Function at 0x1400bdfc8
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1038
call fcn.140203400
sub rsp, rax
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov qword [rsp + 0x70], 0xffffffffffffffff
cmp r8, 0x10
jne 0x1400be60f
mov rbx, rcx
mov qword [rsp + 0x60], rdx
lea r15, [rsp + 0x280]
mov r8d, 0xb0
mov rcx, r15
mov dl, 0xaa
call fcn.1402055c0
xor r13d, r13d
call fcn.1400beff4
mov r14, rax
mov rbp, qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
lea rsi, [0x140281898]
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x68], rax
mov dil, 1
test r13d, r13d
jne 0x1400be5e3
mov rcx, r15
mov edx, 0xffffffff
call rbp
xor r13d, r13d
test eax, eax
je 0x1400be5e1
mov r12d, 0x10002
mov eax, dword [rsp + 0x280]
dec eax
cmp eax, 5
ja case.default.0x1400be08c
movsxd rax, dword [rsi + rax*4]
add rax, rsi
jmp rax
mov edx, dword [rsp + 0x288]
mov rcx, r14
call fcn.1400bf0ee
cmp rax, 0xffffffffffffffff
je 0x1400be5e1
mov rbp, rax
mov r14d, dword [rsp + 0x288]
mov r15d, dword [rsp + 0x290]
mov r8d, 0x4d0
lea r13, [rsp + 0xb60]
mov rcx, r13
mov dl, 0xaa
call fcn.1402055c0
mov r8d, 0xe8
lea rcx, [rsp + 0xa78]
mov dl, 0xaa
call fcn.1402055c0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x268], rax
mov r8d, 0x148
lea rcx, [rsp + 0x120]
mov dl, 0xaa
call fcn.1402055c0
mov r8d, 0x748
lea rcx, [rsp + 0x330]
mov dl, 0xaa
call fcn.1402055c0
mov r8d, 0xa8
lea rcx, [rsp + 0x78]
mov dl, 0xaa
call fcn.1402055c0
mov dword [rsp + 0xb90], 0x100007
mov rcx, rbp
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400be1e7
mov ecx, 0x8000
call fcn.1400fe9f0
test rax, rax
je 0x1400be1e7
mov r13, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x278], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r9d, 0x8000
mov qword [rsp + 0x58], rbx
mov rcx, rbx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400be1da
cmp qword [rsp + 0x278], 0x8000
jne 0x1400be1da
mov rax, r13
xor ebx, ebx
cmp dword [rax], r14d
je 0x1400be2be
add rbx, 0xfffffffffffffff8
add rax, 4
cmp rbx, 0xffffffffffff0000
jne 0x1400be1c0
mov rcx, r13
call fcn.1400fea50
mov rbx, qword [rsp + 0x58]
mov rbp, qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor r15d, 0x80000003
mov ecx, dword [rsp + 0x44]
or r15d, ecx
mov r12d, 0x10002
mov eax, 0x80010001
cmovne r12d, eax
mov eax, 1
cmove ecx, eax
mov dword [rsp + 0x44], ecx
xor r13d, r13d
mov r14, qword [rsp + 0x68]
lea r15, [rsp + 0x280]
jmp case.default.0x1400be08c
mov r8, qword [rsp + 0x290]
jmp 0x1400be249
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0x288]
mov rcx, r14
call fcn.1400bf05b
xor r13d, r13d
test eax, eax
jne case.default.0x1400be08c
jmp 0x1400be5e1
mov edx, dword [rsp + 0x288]
mov rcx, r14
call fcn.1400bf11e
jmp case.default.0x1400be08c
mov edx, dword [rsp + 0x288]
mov rcx, r14
call fcn.1400bf11e
mov r13d, 1
jmp case.default.0x1400be08c
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x284]
mov edx, dword [rsp + 0x288]
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
test eax, eax
jne 0x1400be04c
jmp 0x1400be5e3
mov rcx, r13
call fcn.1400fea50
mov rax, qword [rsp + 0x60]
mov rdx, qword [rax]
sub rdx, rbx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x278], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r9d, 8
mov rbx, qword [rsp + 0x58]
mov rcx, rbx
lea r8, [rsp + 0x268]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400be1e7
cmp qword [rsp + 0x278], 8
jne 0x1400be1e7
mov r13, qword [rsp + 0x268]
test r13, r13
je 0x1400be1e7
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x278], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r9d, 0x148
mov rcx, rbx
mov rdx, r13
lea r8, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400be1e7
cmp qword [rsp + 0x278], 0x148
jne 0x1400be1e7
mov rdx, qword [rsp + 0x1e8]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x278], rax
lea rax, [rsp + 0x278]
mov qword [rsp + 0x20], rax
mov r9d, 0x748
mov rcx, rbx
lea r8, [rsp + 0x330]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1400be1e7
cmp qword [rsp + 0x278], 0x748
jne 0x1400be1e7
mov cl, byte [rsp + 0x330]
mov r14d, 1
shl r14, cl
mov rax, qword [rsp + 0xc58]
mov rcx, qword [rsp + 0x348]
cmp rax, rcx
jb 0x1400be1e7
add rcx, r14
cmp rax, rcx
jae 0x1400be1e7
cmp dword [rsp + 0xa38], 0
je 0x1400be464
mov r8, qword [rsp + 0x1e8]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov rdx, rbp
lea r9, [rsp + 0x330]
call fcn.1400be6b6
xor r13d, r13d
test eax, eax
mov rbp, qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
jne 0x1400be21a
jmp 0x1400be1ee
mov qword [rsp + 0x48], r13
lea r13, [rsp + 0x78]
mov rcx, r13
lea rdx, [rsp + 0xb60]
call fcn.1400c0364
lea rax, [rsp + 0x330]
mov qword [rsp + 0x1e8], rax
mov rcx, r13
mov r13, qword [rsp + 0x48]
lea rdx, [rsp + 0x120]
call fcn.1400b0c7d
test eax, eax
je 0x1400be1e7
test byte [rsp + 0x210], 1
je 0x1400be1e7
cmp dword [rsp + 0x23c], 0
jne 0x1400be1e7
mov eax, dword [rsp + 0x238]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x274], 1
add r13, 0x11c
mov r9d, 4
mov rcx, rbx
mov rdx, r13
lea r8, [rsp + 0x274]
call fcn.1400be7c0
test eax, eax
je 0x1400be1e7
test byte [rsp + 0xa20], 0x1f
jne 0x1400be1e7
mov r13d, dword [rsp + 0xbf8]
add r13d, 0xffffff80
mov eax, dword [rsp + 0x54]
test eax, eax
cmovne r13d, eax
and r13d, 0xfffffff0
mov eax, r13d
sub eax, 0xe8
mov qword [rsp + 0x48], rax
jb 0x1400be1e7
cmp r14, r13
jb 0x1400be1e7
add r13d, 0xffffff20
lea r14, [rsp + 0xa78]
mov rcx, r14
lea rdx, [rsp + 0x78]
mov r8d, r13d
call fcn.1400b0cfa
mov rdx, qword [rsp + 0x348]
add rdx, qword [rsp + 0x48]
mov r9d, 0xe8
mov rcx, rbx
mov r8, r14
call fcn.1400be7c0
test eax, eax
je 0x1400be1e7
mov eax, r13d
mov qword [rsp + 0xc10], rax
mov rax, qword [rsp + 0x348]
mov ecx, dword [rsp + 0xa20]
add rcx, rax
mov qword [rsp + 0xc58], rcx
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov qword [rsp + 0xbf8], rcx
and byte [rsp + 0xba5], 0xfb
mov rcx, rbp
lea rdx, [rsp + 0xb60]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
jmp 0x1400be44d
xor edi, edi
mov rcx, r14
call fcn.1400bf03e
mov rcx, qword [rsp + 0x70]
cmp rcx, 0xffffffffffffffff
je 0x1400be5fc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
jne 0x1400be60f
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.140203460
nop
add rsp, 0x1038
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret