Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 8], 0
mov dword [rbp - 0xc], 0
lea rax, [rbp - 0xc0]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.ucrtbase.dll_memset
mov rax, qword [0x14000e1e0]
mov eax, dword [rax]
test eax, eax
je 0x1400011a8
lea rax, [rbp - 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call rax
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x24], 0x30
mov eax, dword [rbp - 0x24]
mov rax, qword gs:[rax]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov rax, qword [rax + 8]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 0
jmp 0x1400011f8
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp - 0x20]
jne 0x1400011ea
mov dword [rbp - 0x10], 1
jmp 0x14000122f
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x14000e240]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], 0
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x38]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x1400011d7
mov rax, qword [0x14000e250]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001249
mov ecx, 0x1f
call fcn.14000b9e0
jmp 0x140001288
mov rax, qword [0x14000e250]
mov eax, dword [rax]
test eax, eax
jne 0x14000127e
mov rax, qword [0x14000e250]
mov dword [rax], 1
mov rax, qword [0x14000e2a0]
mov rdx, rax
mov rax, qword [0x14000e290]
mov rcx, rax
call sub.ucrtbase.dll__initterm
jmp 0x140001288
mov dword [0x140012024], 1
mov rax, qword [0x14000e250]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400012bc
mov rax, qword [0x14000e280]
mov rdx, rax
mov rax, qword [0x14000e270]
mov rcx, rax
call sub.ucrtbase.dll__initterm
mov rax, qword [0x14000e250]
mov dword [rax], 2
cmp dword [rbp - 0x10], 0
jne 0x1400012e0
mov rax, qword [0x14000e240]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 0
mov rdx, qword [rbp - 0x58]
mov rax, qword [rbp - 0x50]
xchg qword [rax], rdx
mov rax, qword [0x14000e190]
mov rax, qword [rax]
test rax, rax
je 0x14000130b
mov rax, qword [0x14000e190]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.140005268
mov rax, qword [0x14000e2e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x14000e230]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.ucrtbase.dll__set_invalid_parameter_handler
call fcn.140004a60
lea rax, [0x140012e18]
mov rdx, qword [0x14000e1b0]
mov qword [rax], rdx
call sub.ucrtbase.dll___p__acmdln
mov rax, qword [rax]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x1400013cb
jmp 0x140001384
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x22
jne 0x14000137f
cmp dword [rbp - 0xc], 0
sete al
movzx eax, al
mov dword [rbp - 0xc], eax
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x20
jg 0x140001367
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
test al, al
je 0x1400013a7
cmp dword [rbp - 0xc], 0
jne 0x140001367
jmp 0x1400013a7
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
test al, al
je 0x1400013bd
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x20
jle 0x1400013a2
lea rax, [0x140012e10]
mov rdx, qword [rbp - 8]
mov qword [rax], rdx
mov rax, qword [0x14000e1e0]
mov eax, dword [rax]
test eax, eax
je 0x1400013f9
mov eax, dword [rbp - 0x84]
and eax, 1
test eax, eax
je 0x1400013ee
movzx eax, word [rbp - 0x80]
movzx eax, ax
jmp 0x1400013f3
mov eax, 0xa
mov dword [section..data], eax
mov eax, dword [0x140012004]
lea rdx, [0x140012008]
mov ecx, eax
call fcn.140001583
call fcn.1400047f7
mov rax, qword [0x14000e1c0]
mov rax, qword [rax]
mov rdx, qword [0x140012010]
mov qword [rax], rdx
mov rcx, qword [0x140012010]
mov rdx, qword [0x140012008]
mov eax, dword [0x140012004]
mov r8, rcx
mov ecx, eax
call fcn.14000bcf0
mov dword [0x14001201c], eax
mov eax, dword [0x140012020]
test eax, eax
jne 0x140001461
mov eax, dword [0x14001201c]
mov ecx, eax
call sub.ucrtbase.dll_exit
mov eax, dword [0x140012024]
test eax, eax
jne 0x140001470
call sub.ucrtbase.dll__cexit
mov eax, dword [0x14001201c]
add rsp, 0xe0
pop rbp
ret