Function at 0x140001160
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov r9d, dword [0x1401059b0]
xor eax, eax
mov ecx, 0xd
lea rdx, [rsp + 0x20]
test r9d, r9d
mov rdi, rdx
rep stosq qword [rdi], rax
jne 0x140001440
mov rax, qword gs:[0x30]
xor esi, esi
mov rbx, qword [rax + 8]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400011c0
cmp rbx, rax
je 0x1400013e0
mov ecx, 0x3e8
call rdi
mov rax, rsi
lock cmpxchg qword [0x1401053d0], rbx
test rax, rax
jne 0x1400011b0
mov eax, dword [0x1401053d8]
xor ebx, ebx
cmp eax, 1
je 0x1400013f4
mov eax, dword [0x1401053d8]
test eax, eax
je 0x140001450
mov dword [0x140105388], 1
mov eax, dword [0x1401053d8]
cmp eax, 1
je 0x14000140d
test ebx, ebx
je 0x140001432
mov rax, qword [0x14009fee0]
test rax, rax
je 0x140001229
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.14000b8c0
lea rcx, [0x14000be50]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [0x1401059e0], rax
call fcn.14000bd60
lea rcx, section..text
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14000b6a0
lea rax, [0x140000000]
mov qword [0x1401053b0], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__acmdln
mov rax, qword [rax]
test rax, rax
je 0x1400012c7
xor ecx, ecx
jmp 0x140001291
test dl, dl
je 0x1400012c0
test ecx, ecx
je 0x1400012b4
mov ecx, 1
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x20
jle 0x140001280
mov r8d, ecx
xor r8d, 1
cmp dl, 0x22
cmove ecx, r8d
jmp 0x14000128d
test dl, dl
je 0x1400012c0
add rax, 1
movzx edx, byte [rax]
cmp dl, 0x20
jle 0x1400012b0
mov qword [0x1401053b8], rax
mov r8d, dword [0x1401059b0]
test r8d, r8d
je 0x1400012e9
test byte [rsp + 0x5c], 1
mov eax, 0xa
jne 0x1400013d0
mov dword [section..data], eax
mov r12d, dword [0x1401053a8]
lea r13d, [r12 + 1]
movsxd r13, r13d
shl r13, 3
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test r12d, r12d
mov rbp, rax
mov rdi, qword [0x1401053a0]
jle 0x140001472
xor ebx, ebx
nop dword [rax]
mov rcx, qword [rdi + rbx*8]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbp + rbx*8], rax
mov rdx, qword [rdi + rbx*8]
mov rcx, rax
mov r8, rsi
add rbx, 1
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp r12d, ebx
jg 0x140001320
sub r13, 8
mov qword [rbp + r13], 0
mov qword [0x1401053a0], rbp
call fcn.14000b280
mov rdx, qword [0x140105398]
mov rax, qword [0x140105100]
mov ecx, dword [0x1401053a8]
mov qword [rax], rdx
mov r8, qword [0x140105398]
mov rdx, qword [0x1401053a0]
call fcn.1400014f0
mov ecx, dword [0x14010538c]
mov dword [0x140105390], eax
test ecx, ecx
je 0x14000147a
mov edx, dword [0x140105388]
test edx, edx
jne 0x1400013be
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140105390]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movzx eax, word [rsp + 0x60]
jmp 0x1400012e3
mov eax, dword [0x1401053d8]
mov ebx, 1
cmp eax, 1
jne 0x1400011e2
mov ecx, 0x1f
call fcn.14000c1c0
mov eax, dword [0x1401053d8]
cmp eax, 1
jne 0x140001209
lea rdx, [0x1400f2870]
lea rcx, [0x1400f2860]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
test ebx, ebx
mov dword [0x1401053d8], 2
jne 0x140001211
xor eax, eax
xchg qword [0x1401053d0], rax
jmp 0x140001211
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
jmp 0x140001191
lea rdx, [0x1400f28a0]
lea rcx, [0x1400f2888]
mov dword [0x1401053d8], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011fa
xor r13d, r13d
jmp 0x140001356
mov ecx, eax
nop dword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
nop word cs:[rax + rax]
sub rsp, 0x28
mov dword [0x1401059b0], 1
call fcn.14000b2c0
call fcn.140001160
nop
nop
add rsp, 0x28
ret