Function at 0x140047210
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rcx, qword [0x1401b3b50]
test rcx, rcx
je 0x1400474ae
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rsi
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x20]
mov qword [rsp + 0x38], rdi
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ebx, ebx
movabs rsi, 0x346dc5d63886594b
test eax, eax
jne 0x14004726b
mov edi, ebx
jmp 0x14004729f
mov eax, dword [rbp + 0x10]
mov ecx, dword [rbp + 0x14]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x1c]
mov rdi, rdx
shl rcx, 0x20
or rcx, rax
shr rdi, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add rdi, rdx
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x10], 0x190
call fcn.140073600
mov rcx, qword [0x1401b3b50]
lea rax, [rbp + 0x10]
lea r9, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x1400472db
mov r8, rbx
jmp 0x14004730f
mov eax, dword [rbp + 0x10]
mov ecx, dword [rbp + 0x14]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x1c]
mov r8, rdx
shl rcx, 0x20
or rcx, rax
shr r8, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add r8, rdx
cmp rdi, r8
jne 0x14004749f
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x10], 0x190
call fcn.140073600
mov rcx, qword [0x1401b3b50]
lea rax, [rbp + 0x10]
lea r9, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x140047354
mov r8, rbx
jmp 0x140047388
mov eax, dword [rbp + 0x10]
mov ecx, dword [rbp + 0x14]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x1c]
mov r8, rdx
shl rcx, 0x20
or rcx, rax
shr r8, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add r8, rdx
cmp rdi, r8
jne 0x14004749f
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x10], Ordinal_301
call fcn.140073600
mov rcx, qword [0x1401b3b50]
lea rax, [rbp + 0x10]
lea r9, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x1400473cd
mov r8, rbx
jmp 0x140047401
mov eax, dword [rbp + 0x10]
mov ecx, dword [rbp + 0x14]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp + 0x1c]
mov r8, rdx
shl rcx, 0x20
or rcx, rax
shr r8, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add r8, rdx
cmp rdi, r8
jne 0x14004749f
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x10], Ordinal_301
call fcn.140073600
mov rcx, qword [0x1401b3b50]
lea rax, [rbp + 0x10]
lea r9, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140047476
mov ecx, dword [rbp + 0x10]
mov rax, rsi
mov edx, dword [rbp + 0x14]
mov r8d, dword [rbp + 0x1c]
shl rdx, 0x20
or rdx, rcx
shl r8, 0x20
mov ecx, dword [rbp + 0x18]
mul rdx
or r8, rcx
mov rax, rsi
mov rbx, rdx
mul r8
shr rbx, 0xb
shr rdx, 0xb
add rbx, rdx
cmp rdi, rbx
jne 0x14004749f
mov r8d, dword [0x1401b3b48]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14004749f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
add rsp, 0x50
pop rbp
ret