Function at 0x100002334
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x70
lea rcx, [0x1000014e0]
call fcn.1000017d8
call fcn.100002620
mov ebx, 0x30
lea rcx, [rsp + 0x40]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x88], 0
call sub.ntdll.dll_memset
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea ecx, [rbx - 0x2e]
xor edx, edx
mov r9d, 0x1000
mov r8d, 0x100000
mov dword [rsp + 0x40], ebx
call sub.ntdll.dll_RtlCreateHeap
test rax, rax
mov qword [0x100004690], rax
jne 0x1000023b7
lea rcx, [0x1000011a8]
call fcn.1000017d8
jmp 0x10000249b
xor ecx, ecx
call sub.ntdll.dll_NtInitializeRegistry
xor r8d, r8d
lea r9, [rsp + 0x88]
lea ecx, [r8 + 7]
mov dl, 1
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x1000023e4
lea rcx, [0x1000011c0]
jmp 0x100002494
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 8]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x10000240a
lea rcx, [0x1000011f0]
jmp 0x100002494
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 0x13]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x10000242d
lea rcx, [0x100001228]
jmp 0x100002494
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 0x11]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x100002450
lea rcx, [0x100001260]
jmp 0x100002494
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 0x12]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x100002473
lea rcx, [0x100001288]
jmp 0x100002494
xor r8d, r8d
lea r9, [rsp + 0x88]
mov dl, 1
lea ecx, [r8 + 5]
call sub.ntdll.dll_RtlAdjustPrivilege
test eax, eax
je 0x1000024ac
lea rcx, [0x1000012b0]
mov edx, eax
call fcn.1000017d8
lea rcx, [0x100001540]
call fcn.1000017d8
jmp 0x1000025f9
mov ecx, 4
call fcn.100002b10
call fcn.1000019d0
test eax, eax
jne 0x1000024c8
lea rcx, [0x100001558]
jmp 0x1000024a2
call fcn.100002108
lea rdx, [rsp + 0x90]
mov rbp, 0xfffffffffe363c80
xor ecx, ecx
mov qword [rsp + 0x90], rbp
call qword [sym.imp.ntdll.dll_NtDelayExecution]
cmp dword [0x100004680], 0
je 0x100002589
mov rbx, qword [0x100004688]
jmp 0x10000257a
lea rcx, [0x1000013c0]
call fcn.1000017d8
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtDisplayString]
lea rcx, [0x1000013cc]
call fcn.1000017d8
mov rcx, rbx
call fcn.100001de4
lea rdx, [rsp + 0x88]
xor ecx, ecx
mov edi, eax
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ntdll.dll_NtDelayExecution]
test edi, edi
je 0x10000256a
lea rcx, [0x1000013d8]
mov edx, edi
call fcn.1000017d8
jmp 0x100002576
lea rcx, [0x1000013f8]
call fcn.1000017d8
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x100002502
lea ecx, [rbx + 8]
call fcn.100002b10
jmp 0x100002595
lea rcx, [0x100001570]
call fcn.1000017d8
cmp dword [0x100004680], 0
je 0x1000025e1
cmp dword [0x100004684], 6
jne 0x1000025ac
call fcn.1000028bc
lea rcx, [0x100001588]
call fcn.1000017d8
lea rdx, [rsp + 0x90]
xor ecx, ecx
mov qword [rsp + 0x90], 0xfffffffffc6c7900
call qword [sym.imp.ntdll.dll_NtDelayExecution]
mov ecx, 1
call qword [sym.imp.ntdll.dll_NtShutdownSystem]
jmp 0x1000025f9
lea rdx, [rsp + 0x90]
xor ecx, ecx
mov qword [rsp + 0x90], rbp
call qword [sym.imp.ntdll.dll_NtDelayExecution]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret