Function at 0x100010300
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rbp, rcx
xor ecx, ecx
mov word [rax - 0x60], cx
mov qword [rax + 0x18], rcx
mov rcx, qword [rbp + 0x20]
xor eax, eax
mov qword [rsp + 0x2a], rax
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
call qword [sym.imp.ntdll.dll_RtlNormalizeProcessParams]
xor r8d, r8d
lea rsi, [rsp + 0xa0]
lea ecx, [r8 + 1]
mov ebx, r8d
mov dword [rsp + 0x98], r8d
mov rdi, rax
mov qword [rsp + 0xa8], rax
mov r14, r8
mov r12d, ecx
mov dword [rsp + 0x90], ebx
lea r15, [rsp + 0xa0]
mov r13d, r8d
cmp rax, r8
je 0x10001047b
mov eax, dword [rax + 0xc]
lea rdx, [rdi + 0x70]
mov dword [rsp + 0x98], eax
cmp qword [rdx + 8], r8
je 0x10001039a
cmp word [rdx], r8w
jne 0x1000103a8
lea rdx, [rdi + 0x60]
cmp qword [rdx + 8], r8
je 0x10001043d
mov r8b, cl
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
xor r8d, r8d
cmp eax, r8d
mov r13d, eax
jl 0x100010608
movzx esi, word [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
cmp esi, r8d
jbe 0x10001044c
cmp byte [rbx], r8b
je 0x100010433
cmp esi, r8d
jbe 0x1000103fe
cmp byte [rbx], r8b
je 0x1000103fb
movzx ecx, byte [rbx]
call sub.ntdll.dll_isspace
xor r8d, r8d
cmp eax, r8d
je 0x1000103fb
inc rbx
add esi, 0xffffffff
jne 0x1000103de
cmp esi, r8d
je 0x100010433
cmp byte [rbx], r8b
je 0x10001042e
inc r12d
mov rdi, rbx
inc rbx
add esi, 0xffffffff
je 0x100010423
movzx ecx, byte [rbx]
call sub.ntdll.dll_isspace
xor r8d, r8d
cmp eax, r8d
je 0x10001040b
mov rax, rbx
sub rax, rdi
lea r14, [r14 + rax + 1]
cmp esi, r8d
ja 0x1000103d4
mov rdi, qword [rsp + 0xa8]
jmp 0x10001044c
mov rbx, qword [rsp + 0x90]
mov esi, dword [rsp + 0x90]
mov rcx, qword [rdi + 0x80]
mov edx, r8d
cmp rcx, r8
je 0x100010476
jmp 0x100010470
add rcx, 2
inc edx
movzx eax, word [rcx]
add rcx, 2
cmp ax, r8w
jne 0x100010463
cmp word [rcx], r8w
jne 0x10001045d
lea ecx, [rdx + 1]
jmp 0x10001048a
mov rbx, qword [rsp + 0x90]
mov esi, dword [rsp + 0x90]
lea eax, [r12 + rcx]
cmp eax, 2
jbe 0x1000105f9
cmp r12d, 1
jbe 0x1000104a7
mov rbx, qword [rsp + 0x30]
movzx esi, word [rsp + 0x28]
mov edi, eax
mov rax, qword gs:[0x30]
xor edx, edx
mov dword [rax + 0x1250], r8d
mov rcx, qword [rbp + 0x30]
shl rdi, 3
add r14, rdi
mov r8, r14
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor r8d, r8d
mov rbp, rax
cmp rax, r8
jne 0x100010509
mov rax, qword gs:[0x30]
mov ebx, r8d
lea rsi, [rsp + 0xa0]
mov r13d, dword [rax + 0x1250]
cmp r13d, r8d
jl 0x100010608
mov r13d, 0xc0000017
jmp 0x100010608
mov qword [rsp + 0x20], rax
cmp r12d, 1
jbe 0x1000105b0
add rdi, rax
lea r12, [r14 + rax]
cmp esi, r8d
jbe 0x1000105b0
mov r14d, r8d
cmp byte [rbx], r8b
je 0x1000105a8
cmp rdi, r12
jae 0x1000105a8
cmp esi, r8d
jbe 0x10001055a
cmp byte [rbx], r8b
je 0x100010557
movzx ecx, byte [rbx]
call sub.ntdll.dll_isspace
xor r8d, r8d
cmp eax, r8d
je 0x100010557
inc rbx
add esi, 0xffffffff
jne 0x10001053a
cmp esi, r8d
je 0x1000105a8
cmp byte [rbx], r8b
je 0x1000105a3
mov qword [rbp], rdi
add rbp, 8
inc r14d
mov al, byte [rbx]
inc rbx
mov byte [rdi], al
inc rdi
add esi, 0xffffffff
je 0x100010590
cmp rdi, r12
jae 0x10001059d
movzx ecx, byte [rbx]
call sub.ntdll.dll_isspace
xor r8d, r8d
cmp eax, r8d
je 0x10001056c
cmp rdi, r12
jae 0x10001059d
mov byte [rdi], r8b
inc rdi
jmp 0x1000105a3
dec rdi
mov byte [rdi], r8b
cmp esi, r8d
ja 0x10001052b
mov dword [rsp + 0x90], r14d
mov rcx, qword [rsp + 0xa8]
mov qword [rbp], r8
lea r15, [rbp + 8]
mov rcx, qword [rcx + 0x80]
mov rdx, r15
cmp rcx, r8
je 0x1000105ef
jmp 0x1000105e9
mov qword [rdx], rcx
add rdx, 8
add rcx, 2
movzx eax, word [rcx]
add rcx, 2
cmp ax, r8w
jne 0x1000105dc
cmp word [rcx], r8w
jne 0x1000105d1
mov rsi, qword [rsp + 0x20]
mov qword [rdx], r8
jmp 0x100010601
lea rsi, [rsp + 0xa0]
mov ebx, dword [rsp + 0x90]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
mov eax, dword [rsp + 0x98]
xor ecx, ecx
cmp eax, ecx
je 0x100010621
int3
cmp r13d, ecx
jl 0x100010639
mov r9d, eax
mov r8, r15
mov rdx, rsi
mov ecx, ebx
call fcn.10000d058
mov r13d, eax
mov edx, r13d
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.10007d0cc
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x100010300