Function at 0x140002ec0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x14001c008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14d, ecx
call fcn.1400071f0
mov rdi, qword [0x14001e6d8]
mov rsi, rax
test rdi, rdi
jne 0x140002f06
mov rcx, qword [rax + 0x30]
lea edx, [rdi + 1]
call fcn.140004000
mov rdi, rax
mov qword [0x14001e6d8], rax
mov rbx, qword [0x14001e6c8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], r12
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x60], r15
test rbx, rbx
jne 0x140002f61
mov rcx, qword [rsi + 0x50]
call fcn.140002740
test rax, rax
je 0x1400031ad
xor edx, edx
mov rcx, rax
call fcn.140004000
mov rdx, qword [rdi + 0x10]
mov rcx, rax
mov rbx, rax
mov qword [0x14001e6c8], rax
call fcn.140003de0
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
call fcn.140004140
xor r13d, r13d
test eax, eax
jne 0x140002f7c
mov ebp, r13d
jmp 0x140002f89
mov edx, eax
mov rcx, rbx
call fcn.140003d50
mov rbp, rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, rdi
call fcn.140004140
test eax, eax
jne 0x140002fa1
mov rbx, r13
jmp 0x140002fae
mov edx, eax
mov rcx, rdi
call fcn.140003d50
mov rbx, rax
mov rdx, rbp
mov rsi, r13
sub rdx, rbx
mov r15, rbx
nop word [rax + rax]
movzx ecx, byte [rdx + r15]
cmp byte [r15], cl
jne 0x140002fde
inc rsi
inc r15
cmp rsi, 0x18
jb 0x140002fc0
mov rax, rbx
jmp 0x140003179
mov rdx, rbx
lea rcx, [rsi + rbp]
sub rdx, rbp
mov r8, rsi
nop dword [rax + rax]
cmp rsi, 0x18
jae 0x140003005
movzx eax, byte [rcx + 1]
inc rcx
inc rsi
cmp byte [rdx + rcx], al
jne 0x140002ff0
sub rsi, r8
jne 0x140003012
mov rax, rbx
jmp 0x140003179
cmp r14d, 3
jne 0x14000310f
xorps xmm0, xmm0
lea r12, [r15 + rsi]
sub r15, rbx
lea r8d, [r14 + 0x2d]
lea rdx, [rsp + 0x20]
xor ecx, ecx
add r15, rbp
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400031ad
cmp dword [rsp + 0x40], 0x1000
jne 0x1400030e5
mov ecx, dword [rsp + 0x44]
lea eax, [rcx - 0x10]
test eax, 0xffffffcf
jne 0x1400030e5
cmp ecx, 0x30
je 0x1400030e5
mov rbp, qword [rsp + 0x38]
mov r14, qword [rsp + 0x20]
test rbp, rbp
je 0x1400030ea
mov rdi, rbp
test r14, r14
je 0x1400030e5
test rbp, rbp
je 0x1400030e5
test r15, r15
je 0x1400030e5
mov rbx, r14
cmp rbp, rsi
jb 0x1400030e5
nop dword [rax]
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400030bf
inc rbx
dec rdi
cmp rdi, rsi
jae 0x1400030a0
jmp 0x1400030e5
test rbx, rbx
je 0x1400030e5
lea rcx, [rbx + rsi]
call fcn.1400031d0
cmp rax, r12
je 0x14000300a
sub r14, rbx
dec r14
add rbp, r14
lea r14, [rbx + 1]
jne 0x140003082
mov rbp, qword [rsp + 0x38]
add r13, rbp
lea rdx, [rsp + 0x20]
mov rcx, r13
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400031ad
jmp 0x140003052
cmp r14d, 2
jne 0x140003177
lea r9d, [r14 + 2]
mov r8d, 0x3000
lea rdx, [rsi + 0xe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400031b8
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x25ff
lea r9, [rsp + 0x50]
mov word [rdi + rsi], ax
lea r8d, [r14 + 0x1e]
lea rax, [rsi + rbx]
mov dword [rdi + rsi + 2], r13d
lea rdx, [rsi + 0xe]
mov qword [rdi + rsi + 6], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rdi
jmp 0x140003179
xor eax, eax
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400085d0
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3