Function at 0x500001e60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov dword [rbp + 7], 0xa88d8b48
xor ebx, ebx
mov dword [rbp + 0xb], 0x83fffff7
movabs rsi, 0x200000000
mov dword [rbp + 0xf], 0x8b480039
mov dword [rbp + 0x13], 0xfff7a88d
mov byte [rbp + 0x17], 0xff
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [rbp + 0x1f]
mov r9d, 0x30
mov rdx, rbx
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
lea rcx, [r9 - 0x31]
movups xmmword [rbp + 0x3f], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rdi, qword [rbp + 0x1f]
mov r11, qword [rbp + 0x37]
test rdi, rdi
je 0x500001f40
cmp dword [rbp + 0x3f], 0x1000
jne 0x500001f40
cmp dword [rbp + 0x43], 0x40
jne 0x500001f40
lea r10, [r11 - 0x11]
xor r8d, r8d
test r10, r10
je 0x500001f40
lea rax, [rbp + 7]
mov r9, rdi
sub r9, rax
nop dword [rax + rax]
xor eax, eax
lea rcx, [rbp + 7]
add rcx, rax
lea rdx, [rcx + r9]
movzx ecx, byte [rcx]
cmp byte [rdx + r8], cl
jne 0x500001f35
cmp rax, 0x10
je 0x500001f6e
inc rax
cmp rax, 0x11
jb 0x500001f12
inc rdi
inc r8
cmp r8, r10
jb 0x500001f10
add rbx, r11
cmp rbx, rsi
jb 0x500001eb0
xor r9d, r9d
lea r8, [0x5000063c8]
lea rdx, [0x5000063c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test rdi, rdi
je 0x500001f4c
xor ecx, ecx
mov edx, 0x1000
cmp byte [rdi + 0x13], 0x89
mov r8d, edx
lea r9d, [rcx + 0x40]
jne 0x500002069
mov word [rbp - 0x29], 0x6348
mov byte [rbp - 0x27], 0x89
mov qword [rbp - 0x22], 0x5b948
mov dword [rbp - 0x1a], 0x8d890000
mov dword [rbp - 0x16], 0xfffff7a4
mov dword [rbp - 0x12], 0xa48d6348
mov dword [rbp - 0xe], 0xfffffff7
mov dword [rbp - 0xa], 0x25
mov byte [rbp - 6], cl
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rdi + 0x14]
mov r11, rax
mov dword [rbp - 0x26], ecx
mov r10, rax
movups xmm0, xmmword [rbp - 0x29]
lea rcx, [rdi + 0x25]
shr r11, 8
mov qword [rbp - 5], rcx
mov r9, rax
movups xmmword [rax], xmm0
mov r8, rax
mov rdx, rax
movups xmm1, xmmword [rbp - 0x19]
shr r10, 0x10
mov rbx, rax
shr r9, 0x18
movups xmmword [rax + 0x10], xmm1
shr r8, 0x20
movsd xmm0, qword [rbp - 9]
movsd qword [rax + 0x20], xmm0
mov ecx, dword [rbp - 1]
mov dword [rax + 0x28], ecx
mov rcx, rax
shr rdx, 0x28
shr rcx, 0x30
mov dword [rdi + 0x11], 0x25ff
mov word [rdi + 0x15], 0
mov byte [rdi + 0x17], bl
mov byte [rdi + 0x18], r11b
lea r11, [rsp + 0xa0]
mov byte [rdi + 0x19], r10b
mov byte [rdi + 0x1a], r9b
mov byte [rdi + 0x1b], r8b
mov byte [rdi + 0x1c], dl
mov byte [rdi + 0x1d], cl
shr rax, 0x38
mov byte [rdi + 0x1e], al
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov word [rbp - 0x29], 0x6348
movzx eax, byte [rdi + 0x14]
mov r11, rbx
mov byte [rbp - 0x26], al
mov r10, rbx
lea rax, [rdi + 0x22]
mov byte [rbp - 0x27], 0x49
mov qword [rbp - 8], rax
mov r9, rbx
movzx eax, byte [rbp - 1]
mov r8, rbx
mov qword [rbp - 0x25], 0x5b948
mov rdx, rbx
mov dword [rbp - 0x1d], 0x8d890000
mov rcx, rbx
movups xmm0, xmmword [rbp - 0x29]
mov dword [rbp - 0x19], 0xfffff7a4
mov dword [rbp - 0x15], 0xa48d6348
movups xmmword [rbx], xmm0
mov dword [rbp - 0x11], 0xfffffff7
mov dword [rbp - 0xd], 0x25
movups xmm1, xmmword [rbp - 0x19]
mov byte [rbp - 9], 0
movsd xmm0, qword [rbp - 9]
movups xmmword [rbx + 0x10], xmm1
shr r11, 8
movsd qword [rbx + 0x20], xmm0
shr r10, 0x10
shr r9, 0x18
shr r8, 0x20
shr rdx, 0x28
mov byte [rbx + 0x28], al
mov rax, rbx
shr rcx, 0x30
jmp 0x500002023