Function at 0x1400367a0
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rbp + 7], rax
movzx esi, r9w
movsxd r13, r8d
mov rbx, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rbp - 0x61], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r12 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rbp - 0x61], rax
test rax, rax
jne 0x140036826
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov eax, 0x80004005
test r14d, r14d
cmovns r14d, eax
mov dword [rbp - 0x79], r14d
jmp 0x1400369a5
mov qword [rbp - 0x69], r12
lea rcx, [0x14037c890]
cmp qword [rbx + 0x10], r12
cmovne rcx, qword [rbx + 0x10]
lea r8, [rbp - 0x69]
movzx edx, si
call fcn.140033a00
mov r14d, eax
mov dword [rbp - 0x79], eax
mov rsi, qword [rbp - 0x69]
test eax, eax
js 0x14003699b
mov qword [rbp - 0x71], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rsi
lea rax, [r13 + 3]
add rax, rax
movups xmm0, xmmword [r15 + rax*8]
movdqu xmmword [rbp - 0x39], xmm0
mov eax, dword [rbx + 0x18]
mov dword [rbp - 0x29], eax
movzx eax, word [r15 + 0x50]
mov word [rbp - 0x25], ax
mov qword [rbp - 0x21], rdi
mov rax, qword [r15 + 8]
mov qword [rbp - 0x19], rax
mov rax, qword [r15 + 0x10]
mov qword [rbp - 0x11], rax
mov rax, qword [r15 + 0x28]
mov qword [rbp - 9], rax
mov al, byte [0x1403e51ba]
mov byte [rbp - 1], al
mov byte [rbp], 0
test r13d, r13d
sete dl
lea r8, [rbp - 0x71]
lea rcx, [rbp - 0x49]
call fcn.140033cf8
mov r14d, eax
mov dword [rbp - 0x79], eax
mov rbx, qword [rbp - 0x71]
test eax, eax
jne 0x140036986
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], rdi
and dword [rsp + 0x20], eax
mov r9d, 0x7530
xor r8d, r8d
lea rdx, [rbp - 0x59]
lea ecx, [rax + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x14003691c
lea rdx, [rbp - 0x79]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r14d, dword [rbp - 0x79]
test r14d, r14d
js 0x140036976
mov r14d, 0x80080005
jmp 0x14003696f
cmp eax, 1
jne 0x14003692a
xor r14d, r14d
mov dword [rbp - 0x79], r14d
jmp 0x140036978
cmp eax, 0x102
jne 0x14003694c
mov dword [rbp - 0x79], 0x800705b4
mov edx, 0x5b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r14d, dword [rbp - 0x79]
jmp 0x140036973
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov eax, 0x80004005
test r14d, r14d
cmovns r14d, eax
mov dword [rbp - 0x79], r14d
test r14d, r14d
jne 0x140036986
mov rax, rbx
xor ebx, ebx
mov qword [rbp - 0x71], rbx
mov qword [r15 + r13*8 + 0x18], rax
xor r12d, r12d
test rbx, rbx
je 0x14003699b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x71], r12
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
test rdi, rdi
je 0x1400369b7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x61], r12
mov eax, r14d
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14005f5e0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret