Function at 0x140013320
Capabilities:
Create thread
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [section..data]
xor edx, edx
mov dword [rbp - 0x1c], 0x3d33
mov r8d, 0x3a21
mov dword [rbp - 0x14], 0x4926
mov dword [rbp - 0xc], 0x4141
lea ecx, [rdx + 1]
mov dword [rbp - 0x18], r8d
mov dword [rax + 0xc], ecx
mov rax, qword [section..data]
mov dword [0x140080028], 0xe
mov dword [rbp - 0x10], 0x4926
mov dword [rbp - 0x20], edx
mov dword [rax + 0x1c], 0x47
mov rax, qword [section..data]
mov dword [rax + 0x20], edx
mov rax, qword [section..data]
mov dword [0x140080050], 3
mov dword [0x140080060], edx
mov dword [0x140080070], 4
mov dword [0x14008007c], 0x2f
mov dword [0x140080088], edx
mov dword [0x14008008c], 0x40
mov dword [0x140080094], ecx
mov dword [rax + 0x88], 0x13
mov rax, qword [section..data]
mov dword [0x1400800a0], 0x31
mov dword [0x1400800a4], 0xc
mov dword [0x1400800a8], ecx
mov dword [0x1400800c0], ecx
mov qword [0x1400800cc], rcx
mov dword [rax + 0xd0], edx
mov rax, qword [section..data]
mov dword [rax + 0xd4], ecx
mov dword [0x1400800e8], edx
mov dword [0x1400800f0], edx
mov dword [0x140080100], ecx
add dword [rbp - 0x1c], 0x156
cmp dword [0x1400800e0], 0x64aa
je 0x140013457
mov eax, dword [0x1400800e4]
add eax, 0x7e6c5
xor dword [0x14008002c], eax
xor dword [rbp - 0x1c], 0x75d9
lea r13, [0x140080010]
mov ecx, dword [rbp - 0x20]
mov esi, 0xdc6
mov eax, dword [rbp - 0x10]
xor ecx, 0x3d33
mov r10d, 0x467d
cmp eax, ecx
jle 0x140013664
mov ecx, dword [rbp - 0x1c]
mov eax, dword [rbp - 0x10]
add ecx, 0xffffed8e
cmp eax, ecx
jle 0x140013577
mov eax, dword [0x140080100]
xor eax, dword [0x1400800a0]
mov rcx, qword [section..data]
add eax, 0x1b33cb
xor dword [rcx + 0x84], eax
add dword [rbp - 0x20], r8d
cmp dword [0x140080070], 0x16d49
mov rdx, qword [section..data]
jbe 0x1400134e7
mov ecx, dword [rdx + 0xd0]
xor ecx, dword [0x1400800e8]
add ecx, dword [0x1400800e8]
xor dword [0x14008008c], ecx
jmp 0x140013504
mov ecx, dword [0x140080050]
mov eax, 0xfff6cc85
xor ecx, dword [0x14008007c]
sub eax, ecx
add dword [rdx + 0xc], eax
mov rdx, qword [section..data]
mov eax, dword [0x14008002c]
cmp eax, dword [0x1400800e4]
jb 0x14001351c
xor eax, 0xe223d
sub dword [rdx + 0xc], eax
jmp 0x14001353a
mov ecx, dword [rdx + 0x60]
sub ecx, dword [0x1400800a8]
mov eax, dword [0x14008001c]
add ecx, dword [0x1400800f0]
imul eax, ecx
mov dword [0x14008001c], eax
mov ecx, dword [rbp - 0x20]
mov eax, 0xcc3
mov edx, dword [rbp - 0x18]
xor ecx, 0x553
mov r8d, dword [rbp - 0x18]
add edx, esi
mov r9d, dword [rbp - 0x20]
add r8d, eax
add r9d, eax
mov qword [rsp + 0x20], r13
call fcn.140002d60
mov dword [rbp - 0x14], eax
dec dword [rbp - 0x14]
xor dword [rbp - 0x10], 0xd7b
jmp 0x14001365e
mov eax, dword [rbp - 0x20]
mov ecx, dword [rbp - 0x1c]
sub ecx, eax
mov rax, qword [section..data]
cmp dword [rax + 0xbc], ecx
je 0x140013664
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x1c]
or ecx, eax
mov eax, dword [rbp - 0x20]
sub ecx, eax
mov eax, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x14]
xor eax, r10d
mov r8d, dword [rbp - 0xc]
add edx, eax
mov r10d, dword [rbp - 0x18]
mov eax, dword [rbp - 0x18]
xor r10d, eax
add r8d, dword [0x1400800a8]
xor r10d, 0x4447
mov r9, qword [section..data]
mov dword [rsp + 0x20], r10d
call fcn.1400016d0
mov ecx, dword [0x14008009c]
and ecx, dword [0x1400800e4]
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x20]
xor eax, ecx
sub dword [rbp - 0x18], eax
movsxd rcx, dword [rbp - 0x14]
mov ebx, dword [rbp - 0x1c]
xor rcx, 0x4b50
mov r11d, dword [rbp - 0x10]
or ebx, 0x3e83
mov rax, qword [section..data]
mov r9d, dword [0x1400800d0]
or r9d, dword [0x14008007c]
sub r9d, 0x46e4
mov edx, dword [rax + 8]
mov eax, dword [0x1400800cc]
mov r8d, eax
imul edx, eax
mov eax, dword [rbp - 0xc]
xor r8, 0x468b
xor r11d, eax
mov rax, qword [section..data]
mov eax, dword [rax + 0xd4]
imul eax, r11d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r10d, 0x467d
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0xc]
xor ecx, 0x7e66
cmp eax, ecx
jge 0x140013a69
mov ecx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x14]
add ecx, 0xcc3
cmp eax, ecx
jl 0x140013847
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x78]
cmp dword [0x14008008c], eax
jbe 0x1400136a9
mov eax, dword [0x1400800d8]
mov dword [rcx + 0x4c], eax
jmp 0x1400136c1
mov eax, dword [rcx + 0x98]
sub eax, dword [0x1400800e0]
add eax, dword [0x1400800cc]
add dword [0x14008001c], eax
mov eax, dword [0x140080020]
sub dword [0x14008005c], eax
add dword [rbp - 0x20], esi
add dword [rbp - 0x10], 0x6f4
mov eax, dword [0x1400800d8]
mov dword [0x1400800c8], eax
xor dword [rbp - 0x20], 0x103
mov eax, dword [0x140080024]
add dword [0x1400800c8], eax
mov ecx, dword [0x14008001c]
mov rdx, qword [section..data]
cmp ecx, 0x4f58
jb 0x140013717
mov dword [0x140080040], 0xd1d74
jmp 0x140013731
mov eax, dword [rdx + 0x88]
add eax, dword [0x1400800d0]
add eax, dword [0x140080094]
xor ecx, eax
mov dword [0x14008001c], ecx
mov ecx, dword [rbp - 0x14]
mov eax, dword [0x1400800e8]
xor ecx, 0x7663
add eax, 0x2d74
mov qword [rsp + 0x28], r13
xor dword [rdx + 0x30], eax
mov edx, dword [rbp - 0x20]
mov r8d, dword [rbp - 0x20]
sub edx, 0x287
mov r9d, dword [rbp - 0x18]
xor r8d, 0x6f
mov eax, dword [rbp - 0x1c]
add r9d, 0x1135
sub eax, 0x1272
mov dword [rsp + 0x20], eax
call section..text
cmp dword [0x140080088], 0x1568d
mov dword [rbp - 0x10], eax
jbe 0x14001379c
mov eax, dword [0x140080070]
xor eax, 0x2345b
add dword [0x1400800a8], eax
jmp 0x1400137bb
mov eax, dword [0x140080054]
mov ecx, dword [0x1400800a0]
add eax, 0xffffea16
sub ecx, dword [0x140080050]
add ecx, eax
mov dword [0x140080054], ecx
mov ecx, dword [rbp - 0x20]
lea rax, [0x1400a5010]
mov edx, dword [rbp - 0x1c]
xor ecx, 0xdb4
mov r9d, dword [rbp - 0x14]
sub edx, 0xcc7
mov r10d, dword [rbp - 0x10]
sub r9d, 0x46c
mov r8, qword [section..data]
sub r10d, 0x7e5
mov qword [0x140080080], rax
mov eax, dword [rbp - 0x1c]
sub eax, 0xe1d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.1400151ac
mov rcx, qword [0x140080068]
mov dword [rbp - 0x10], eax
mov eax, dword [0x140080098]
cmp dword [0x140080094], eax
cmovne rcx, qword [0x1400800b8]
mov qword [0x140080068], rcx
call rcx
mov rcx, qword [section..data]
mov dword [rcx + 0xcc], eax
jmp 0x140013a69
mov esi, dword [rbp - 0x14]
mov edx, dword [rbp - 0x10]
mov rax, qword [section..data]
or esi, dword [0x14008002c]
mov ecx, dword [rax + 0xe4]
movsxd rax, dword [rbp - 0x10]
sub ecx, r10d
movsxd r8, dword [rbp - 0x1c]
mov r9d, dword [rbp - 0x1c]
xor r8, rax
mov eax, dword [0x1400800e4]
sub r9d, 0x4b51
imul edx, ecx
mov ecx, dword [rbp - 0xc]
mov edi, dword [rbp - 0x14]
or rcx, rax
mov ebx, dword [rbp - 0x20]
or rdi, rcx
mov r11d, dword [rbp - 0x18]
mov ecx, esi
mov rax, qword [section..data]
xor r11d, dword [0x140080030]
or ebx, dword [0x140080028]
sub r11d, r10d
sub ebx, r10d
mov r10d, dword [rbp - 0x20]
sub r10d, dword [rax + 0x88]
mov eax, dword [rbp - 0x14]
sub r10d, eax
mov eax, r10d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [rbp - 0x20]
mov r8d, 0xffffc722
mov eax, dword [rbp - 0xc]
xor ecx, dword [0x1400800a4]
or ecx, dword [0x140080030]
imul eax, ecx
mov dword [rbp - 0xc], eax
mov eax, dword [0x140080094]
or eax, 0x468b
add dword [rbp - 0x18], eax
mov rcx, qword [section..data]
mov eax, dword [0x140080060]
mov edx, dword [0x1400800a8]
sub eax, dword [rcx + 0x40]
sub edx, dword [rcx + 0xb4]
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x14]
sub edx, eax
mov ecx, edx
mov edx, dword [rbp - 0xc]
mov eax, dword [rbp - 0x20]
sub r8d, eax
mov eax, dword [rbp - 0x10]
add edx, dword [0x140080030]
add eax, r8d
movsxd r8, eax
and edx, 0x4141
mov rax, qword [section..data]
mov r9d, dword [rax + 0x60]
sub r9d, 0x4b56
xor r9, 0x4b51
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rax, qword [section..data]
mov edx, dword [0x1400800ec]
mov r8d, dword [rbp - 0x18]
xor edx, 0x3d33
mov ecx, dword [rax + 0x18]
mov eax, dword [rax + 0x60]
sub ecx, 0x34b0
and ecx, 0x468b
and r8, rax
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [rbp - 0x18]
mov rax, qword [section..data]
xor ecx, 0x4b51
sub ecx, dword [rax + 0x20]
or dword [rbp - 0x18], ecx
mov r11d, 0x4002
mov edx, dword [rbp - 0x20]
mov rcx, r13
mov eax, dword [rbp - 0x14]
sub edx, eax
mov eax, dword [rbp - 0xc]
sub edx, eax
mov r8d, dword [rbp - 0x18]
mov r10, qword [section..data]
mov eax, dword [rbp - 0x1c]
or r8d, dword [0x1400800cc]
sub r8d, dword [0x140080090]
add eax, dword [r10 + 0x3c]
mov r9d, dword [r10 + 0x1c]
or eax, r11d
xor r9d, r11d
mov dword [rsp + 0x20], eax
call fcn.140001d40
mov ecx, dword [0x140080090]
or ecx, dword [0x140080100]
or ecx, dword [0x14008009c]
mov dword [rbp - 0x1c], eax
mov edx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x18]
and edx, eax
mov eax, dword [rbp - 0x18]
sub edx, eax
mov r8d, dword [0x14008002c]
or r8d, 0x3e89
add r8d, dword [0x14008009c]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [rbp - 0x14]
mov rax, qword [section..data]
or ecx, 0x4926
sub dword [rax + 0x94], ecx
mov eax, dword [rbp - 0x1c]
mov ecx, dword [0x140080060]
or rax, 0x3f72
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x1400800dc]
call qword [sym.imp.KERNEL32.dll_ExitProcess]