Function at 0x140003aa8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov qword [0x140015128], r8
mov eax, 0x383d
mov dword [rsp + 0x80], 0
mov r9d, 0x3cec
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], r9d
mov dword [rsp + 0x44], 0x3c56
mov dword [rsp + 0x4c], 0x43dc
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x4c]
xor ecx, 0x3552
mov r8d, dword [rsp + 0x80]
sub edx, 0xb9f
xor r8d, r9d
mov r9d, dword [rsp + 0x48]
mov r11d, dword [rsp + 0x50]
sub r9d, 0x96
mov eax, dword [rsp + 0x40]
mov r10, qword [section..data]
xor eax, 0x7e93
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r11d
call fcn.140003620
mov rcx, qword [section..data]
mov r9d, dword [0x140015034]
add r9d, 0xfff35547
mov dword [rsp + 0x50], eax
mov r8d, dword [rcx + 0x104]
mov edx, dword [rcx + 0x4c]
sub r8d, 0x1a345b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rsp + 0x40]
lea rdi, [0x140015010]
mov edx, dword [rsp + 0x40]
add rax, 0x1000
mov r8d, dword [rsp + 0x4c]
add ecx, 0x6af
mov r9d, dword [rsp + 0x80]
xor edx, 0x7b97
mov qword [0x1400150c0], rax
sub r8d, 0x9dc
mov eax, dword [rsp + 0x44]
add r9d, 0x46ae
sub eax, 0x83b
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call fcn.1400016a4
mov dword [rsp + 0x4c], eax
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x40]
add ecx, 0x3cec
cmp eax, ecx
jge 0x140003df3
mov ecx, dword [rsp + 0x48]
mov eax, dword [rsp + 0x80]
add ecx, 0x5e7
cmp eax, ecx
jge 0x140003d63
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x48]
add ecx, 0x9cf
mov r8d, dword [rsp + 0x50]
sub edx, 0x2bc
mov eax, dword [rsp + 0x4c]
xor r8d, 0x429
mov r9, qword [section..data]
add eax, 0xdf1
mov dword [rsp + 0x20], eax
call fcn.140001dd8
mov dword [rsp + 0x48], eax
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
add ecx, 0xb6d
mov r9d, dword [rsp + 0x48]
sub edx, 0x704
mov r11d, dword [rsp + 0x48]
sub r9d, 0x44
mov r10d, dword [rsp + 0x44]
xor r11d, 0x1ea4
mov eax, dword [rsp + 0x4c]
sub r10d, 0x4f5
mov r8, qword [section..data]
add eax, 0xad1
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.1400029b8
mov dword [rsp + 0x44], eax
mov ebx, 0x17a0
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x80]
xor ecx, ebx
mov r8d, dword [rsp + 0x48]
xor edx, 0x46ae
mov r9d, dword [rsp + 0x50]
sub r8d, 0x137
xor r9d, 0xf0e
mov qword [rsp + 0x20], rdi
call fcn.1400020ac
mov dword [rsp + 0x40], eax
mov r8, rdi
mov eax, dword [rsp + 0x80]
mov eax, dword [rsp + 0x44]
mov edx, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
xor edx, 0xbe2
mov rax, qword [0x140015090]
sub ecx, 0x57e
add edx, 0xffffc114
xor ecx, 0x7572
cmp edx, ecx
cmovl rax, qword [0x1400150c0]
xor edx, 0x3761
mov qword [0x140015090], rax
mov dword [rsp + 0x40], edx
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x48]
add ecx, 0x5b6
mov r9d, dword [rsp + 0x4c]
sub edx, 0x44
mov eax, dword [rsp + 0x44]
add r9d, 0xf8f
xor eax, ebx
mov dword [rsp + 0x20], eax
call fcn.140002310
mov dword [rsp + 0x80], eax
jmp 0x140003df3
mov eax, dword [rsp + 0x80]
mov ecx, dword [0x1400150ac]
sub ecx, eax
mov eax, dword [rsp + 0x80]
cmp eax, ecx
je 0x140003df3
mov ebx, dword [0x140015084]
mov edi, 0x3eec
jmp 0x140003de9
mov eax, dword [rsp + 0x4c]
mov edx, dword [0x140015058]
add edx, dword [0x140015078]
and eax, edx
cmp dword [0x1400150f4], eax
jae 0x140003de6
mov ecx, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x40]
mov eax, dword [rsp + 0x80]
sub edx, eax
sub ecx, dword [0x140015018]
movsxd rdx, edx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov eax, dword [rsp + 0x40]
mov rdx, qword [section..data]
sub eax, 0x3127
movsxd rcx, eax
mov eax, dword [rsp + 0x40]
add eax, dword [rdx + 0x7c]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
add ebx, 4
mov eax, dword [rsp + 0x44]
sub eax, edi
cmp ebx, eax
jne 0x140003d8a
mov ecx, dword [0x1400150f0]
call qword [sym.imp.KERNEL32.dll_ExitProcess]