Function at 0x140011020
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x930
mov rsi, rcx
mov rdi, rdx
mov r12d, 0x3ff
lea rcx, [rax - 0x407]
xor ebp, ebp
xor edx, edx
mov r8, r12
mov ebx, r9d
mov byte [rax - 0x408], bpl
call sub.msvcrt.dll_memset
sub ebx, 0x9c65
je 0x1400112e8
lea ecx, [rbp + 1]
sub ebx, ecx
je 0x1400112a3
sub ebx, 6
je 0x140011247
sub ebx, 0x19
je 0x140011214
sub ebx, 3
je 0x1400111be
sub ebx, 0xf
je 0x140011176
sub ebx, ecx
je 0x140011153
sub ebx, 6
je 0x140011104
cmp ebx, ecx
jne 0x140011310
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x30], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x131]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x130], bpl
call sub.msvcrt.dll_memset
mov edx, dword [rdi + 0x24]
lea rcx, [rsp + 0x30]
call fcn.140016650
lea r8, [rsp + 0x30]
lea rdx, str.exclude:remote:tcpudp:_s
jmp 0x1400111f2
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x30], bpl
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x131]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x130], bpl
call sub.msvcrt.dll_memset
mov edx, dword [rdi + 0x24]
lea rcx, [rsp + 0x30]
call fcn.140016650
lea r8, [rsp + 0x30]
lea rdx, str.include:remote:tcpudp:_s
jmp 0x1400111f2
lea rcx, [rsp + 0x131]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x130], bpl
call sub.msvcrt.dll_memset
lea rdx, str.exclude:remote:tcpudp:_d
jmp 0x140011197
lea rcx, [rsp + 0x131]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x130], bpl
call sub.msvcrt.dll_memset
lea rdx, str.include:remote:tcpudp:_d
mov eax, dword [rdi + 0x28]
lea rcx, [rsp + 0x130]
shr eax, 8
movzx r8d, al
movzx eax, byte [rdi + 0x28]
shl ax, 8
movzx eax, ax
or r8d, eax
call sub.msvcrt.dll_sprintf
jmp 0x1400111ff
lea rcx, [rsp + 0x131]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x130], bpl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x530]
mov rcx, rdi
call fcn.14000322c
lea rdx, str.exclude:process:_s
mov r8, rax
lea rcx, [rsp + 0x130]
call sub.msvcrt.dll_sprintf
lea rdx, [rsp + 0x130]
mov rcx, rsi
call fcn.140012260
jmp 0x140011310
lea rcx, [rsp + 0x131]
mov r8, r12
xor edx, edx
mov byte [rsp + 0x130], bpl
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x530]
mov rcx, rdi
call fcn.14000322c
lea rdx, str.include:process:_s
jmp 0x1400111ef
cmp dword [rdi + 0x24], ebp
je 0x140011310
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0xfe
mov byte [rsp + 0x30], bpl
call sub.msvcrt.dll_memset
mov edx, dword [rdi + 0x24]
lea rcx, [rsp + 0x30]
call fcn.140016650
or edi, 0xffffffff
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x5a0]
mov r8d, edi
call fcn.14000939c
lea rdx, [0x140021378]
lea rcx, [rsi + 0x5a0]
mov r8d, edi
call fcn.14000939c
jmp 0x140011310
movsxd rdx, dword [rdi + 0x1e4]
mov rax, qword [0x140026560]
imul rdx, rdx, 0x514
cmp byte [rdx + rax], bpl
je 0x140011310
mov r8d, dword [rdi + 0x2c]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp rax, rbp
mov rbx, rax
je 0x140011310
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011310
mov eax, dword [rdi + 0x28]
mov r9d, dword [rdi + 0x24]
mov r8d, dword [rdi + 0x20]
mov edx, dword [rdi + 0x1c]
mov rcx, qword [rsi + 0x598]
mov dword [rsp + 0x20], eax
call fcn.140017ae4
cmp eax, ebp
je 0x140011310
mov dword [rsi + 0x60c], eax
lea r11, [rsp + 0x930]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret