Function at 0x140196680
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb8]
sub rsp, 0x1b8
mov dword [rbp + 0x108], 0
xor al, al
mov byte [rbp + 0x100], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r14d, eax
lea rcx, [rsp + 0x40]
call fcn.140195900
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x80], xmm0
xor esi, esi
mov qword [rbp - 0x70], rsi
mov r13d, 2
mov dword [rbp + 0x108], r13d
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov r12, qword [rbp - 0x78]
cmp rbx, r15
je 0x1401967e6
mov r8d, dword [rbx]
cmp r8d, r14d
je 0x1401967d9
test r8d, 0xfffffffb
je 0x1401967d9
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1401967d9
mov qword [rbp + 0x110], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movzx edx, word [rbx + 6]
mov dword [rsp + 0x30], r13d
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea r9, [rbp + 0x110]
mov r8, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401967d0
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, r14d
jne 0x1401967b6
mov dword [rbx + 0x14], 1
cmp r12, rsi
je 0x14019679d
movups xmm0, xmmword [rbx]
movups xmmword [r12], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [r12 + 0x10], xmm1
add r12, 0x18
mov qword [rbp - 0x78], r12
jmp 0x1401967bd
mov r8, rbx
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.1401a3520
mov rsi, qword [rbp - 0x70]
mov r12, qword [rbp - 0x78]
jmp 0x1401967bd
mov dword [rbx + 0x14], 0
mov rcx, qword [rbp + 0x110]
cmp rcx, 0xffffffffffffffff
je 0x1401967d0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x18
cmp rbx, r15
jne 0x1401966f4
lea rcx, [rsp + 0x40]
call fcn.14019af70
mov rsi, qword [rbp - 0x80]
mov r15, rsi
cmp rsi, r12
je 0x140196c57
mov r14, r12
sub r14, rsi
mov qword [rbp + 0x110], r14
movabs rax, 0x2aaaaaaaaaaaaaab
imul r14
mov rcx, rdx
sar rcx, 2
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov qword [rbp + 0x118], rcx
movabs rdx, 0xaaaaaaaaaaaaaaa
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
test rcx, rcx
je 0x1401968d0
cmp rcx, rdx
ja 0x140196c80
lea rax, [rcx + rcx*2]
lea rdi, [rax*8]
test rdi, rdi
jne 0x140196871
xor ebx, ebx
jmp 0x1401968ae
cmp rdi, 0x1000
jb 0x1401968a3
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x140196c7a
call fcn.14037aa28
test rax, rax
je 0x140196c32
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1401968ae
mov rcx, rdi
call fcn.14037aa28
mov rbx, rax
mov qword [rsp + 0x40], rbx
add rdi, rbx
mov qword [rsp + 0x50], rdi
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x48], rdi
jmp 0x1401968da
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, dword [r15]
test eax, 0xfffffffb
je 0x140196907
cmp rbx, rdi
je 0x140196907
nop dword [rax]
cmp dword [rbx], eax
jne 0x1401968fe
cmp dword [rbx + 0x14], 0
jne 0x1401969a3
add rbx, 0x18
cmp rbx, rdi
jne 0x1401968f0
xor bl, bl
lea rcx, [rsp + 0x40]
call fcn.14019af70
test bl, bl
je 0x140196c11
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [r15]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1401969b0
mov r9d, 0x104
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov rcx, rbx
test eax, eax
je 0x1401969aa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x140196985
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.14016c670
mov rax, qword [rsp + 0x78]
jmp 0x1401969cd
mov bl, 1
jmp 0x140196909
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov qword [rsp + 0x70], rbx
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x60], bl
or r13d, 1
mov dword [rbp + 0x108], r13d
lea rdx, [rsp + 0x60]
cmp rax, 0xf
cmova rdx, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140196a00
lea rcx, [rsp + 0x40]
call fcn.14016c670
nop
lea rcx, [rsp + 0x40]
call fcn.140195fc0
movzx ebx, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140196a5f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140196a5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196c39
call fcn.14037ad7c
test bl, bl
je 0x140196c26
lea rcx, [rsp + 0x60]
call fcn.140196130
test al, al
jne 0x140196bd8
lea rbx, [rsp + 0x60]
mov r14, qword [rsp + 0x78]
cmp r14, 0xf
cmova rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x140196b49
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14044217c]
lea rsi, [0x14044217e]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rbp + rax - 0x60], 1
inc rcx
cmp rcx, rsi
jne 0x140196ac0
mov rsi, qword [rsp + 0x60]
lea rax, [rdi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x60], 0
jne 0x140196b08
cmp r8, rbx
je 0x140196b49
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax - 0x60], 0
je 0x140196af5
sub r8, rbx
cmp r8, 0xffffffffffffffff
je 0x140196b49
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rsp + 0x60]
cmp r14, 0xf
cmova rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14016c670
or r13d, 0xc
jmp 0x140196b5c
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140199e20
or r13d, 4
mov dword [rbp + 0x108], r13d
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140196ba0
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140196b9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196c40
call fcn.14037ad7c
mov r14, qword [rbp + 0x110]
mov rsi, qword [rbp - 0x80]
mov r8d, dword [r15]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140196bd8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140196c11
inc rdx
mov rcx, qword [rsp + 0x60]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140196c0c
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140196c47
call fcn.14037ad7c
add r15, 0x18
cmp r15, r12
je 0x140196c4e
mov rcx, qword [rbp + 0x118]
jmp 0x140196832
mov byte [rbp + 0x100], 1
jmp 0x140196bab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rbp + 0x100], 0
jne 0x140196c74
lea rcx, [rbp - 0x80]
call fcn.14019af70
add rsp, 0x1b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140191d40
nop
call fcn.14012b2a0
int3
call fcn.14019b360
int3