Function at 0x14001de60
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
cmp dword [rcx + 0x10], 0
mov rcx, qword [rcx]
je 0x14001defe
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14001deb0
mov rcx, rdi
call fcn.140015200
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x14001df21
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x14001dec8
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x14001df65
lea rcx, [rsi + 0x28]
call fcn.140005c40
lea rcx, [rsi + 0x20]
call fcn.140005c40
lea rcx, [rsi + 0x18]
call fcn.140005c40
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400148e0
test rcx, rcx
jne 0x14001de76
cmp dword [rsi + 0x14], 0
jne 0x14001de76
cmp qword [rsi + 8], 0
jne 0x14001de76
jmp 0x14001de8f
mov rdx, qword [rsi + 0x68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14001df49
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001df7a
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x58]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x14001deb9
mov rcx, rdi
call fcn.140015200
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14001ded5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14001e470
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14001e4a2
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x14001e4a2
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x14001e4a2
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x14001e4a1

Function at 0x14001ebf0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140001846
mov r15, qword [r14 + 0x20]
lea rcx, [0x14003ac50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140001846
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140001870
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14001ec56
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.140018dd0
test al, al
je 0x14001ec56
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001ec56
mov r14, rax
mov rcx, rax
call fcn.140018dd0
test al, al
je 0x14001ec56
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140001800
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret