Function at 0x14000c040
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x2e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x258], 0xfffffffffffffffe
mov rax, qword [rbp + 0x2a0]
mov r10, qword [rbp + 0x298]
mov r11, qword [rbp + 0x290]
mov qword [rbp + 0x248], r9
mov dword [rbp + 0x244], r8d
mov qword [rbp + 0x238], rdx
mov dword [rbp + 0x234], ecx
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x220], 0
mov rdx, qword [rbp + 0x238]
lea rcx, [rbp + 0x208]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x90], r10
mov qword [rbp + 0x88], r11
call fcn.14000c860
mov r8d, dword [rbp + 0x234]
mov dword [rbp + 0x204], r8d
cmp dword [rbp + 0x204], 0
jne 0x14000c0fa
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c7ae
mov edx, dword [rbp + 0x204]
lea rcx, [rbp + 0x1e0]
call fcn.14000c910
jmp 0x14000c111
lea rcx, [rbp + 0x208]
call fcn.14000c9c0
lea rdx, [rbp + 0x228]
lea r8, [rbp + 0x220]
mov rcx, rax
call fcn.140004420
mov byte [rbp + 0x87], al
jmp 0x14000c13e
mov al, byte [rbp + 0x87]
test al, 1
jne 0x14000c167
jmp 0x14000c151
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c79d
mov rcx, qword [rbp + 0x238]
call fcn.14000c9e0
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x1b8]
mov rcx, rax
mov qword [rbp + 0x78], rax
call fcn.140001090
mov rdx, qword [rbp + 0x1d8]
lea rcx, [rbp + 0x1c0]
mov r8, qword [rbp + 0x78]
mov qword [rbp + 0x70], rax
call fcn.14000ca10
jmp 0x14000c1ad
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1a8], 0
mov rax, qword [rbp + 0x290]
cmp qword [rax], 0
jne 0x14000c262
mov rdx, qword [rbp + 0x1d8]
lea rcx, [rbp + 0x1e0]
mov r8d, 0x40
lea r9, [rbp + 0x1b0]
call fcn.14000ca60
mov byte [rbp + 0x6f], al
jmp 0x14000c1fc
mov al, byte [rbp + 0x6f]
test al, 1
jne 0x14000c222
jmp 0x14000c20c
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c78c
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1a0]
call fcn.1400043c0
lea rcx, [rbp + 0x1a0]
mov qword [rbp + 0x60], rax
call fcn.1400043e0
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x290]
mov qword [rcx], rax
jmp 0x14000c273
mov rax, qword [rbp + 0x290]
mov rax, qword [rax]
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x208]
call fcn.14000c9c0
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x1c0]
mov rcx, rax
mov qword [rbp + 0x58], rax
call fcn.14000c9c0
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x58]
call fcn.14000c9e0
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x170], rax
mov byte [rbp + 0x178], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], 0
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x198], rax
mov rdx, qword [rbp + 0x298]
lea rcx, [rbp + 0x148]
call fcn.1400061a0
mov byte [rbp + 0x57], al
jmp 0x14000c31f
mov al, byte [rbp + 0x57]
test al, 1
jne 0x14000c345
jmp 0x14000c32f
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c78c
lea rcx, [rbp + 0x148]
call fcn.1400062b0
mov byte [rbp + 0x56], al
jmp 0x14000c359
mov al, byte [rbp + 0x56]
test al, 1
jne 0x14000c37f
jmp 0x14000c369
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c78c
movups xmm0, xmmword [str.D__H]
movups xmmword [rbp + 0x12e], xmm0
movaps xmm0, xmmword [0x1400458d0]
movaps xmmword [rbp + 0x120], xmm0
movaps xmm0, xmmword [0x1400458c0]
movaps xmmword [rbp + 0x110], xmm0
movaps xmm0, xmmword [0x1400458b0]
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [0x1400458a0]
movaps xmmword [rbp + 0xf0], xmm0
movaps xmm0, xmmword [0x140045890]
movaps xmmword [rbp + 0xe0], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xce], 0
mov dword [rbp + 0xb0], 0x1327
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0xb4], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x2a0]
mov edx, dword [rcx]
mov ecx, edx
add rax, rcx
mov qword [rbp + 0xbc], rax
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax + 4]
