Function at 0x140003d90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp ecx, 3
jne 0x140004090
mov rax, qword [rdx + 8]
mov rcx, qword [rdx + 0x10]
mov qword [0x140028cc8], rax
call fcn.14000b8d0
xor ecx, ecx
mov dword [0x140028cc4], eax
call fcn.14000b4e0
mov rcx, rax
call fcn.1400080c8
call fcn.14000809c
mov ebx, eax
and ebx, 0x80000003
jge 0x140003dfb
dec ebx
or ebx, 0xfffffffc
inc ebx
mov eax, dword [0x1400233e0]
add ebx, 7
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov dword [rsp + 0x50], eax
mov edx, 1
movzx eax, byte [0x1400233e4]
movups xmm1, xmmword [0x1400233c0]
mov byte [rsp + 0x54], al
lea eax, [rbx*2 + 0xc]
movups xmmword [rsp + 0x20], xmm0
movsxd rcx, eax
movups xmm0, xmmword [0x1400233d0]
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm0
call fcn.140008094
mov qword [0x140027c98], rax
test rax, rax
je 0x1400040b5
xor ebp, ebp
movsxd rsi, ebx
test ebx, ebx
jle 0x140003ea0
mov edi, ebp
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [rax - 1]
call fcn.14000809c
cdq
idiv ebx
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x20]
mov rax, qword [0x140027c98]
mov byte [rdi + rax], cl
inc rdi
cmp rdi, rsi
jl 0x140003e70
lea rcx, [0x140022ac8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140004090
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [0x140029c80]
lea rdx, [0x140028cc0]
lea rcx, [0x140027c94]
call rax
mov edx, dword [0x140027c94]
mov word [0x140029c82], bp
cmp edx, 0xa
jae 0x140003efc
cmp dword [0x140028cc4], 1
je 0x140004090
mov r9d, dword [0x140029c80]
lea rcx, str.Windows_version:__d._d._d_version._n
mov r8d, dword [0x140028cc0]
call fcn.140001010
call fcn.140002050
test eax, eax
je 0x140004090
lea rcx, str.PsSetCreateProcessNotifyRoutine
call fcn.1400026e0
lea rcx, str.PsSetCreateThreadNotifyRoutine
mov rsi, rax
call fcn.1400026e0
lea rcx, str.PsSetLoadImageNotifyRoutine
mov rdi, rax
call fcn.1400026e0
mov rbx, rax
test rsi, rsi
je 0x140003f66
lea rdx, str.PsSetCreateProcessNotifyRoutine
mov rcx, rsi
call fcn.140002ad0
jmp 0x140003f72
lea rcx, str.Failed_to_obtain_process_callback_address._n
call fcn.140001010
test rdi, rdi
je 0x140003f88
lea rdx, str.PsSetCreateThreadNotifyRoutine
mov rcx, rdi
call fcn.140002ad0
jmp 0x140003f94
lea rcx, str.Failed_to_obtain_thread_callback_address._n
call fcn.140001010
test rbx, rbx
je 0x140003faa
lea rdx, str.PsSetLoadImageNotifyRoutine
mov rcx, rbx
call fcn.140002ad0
jmp 0x140003fb6
lea rcx, str.Image_loading_callback_address_acquisition_failed._n
call fcn.140001010
call fcn.140002d80
call fcn.140003270
call fcn.140003820
mov ebx, 0x800
lea rcx, [0x140027cb4]
mov r8d, ebx
xor edx, edx
call fcn.1400051d0
mov r8d, ebx
mov dword [0x1400284b4], ebp
xor edx, edx
lea rcx, [0x1400284b8]
call fcn.1400051d0
mov eax, dword [0x1400284b4]
lea rcx, [0x140027ca0]
sub ebx, eax
mov dword [0x140028cb8], ebp
mov dword [0x140027cac], ebp
mov dword [0x140027cb0], 1
cmp ebx, 0x14
jae 0x140004028
mov dword [0x140027cac], 1
jmp 0x140004048
movups xmm0, xmmword [0x140027c80]
mov rdx, rax
movups xmmword [rax + rcx + 0x14], xmm0
mov eax, dword [0x140027c90]
mov dword [rdx + rcx + 0x24], eax
add dword [0x1400284b4], 0x14
mov edx, 2
call fcn.140001500
test eax, eax
jne 0x140004083
cmp dword [0x140028cb8], 4
jne 0x140004083
mov edx, dword [0x1400284b8]
test edx, edx
je 0x140004077
lea rcx, str.DeleteService_error:__u_n
call fcn.140001010
jmp 0x140004083
lea rcx, str.Finished_n
call fcn.140001010
mov rcx, qword [0x140027ca0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400040e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, str.Random_Error__n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]