Function at 0x140052950
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x38
mov rcx, qword [0x14017a158]
lea rax, [rbp + 0x28]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ebx, ebx
movabs rsi, 0x346dc5d63886594b
test eax, eax
jne 0x140052996
mov edi, ebx
jmp 0x1400529ca
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x2c]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x30]
mov ecx, dword [rbp + 0x34]
mov rdi, rdx
shl rcx, 0x20
or rcx, rax
shr rdi, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add rdi, rdx
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], 0x190
call fcn.14006e670
mov rcx, qword [0x14017a158]
lea rax, [rbp + 0x28]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x140052a06
mov r8, rbx
jmp 0x140052a3a
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x2c]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x30]
mov ecx, dword [rbp + 0x34]
mov r8, rdx
shl rcx, 0x20
or rcx, rax
shr r8, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add r8, rdx
cmp rdi, r8
jne 0x140052bd5
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], 0x190
call fcn.14006e670
mov rcx, qword [0x14017a158]
lea rax, [rbp + 0x28]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x140052a7f
mov r8, rbx
jmp 0x140052ab3
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x2c]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x30]
mov ecx, dword [rbp + 0x34]
mov r8, rdx
shl rcx, 0x20
or rcx, rax
shr r8, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add r8, rdx
cmp rdi, r8
jne 0x140052bd5
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], Ordinal_301
call fcn.14006e670
mov rcx, qword [0x14017a158]
lea rax, [rbp + 0x28]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
jne 0x140052af8
mov r8, rbx
jmp 0x140052b2c
mov eax, dword [rbp + 0x28]
mov ecx, dword [rbp + 0x2c]
shl rcx, 0x20
or rcx, rax
mov rax, rsi
mul rcx
mov eax, dword [rbp + 0x30]
mov ecx, dword [rbp + 0x34]
mov r8, rdx
shl rcx, 0x20
or rcx, rax
shr r8, 0xb
mov rax, rsi
mul rcx
shr rdx, 0xb
add r8, rdx
cmp rdi, r8
jne 0x140052bd5
lea rcx, [rbp + 0x28]
mov qword [rbp + 0x28], Ordinal_301
call fcn.14006e670
mov rcx, qword [0x14017a158]
lea rax, [rbp + 0x28]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x140052ba1
mov ecx, dword [rbp + 0x28]
mov rax, rsi
mov edx, dword [rbp + 0x2c]
mov r8d, dword [rbp + 0x34]
shl rdx, 0x20
or rdx, rcx
shl r8, 0x20
mov ecx, dword [rbp + 0x30]
mul rdx
or r8, rcx
mov rax, rsi
mov rbx, rdx
mul r8
shr rbx, 0xb
shr rdx, 0xb
add rbx, rdx
cmp rdi, rbx
jne 0x140052bd5
mov r8d, dword [0x14017a154]
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140052bca
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
add rsp, 0x38
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor al, al
add rsp, 0x38
pop rdi
pop rsi
pop rbx
pop rbp
ret