Function at 0x7d22e5c0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x40
mov ecx, 0x80
call fcn.7d221988
xor edx, edx
mov qword [0x7d2abfc0], rax
mov r8d, 0x80
mov rcx, rax
call sub.ntdll.dll_memset
mov ecx, 0x200
call fcn.7d221988
xor edx, edx
mov qword [0x7d2abfc8], rax
mov r8d, 0x200
mov rcx, rax
call sub.ntdll.dll_memset
mov ecx, 0xc0
call fcn.7d221988
xor edx, edx
mov qword [0x7d2abfd0], rax
mov r8d, 0xc0
mov rcx, rax
call sub.ntdll.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9, qword [0x7d2abfc8]
xor edi, edi
mov r8, qword [0x7d2abfc0]
mov edx, 0xff
mov dword [0x7d2abf98], eax
mov ecx, eax
lea rax, [0x7d2abf9c]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov rax, qword [0x7d2abfd0]
mov qword [rsp + 0x20], rax
call sym.imfsbDll.dll_SbieApi_QueryProcessEx2
test eax, eax
je 0x7d22e68d
mov rdx, qword [0x7d2abf60]
mov ecx, 0x900
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x7d2abfc0]
mov rcx, qword [0x7d2abfd0]
mov qword [0x7d2abf58], rax
mov rax, qword [0x7d2abfc8]
mov qword [rsp + 0x68], rbx
or rbx, 0xffffffffffffffff
mov qword [0x7d2abf60], rax
mov rax, rbx
mov qword [0x7d2abf68], rcx
inc rax
cmp word [rcx + rax*2], di
jne 0x7d22e6c3
xor edx, edx
mov dword [0x7d2abf94], eax
xor ecx, ecx
call sym.imfsbDll.dll_SbieApi_QueryProcessInfo
mov qword [0x7d2abfa0], rax
call fcn.7d22eb30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], edi
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov dword [rsp + 0x50], edi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call sym.imfsbDll.dll_SbieApi_QueryBoxPath
test eax, eax
je 0x7d22e73f
mov rdx, qword [0x7d2abf60]
mov ecx, 0x900
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [rsp + 0x60]
call fcn.7d221988
mov ecx, dword [rsp + 0x58]
mov qword [0x7d2abf70], rax
call fcn.7d221988
mov ecx, dword [rsp + 0x50]
mov qword [0x7d2abf78], rax
call fcn.7d221988
mov r8, qword [0x7d2abf78]
lea rcx, [rsp + 0x50]
mov rdx, qword [0x7d2abf70]
mov r9, rax
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [0x7d2abf80], rax
call sym.imfsbDll.dll_SbieApi_QueryBoxPath
test eax, eax
je 0x7d22e7c4
mov rdx, qword [0x7d2abf60]
mov ecx, 0x900
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x7d2abf70]
mov rax, rbx
nop
inc rax
cmp word [rcx + rax*2], di
jne 0x7d22e7d0
mov rcx, qword [0x7d2abf78]
mov dword [0x7d2abf88], eax
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x7d22e7f0
mov dword [0x7d2abf8c], eax
mov rax, qword [0x7d2abf80]
inc rbx
cmp word [rax + rbx*2], di
jne 0x7d22e806
xor ecx, ecx
mov dword [0x7d2abf90], ebx
call fcn.7d2211ef
mov byte [0x7d2abfa9], al
call fcn.7d221082
call fcn.7d221582
test al, al
je 0x7d22e8f2
call fcn.7d221433
test al, al
je 0x7d22e8f2
mov ecx, 0x800
call fcn.7d2212da
mov r9, rax
or r8d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov rbx, rax
call sym.imfsbDll.dll_SbieApi_EnumProcessEx
test eax, eax
jne 0x7d22e879
movzx ecx, byte [0x7d2abfad]
mov eax, 1
cmp dword [rbx], eax
cmove ecx, eax
mov byte [0x7d2abfad], cl
mov rcx, rbx
call fcn.7d221938
call fcn.7d221393
test al, al
je 0x7d22e8f2
call fcn.7d221190
test al, al
je 0x7d22e8f2
call fcn.7d22144c
test al, al
je 0x7d22e8f2
call fcn.7d221406
test al, al
je 0x7d22e8f2
call fcn.7d2211e5
test al, al
je 0x7d22e8f2
call fcn.7d22140b
test al, al
je 0x7d22e8f2
call fcn.7d2214d8
test al, al
je 0x7d22e8f2
call fcn.7d221366
test al, al
je 0x7d22e8f2
call fcn.7d22195b
test al, al
je 0x7d22e8f2
cmp byte [0x7d2abfab], dil
mov byte [0x7d2abfaa], 1
jne 0x7d22e8e7
call fcn.7d2216e5
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rdx, qword [0x7d2abf60]
mov ecx, 0x900
call sym.imfsbDll.dll_SbieApi_Log
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]