Function at 0x100002310
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x70
lea rcx, [0x1000014d0]
call fcn.1000017b8
call fcn.1000025fc
mov ebx, 0x30
lea rcx, [rsp + 0x40]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x88], 0
call sub.ntdll.dll_memset
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea ecx, [rbx - 0x2e]
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x100000
mov dword [rsp + 0x40], ebx
call sub.ntdll.dll_RtlCreateHeap
mov qword [0x100004690], rax
test rax, rax
jne 0x100002393
lea rcx, [0x1000011a8]
call fcn.1000017b8
jmp 0x100002477
xor ecx, ecx
call sub.ntdll.dll_NtInitializeRegistry
xor r8d, r8d
lea r9, [rsp + 0x88]
lea ecx, [r8 + 7]
mov dl, 1
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x1000023c0
lea rcx, [0x1000011c0]
jmp 0x100002470
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 8]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x1000023e6
lea rcx, [0x1000011f0]
jmp 0x100002470
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 0x13]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x100002409
lea rcx, [0x100001228]
jmp 0x100002470
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 0x11]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x10000242c
lea rcx, [0x100001260]
jmp 0x100002470
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 0x12]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x10000244f
lea rcx, [0x100001288]
jmp 0x100002470
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 5]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x100002488
lea rcx, [0x1000012b0]
mov edx, eax
call fcn.1000017b8
lea rcx, [0x100001530]
call fcn.1000017b8
jmp 0x1000025d5
mov ecx, 4
call fcn.100002ad8
call fcn.1000019b0
test eax, eax
jne 0x1000024a4
lea rcx, [0x100001548]
jmp 0x10000247e
call fcn.1000020e4
lea rdx, [rsp + 0x90]
mov rbp, 0xfffffffffe363c80
xor ecx, ecx
mov qword [rsp + 0x90], rbp
call qword [sym.imp.ntdll.dll_NtDelayExecution]
cmp dword [0x100004680], 0
je 0x100002565
mov rbx, qword [0x100004688]
jmp 0x100002556
lea rcx, [0x1000013c0]
call fcn.1000017b8
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtDisplayString]
lea rcx, [0x1000013cc]
call fcn.1000017b8
mov rcx, rbx
call fcn.100001dc0
lea rdx, [rsp + 0x88]
xor ecx, ecx
mov edi, eax
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntdll.dll_NtDelayExecution]
test edi, edi
je 0x100002546
lea rcx, [0x1000013d8]
mov edx, edi
call fcn.1000017b8
jmp 0x100002552
lea rcx, [0x1000013e8]
call fcn.1000017b8
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1000024de
lea ecx, [rbx + 8]
call fcn.100002ad8
jmp 0x100002571
lea rcx, [0x100001560]
call fcn.1000017b8
cmp dword [0x100004680], 0
je 0x1000025bd
cmp dword [0x100004684], 6
jne 0x100002588
call fcn.100002884
lea rcx, [0x100001578]
call fcn.1000017b8
lea rdx, [rsp + 0x90]
xor ecx, ecx
mov qword [rsp + 0x90], 0xfffffffffc6c7900
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov ecx, 1
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
jmp 0x1000025d5
lea rdx, [rsp + 0x90]
xor ecx, ecx
mov qword [rsp + 0x90], rbp
call qword [sym.imp.ntdll.dll_NtDelayExecution]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret