Function at 0x180002220
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x208
mov rsi, rcx
lea rcx, [rsp + 0x60]
call fcn.180002bf0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov rcx, rdx
neg rcx
mov ecx, dword [rsp + 0x70]
jno 0x18000233f
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], ecx
lea rax, [rsp + 0x30]
mov qword [rsp + 0xd0], rax
lea rax, [0x1800e27a0]
mov qword [rsp + 0xd8], rax
lea rax, [0x180113a90]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xf0]
call fcn.1801060e0
mov rdi, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rcx, rdi
call fcn.180006f70
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x18000230a
mov r8d, 1
mov rcx, rdi
call fcn.18000b700
call fcn.1800e2770
mov rdi, rax
mov ebx, edx
cmp qword [rsp + 0x30], 0
je 0x180002326
lea rcx, [rsp + 0x30]
call fcn.1800e2760
mov qword [rsi + 8], rdi
mov dword [rsi + 0x10], ebx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x180002abe
mov r8d, dword [rsp + 0x7c]
mov dword [rsp + 0xec], r8d
mov r8, qword [rsp + 0x74]
mov qword [rsp + 0xe4], r8
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xe0], ecx
call fcn.1800dccc0
mov qword [rsp + 0xf0], 1
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], 0xa
lea r14, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
mov rcx, r14
call fcn.18000a1c0
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
mov rax, rdi
sub rax, r15
cmp rax, 3
jbe 0x180002ad5
mov rbx, qword [rsp + 0x68]
mov dword [rbx + r15], 0x6c6c642e
add r15, 4
lea rdx, [0x180113908]
lea rcx, [rsp + 0xf0]
mov r8d, 0x13
call fcn.1800fd6e0
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xa0], xmm0
lea r12, [rsp + 0xa0]
mov rcx, r12
mov rdx, rbx
mov r8, r15
call fcn.1800ed9c0
mov rcx, r12
call fcn.1800fd470
mov r8, rdx
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.1800f4360
cmp dword [rsp + 0xf0], 2
jne 0x1800024a7
mov r15, qword [rsp + 0xf8]
mov eax, r15d
and eax, 3
cmp eax, 1
jne 0x180002589
mov r12, qword [r15 - 1]
mov r13, qword [r15 + 7]
mov rax, qword [r13]
test rax, rax
je 0x180002477
mov rcx, r12
call rax
dec r15
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x18000248f
mov r8, qword [r13 + 0x10]
mov rcx, r12
call fcn.18000b700
mov edx, 0x18
mov r8d, 8
mov rcx, r15
call fcn.18000b700
jmp 0x180002589
mov qword [rsp + 0x60], r12
lea r13, case.0x1800ee484.26
mov qword [rsp + 0x68], r13
lea rax, [0x180113948]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x1f0]
lea rdx, [rsp + 0xf0]
call fcn.1801060e0
mov r15, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x200]
mov rcx, r12
call fcn.180006f70
test r15, r15
je 0x18000253e
mov r8d, 1
mov rcx, r12
mov rdx, r15
call fcn.18000b700
lea r15, [rsp + 0xa0]
mov rcx, r15
call fcn.1800fd470
mov rcx, rax
call fcn.1800f42a0
test rax, rax
je 0x180002589
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
lea rax, [0x1800ea550]
mov qword [rsp + 0x78], rax
lea rax, str.Failed_to_delete_existing_file_at_:
jmp 0x180002603
lea rcx, [rsp + 0xd0]
call fcn.1800fd470
mov r12, rax
mov r13, rdx
lea r15, [rsp + 0xa0]
mov rcx, r15
call fcn.1800fd470
mov r9, rdx
mov rcx, r12
mov rdx, r13
mov r8, rax
call fcn.1800f47f0
test rax, rax
je 0x180002748
cmp rax, 1
jne 0x1800026e8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r15
lea rax, case.0x1800ee484.26
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], rax
lea rax, [0x1800ea550]
mov qword [rsp + 0x78], rax
lea rax, str.Failed_to_copy_the_module_to
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 2
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xf0]
call fcn.1801060e0
mov r14, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.180006f70
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002673
mov r8d, 1
mov rcx, r14
call fcn.18000b700
call fcn.1800e2770
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov r14, qword [rsp + 0x48]
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x180002a68
mov r15, qword [r14 - 1]
mov r12, qword [r14 + 7]
mov rax, qword [r12]
test rax, rax
je 0x1800026b6
mov rcx, r15
call rax
dec r14
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x1800026d0
mov r8, qword [r12 + 0x10]
mov rcx, r15
call fcn.18000b700
mov edx, 0x18
mov r8d, 8
mov rcx, r14
call fcn.18000b700
jmp 0x180002a68
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x180002748
mov r15, qword [rdx - 1]
mov r13, qword [rdx + 7]
mov rax, qword [r13]
test rax, rax
je 0x18000271a
mov rcx, r15
mov r12, rbx
mov rbx, rdi
mov rdi, rdx
call rax
mov rdx, rdi
mov rdi, rbx
mov rbx, r12
dec rdx
mov r12, rdx
mov rdx, qword [r13 + 8]
test rdx, rdx
je 0x180002735
mov r8, qword [r13 + 0x10]
mov rcx, r15
call fcn.18000b700
mov edx, 0x18
mov r8d, 8
mov rcx, r12
call fcn.18000b700
lea rcx, [rsp + 0xa0]
call fcn.1800fd470
mov r8, rdx
lea rcx, [rsp + 0xf0]
mov rdx, rax
call fcn.1800ea220
test byte [rsp + 0xf0], 1
jne 0x180002b06
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [rsp + 0x1d0], xmm0
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x60], rax
lea rax, [0x18000af80]
mov qword [rsp + 0x68], rax
lea rax, str.rundll32.exe_____DllMain
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 2
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x100], r14
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0xf0]
call fcn.1801060e0
lea rdx, str.C:WindowsSystem32_rundll32.exeDllMainFailed_to_launch_rundll32_with_DLL:
lea r15, [rsp + 0xf0]
mov r8d, 0x20
mov rcx, r15
call fcn.1800f6030
mov rdx, qword [rsp + 0x1d0]
mov r8, qword [rsp + 0x1d8]
mov rcx, r15
call fcn.1800f6150
lea rdx, [0x180113af8]
mov r8d, 7
mov rcx, r15
call fcn.1800f6150
lea rcx, [rsp + 0x60]
mov rdx, r15
call fcn.1800ef490
mov rcx, r15
call fcn.180001b20
mov r14, qword [rsp + 0x60]
cmp r14, 2
jne 0x180002b12
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x1e0], rax
lea rax, [0x1800ea550]
mov qword [rsp + 0x1e8], rax
lea rax, [0x180113b28]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 1
lea r15, [rsp + 0x30]
lea rdx, [rsp + 0xf0]
mov rcx, r15
call fcn.1801060e0
mov r14, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.180006f70
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x180002908
mov r8d, 1
mov rcx, r14
call fcn.18000b700
call fcn.1800e2770
mov r12, rax
mov ebp, edx
mov r13, qword [rsp + 0xc8]
mov eax, r13d
and eax, 3
cmp eax, 1
jne 0x180002976
mov r15, rbx
mov rbx, rdi
mov r14, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x180002940
mov rcx, r14
call rax
dec r13
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180002958
mov r8, qword [rdi + 0x10]
mov rcx, r14
call fcn.18000b700
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.18000b700
mov rdi, rbx
mov rbx, r15
lea r15, [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180002990
mov rcx, qword [rsp + 0x50]
mov r8d, 1
call fcn.18000b700
mov qword [rsp + 0x1c0], r12
mov dword [rsp + 0x1c8], ebp
test ebp, ebp
je 0x180002b7e
mov qword [rsp + 0x48], r12
mov dword [rsp + 0x50], ebp
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [0x1800e27a0]
mov qword [rsp + 0x38], rax
lea rax, str.Failed_to_launch_new_instance_with_rundll32:
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 1
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], 1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
call fcn.1801060e0
mov r14, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov rcx, r14
call fcn.180006f70
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x180002a3d
mov r8d, 1
mov rcx, r14
call fcn.18000b700
call fcn.1800e2770
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], edx
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x48], 0
je 0x180002a68
lea rcx, [rsp + 0x48]
call fcn.1800e2760
mov rdx, qword [rsp + 0xa0]
test rdx, rdx
je 0x180002a88
mov rcx, qword [rsp + 0xa8]
mov r8d, 1
call fcn.18000b700
test rdi, rdi
je 0x180002a9e
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.18000b700
mov rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x180002abe
mov rcx, qword [rsp + 0xd8]
mov r8d, 1
call fcn.18000b700
mov rax, rsi
add rsp, 0x208
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x60]
mov r8d, 4
mov r9d, 1
mov rdx, r15
call fcn.18010d440
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
jmp 0x1800023c4
lea rcx, [0x180113b68]
call fcn.180112390
lea rcx, str.New_instance_launched_successfully.srcgates.rs
mov edx, 0x23
call fcn.180006f70
mov rcx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [sym.imp.kernel32.dll_CloseHandle]
call rdi
mov rcx, rsi
call rdi
test r14, r14
jne 0x180002ba4
cmp qword [rsp + 0x70], 0
jne 0x180002bb7
cmp qword [rsp + 0x80], 0
jne 0x180002bcd
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x180002b73
mov rcx, qword [rsp + 0x50]
mov r8d, 1
call fcn.18000b700
mov dword [rsp + 0x1c8], 0
lea rcx, [rsp + 0x1c0]
call fcn.180002190
lea rcx, str.Exiting_current_process_to_pass_control_to_the_new_instance.Failed_to_get_current_module_path:
mov edx, 0x3c
call fcn.180006f70
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x70], 0
je 0x180002b4e
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rsp + 0x80], 0
je 0x180002b59
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
jne 0x180002b63
jmp 0x180002b73