Function at 0x140088a60
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1038
call fcn.1401a4200
sub rsp, rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140362028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
lea rcx, [rsp + 0x280]
mov r8d, 0xb0
mov dl, 0xaa
call fcn.1401a64a0
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp rdi, 0x10
jne 0x14008918b
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rsi
xor ebp, ebp
call fcn.1401f3450
mov r15, rax
lea rbx, [rsp + 0x280]
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov rdi, qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
lea r13, [0x1400891b0]
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x60], rax
mov r14b, 1
test ebp, ebp
jne 0x14008915d
mov rcx, rbx
mov edx, 0xffffffff
call rsi
xor ebp, ebp
test eax, eax
je 0x14008915a
mov r12d, 0x10002
mov eax, dword [rsp + 0x280]
dec eax
cmp eax, 5
ja case.default.0x140088b39
movsxd rax, dword [r13 + rax*4]
add rax, r13
jmp rax
mov edx, dword [rsp + 0x288]
mov rcx, r15
call fcn.1401f3560
cmp rax, 0xffffffffffffffff
je 0x14008915a
mov rbp, rax
mov rsi, r13
mov edi, dword [rsp + 0x288]
mov r15d, dword [rsp + 0x290]
mov r8d, 0x4d0
lea rbx, [rsp + 0xb60]
mov rcx, rbx
mov dl, 0xaa
call fcn.1401a64a0
mov dword [rsp + 0x26c], 0xaaaaaaaa
mov r8d, 0xe8
lea rcx, [rsp + 0xa78]
mov dl, 0xaa
call fcn.1401a64a0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x260], rax
mov r8d, 0x148
lea rcx, [rsp + 0x118]
mov dl, 0xaa
call fcn.1401a64a0
mov r8d, 0x748
lea rcx, [rsp + 0x330]
mov dl, 0xaa
call fcn.1401a64a0
mov r8d, 0xa8
lea rcx, [rsp + 0x70]
mov dl, 0xaa
call fcn.1401a64a0
mov dword [rsp + 0xb90], 0x100007
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140088c94
mov ecx, 0x8000
call fcn.1401a00f0
test rax, rax
je 0x140088c94
mov r13, rax
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, 0x8000
mov rcx, qword [rsp + 0x40]
mov r8, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140088c8c
cmp qword [rsp + 0x270], 0x8000
jne 0x140088c8c
mov rax, r13
xor ebx, ebx
cmp dword [rax], edi
je 0x140088d6e
add rbx, 0xfffffffffffffff8
add rax, 4
cmp rbx, 0xffffffffffff0000
jne 0x140088c73
mov rcx, r13
call fcn.1401a0150
mov r13, rsi
xor r15d, 0x80000003
mov ecx, dword [rsp + 0x4c]
or r15d, ecx
mov r12d, 0x10002
mov eax, 0x80010001
cmovne r12d, eax
mov eax, 1
cmove ecx, eax
mov dword [rsp + 0x4c], ecx
xor ebp, ebp
mov r15, qword [rsp + 0x60]
lea rbx, [rsp + 0x280]
mov rsi, qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov rdi, qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp case.default.0x140088b39
mov r8, qword [rsp + 0x290]
jmp 0x140088cff
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x2a0]
mov edx, dword [rsp + 0x288]
mov rcx, r15
call fcn.1401f34c0
xor ebp, ebp
test eax, eax
jne case.default.0x140088b39
jmp 0x14008915a
mov edx, dword [rsp + 0x288]
mov rcx, r15
call fcn.1401f3590
jmp case.default.0x140088b39
mov edx, dword [rsp + 0x288]
mov rcx, r15
call fcn.1401f3590
mov ebp, 1
jmp case.default.0x140088b39
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x284]
mov edx, dword [rsp + 0x288]
mov r8d, r12d
call rdi
test eax, eax
jne 0x140088afa
jmp 0x14008915d
mov rcx, r13
call fcn.1401a0150
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax]
sub rdx, rbx
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, 8
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140088c94
cmp qword [rsp + 0x270], 8
jne 0x140088c94
mov rdi, qword [rsp + 0x260]
test rdi, rdi
je 0x140088c94
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, 0x148
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
lea r8, [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140088c94
cmp qword [rsp + 0x270], 0x148
jne 0x140088c94
mov rdx, qword [rsp + 0x1e0]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, 0x748
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x330]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140088c94
cmp qword [rsp + 0x270], 0x748
jne 0x140088c94
mov cl, byte [rsp + 0x330]
mov r13d, 1
shl r13, cl
mov rax, qword [rsp + 0xc58]
mov rcx, qword [rsp + 0x348]
cmp rax, rcx
jb 0x140088c94
add rcx, r13
cmp rax, rcx
jae 0x140088c94
cmp dword [rsp + 0xa38], 0
jne 0x140089046
lea rbx, [rsp + 0x70]
mov rcx, rbx
lea rdx, [rsp + 0xb60]
call fcn.1401f3c30
lea rax, [rsp + 0x330]
mov qword [rsp + 0x1e0], rax
mov rcx, rbx
lea rdx, [rsp + 0x118]
call fcn.140086230
test eax, eax
je 0x140088c94
test byte [rsp + 0x208], 1
je 0x140088c94
cmp dword [rsp + 0x234], 0
jne 0x140088c94
mov eax, dword [rsp + 0x230]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x26c], 1
add rdi, 0x11c
mov r9d, 4
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
lea r8, [rsp + 0x26c]
call fcn.1401f2b00
test eax, eax
je 0x140088c94
test byte [rsp + 0xa20], 0x1f
jne 0x140088c94
mov ebx, dword [rsp + 0xbf8]
add ebx, 0xffffff80
mov eax, dword [rsp + 0x50]
test eax, eax
cmovne ebx, eax
add ebx, 0xffffff20
and ebx, 0xfffffff0
lea ecx, [rbx - 8]
lea eax, [rbx + 0xe0]
mov qword [rsp + 0x50], rcx
cmp eax, ecx
jb 0x140088c94
cmp r13, rax
jb 0x140088c94
lea rdi, [rsp + 0xa78]
mov rcx, rdi
lea rdx, [rsp + 0x70]
mov r8d, ebx
call fcn.1401e7680
mov rdx, qword [rsp + 0x348]
add rdx, qword [rsp + 0x50]
mov r9d, 0xe8
mov rcx, qword [rsp + 0x40]
mov r8, rdi
call fcn.1401f2b00
test eax, eax
je 0x140088c94
mov eax, ebx
mov qword [rsp + 0xc10], rax
mov rax, qword [rsp + 0x348]
mov ecx, dword [rsp + 0xa20]
add rcx, rax
mov qword [rsp + 0xc58], rcx
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov qword [rsp + 0xbf8], rcx
and byte [rsp + 0xba5], 0xfb
mov rcx, rbp
lea rdx, [rsp + 0xb60]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ecx, eax
jmp 0x14008908f
mov rdx, qword [rsp + 0x1e0]
mov eax, 0x70c
add rdx, rax
mov dword [rsp + 0x270], r15d
mov eax, dword [rsp + 0xa3c]
inc eax
mov dword [rsp + 0x27c], eax
mov r9d, 4
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
lea r8, [rsp + 0x27c]
call fcn.1401f2b00
xor ecx, ecx
test eax, eax
jne 0x1400890a1
mov r13, rsi
xor ebp, ebp
test ecx, ecx
jne 0x140088cc2
jmp 0x140088c97
add rdi, 0x100
mov r9d, 4
mov rcx, rbx
mov rdx, rdi
lea r8, [rsp + 0x270]
call fcn.1401f2b00
test eax, eax
je 0x140089150
cmp qword [rsp + 0xa40], 0xffffffffffffffff
je 0x140089150
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
jne 0x140089124
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rsp + 0xa40]
xor ecx, ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 2
mov rcx, qword [rsp + 0x40]
mov r8, rax
lea r9, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
mov r13, rsi
je 0x140089092
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, 0
test eax, eax
mov r13, rsi
je 0x140089092
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
jmp 0x140089092
mov r13, rsi
xor ecx, ecx
jmp 0x140089092
xor r14d, r14d
mov rcx, r15
call fcn.1401f34a0
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x140089176
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
mov rcx, qword [rsp + 0x40]
jne 0x14008918b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401a4270
nop
add rsp, 0x1038
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret