Function at 0x1011220
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x450
mov rax, qword [0x010667f0]
xor rax, rsp
mov qword [rsp + 0x448], rax
movzx eax, word [0x01001c50]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x42]
mov rdi, rax
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov dword [rsp + 0x440], 0
call fcn.01030180
cmp qword [0x01068950], 0
je 0x101127f
mov rcx, qword [0x01068950]
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp qword [0x01068f38], 0
je 0x1011296
mov rcx, qword [0x01068f38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x010689dc], 0
jne 0x1011480
lea rcx, [0x01066cd8]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066d68]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066d98]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066dc8]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066d38]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066d08]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066ca8]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066c78]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066c48]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
lea rcx, [0x01066c18]
call qword [sym.imp.SQLSVC.dll_SHRecMemFree]
cmp qword [0x01069168], 0
je 0x1011347
lea rcx, [0x01066990]
call qword [sym.imp.SQLSVC.dll_FreeCrossServiceSA]
mov qword [0x01069168], 0
cmp qword [0x01069170], 0
je 0x1011369
lea rcx, [0x01066910]
call qword [sym.imp.SQLSVC.dll_FreeCrossServiceSA]
mov qword [0x01069170], 0
mov dword [rsp + 0x444], 0
jmp 0x1011387
mov eax, dword [rsp + 0x444]
add eax, 1
mov dword [rsp + 0x444], eax
cmp dword [rsp + 0x444], 0x11
jge 0x10113d9
movsxd rax, dword [rsp + 0x444]
lea rcx, [0x01068930]
cmp qword [rcx + rax*8], 0
je 0x10113d7
movsxd rax, dword [rsp + 0x444]
lea rcx, [0x01068930]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [rsp + 0x444]
lea rcx, [0x01068930]
mov qword [rcx + rax*8], 0
jmp 0x1011376
mov eax, dword [0x01069390]
mov dword [rsp + 0x440], eax
cmp dword [rsp + 0x440], 0
je 0x1011409
mov r9d, dword [0x01069390]
mov r8d, 0x61
xor edx, edx
mov ecx, 1
call fcn.01034b80
call fcn.01015970
mov ecx, dword [rsp + 0x440]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x440], eax
cmp dword [0x010689c0], 0
jne 0x1011433
cmp dword [rsp + 0x440], 0
je 0x101147e
mov r9d, dword [0x01069394]
mov r8d, 0x60
xor edx, edx
mov ecx, 3
call fcn.01034b80
mov r9d, dword [0x01069398]
mov r8d, 0x134
xor edx, edx
mov ecx, 3
call fcn.01034b80
mov r9d, dword [0x0106939c]
mov r8d, 0x135
xor edx, edx
mov ecx, 3
call fcn.01034b80
jmp 0x10114ec
mov r9d, 0x200
lea r8, [rsp + 0x40]
mov edx, 0xf3
mov rcx, qword [0x01069158]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x01001c30]
mov r8d, 0x62
xor edx, edx
mov ecx, 2
call fcn.01034b80
cmp qword [0x01068c18], 0
je 0x10114d7
mov rcx, qword [0x01068c18]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [0x01065108]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x448]
xor rcx, rsp
call fcn.01059ab0
add rsp, 0x450
pop rdi
ret