword [r11 + 0x10], rbx
lea rbx, [0x14001f088]
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x18], r12
xor r12d, r12d
xor esi, esi
mov qword [r11 - 0x20], r13
mov dword [rbp - 0x61], esi
mov qword [r11 - 0x28], r14
mov qword [0x14001f088], rdx
mov qword [0x14001f0b8], rax
mov qword [rbp - 0x59], rbx
nop dword [rax]
mov rdx, qword [rbx - 8]
lea rcx, str.____ObjectCallblacks__tEnumerating__s_object_callbacks_:__n
call fcn.140001480
mov rbx, qword [rbx]
call fcn.140008270
lea r8, [rbp - 1]
mov ecx, 8
lea rdx, [rbx + rax]
call fcn.140005ef0
mov rbx, qword [0x14001f728]
lea r8, [rbp + 7]
mov rdi, qword [rbp - 1]
mov ecx, 8
add rbx, rdi
mov rdx, rbx
mov qword [rbp - 0x69], rbx
call fcn.140005ef0
mov r13, qword [rbp + 7]
cmp r13, rbx
je 0x140004a87
nop word [rax + rax]
lea rdx, [r13 + 0x20]
mov ecx, 8
lea r8, [rbp + 0xf]
call fcn.140005ef0
cmp qword [rbp + 0xf], rdi
jne 0x140004b34
lea rdx, [r13 + 0x10]
mov ecx, 4
lea r8, [rbp - 9]
call fcn.140005ef0
mov eax, dword [rbp - 9]
sub eax, 1
je 0x140004746
sub eax, 1
je 0x14000473d
cmp eax, 1
jne 0x140004afb
lea r8, str.creations__duplications
jmp 0x14000474d
lea r8, str.duplications
jmp 0x14000474d
lea r8, str.creations
mov rdx, r13
lea rcx, str.____ObjectCallblacks__t_tCallback_at__p_for_handle__s:_n
call fcn.140001480
lea rsi, [r13 + 0x14]
mov ecx, 4
mov rdx, rsi
lea r8, [rbp - 5]
call fcn.140005ef0
mov r14d, dword [rbp - 5]
cmp r14d, 1
ja 0x140004b1d
lea rax, str.Enabled
test r14d, r14d
lea rdx, str.Disabled
cmovne rdx, rax
lea rcx, str.____ObjectCallblacks__t_t_tStatus:__s_n
call fcn.140001480
lea rdx, [r13 + 0x28]
mov ecx, 8
lea r8, [rbp + 0x17]
call fcn.140005ef0
mov rdi, qword [rbp + 0x17]
test rdi, rdi
je 0x1400048f0
lea rdx, [rbp - 0x19]
mov rcx, rdi
call fcn.140008420
mov r9, qword [rbp - 0x19]
lea rcx, str.____ObjectCallblacks__t_t_tPreoperation_at_0x_016llx___s__0x_llx__n
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.140001480
xor r10d, r10d
lea r9, str.360qpesv.sys
nop
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140004814
add rax, 2
test ecx, ecx
jne 0x140004800
test edx, edx
je 0x14000482d
inc r10d
add r9, 8
cmp r10d, 0x405
jb 0x1400047f0
jmp 0x1400048ec
lea rcx, str.____ObjectCallblacks__t_t_tCallback_belongs_to_an_EDR
call fcn.140001480
test r14d, r14d
je 0x1400048e0
lea rcx, str.and_is_enabled_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov rcx, qword [r15 + 8]
mov dword [rbp - 0x51], 1
mov qword [rbp - 0x49], rbx
mov dword [rbp - 0x21], 0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x41], rsi
cmp qword [r15], rcx
jne 0x1400048aa
lea rcx, [rcx*2 + 1]
mov eax, 0x38
mul rcx
mov qword [r15 + 8], rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword [r15 + 0x10]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140004b12
mov qword [r15 + 0x10], rax
imul rcx, qword [r15], 0x38
movups xmm0, xmmword [rbp - 0x51]
movups xmm1, xmmword [rbp - 0x41]
mov rax, qword [r15 + 0x10]
movups xmmword [rcx + rax], xmm0
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rcx + rax + 0x10], xmm1
movsd xmm1, qword [rbp - 0x21]
movups xmmword [rcx + rax + 0x20], xmm0
movsd qword [rcx + rax + 0x30], xmm1
inc qword [r15]
or r12d, 1
jmp 0x1400048ec
lea rcx, str.but_is_disabled.
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov rbx, qword [rbp - 0x69]
lea rdx, [r13 + 0x30]
mov ecx, 8
lea r8, [rbp + 0x1f]
call fcn.140005ef0
mov rdi, qword [rbp + 0x1f]
test rdi, rdi
je 0x140004a62
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.140008420
mov r9, qword [rbp - 0x11]
lea rcx, str.____ObjectCallblacks__t_t_tPostoperation_at_0x_016llx___s__0x_llx__n
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.140001480
test r14d, r14d
je 0x140004a5e
xor r10d, r10d
lea r9, str.360qpesv.sys
nop word [rax + rax]
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140004974
add rax, 2
test ecx, ecx
jne 0x140004960
test edx, edx
je 0x14000498d
inc r10d
add r9, 8
cmp r10d, 0x405
jb 0x140004950
jmp 0x140004a5e
lea rcx, str.____ObjectCallblacks__t_t_tCallback_belongs_to_an_EDR
call fcn.140001480
lea rcx, str.and_is_enabled_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov rdx, qword [r15]
test rdx, rdx
je 0x1400049ca
imul r8, rdx, 0x38
add r8, qword [r15 + 0x10]
cmp dword [r8 - 0x38], 1
jne 0x1400049ca
lea rax, [r13 + 0x14]
cmp qword [r8 - 0x28], rax
je 0x140004a5e
mov rcx, qword [r15 + 8]
lea rax, [r13 + 0x14]
mov dword [rbp - 0x51], 1
mov qword [rbp - 0x49], rbx
mov dword [rbp - 0x21], 0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x41], rax
cmp rdx, rcx
jne 0x140004a2a
lea rcx, [rcx*2 + 1]
mov eax, 0x38
mul rcx
mov qword [r15 + 8], rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword [r15 + 0x10]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140004b12
mov qword [r15 + 0x10], rax
imul rcx, qword [r15], 0x38
movups xmm0, xmmword [rbp - 0x51]
movups xmm1, xmmword [rbp - 0x41]
mov rax, qword [r15 + 0x10]
movups xmmword [rcx + rax], xmm0
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rcx + rax + 0x10], xmm1
movsd xmm1, qword [rbp - 0x21]
movups xmmword [rcx + rax + 0x20], xmm0
movsd qword [rcx + rax + 0x30], xmm1
inc qword [r15]
or r12d, 1
mov rbx, qword [rbp - 0x69]
lea r8, [rbp + 0x27]
mov rdx, r13
mov ecx, 8
call fcn.140005ef0
mov r13, qword [rbp + 0x27]
mov rdi, qword [rbp - 1]
cmp r13, rbx
jne 0x1400046f0
mov esi, dword [rbp - 0x61]
mov rbx, qword [rbp - 0x59]
inc esi
add rbx, 0x30
mov dword [rbp - 0x61], esi
mov qword [rbp - 0x59], rbx
cmp esi, 2
jb 0x140004690
mov r13, qword [rsp + 0xc8]
mov eax, r12d
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xc0]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140009ae0
add rsp, 0xd8
pop r15
pop rbp
ret
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
xor eax, eax
jmp 0x140004ad4
lea rcx, str.Unexpected_value_in_callback_entry__Operations___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unexpected_value_in_callback_entry__Enabled___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unexpected_value_in_callback_entry__ObjectTypeField___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3