Function at 0x7d270350
Capabilities:
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x98
mov r13, rcx
mov r12, r8
xor ecx, ecx
mov rdi, rdx
call fcn.7d221744
mov rsi, qword [rsp + 0x120]
mov rbx, rax
mov r15, qword [rsp + 0x110]
lea rax, [rsp + 0x60]
mov r9, rsi
mov qword [rsp + 0x20], rax
mov r8, r15
mov qword [0x7d2ad100], 0
mov rdx, r12
mov rcx, rdi
call fcn.7d26fe50
test eax, eax
je 0x7d2703cc
mov eax, dword [rsp + 0x60]
add rsp, 0x98
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov ecx, dword [0x7d2abfb0]
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r14
lea eax, [rcx - 0x1a]
cmp eax, 1
jbe 0x7d2703ef
cmp ecx, 0x17
jne 0x7d2703f2
xor r13d, r13d
mov rcx, r15
call fcn.7d272620
mov ebp, dword [rsp + 0x100]
test rax, rax
mov rcx, qword [rsp + 0x108]
mov r14, rax
cmove r14, r15
mov edx, ebp
shr edx, 0xa
xor r9d, r9d
and dl, 1
mov qword [rsp + 0x68], r14
xor r8d, r8d
call fcn.7d2218d4
mov rcx, qword [rsp + 0x128]
bts ebp, 0xa
inc dword [rbx + 0x130]
xor r9d, r9d
mov qword [rsp + 0x58], rcx
mov r8, r12
mov rcx, qword [rsp + 0x118]
mov rdx, rdi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x70], rax
xor eax, eax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x100], ebp
mov byte [rbx + 0x134], 1
call qword [0x7d2ad0b0]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rbx + 0x134], 0
mov edi, eax
test ebp, ebp
jne 0x7d27082f
cmp eax, 0xc1
jne 0x7d27082f
mov rcx, qword [rbx + 0x138]
test rcx, rcx
jne 0x7d2704c6
jmp 0x7d27082f
movzx edx, byte [rbx + 0x137]
call fcn.7d26ffd0
test al, al
jne 0x7d2704e0
xor ebp, ebp
lea edi, [rbp + 5]
jmp 0x7d27082f
cmp dword [rbx + 0x130], 1
jne 0x7d270502
mov rcx, qword [rbx + 0x138]
call fcn.7d221640
mov edi, eax
cmp eax, 0x2e4
je 0x7d27082f
mov rax, qword [rbx + 0x140]
test rax, rax
cmovne r12, rax
mov rax, qword [rsp + 0xe8]
xor ecx, ecx
mov r15d, ecx
mov r14d, ecx
test rax, rax
je 0x7d27054f
mov rax, qword [rax + 8]
test rax, rax
je 0x7d27054f
cmp word [rax + 2], cx
jge 0x7d270542
mov r15d, dword [rax + 4]
test r15, r15
je 0x7d27054f
mov dword [rax + 4], ecx
jmp 0x7d27054f
mov r15, qword [rax + 8]
test r15, r15
je 0x7d27054f
mov qword [rax + 8], rcx
mov rbp, qword [rsp + 0xf0]
test rbp, rbp
je 0x7d270586
mov rax, qword [rbp + 8]
test rax, rax
je 0x7d270586
cmp word [rax + 2], cx
jge 0x7d270579
mov r14d, dword [rax + 4]
test r14, r14
je 0x7d270586
mov dword [rax + 4], ecx
jmp 0x7d270586
mov r14, qword [rax + 8]
test r14, r14
je 0x7d270586
mov qword [rax + 8], rcx
cmp qword [rsp + 0xd8], rcx
jne 0x7d27061a
mov rcx, qword [rbx + 0x138]
test rcx, rcx
je 0x7d27061a
mov edx, 0x2e
call sub.ntdll.dll_wcsrchr
mov rdi, rax
test rax, rax
je 0x7d27061a
lea rdx, [0x7d296fb0]
lea rcx, [rax + 2]
call sub.ntdll.dll__wcsicmp
test eax, eax
je 0x7d2705da
lea rdx, [0x7d296fc0]
lea rcx, [rdi + 2]
call sub.ntdll.dll__wcsicmp
test eax, eax
jne 0x7d27061a
cmp byte [rbx + 0x137], 0
je 0x7d270603
mov r8, qword [rbx + 0x138]
mov rdx, r12
mov rcx, rbx
call fcn.7d271340
mov rax, qword [rbx + 0x140]
test rax, rax
cmovne r12, rax
mov rcx, qword [rbx + 0x138]
call fcn.7d221938
mov qword [rbx + 0x138], 0
mov ecx, dword [rsp + 0x100]
mov r8, r12
mov r9, qword [rsp + 0xe8]
mov eax, ecx
mov rdx, qword [rbx + 0x138]
and eax, 4
mov dword [rsp + 0x60], eax
btr ecx, 0x18
mov rax, qword [rsp + 0x128]
or ecx, 4
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x30], ecx
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [0x7d2ad0b0]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test r15, r15
je 0x7d2706be
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax + 8]
cmp word [rax + 2], 0
jge 0x7d2706ba
mov dword [rax + 4], r15d
jmp 0x7d2706be
mov qword [rax + 8], r15
test r14, r14
je 0x7d2706e0
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 8]
cmp word [rax + 2], 0
jge 0x7d2706dc
mov dword [rax + 4], r14d
jmp 0x7d2706e0
mov qword [rax + 8], r14
test ebp, ebp
je 0x7d270822
test r13, r13
je 0x7d2706ff
mov rcx, r13
call fcn.7d270a60
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test ebp, ebp
je 0x7d270741
mov rcx, qword [rsi]
lea r8, [rsp + 0x78]
mov r9d, 0x10
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
lea edx, [r9 - 7]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
test eax, eax
js 0x7d270735
mov rdx, qword [rsi]
mov rcx, r13
call fcn.7d22128f
jmp 0x7d270741
xor ebp, ebp
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
test r13, r13
je 0x7d27074d
xor ecx, ecx
call fcn.7d270a60
test ebp, ebp
je 0x7d270801
cmp dword [rsp + 0x60], 0
mov rax, qword [rsi]
mov qword [0x7d2ad100], rax
jne 0x7d270822
mov rax, qword [rsp + 0xd8]
test rax, rax
je 0x7d2707f5
lea rdx, str.WerFault.exe
mov rcx, rax
call sub.ntdll.dll_wcsstr
test rax, rax
je 0x7d2707f5
cmp dword [0x7d2ad108], 1
jne 0x7d2707b2
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi]
mov edx, 0x7530
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x7d27080f
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r9, qword [0x7d2abf58]
lea rdx, str._S___S_
mov r8, qword [0x7d2abf60]
mov ecx, 0x8b0
call sym.imfsbDll.dll_SbieApi_Log
mov rcx, qword [rsi]
mov edx, 0x7530
mov dword [0x7d2ad108], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x7d270822
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x7d270822
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x110]
mov r14, qword [rsp + 0x68]
dec dword [rbx + 0x130]
test ebp, ebp
jne 0x7d27086e
cmp edi, 0x2e4
jne 0x7d27086e
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov r8, rsi
mov rdx, r14
mov rcx, r12
call fcn.7d22150a
test eax, eax
je 0x7d270861
xor edi, edi
lea ebp, [rdi + 1]
cmp dword [rsp + 0x60], 0
mov eax, 0x4c7
cmovne edi, eax
mov rcx, qword [rsp + 0x70]
call fcn.7d221938
test r14, r14
je 0x7d27088a
cmp r14, r15
je 0x7d27088a
mov rcx, r14
call fcn.7d221938
mov rcx, qword [rbx + 0x138]
mov r14, qword [rsp + 0x90]
test rcx, rcx
je 0x7d2708ae
call fcn.7d221938
mov qword [rbx + 0x138], 0
mov rcx, qword [rbx + 0x140]
mov byte [rbx + 0x137], 0
test rcx, rcx
je 0x7d2708d1
call fcn.7d221938
mov qword [rbx + 0x140], 0
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebp
mov rbp, qword [rsp + 0xd0]
add rsp, 0x98
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret