Function at 0x14019e150
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
mov dword [rbp + 0x108], 0
xor al, al
mov byte [rbp + 0x100], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
lea rcx, [rsp + 0x40]
call fcn.14019d3d0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor esi, esi
mov qword [rbp - 0x70], rsi
mov r13d, 2
mov dword [rbp + 0x108], r13d
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov r12, qword [rbp - 0x78]
cmp rbx, r15
je 0x14019e2b6
mov r8d, dword [rbx]
cmp r8d, r14d
je 0x14019e2a9
test r8d, 0xfffffffb
je 0x14019e2a9
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14019e2a9
mov qword [rbp + 0x110], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx edx, word [rbx + 6]
mov dword [rsp + 0x30], r13d
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea r9, [rbp + 0x110]
mov r8, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14019e2a0
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, r14d
jne 0x14019e286
mov dword [rbx + 0x14], 1
cmp r12, rsi
je 0x14019e26d
movups xmm0, xmmword [rbx]
movups xmmword [r12], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [r12 + 0x10], xmm1
add r12, 0x18
mov qword [rbp - 0x78], r12
jmp 0x14019e28d
mov r8, rbx
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.1401aaff0
mov rsi, qword [rbp - 0x70]
mov r12, qword [rbp - 0x78]
jmp 0x14019e28d
mov dword [rbx + 0x14], 0
mov rcx, qword [rbp + 0x110]
cmp rcx, 0xffffffffffffffff
je 0x14019e2a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x18
cmp rbx, r15
jne 0x14019e1c4
lea rcx, [rsp + 0x40]
call fcn.1401a2a40
mov rsi, qword [rbp - 0x80]
mov r15, rsi
cmp rsi, r12
je 0x14019e727
mov r14, r12
sub r14, rsi
mov qword [rbp + 0x110], r14
movabs rax, 0x2aaaaaaaaaaaaaab
imul r14
mov rcx, rdx
sar rcx, 2
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov qword [rbp + 0x118], rcx
movabs rdx, 0xaaaaaaaaaaaaaaa
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
test rcx, rcx
je 0x14019e3a0
cmp rcx, rdx
ja 0x14019e750
lea rax, [rcx + rcx*2]
lea rdi, [rax*8]
test rdi, rdi
jne 0x14019e341
xor ebx, ebx
jmp 0x14019e37e
cmp rdi, 0x1000
jb 0x14019e373
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14019e74a
call fcn.1403824f8
test rax, rax
je 0x14019e702
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14019e37e
mov rcx, rdi
call fcn.1403824f8
mov rbx, rax
mov qword [rsp + 0x40], rbx
add rdi, rbx
mov qword [rsp + 0x50], rdi
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x48], rdi
jmp 0x14019e3aa
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, dword [r15]
test eax, 0xfffffffb
je 0x14019e3d7
cmp rbx, rdi
je 0x14019e3d7
nop dword [rax]
cmp dword [rbx], eax
jne 0x14019e3ce
cmp dword [rbx + 0x14], 0
jne 0x14019e473
add rbx, 0x18
cmp rbx, rdi
jne 0x14019e3c0
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.1401a2a40
test bl, bl
je 0x14019e6e1
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14019e480
mov r9d, 0x104
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov rcx, rbx
test eax, eax
je 0x14019e47a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x14019e455
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.14016c650
mov rax, qword [rsp + 0x78]
jmp 0x14019e49d
mov bl, 1
jmp 0x14019e3d9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], bl
or r13d, 1
mov dword [rbp + 0x108], r13d
lea rdx, [rsp + 0x60]
cmp rax, 0xf
cmova rdx, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14019e4d0
lea rcx, [rsp + 0x40]
call fcn.14016c650
nop
lea rcx, [rsp + 0x40]
call fcn.14019da90
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14019e52f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e52a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14019e709
call fcn.14038284c
test bl, bl
je 0x14019e6f6
lea rcx, [rsp + 0x60]
call fcn.14019dc00
test al, al
jne 0x14019e6a8
lea rbx, [rsp + 0x60]
mov r14, qword [rsp + 0x78]
cmp r14, 0xf
cmova rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x14019e619
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14044b414]
lea rsi, [0x14044b416]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x60], 1
inc rcx
cmp rcx, rsi
jne 0x14019e590
mov rsi, qword [rsp + 0x60]
lea rax, [rdi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x60], 0
jne 0x14019e5d8
cmp r8, rbx
je 0x14019e619
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x60], 0
je 0x14019e5c5
sub r8, rbx
cmp r8, 0xffffffffffffffff
je 0x14019e619
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rsp + 0x60]
cmp r14, 0xf
cmova rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14016c650
or r13d, 0xc
jmp 0x14019e62c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1401a18f0
or r13d, 4
mov dword [rbp + 0x108], r13d
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14019e670
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14019e66b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14019e710
call fcn.14038284c
mov r14, qword [rbp + 0x110]
mov rsi, qword [rbp - 0x80]
mov r8d, dword [r15]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14019e6a8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14019e6e1
inc rdx
mov rcx, qword [rsp + 0x60]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14019e6dc
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14019e717
call fcn.14038284c
add r15, 0x18
cmp r15, r12
je 0x14019e71e
mov rcx, qword [rbp + 0x118]
jmp 0x14019e302
mov byte [rbp + 0x100], 1
jmp 0x14019e67b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rbp + 0x100], 0
jne 0x14019e744
lea rcx, [rbp - 0x80]
call fcn.1401a2a40
add rsp, 0x1b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140199810
nop
call fcn.14012b280
int3
call fcn.1401a2e30
int3