mov qword [rbp + 0xc4], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0xcc], rax
lea rcx, [rbp + 0x1e0]
call fcn.140005cf0
mov rcx, rsp
mov dword [rcx + 0x20], 0x40
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov r8d, 0x5e
mov r9d, 0x1000
mov qword [rbp + 0x48], rcx
mov rcx, rax
mov rax, qword [rbp + 0x48]
call rax
mov qword [rbp + 0x40], rax
jmp 0x14000c484
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14000c4ad
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c4ad
lea rcx, [rbp + 0x1e0]
call fcn.140005cf0
mov rcx, rsp
mov dword [rcx + 0x20], 4
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov r8d, 0x26
mov r9d, 0x1000
mov qword [rbp + 0x38], rcx
mov rcx, rax
mov rax, qword [rbp + 0x38]
call rax
mov qword [rbp + 0x30], rax
jmp 0x14000c4ee
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xa0], rax
cmp qword [rbp + 0xa0], 0
jne 0x14000c517
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c517
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x28], rdx
call fcn.140005cf0
mov rcx, rsp
mov qword [rcx + 0x20], 0
mov rcx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [rbp + 0xe0]
mov r9d, 0x5e
mov qword [rbp + 0x20], rcx
mov rcx, rax
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
call rax
mov dword [rbp + 0x1c], eax
jmp 0x14000c566
mov eax, dword [rbp + 0x1c]
cmp eax, 0
jne 0x14000c582
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c582
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x10], rdx
call fcn.140005cf0
mov rcx, rsp
mov qword [rcx + 0x20], 0
mov rcx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [rbp + 0xb0]
mov r9d, 0x26
mov qword [rbp + 8], rcx
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 8]
call rax
mov dword [rbp + 4], eax
jmp 0x14000c5d1
mov eax, dword [rbp + 4]
cmp eax, 0
jne 0x14000c5ed
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c5ed
mov rax, qword [rbp + 0xa0]
mov r9, qword [rbp + 0xa8]
lea rcx, [rbp + 0x1e0]
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], r9
call fcn.140005cf0
mov rcx, rsp
mov rdx, qword [rbp - 8]
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x30], 0
mov dword [rcx + 0x28], 0
mov rcx, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor r8d, r8d
mov edx, r8d
mov qword [rbp - 0x18], rcx
mov rcx, rax
mov qword [rbp - 0x20], rdx
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
call rax
jmp 0x14000c654
jmp 0x14000c659
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0x1e0]
mov qword [rbp - 0x28], rdx
call fcn.140005cf0
mov rcx, rsp
mov qword [rcx + 0x20], 0
mov rcx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea r8, [rbp + 0xb0]
mov r9d, 0x26
mov qword [rbp - 0x30], rcx
mov rcx, rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
call rax
mov dword [rbp - 0x34], eax
jmp 0x14000c6a8
mov eax, dword [rbp - 0x34]
cmp eax, 0
jne 0x14000c6b9
jmp 0x14000c6e4
mov al, byte [rbp + 0xd5]
cmp al, 0
je 0x14000c6cc
jmp 0x14000c6e4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call rax
jmp 0x14000c6df
jmp 0x14000c659
movzx eax, byte [rbp + 0xd4]
cmp eax, 1
je 0x14000c734
lea rcx, [rbp + 0x1e0]
call fcn.140005cf0
mov rcx, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 1
mov qword [rbp - 0x40], rcx
mov rcx, rax
mov rax, qword [rbp - 0x40]
call rax
jmp 0x14000c71e
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c78c
mov r8, qword [rbp + 0x248]
mov edx, dword [rbp + 0x244]
lea rcx, [rbp + 0x148]
call fcn.140006330
mov byte [rbp - 0x41], al
jmp 0x14000c755
mov al, byte [rbp - 0x41]
test al, 1
jne 0x14000c77b
jmp 0x14000c765
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c78c
mov byte [rbp + 0x257], 1
mov dword [rbp + 0x200], 1
lea rcx, [rbp + 0x1c0]
call fcn.140001130
jmp 0x14000c79d
lea rcx, [rbp + 0x1e0]
call fcn.14000cad0
jmp 0x14000c7ae
lea rcx, [rbp + 0x208]
call fcn.140001130
mov al, byte [rbp + 0x257]
and al, 1
movzx eax, al
add rsp, 0x2e0
pop rbp
ret