Function at 0x1000286a0
Capabilities:
Terminate process

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov r13d, ecx
mov r8d, ecx
lea rdx, str.CleanupEngine__d_
mov ecx, 0x10
call fcn.100002470
xor r14d, r14d
cmp byte [0x10009e052], r14b
jne 0x10002c972
mov rcx, qword [0x10009e168]
cmp rcx, r14
je 0x10002870b
call sub.WTSAPI32.dll_WTSUnRegisterSessionNotification
mov rcx, qword [0x10009e168]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov r15d, 1
mov ecx, r15d
call qword [sym.imp.USER32.dll_ShowCursor]
mov rcx, qword [0x10009e190]
call sub.msvcrt.dll_free
mov qword [0x10009e190], r14
mov rcx, qword [0x10009fb80]
cmp rcx, r14
je 0x10002873e
call sub.gdiplus.dll_GdiplusShutdown
cmp dword [0x10009e098], r15d
je 0x10002c98e
mov rcx, qword [0x10009e178]
cmp rcx, r14
je 0x100028770
call fcn.1000296dc
mov rcx, qword [0x10009e178]
cmp rcx, r14
je 0x100028770
mov rax, qword [rcx]
mov edx, r15d
call qword [rax]
mov qword [0x10009e178], r14
mov rbx, qword [0x10009e1b8]
cmp rbx, r14
je 0x100028793
mov rcx, rbx
call fcn.100028dc0
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10009e1b8], r14
mov rbx, qword [0x10009e1d8]
cmp rbx, r14
je 0x1000287e3
lea rcx, [rbx + 0x30]
call fcn.1000289ec
mov dword [rbx + 0x28], r14d
mov dword [rbx + 0x2c], r14d
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.msvcrt.dll_free]
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], r14
mov rcx, rbx
call fcn.1000289ec
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10009e1d8], r14
mov rcx, qword [0x10009e1e0]
cmp rcx, r14
je 0x1000287fe
mov edx, r15d
call fcn.100027614
mov qword [0x10009e1e0], r14
mov rbx, qword [0x10009e1c0]
mov qword [rsp + 0x68], rbx
cmp rbx, r14
je 0x10002883e
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x100028829
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 0x10], r14
mov rcx, qword [rbx + 0x30]
cmp rcx, r14
jne 0x10002c99f
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10009e1c0], r14
mov rbx, qword [0x10009e1d0]
mov qword [rsp + 0x68], rbx
cmp rbx, r14
je 0x1000288b9
mov ebp, r14d
cmp dword [rbx], r14d
jbe 0x1000288a2
mov rsi, r14
mov rax, qword [rbx + 0x10]
mov rdi, qword [rsi + rax]
cmp rdi, r14
je 0x100028897
mov r12, qword [rdi + 8]
cmp r12, r14
je 0x100028887
mov rcx, r12
call fcn.100003fe4
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, qword [rdi]
call sub.msvcrt.dll_free
mov rcx, rdi
call sub.msvcrt.dll_free
add ebp, r15d
add rsi, 8
cmp ebp, dword [rbx]
jb 0x100028861
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
je 0x1000288b1
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10009e1d0], r14
mov rbx, qword [0x10009e198]
mov qword [rsp + 0x68], rbx
cmp rbx, r14
je 0x100028943
mov rcx, qword [rbx + 0x2810]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100003b90
mov rcx, rbx
call fcn.100003c24
nop
mov rcx, qword [rbx + 0x2860]
cmp rcx, r14
jne 0x10002c9ab
mov rcx, qword [rbx + 0x2848]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rbx + 0x2830]
cmp rcx, r14
jne 0x10002c9b7
lea r9, [fcn.100029290]
mov edx, 0x28
mov r8d, 0x100
mov rcx, rbx
call fcn.1000043e8
nop
mov qword [0x10009e320], r14
mov rcx, rbx
call sub.msvcrt.dll_free
mov qword [0x10009e198], r14
mov ebp, r14d
cmp dword [0x10009e3f8], r14d
ja 0x10002c9c3
xor edx, edx
lea rcx, [0x10009e3e8]
call fcn.100003d14
mov edi, r14d
cmp dword [0x10009e410], r14d
ja 0x10002ca8d
mov dword [0x10009e410], r14d
mov edi, r14d
cmp dword [0x10009e350], r14d
ja 0x10002cae4
mov dword [0x10009e350], r14d
mov rcx, qword [0x10009e158]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov cl, byte [0x10009e052]
call fcn.100027a90
mov rcx, qword [0x10009e180]
cmp rcx, r14
je 0x1000289cf
lea rax, vtable.IEngineInterface.0
mov qword [rcx], rax
call sub.msvcrt.dll_free
mov qword [0x10009e180], r14
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [0x1000a1a00]
cmp rcx, r14
je 0x1000286ed
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
jmp 0x1000286ed
mov ecx, 0x21
call qword [sym.imp.WINMM.dll_timeEndPeriod]
nop
jmp 0x10002874b
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x100028836
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x1000288fc
call qword [sym.imp.msvcrt.dll_free]
nop
jmp 0x100028919
mov rdi, r14
mov ebx, dword [0x10009e410]
mov rax, qword [0x10009e3f0]
mov rcx, qword [rax + rdi]
mov edx, dword [rcx + 0x10]
cmp edx, r14d
je 0x10002ca4e
mov r9d, ebx
xor r8d, r8d
lea rcx, [0x10009e400]
call fcn.100001944
movsxd r11, eax
mov rdx, r11
lea ecx, [rbx - 1]
cmp r11d, ecx
jae 0x10002ca46
mov r8, rdx
shl r8, 3
mov r9, rdx
shl r9, 2
mov rdx, qword [0x10009e400]
mov ecx, dword [r9 + rdx + 4]
mov dword [r9 + rdx], ecx
mov rcx, qword [0x10009e408]
mov rax, qword [r8 + rcx + 8]
mov qword [r8 + rcx], rax
add r11d, r15d
add r9, 4
add r8, 8
mov ebx, dword [0x10009e410]
lea eax, [rbx - 1]
cmp r11d, eax
jb 0x10002ca0d
dec ebx
mov dword [0x10009e410], ebx
mov rax, qword [0x10009e3f0]
mov rsi, qword [rdi + rax]
cmp rsi, r14
je 0x10002ca75
mov rcx, qword [rsi + 8]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
mov ebx, dword [0x10009e410]
add ebp, r15d
add rdi, 8
cmp ebp, dword [0x10009e3f8]
jae 0x10002895a
jmp 0x10002c9cc
mov rbx, r14
mov rax, qword [0x10009e408]
mov rcx, qword [rbx + rax]
mov rcx, qword [rcx + 0x220]
cmp rcx, 0xffffffffffffffff
je 0x10002caae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x10009e408]
mov rsi, qword [rbx + rax]
cmp rsi, r14
je 0x10002cacf
mov rcx, qword [rsi + 8]
call sub.msvcrt.dll_free
mov rcx, rsi
call sub.msvcrt.dll_free
add edi, r15d
add rbx, 8
cmp edi, dword [0x10009e410]
jae 0x100028978
jmp 0x10002ca90
mov rbx, r14
mov rcx, qword [0x10009e360]
mov rcx, qword [rcx + rbx]
call qword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov rcx, qword [0x10009e360]
mov rcx, qword [rcx + rbx]
call sub.msvcrt.dll_free
add edi, r15d
add rbx, 8
cmp edi, dword [0x10009e350]
jae 0x10002898f
jmp 0x10002cae7