Function at 0x140004ca8
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov rax, qword [0x140029010]
xor rax, rsp
mov qword [rbp + 7], rax
movzx edi, r9w
movsxd r13, r8d
mov rbx, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rbp - 0x71], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
mov qword [rbp - 0x71], rax
test rax, rax
jne 0x140004d2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
jmp 0x140004d2d
mov esi, r12d
mov dword [rsp + 0x30], esi
test esi, esi
js 0x140004ead
mov qword [rbp - 0x79], r12
lea rcx, [0x140022150]
cmp qword [rbx + 0x10], r12
cmovne rcx, qword [rbx + 0x10]
lea r8, [rbp - 0x79]
movzx edx, di
call fcn.1400029c8
mov esi, eax
mov dword [rsp + 0x30], eax
mov rdi, qword [rbp - 0x79]
test eax, eax
js 0x140004ea3
mov qword [rsp + 0x38], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rdi
lea rax, [r13 + 3]
add rax, rax
movups xmm0, xmmword [r15 + rax*8]
movdqu xmmword [rbp - 0x39], xmm0
and dword [rbp - 0x29], 0
movzx eax, word [r15 + 0x50]
mov word [rbp - 0x25], ax
mov qword [rbp - 0x21], r14
mov rax, qword [r15 + 8]
mov qword [rbp - 0x19], rax
mov rax, qword [r15 + 0x10]
mov qword [rbp - 0x11], rax
mov rax, qword [r15 + 0x28]
mov qword [rbp - 9], rax
mov word [rbp - 1], 0x101
test r13d, r13d
sete dl
lea r8, [rsp + 0x38]
lea rcx, [rbp - 0x49]
call fcn.140002bc4
mov esi, eax
mov dword [rsp + 0x30], eax
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x140004e8d
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x61], r14
and dword [rsp + 0x20], eax
mov r9d, 0x7530
xor r8d, r8d
lea rdx, [rbp - 0x69]
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x140004e28
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [rsp + 0x30]
test esi, esi
js 0x140004e7c
mov esi, 0x80080005
jmp 0x140004e76
cmp eax, 1
jne 0x140004e35
xor esi, esi
mov dword [rsp + 0x30], esi
jmp 0x140004e7e
cmp eax, 0x102
jne 0x140004e58
mov dword [rsp + 0x30], 0x800705b4
mov edx, 0x5b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [rsp + 0x30]
jmp 0x140004e7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
mov eax, 0x80004005
cmovns esi, eax
mov dword [rsp + 0x30], esi
test esi, esi
jne 0x140004e8d
mov rax, rbx
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [r15 + r13*8 + 0x18], rax
xor r12d, r12d
test rbx, rbx
je 0x140004ea3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], r12
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
test r14, r14
je 0x140004ebf
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x71], r12
mov eax, esi
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140006d10
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret