Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov ecx, 0xd
xor eax, eax
lea rdx, [rsp + 0x20]
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdi, qword [0x1400209e0]
mov r9d, dword [rdi]
test r9d, r9d
jne 0x140001450
mov rax, qword gs:[0x30]
mov rbx, qword [0x140020a40]
mov rsi, qword [rax + 8]
xor ebp, ebp
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011e9
cmp rsi, rax
je 0x1400013f0
mov ecx, 0x3e8
call r12
mov rax, rbp
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011d8
mov rsi, qword [0x140020a50]
xor ebp, ebp
mov eax, dword [rsi]
cmp eax, 1
je 0x140001407
mov eax, dword [rsi]
test eax, eax
je 0x140001480
mov dword [0x14002601c], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000141c
test ebp, ebp
je 0x14000143d
mov rax, qword [0x1400209a0]
mov rax, qword [rax]
test rax, rax
je 0x14000124c
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.140012750
mov rcx, qword [0x140020ae0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140020a30]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.140012560
mov rax, qword [0x1400209b0]
mov qword [0x140026010], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__acmdln
xor ecx, ecx
mov rax, qword [rax]
test rax, rax
jne 0x1400012b2
jmp 0x1400012f0
test dl, dl
je 0x1400012e9
and ecx, 1
je 0x1400012d0
mov ecx, 1
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x20
jle 0x1400012a0
mov r8d, ecx
xor r8d, 1
cmp dl, 0x22
cmove ecx, r8d
jmp 0x1400012ae
test dl, dl
je 0x1400012e9
nop dword [rax]
movzx edx, byte [rax + 1]
add rax, 1
test dl, dl
je 0x1400012e9
cmp dl, 0x20
jle 0x1400012d8
mov qword [0x140026008], rax
mov r8d, dword [rdi]
test r8d, r8d
je 0x14000130e
mov eax, 0xa
test byte [rsp + 0x5c], 1
jne 0x1400013e0
mov dword [section..data], eax
mov ebx, dword [0x140026038]
lea r12d, [rbx + 1]
movsxd r12, r12d
shl r12, 3
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, qword [0x140026030]
mov rbp, rax
test ebx, ebx
jle 0x14000149e
sub r12, 8
xor ebx, ebx
nop
mov rcx, qword [rdi + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [rdi + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rbx, r12
jne 0x140001340
add rbx, rbp
mov qword [rbx], 0
mov qword [0x140026030], rbp
call fcn.140012360
mov rax, qword [0x1400209c0]
mov r8, qword [0x140026028]
mov ecx, dword [0x140026038]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140026030]
call fcn.140001530
mov ecx, dword [0x140026020]
mov dword [0x140026024], eax
test ecx, ecx
je 0x1400014a6
mov edx, dword [0x14002601c]
test edx, edx
je 0x140001460
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movzx eax, word [rsp + 0x60]
jmp 0x140001308
mov rsi, qword [0x140020a50]
mov ebp, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x14000120a
mov ecx, 0x1f
call fcn.140019560
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001229
mov rdx, qword [0x140020a80]
mov rcx, qword [0x140020a70]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test ebp, ebp
jne 0x140001231
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001231
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
jmp 0x1400011b2
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140026024]
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140020aa0]
mov rcx, qword [0x140020a90]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x14000121e
mov rbx, rax
jmp 0x140001375
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop
sub rsp, 0x28
mov rax, qword [0x1400209e0]
mov dword [rax], 1
call fcn.140001180
nop
nop
add rsp, 0x28
ret