Function at 0x1400010b0
Capabilities:
Accept command line arguments
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400090d8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x1a0], r15
mov dword [rsp + 0x54], r9d
call fcn.140001e00
test byte [0x1400098c0], 1
je 0x1400010f2
call fcn.140005654
lea rcx, [0x1400097f0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x140009018]
lea r9, [0x140009030]
mov dword [rsp + 0x44], 1
lea r8, [0x140009010]
xorps xmm1, xmm1
mov byte [rsp + 0x40], 0
lea rdx, [0x140001e80]
movups xmm0, xmmword [rax - 0x10]
lea rcx, [rbp - 0x40]
movdqu xmmword [0x140009038], xmm1
movups xmmword [rbp - 0x40], xmm0
call qword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_EventRegister]
test eax, eax
jne 0x140001164
mov r8, qword [0x140009018]
lea edx, [rax + 2]
mov rcx, qword [0x140009030]
movzx r9d, word [r8]
call qword [sym.imp.ADVAPI32.dll_EventSetInformation]
mov qword [rsp + 0x1d0], rbx
mov qword [rsp + 0x1d8], rsi
mov qword [rsp + 0x1e0], rdi
call qword [sym.imp.iertutil.dll_Ordinal_798]
test eax, eax
js 0x140001cc6
lea rcx, [rbp - 0x50]
movaps xmmword [rsp + 0x190], xmm6
call qword [sym.imp.api_ms_win_downlevel_ole32_l1_1_0.dll_CoCreateGuid]
test eax, eax
jns 0x1400011ad
movups xmm6, xmmword [0x1400065c0]
movaps xmmword [rbp - 0x50], xmm6
jmp 0x1400011b1
movaps xmm6, xmmword [rbp - 0x50]
call qword [sym.imp.msIso.dll_Ordinal_207]
movups xmmword [rax], xmm6
call qword [sym.imp.msIso.dll_Ordinal_207]
mov byte [rax + 0x10], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
movaps xmm6, xmmword [rsp + 0x190]
lea rsi, str.ETW0
mov dword [rsp + 0x5c], eax
xor r15d, r15d
mov rax, qword gs:[0x58]
movabs rbx, 0x400000000000
mov edi, 1
add rdi, qword [rax]
cmp dword [0x140009010], 5
mov qword [rsp + 0x78], rdi
mov byte [rdi], 1
jbe 0x140001333
test qword [0x140009020], rbx
je 0x140001333
mov rax, qword [0x140009028]
and rax, rbx
cmp rax, qword [0x140009028]
jne 0x140001333
mov ecx, 0x10000003
call qword [sym.imp.iertutil.dll_Ordinal_796]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x10
call qword [sym.imp.msIso.dll_Ordinal_207]
mov qword [rbp + 0x50], rax
lea rax, [rsp + 0x48]
mov qword [rbp + 0x60], rax
lea rax, [rsp + 0x5c]
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x58], 0x10
mov byte [rsp + 0x48], 1
mov qword [rbp + 0x68], 1
mov qword [rbp + 0x78], 4
movzx eax, byte [0x140006e8c]
lea rcx, [0x140006d81]
movzx eax, word [0x140006d82]
sub ecx, esi
mov dword [rbp - 0x74], eax
or ecx, 0xb000000
mov rax, qword [0x140009018]
mov qword [rbp - 0x70], rbx
mov ebx, r15d
mov qword [rbp + 0x20], rax
mov dword [rbp - 0x78], ecx
movzx eax, word [rax]
mov dword [rbp + 0x28], eax
lea rax, [0x140006d8c]
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x2c], 2
mov dword [rbp + 0x38], 0x5d
mov dword [rbp + 0x3c], 1
cmp byte [rdi], r15b
jne 0x140001301
mov ecx, 0x20000019
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
je 0x1400012fc
call fcn.1400057b8
test al, al
je 0x140001301
mov ebx, 2
mov rcx, qword [0x140009030]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x78]
mov dword [rsp + 0x30], 6
mov r9d, ebx
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_EventWriteEx]
xor r8d, r8d
mov byte [rdi], r15b
lea rcx, [0x140006938]
lea edx, [r8 + 1]
call qword [sym.imp.iertutil.dll_Ordinal_797]
test eax, eax
js 0x140001c46
mov qword [rsp + 0x1b8], r12
lea rdx, [0x140001f30]
mov qword [rsp + 0x1b0], r13
lea rcx, [0x1400097e0]
xor r9d, r9d
mov qword [rsp + 0x1a8], r14
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
cmp dword [0x140009750], 2
jne 0x1400013ef
cmp dword [0x140009744], 6
jne 0x1400013ef
cmp dword [0x140009748], 1
jne 0x1400013ef
lea rcx, [rsp + 0x4c]
mov dword [rsp + 0x4c], r15d
call qword [sym.imp.msvcrt.dll_rand_s]
test eax, eax
jne 0x1400013ef
movzx eax, byte [rsp + 0x4c]
mov ebx, r15d
add eax, 1
mov dword [rsp + 0x4c], eax
je 0x1400013ef
nop dword [rax]
nop dword [rax + rax]
xor ecx, ecx
mov edx, 0x10000
mov r8d, 0x2000
lea r9d, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
inc ebx
cmp ebx, dword [rsp + 0x4c]
jb 0x1400013d0
mov rcx, qword [0x1400090a8]
test rcx, rcx
je 0x140001418
call qword [sym.imp.iertutil.dll_Ordinal_701]
test eax, eax
js 0x140001461
mov ecx, r15d
sete cl
mov dword [0x1400090b0], ecx
mov qword [0x1400090a8], r15
mov eax, dword [0x1400090b0]
test eax, eax
je 0x140001461
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001454
lea rdx, str.SetSearchPathMode
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001454
mov ecx, 1
call qword [0x1400064c0]
lea rcx, [0x1400065d0]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8d, 0x27
lea rcx, str.28fb17e0_d393_439d_9a21_9474a070473a
mov rdx, rax
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
je 0x140001496
mov dword [rsp + 0x50], r15d
jmp 0x1400014a2
mov dword [rsp + 0x50], 1
add rbx, 0x4e
movzx eax, word [rbx]
cmp ax, 0x22
jne 0x1400014d0
nop dword [rax + rax]
movzx eax, word [rbx + 2]
mov rcx, rbx
add rbx, 2
test ax, ax
je 0x140001506
cmp ax, 0x22
jne 0x1400014b0
movzx eax, word [rcx + 4]
lea rbx, [rcx + 4]
jmp 0x1400014ee
cmp ax, 0x20
jbe 0x1400014ee
nop word [rax + rax]
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x20
ja 0x1400014e0
test ax, ax
je 0x140001506
cmp ax, 0x20
ja 0x140001506
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x1400014f3
mov r14, 0xffffffffffffffff
mov r12, r14
inc r12
cmp word [rbx + r12*2], r15w
jne 0x140001510
inc r12d
mov ecx, 0x40
mov esi, r12d
lea rdx, [r12 + r12]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
mov r13d, 5
test rax, rax
je 0x1400016ff
lea rcx, [r12 - 1]
mov edx, 0x7ffffffe
cmp rcx, rdx
mov eax, r15d
mov r8d, 0x80070057
cmova eax, r8d
test eax, eax
js 0x1400015a9
mov rcx, rdi
test r12d, r12d
je 0x14000158f
sub rdx, rsi
sub rbx, rdi
nop dword [rax]
lea rax, [rdx + rsi]
test rax, rax
je 0x14000158f
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14000158f
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x140001570
test rsi, rsi
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r15w
mov eax, 0x8007007a
cmovne eax, r15d
jmp 0x1400015b2
test r12d, r12d
je 0x1400015b2
mov word [rdi], r15w
test eax, eax
js 0x1400016ff
mov r14d, 0xffdf
lea rdx, str._eval
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140001622
mov rcx, r13
call fcn.140002de8
movsxd rdx, eax
movzx eax, word [rsi + rdx*2]
lea r8, [rsi + rdx*2]
test r14w, ax
jne 0x140001622
cmp rsi, rdi
je 0x1400015fd
cmp word [rsi - 2], 0x20
jne 0x140001622
cmp ax, 0x20
jne 0x1400016dd
nop word [rax + rax]
add r8, 2
inc edx
cmp word [r8], 0x20
je 0x140001610
jmp 0x1400016dd
lea rdx, str._new
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x14000167f
mov ecx, 4
call fcn.140002de8
movsxd rdx, eax
movzx eax, word [rsi + rdx*2]
lea r8, [rsi + rdx*2]
test r14w, ax
jne 0x14000167f
cmp rsi, rdi
je 0x140001661
cmp word [rsi - 2], 0x20
jne 0x14000167f
cmp ax, 0x20
jne 0x1400016dd
nop word [rax + rax]
add r8, 2
inc edx
cmp word [r8], 0x20
je 0x140001670
jmp 0x1400016dd
lea rdx, str._nowait
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400016f8
mov ecx, 7
call fcn.140002de8
movsxd rdx, eax
movzx eax, word [rsi + rdx*2]
lea r8, [rsi + rdx*2]
test r14w, ax
jne 0x1400016f8
cmp rsi, rdi
je 0x1400016be
cmp word [rsi - 2], 0x20
jne 0x1400016f8
cmp ax, 0x20
jne 0x1400016dd
nop dword [rax]
nop dword [rax + rax]
add r8, 2
inc edx
cmp word [r8], 0x20
je 0x1400016d0
mov eax, r12d
mov rcx, rsi
sub eax, edx
mov edx, eax
mov ebx, eax
call fcn.140005040
mov word [rdi + rbx*2], r15w
jmp 0x1400015c0
mov r14, 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.140001da0
mov ecx, 0x10000031
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
lea rdx, str.Microsoft.InternetExplorer.Default
lea rcx, str.Microsoft.InternetExplorer.Preview
cmove rcx, rdx
call qword [sym.imp.api_ms_win_downlevel_shell32_l1_1_0.dll_SetCurrentProcessExplicitAppUserModelID]
mov rbx, r14
nop
inc rbx
cmp word [rdi + rbx*2], r15w
jne 0x140001740
lea rdx, str._ResetDestinationList
mov rcx, rdi
inc ebx
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400017d3
mov ecx, 0x15
call fcn.140002de8
movsxd rcx, eax
mov r12d, 0xffdf
lea r8, [rsi + rcx*2]
movzx ecx, word [rsi + rcx*2]
test r12w, cx
jne 0x1400017d9
cmp rsi, rdi
je 0x140001791
cmp word [rsi - 2], 0x20
jne 0x1400017d9
cmp cx, 0x20
jne 0x1400017ad
nop word [rax + rax]
add r8, 2
inc eax
cmp word [r8], 0x20
je 0x1400017a0
sub ebx, eax
mov rcx, rsi
mov edx, ebx
call fcn.140005040
mov word [rdi + rbx*2], r15w
call fcn.140003248
call qword [sym.imp.IEFRAME.dll_Ordinal_212]
mov dword [rsp + 0x44], r15d
jmp 0x140001c18
mov r12d, 0xffdf
mov rcx, r14
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r15w
jne 0x1400017e0
inc rcx
call fcn.140002e18
lea rdx, str._newtab
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rbx, rax
test rax, rax
je 0x140001965
mov ecx, 7
call fcn.140002de8
movsxd rcx, eax
test word [rbx + rcx*2], r12w
jne 0x140001965
cmp rbx, rdi
je 0x140001836
cmp word [rbx - 2], 0x20
jne 0x140001965
mov rbx, r15
mov esi, 0x80004005
nop
xor r9d, r9d
lea r8, str.IEFrame
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400018d4
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, rbx
mov esi, 0x800700aa
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1400018ca
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400018ca
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x190
mov edx, 0x80da
mov rcx, rbx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
cmovne esi, dword [rsp + 0x70]
test esi, esi
js 0x140001840
jmp 0x1400018e0
test esi, esi
js 0x140001965
nop dword [rax]
inc r14
cmp word [rdi + r14*2], r15w
jne 0x1400018e0
lea rdx, str._newtab
mov rcx, rdi
inc r14d
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140001c18
mov ecx, 7
call fcn.140002de8
movsxd rcx, eax
lea r8, [rsi + rcx*2]
movzx ecx, word [rsi + rcx*2]
test r12w, cx
jne 0x140001c18
cmp rsi, rdi
je 0x140001938
cmp word [rsi - 2], 0x20
jne 0x140001c18
cmp cx, 0x20
jne 0x14000194d
nop
add r8, 2
inc eax
cmp word [r8], 0x20
je 0x140001940
sub r14d, eax
mov rcx, rsi
mov edx, r14d
call fcn.140005040
mov word [rdi + r14*2], r15w
jmp 0x140001c18
mov rcx, qword [0x140009098]
test rcx, rcx
je 0x140001990
call qword [sym.imp.iertutil.dll_Ordinal_701]
mov edx, eax
test eax, eax
js 0x14000199e
mov ecx, r15d
sete cl
mov dword [0x1400090a0], ecx
mov qword [0x140009098], r15
mov eax, dword [0x1400090a0]
mov edx, r15d
test eax, eax
sete dl
test edx, edx
mov rax, 0xfffffffffffffffc
mov rcx, 0xfffffffffffffffe
cmovne rcx, rax
call qword [sym.imp.USER32.dll_SetProcessDpiAwarenessContext]
mov r8d, 7
lea rdx, str.SCODEF:
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
jne 0x140001b82
movzx ecx, word [rdi + 0xe]
lea rbx, [rdi + 0xe]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140001a00
cmp word [rbx], r15w
je 0x140001a00
movzx ecx, word [rbx + 2]
add rbx, 2
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
je 0x1400019e8
movzx ecx, word [rbx]
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
je 0x140001a22
nop dword [rax]
movzx ecx, word [rbx + 2]
add rbx, 2
call qword [sym.imp.msvcrt.dll_iswspace]
test eax, eax
jne 0x140001a10
mov r8d, 7
lea rdx, str.CREDAT:
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsncmp]
test eax, eax
jne 0x140001b82
cmp dword [rsp + 0x50], r15d
jne 0x140001b78
cmp dword [0x140009010], r13d
mov rbx, qword [rsp + 0x78]
mov byte [rbx], 1
jbe 0x140001b60
movabs rsi, 0x400000000000
test qword [0x140009020], rsi
je 0x140001b60
mov rax, qword [0x140009028]
and rax, rsi
cmp rax, qword [0x140009028]
jne 0x140001b60
mov ecx, 0x10000003
call qword [sym.imp.iertutil.dll_Ordinal_796]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x10
call qword [sym.imp.msIso.dll_Ordinal_207]
mov qword [rbp], rax
lea rax, [rsp + 0x49]
mov qword [rbp + 0x10], rax
mov qword [rbp + 8], 0x10
mov byte [rsp + 0x49], 1
mov qword [rbp + 0x18], 1
lea rax, str.ETW0
lea rcx, [0x140006cb9]
sub ecx, eax
movzx eax, byte [0x140006e8c]
movzx eax, word [0x140006cba]
or ecx, 0xb000000
mov dword [rbp - 0x64], eax
mov rax, qword [0x140009018]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x68], ecx
mov qword [rbp - 0x60], rsi
movzx eax, word [rax]
mov dword [rbp - 0x28], eax
lea rax, [0x140006cc4]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x24], 2
mov dword [rbp - 0x18], 0x4e
mov dword [rbp - 0x14], 1
call fcn.140002ed0
mov rcx, qword [0x140009030]
lea rdx, [rbp - 0x68]
mov r9d, eax
xor r8d, r8d
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_EventWriteEx]
mov edx, dword [rsp + 0x54]
mov rcx, rdi
mov byte [rbx], r15b
mov byte [rsp + 0x40], 1
call qword [sym.imp.IEFRAME.dll_Ordinal_251]
mov r13d, eax
mov dword [rsp + 0x44], r13d
jmp 0x140001c18
cmp word [rdi + r14*2 + 2], r15w
lea r14, [r14 + 1]
jne 0x140001b82
lea rcx, [r14 + 1]
call fcn.140002e18
lea rdx, str._embedding
mov rcx, rdi
call qword [sym.imp.api_ms_win_downlevel_shlwapi_l1_1_0.dll_StrStrIW]
mov rbx, rax
test rax, rax
je 0x140001bfc
mov ecx, 0xa
call fcn.140002de8
movsxd rcx, eax
test word [rbx + rcx*2], r12w
jne 0x140001bfc
cmp rbx, rdi
je 0x140001bcf
cmp word [rbx - 2], 0x20
jne 0x140001bfc
lea rdx, str._startmanager
mov rcx, rdi
call fcn.140002050
test al, al
je 0x140001bfc
mov r9d, dword [rsp + 0x50]
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.IEFRAME.dll_Ordinal_258]
jmp 0x140001c14
mov r9d, dword [rsp + 0x50]
mov r8d, 1
mov edx, dword [rsp + 0x54]
mov rcx, rdi
call qword [sym.imp.IEFRAME.dll_Ordinal_255]
mov dword [rsp + 0x44], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1b8]
cmp byte [rsp + 0x40], r15b
jne 0x140001cce
jmp 0x140001c4b
mov dword [rsp + 0x44], r15d
mov rcx, qword [0x140006140]
lea r9, [rsp + 0x68]
mov edx, 1
mov qword [rsp + 0x30], r15
mov r8d, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
call qword [sym.imp.iertutil.dll_Ordinal_650]
mov rcx, qword [0x140006148]
lea r9, [rsp + 0x64]
mov edx, 1
mov qword [rsp + 0x30], r15
mov r8d, edx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 4
call qword [sym.imp.iertutil.dll_Ordinal_650]
mov ecx, dword [rsp + 0x64]
lea rdx, [rbp - 0x80]
mov eax, dword [rsp + 0x68]
shl rcx, 0x20
or rcx, rax
mov qword [rbp - 0x80], rcx
lea rcx, [rsp + 0x44]
call fcn.140003120
jmp 0x140001cce
xor r15d, r15d
mov dword [rsp + 0x44], r15d
lea rcx, [0x1400097f0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.140001e40
mov rcx, qword [0x140009030]
call qword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_EventUnregister]
lea rax, [rsp + 0x6c]
mov qword [0x140009030], r15
mov qword [rsp + 0x30], rax
lea r8, str.TerminateOnShutdown
lea rax, [rsp + 0x58]
mov dword [0x140009010], r15d
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
mov r9d, 0x10
mov qword [rsp + 0x20], r15
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x6c], 4
call qword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
cmp dword [rsp + 0x58], 0
mov r15, qword [rsp + 0x1a0]
mov rdi, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1d0]
je 0x140001d7c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140002510
add rsp, 0x1c0
pop rbp
ret