Function at 0x14008b968
Capabilities:
Check if file exists
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x230]
xor esi, esi
mov r13, qword [rbp + 0x220]
xor ecx, ecx
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov qword [rsp + 0x40], rcx
xorps xmm1, xmm1
mov r14, r8
mov r12, rdx
mov word [r13], si
mov dil, sil
mov word [rax], si
mov r15b, sil
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rsp + 0x30], xmm1
test r9b, r9b
jne 0x14008ba5a
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.14008b830
mov ebx, eax
test eax, eax
js 0x14008ba2a
cmp dword [rsp + 0x48], esi
je 0x14008ba5a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
nop dword [rax + rax]
test eax, eax
jne 0x14008ba57
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140094220
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15b, 1
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
nop dword [rax + rax]
test eax, eax
jne 0x14008baac
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14008baac
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14008bd30
xor eax, eax
mov ebx, 0x3a
test eax, eax
jne 0x14008bcba
test rsi, rsi
je 0x14008bade
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x2eef
jne 0x14008bc3e
mov dword [rbp - 0x64], 1
mov rdx, qword [rsp + 0x68]
mov rax, rdx
mov qword [rbp - 0x78], rdx
neg rax
sbb ecx, ecx
neg ecx
inc ecx
neg rdx
mov dword [rbp - 0x80], ecx
sbb eax, eax
not eax
and eax, 3
mov dword [rbp - 0x7c], eax
test dil, dil
je 0x14008bb40
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008bb24
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008bb40
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
mov r8d, 8
lea rdx, str.https:__
mov rcx, r14
mov rbx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x14008bb92
lea r9, str.https:__
mov qword [rsp + 0x20], r14
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.14002ba4c
mov ebx, eax
test eax, eax
js 0x14008bd30
lea rbx, [rbp - 0x60]
mov rcx, qword [r12]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x80]
mov rdx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
nop dword [rax + rax]
inc rsi
mov dil, 1
cmp rsi, 2
jb 0x14008baae
xor esi, esi
test eax, eax
jne 0x14008bcbc
lea ebx, [rsi + 0x3a]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14008bc42
cmp word [rax], si
je 0x14008bc42
cmp word [rax], bx
jne 0x14008bbe5
cmp word [rax + 2], si
je 0x14008bc42
test dil, dil
je 0x14008bc25
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008bc0a
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008bc25
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 3
jmp 0x14008bcbc
xor esi, esi
jmp 0x14008bbcb
test dil, dil
je 0x14008bc7d
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14008bc62
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14008bc7d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.WINHTTP.dll_WinHttpGetDefaultProxyConfiguration]
nop dword [rax + rax]
test eax, eax
je 0x14008ba8d
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14008bd2e
cmp word [rax], si
je 0x14008bd2e
cmp word [rax], bx
jne 0x14008bcbc
cmp word [rax + 2], si
je 0x14008bd2e
jmp 0x14008bcbc
xor esi, esi
mov rcx, qword [r12]
lea r8, [rsp + 0x30]
mov r9d, 0x18
lea edx, [r9 + 0xe]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
nop dword [rax + rax]
test eax, eax
je 0x14008ba8d
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14008bd2e
cmp word [rbx], si
je 0x14008bd2e
mov edx, 0x3a
cmp word [rbx], dx
jne 0x14008bd02
cmp word [rbx + 2], si
je 0x14008bd2e
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x14008bd19
mov word [rax], si
mov rax, qword [rsp + 0x58]
mov r8, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.14008bd70
mov ebx, esi
test r15b, r15b
je 0x14008ba2a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop dword [rax + rax]
test eax, eax
jne 0x14008ba2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]