Function at 0x66207c30
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x768]
sub rsp, 0x868
mov r12, r8
mov r14, rcx
call fcn.662073e0
test eax, eax
lea rax, str.Nt0SafeUtil::RaiseHardError_PID
lea rdx, str.ThinApp_has_encountered_an_unexpected_error._Click_Abort_to_close_the_application__Retry_to_debug__or_Continue_to_ignore_the_error._Support_info:_PID
setne r13b
test r13b, r13b
cmovne rdx, rax
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x66207c80
lea rbx, [rdi + rdi]
lea rcx, [rsp + 0x60]
mov r8, rbx
call fcn.6620e7b0
lea rax, [rsp + 0x60]
mov r15d, 0x400
add rbx, rax
mov rax, qword gs:[0x30]
mov r8d, 0xa
mov edx, dword [rax + 0x40]
mov rcx, rbx
sub r15, rdi
call fcn.662080b0
xor esi, esi
mov eax, eax
sub r15, rax
lea rdi, [rbx + rax*2]
test r14, r14
je 0x66207d67
mov eax, dword [0x6621f8e0]
lea edx, [rsi + 0x5c]
mov rcx, r14
mov dword [rdi], eax
add rdi, 4
sub r15, 2
call fcn.6620f910
test rax, rax
je 0x66207cfe
lea r14, [rax + 1]
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [r14 + rdx], sil
jne 0x66207d02
mov rcx, rsi
test rdx, rdx
je 0x66207d32
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rcx + r14]
inc rcx
mov word [rdi + rcx*2 - 2], ax
cmp rcx, rdx
jb 0x66207d20
movzx eax, word [0x6621f8e8]
lea rbx, [rdi + rdx*2]
sub r15, rdx
mov edx, dword [rbp + 0x7b8]
mov word [rbx], ax
add rbx, 2
mov rcx, rbx
mov r8d, 0xa
dec r15
call fcn.662080b0
mov eax, eax
sub r15, rax
lea rdi, [rbx + rax*2]
test r12, r12
je 0x66207da6
mov eax, dword [0x6621f8e0]
add rdi, 4
sub r15, 2
mov dword [rdi - 4], eax
or rbx, 0xffffffffffffffff
inc rbx
cmp word [r12 + rbx*2], si
jne 0x66207d81
cmp rbx, r15
mov rdx, r12
mov rcx, rdi
cmova rbx, r15
add rbx, rbx
mov r8, rbx
call fcn.6620e7b0
add rdi, rbx
lea rax, [rsp + 0x60]
mov r9d, 4
lea r8, [rbp + 0x7b0]
sub rdi, rax
lea edx, [r9 + 8]
or rcx, 0xffffffffffffffff
sar rdi, 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
setns bl
test bl, bl
je 0x66207e15
mov eax, dword [rbp + 0x7b0]
or eax, 1
mov dword [rbp + 0x7c0], eax
cmp eax, dword [rbp + 0x7b0]
jne 0x66207df5
xor bl, bl
jmp 0x66207e15
mov r9d, 4
lea r8, [rbp + 0x7c0]
or rcx, 0xffffffffffffffff
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
test eax, eax
setns bl
movzx eax, di
mov edx, 1
lea r9, [rsp + 0x40]
add ax, ax
mov ecx, 0x40000015
mov r8d, edx
mov word [rsp + 0x30], ax
mov word [rsp + 0x32], ax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7c8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntdll.dll_NtRaiseHardError]
mov r12d, eax
test bl, bl
je 0x66207e83
mov r9d, 4
lea r8, [rbp + 0x7b0]
or rcx, 0xffffffffffffffff
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtSetInformationProcess]
test r13b, r13b
je 0x66207fc1
mov rcx, rsi
test rdi, rdi
je 0x66207eb1
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + rcx*2 + 0x60]
inc rcx
mov byte [rsp + rcx + 0x5f], al
cmp rcx, rdi
jb 0x66207ea0
mov rax, qword [str.__dml__]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], si
jne 0x66207ec0
mov rax, qword [str._col_fg_errfg__bg_errbg__]
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
jne 0x66207ed4
lea r15, [r14 + rbx]
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x60]
add rcx, r15
mov r8, rdi
call fcn.6620e7b0
mov rdx, qword [str.__dml__]
mov rcx, rsi
test rbx, rbx
je 0x66207f20
nop word [rax + rax]
movzx eax, byte [rdx + rcx*2]
inc rcx
mov byte [rsp + rcx + 0x5f], al
cmp rcx, rbx
jb 0x66207f10
mov r8, qword [str._col_fg_errfg__bg_errbg__]
mov rcx, rsi
test r14, r14
je 0x66207f51
lea rdx, [rsp + 0x60]
add rdx, rbx
nop word [rax + rax]
movzx eax, byte [r8 + rcx*2]
inc rcx
mov byte [rdx + rcx - 1], al
cmp rcx, r14
jb 0x66207f40
mov rdx, qword [str.__col_]
add rdi, r15
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rdx + rcx*2], si
jne 0x66207f60
test rcx, rcx
je 0x66207f91
lea r8, [rsp + 0x60]
add r8, rdi
nop word [rax + rax]
movzx eax, byte [rdx + rsi*2]
inc rsi
mov byte [r8 + rsi - 1], al
cmp rsi, rcx
jb 0x66207f80
add rdi, rcx
xor edx, edx
lea r9, [rsp + 0x48]
lea rax, [rdi + 1]
lea r8d, [rdx + 2]
mov ecx, 0x40010006
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov byte [rsp + rdi + 0x60], 0xa
mov qword [rsp + 0x50], rax
call fcn.66207850
test r12d, r12d
js 0x66207fd9
mov eax, dword [rbp + 0x7c8]
cmp eax, 2
je 0x66207fd9
cmp eax, 7
jne 0x66207fe8
int3
mov edx, 0xc0000001
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
add rsp, 0x868
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret