Function at 0x180004500
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x208
mov rsi, rcx
lea rcx, [rsp + 0x60]
call fcn.180005060
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov rcx, rdx
neg rcx
mov ecx, dword [rsp + 0x70]
jno 0x180004631
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], ecx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x1a0], rax
lea rax, [0x18000b760]
mov qword [rsp + 0x1a8], rax
lea rax, [0x18003a790]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0xa0]
call fcn.18002fc40
mov rdi, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x180]
mov rcx, rdi
call fcn.180001c50
mov rdx, qword [rsp + 0x170]
test rdx, rdx
je 0x1800045ea
mov r8d, 1
mov rcx, rdi
call fcn.180008a80
call fcn.18000b730
mov rdi, rax
mov ebx, edx
cmp qword [rsp + 0x30], 0
je 0x180004606
lea rcx, [rsp + 0x30]
call fcn.18000b720
mov qword [rsi + 8], rdi
mov dword [rsi + 0x10], ebx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x208
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, dword [rsp + 0x7c]
mov dword [rsp + 0x1bc], r8d
mov r8, qword [rsp + 0x74]
mov qword [rsp + 0x1b4], r8
mov qword [rsp + 0x1a0], rdx
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x1b0], ecx
call fcn.180008ab0
mov rdi, rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x20], 1
lea r14, [rsp + 0x60]
mov r8d, 0xa
mov r9d, 1
mov rcx, r14
xor edx, edx
call fcn.180036ba0
mov qword [rsp + 0xa0], 1
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 0xa
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.180006880
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xa0], xmm0
mov r15, qword [rsp + 0x70]
mov qword [rsp + 0xb0], r15
mov rdi, qword [rsp + 0xa0]
mov rax, rdi
sub rax, r15
cmp rax, 3
jbe 0x180004f32
mov rbx, qword [rsp + 0xa8]
mov dword [rbx + r15], 0x6c6c642e
add r15, 4
lea rdx, [0x18003a608]
lea rcx, [rsp + 0xa0]
mov r8d, 0x13
call fcn.180027190
movups xmm0, xmmword [rsp + 0xa0]
movups xmm1, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x180], xmm1
movaps xmmword [rsp + 0x170], xmm0
lea r12, [rsp + 0x170]
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1800176d0
mov rcx, r12
call fcn.180026f20
mov r8, rdx
lea rcx, [rsp + 0xa0]
mov rdx, rax
call fcn.18001de10
cmp dword [rsp + 0xa0], 2
jne 0x1800047f1
mov r15, qword [rsp + 0xa8]
mov eax, r15d
and eax, 3
cmp eax, 1
jne 0x1800048d3
mov r12, qword [r15 - 1]
mov r13, qword [r15 + 7]
mov rax, qword [r13]
test rax, rax
je 0x1800047c1
mov rcx, r12
call rax
dec r15
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x1800047d9
mov r8, qword [r13 + 0x10]
mov rcx, r12
call fcn.180008a80
mov edx, 0x18
mov r8d, 8
mov rcx, r15
call fcn.180008a80
jmp 0x1800048d3
mov qword [rsp + 0x60], r12
lea r13, case.0x180018194.26
mov qword [rsp + 0x68], r13
lea rax, [0x18003a648]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0x1f0]
lea rdx, [rsp + 0xa0]
call fcn.18002fc40
mov r15, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x200]
mov rcx, r12
call fcn.180001c50
test r15, r15
je 0x180004888
mov r8d, 1
mov rcx, r12
mov rdx, r15
call fcn.180008a80
lea r15, [rsp + 0x170]
mov rcx, r15
call fcn.180026f20
mov rcx, rax
call fcn.18001dd50
test rax, rax
je 0x1800048d3
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
lea rax, [0x180014260]
mov qword [rsp + 0x78], rax
lea rax, str.Failed_to_delete_existing_file_at_:
jmp 0x18000494d
lea rcx, [rsp + 0x1a0]
call fcn.180026f20
mov r12, rax
mov r13, rdx
lea r15, [rsp + 0x170]
mov rcx, r15
call fcn.180026f20
mov r9, rdx
mov rcx, r12
mov rdx, r13
mov r8, rax
call fcn.18001e2a0
test rax, rax
je 0x180004a92
cmp rax, 1
jne 0x180004a32
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r15
lea rax, case.0x180018194.26
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
lea rax, [0x180014260]
mov qword [rsp + 0x78], rax
lea rax, str.Failed_to_copy_the_module_to
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], 2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
call fcn.18002fc40
mov r14, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1800049bd
mov r8d, 1
mov rcx, r14
call fcn.180008a80
call fcn.18000b730
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov r14, qword [rsp + 0x48]
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x180004ed3
mov r15, qword [r14 - 1]
mov r12, qword [r14 + 7]
mov rax, qword [r12]
test rax, rax
je 0x180004a00
mov rcx, r15
call rax
dec r14
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x180004a1a
mov r8, qword [r12 + 0x10]
mov rcx, r15
call fcn.180008a80
mov edx, 0x18
mov r8d, 8
mov rcx, r14
call fcn.180008a80
jmp 0x180004ed3
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x180004a92
mov r15, qword [rdx - 1]
mov r13, qword [rdx + 7]
mov rax, qword [r13]
test rax, rax
je 0x180004a64
mov rcx, r15
mov r12, rbx
mov rbx, rdi
mov rdi, rdx
call rax
mov rdx, rdi
mov rdi, rbx
mov rbx, r12
dec rdx
mov r12, rdx
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x180004a7f
mov r8, qword [r13 + 0x10]
mov rcx, r15
call fcn.180008a80
mov edx, 0x18
mov r8d, 8
mov rcx, r12
call fcn.180008a80
lea rcx, [rsp + 0x170]
call fcn.180026f20
mov r8, rdx
lea rcx, [rsp + 0xa0]
mov rdx, rax
call fcn.180013f30
test byte [rsp + 0xa0], 1
jne 0x180004f6c
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rsp + 0x1d0], xmm0
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x60], rax
lea rax, [0x180006eb0]
mov qword [rsp + 0x68], rax
lea rax, str.rundll32.exe_____DllMain
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 2
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0xa0]
call fcn.18002fc40
lea rdx, str.C:WindowsSystem32_rundll32.exeDllMainFailed_to_launch_rundll32_with_DLL:
lea r14, [rsp + 0xa0]
mov r8d, 0x20
mov rcx, r14
call fcn.18001fae0
mov rdx, qword [rsp + 0x1d0]
mov r8, qword [rsp + 0x1d8]
mov rcx, r14
call fcn.18001fc00
lea rdx, [0x18003a7f8]
mov r8d, 7
mov rcx, r14
call fcn.18001fc00
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.1800191a0
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x180004bad
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call fcn.180008a80
mov r14, qword [rsp + 0xd0]
test r14, r14
je 0x180004bf2
mov r15, qword [rsp + 0xc8]
add r15, 0x10
jmp 0x180004bd9
add r15, 0x28
dec r14
je 0x180004bf2
mov rdx, qword [r15 - 8]
test rdx, rdx
je 0x180004bd0
mov rcx, qword [r15]
mov r8d, 1
call fcn.180008a80
jmp 0x180004bd0
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x180004c1a
mov rcx, qword [rsp + 0xc8]
shl rax, 3
lea rdx, [rax + rax*4]
mov r8d, 8
call fcn.180008a80
lea rcx, [rsp + 0x128]
call fcn.1800072c0
mov rdx, qword [rsp + 0xd8]
mov rax, rdx
neg rax
jo 0x180004c4c
jae 0x180004c4c
mov rcx, qword [rsp + 0xe0]
mov r8d, 1
call fcn.180008a80
mov eax, dword [rsp + 0xf8]
cmp eax, 4
jb 0x180004c6b
cmp eax, 6
je 0x180004c6b
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsp + 0x108]
cmp eax, 4
jb 0x180004c8a
cmp eax, 6
je 0x180004c8a
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [rsp + 0x118]
cmp eax, 4
jb 0x180004ca9
cmp eax, 6
je 0x180004ca9
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [rsp + 0x148]
call fcn.180006f20
mov r14, qword [rsp + 0x60]
cmp r14, 2
jne 0x180004f78
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x198], rax
lea rax, [rsp + 0x198]
mov qword [rsp + 0x1e0], rax
lea rax, [0x180014260]
mov qword [rsp + 0x1e8], rax
lea rax, [0x18003a828]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xc0], 0
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 1
lea r15, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
mov rcx, r15
call fcn.18002fc40
mov r14, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.180001c50
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180004d73
mov r8d, 1
mov rcx, r14
call fcn.180008a80
call fcn.18000b730
mov r12, rax
mov ebp, edx
mov r13, qword [rsp + 0x198]
mov eax, r13d
and eax, 3
cmp eax, 1
jne 0x180004de1
mov r15, rbx
mov rbx, rdi
mov r14, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x180004dab
mov rcx, r14
call rax
dec r13
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180004dc3
mov r8, qword [rdi + 0x10]
mov rcx, r14
call fcn.180008a80
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.180008a80
mov rdi, rbx
mov rbx, r15
lea r15, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180004dfb
mov rcx, qword [rsp + 0x50]
mov r8d, 1
call fcn.180008a80
mov qword [rsp + 0x1c0], r12
mov dword [rsp + 0x1c8], ebp
test ebp, ebp
je 0x180004fe4
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [0x18000b760]
mov qword [rsp + 0x38], rax
lea rax, str.Failed_to_launch_new_instance_with_rundll32:
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 1
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xa0]
call fcn.18002fc40
mov r14, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, r14
call fcn.180001c50
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180004ea8
mov r8d, 1
mov rcx, r14
call fcn.180008a80
call fcn.18000b730
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x48], 0
je 0x180004ed3
lea rcx, [rsp + 0x48]
call fcn.18000b720
mov rdx, qword [rsp + 0x170]
test rdx, rdx
je 0x180004ef3
mov rcx, qword [rsp + 0x178]
mov r8d, 1
call fcn.180008a80
test rdi, rdi
je 0x180004f09
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.180008a80
mov rdx, qword [rsp + 0x1a0]
test rdx, rdx
je 0x18000461a
mov rcx, qword [rsp + 0x1a8]
mov r8d, 1
call fcn.180008a80
jmp 0x18000461a
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0xa0]
mov r8d, 4
mov r9d, 1
mov rdx, r15
call fcn.180036ba0
mov rdi, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xb0]
jmp 0x18000470b
lea rcx, [0x18003a868]
call fcn.180038160
lea rcx, str.New_instance_launched_successfully.srcgates.rs
mov edx, 0x23
call fcn.180001c50
mov rcx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [sym.imp.kernel32.dll_CloseHandle]
call rdi
mov rcx, rsi
call rdi
test r14, r14
jne 0x18000500a
cmp qword [rsp + 0x70], 0
jne 0x18000501d
cmp qword [rsp + 0x80], 0
jne 0x180005033
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180004fd9
mov rcx, qword [rsp + 0x50]
mov r8d, 1
call fcn.180008a80
mov dword [rsp + 0x1c8], 0
lea rcx, [rsp + 0x1c0]
call fcn.180004490
lea rcx, str.Exiting_current_process_to_pass_control_to_the_new_instance.Failed_to_get_current_module_path:
mov edx, 0x3c
call fcn.180001c50
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x70], 0
je 0x180004fb4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x80], 0
je 0x180004fbf
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x180004fc9
jmp 0x180004fd9