Function at 0x14000c160
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x2e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x258], 0xfffffffffffffffe
mov rax, qword [rbp + 0x2a0]
mov r10, qword [rbp + 0x298]
mov r11, qword [rbp + 0x290]
mov qword [rbp + 0x248], r9
mov dword [rbp + 0x244], r8d
mov qword [rbp + 0x238], rdx
mov dword [rbp + 0x234], ecx
mov qword [rbp + 0x228], 0
mov qword [rbp + 0x220], 0
mov rdx, qword [rbp + 0x238]
lea rcx, [rbp + 0x208]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x90], r10
mov qword [rbp + 0x88], r11
call fcn.14000c980
mov r8d, dword [rbp + 0x234]
mov dword [rbp + 0x204], r8d
cmp dword [rbp + 0x204], 0
jne 0x14000c21a
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8ce
mov edx, dword [rbp + 0x204]
lea rcx, [rbp + 0x1e0]
call fcn.14000ca30
jmp 0x14000c231
lea rcx, [rbp + 0x208]
call fcn.14000cae0
lea rdx, [rbp + 0x228]
lea r8, [rbp + 0x220]
mov rcx, rax
call fcn.140004540
mov byte [rbp + 0x87], al
jmp 0x14000c25e
mov al, byte [rbp + 0x87]
test al, 1
jne 0x14000c287
jmp 0x14000c271
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8bd
mov rcx, qword [rbp + 0x238]
call fcn.14000cb00
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x1b8]
mov rcx, rax
mov qword [rbp + 0x78], rax
call fcn.1400011b0
mov rdx, qword [rbp + 0x1d8]
lea rcx, [rbp + 0x1c0]
mov r8, qword [rbp + 0x78]
mov qword [rbp + 0x70], rax
call fcn.14000cb30
jmp 0x14000c2cd
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1a8], 0
mov rax, qword [rbp + 0x290]
cmp qword [rax], 0
jne 0x14000c382
mov rdx, qword [rbp + 0x1d8]
lea rcx, [rbp + 0x1e0]
mov r8d, 0x40
lea r9, [rbp + 0x1b0]
call fcn.14000cb80
mov byte [rbp + 0x6f], al
jmp 0x14000c31c
mov al, byte [rbp + 0x6f]
test al, 1
jne 0x14000c342
jmp 0x14000c32c
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8ac
mov rdx, qword [rbp + 0x1b0]
lea rcx, [rbp + 0x1a0]
call fcn.1400044e0
lea rcx, [rbp + 0x1a0]
mov qword [rbp + 0x60], rax
call fcn.140004500
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x290]
mov qword [rcx], rax
jmp 0x14000c393
mov rax, qword [rbp + 0x290]
mov rax, qword [rax]
mov qword [rbp + 0x1a8], rax
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x148], rax
lea rcx, [rbp + 0x208]
call fcn.14000cae0
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0x1c0]
mov rcx, rax
mov qword [rbp + 0x58], rax
call fcn.14000cae0
mov qword [rbp + 0x158], rax
mov rcx, qword [rbp + 0x58]
call fcn.14000cb00
mov qword [rbp + 0x160], rax
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x170], rax
mov byte [rbp + 0x178], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], 0
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x198], rax
mov rdx, qword [rbp + 0x298]
lea rcx, [rbp + 0x148]
call fcn.1400062c0
mov byte [rbp + 0x57], al
jmp 0x14000c43f
mov al, byte [rbp + 0x57]
test al, 1
jne 0x14000c465
jmp 0x14000c44f
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8ac
lea rcx, [rbp + 0x148]
call fcn.1400063d0
mov byte [rbp + 0x56], al
jmp 0x14000c479
mov al, byte [rbp + 0x56]
test al, 1
jne 0x14000c49f
jmp 0x14000c489
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8ac
movups xmm0, xmmword [str.D__H]
movups xmmword [rbp + 0x12e], xmm0
movaps xmm0, xmmword [0x1400468d0]
movaps xmmword [rbp + 0x120], xmm0
movaps xmm0, xmmword [0x1400468c0]
movaps xmmword [rbp + 0x110], xmm0
movaps xmm0, xmmword [0x1400468b0]
movaps xmmword [rbp + 0x100], xmm0
movaps xmm0, xmmword [0x1400468a0]
movaps xmmword [rbp + 0xf0], xmm0
movaps xmm0, xmmword [0x140046890]
movaps xmmword [rbp + 0xe0], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xc0], xmm0
movaps xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xce], 0
mov dword [rbp + 0xb0], 0x1327
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0xb4], rax
mov rax, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x2a0]
mov edx, dword [rcx]
mov ecx, edx
add rax, rcx
mov qword [rbp + 0xbc], rax
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax + 4]
mov qword [rbp + 0xc4], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0xcc], rax
lea rcx, [rbp + 0x1e0]
call fcn.140005e10
mov rcx, rsp
mov dword [rcx + 0x20], 0x40
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov r8d, 0x5e
mov r9d, 0x1000
mov qword [rbp + 0x48], rcx
mov rcx, rax
mov rax, qword [rbp + 0x48]
call rax
mov qword [rbp + 0x40], rax
jmp 0x14000c5a4
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14000c5cd
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c5cd
lea rcx, [rbp + 0x1e0]
call fcn.140005e10
mov rcx, rsp
mov dword [rcx + 0x20], 4
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov r8d, 0x26
mov r9d, 0x1000
mov qword [rbp + 0x38], rcx
mov rcx, rax
mov rax, qword [rbp + 0x38]
call rax
mov qword [rbp + 0x30], rax
jmp 0x14000c60e
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xa0], rax
cmp qword [rbp + 0xa0], 0
jne 0x14000c637
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c637
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x28], rdx
call fcn.140005e10
mov rcx, rsp
mov qword [rcx + 0x20], 0
mov rcx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [rbp + 0xe0]
mov r9d, 0x5e
mov qword [rbp + 0x20], rcx
mov rcx, rax
mov rdx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
call rax
mov dword [rbp + 0x1c], eax
jmp 0x14000c686
mov eax, dword [rbp + 0x1c]
cmp eax, 0
jne 0x14000c6a2
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c6a2
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x10], rdx
call fcn.140005e10
mov rcx, rsp
mov qword [rcx + 0x20], 0
mov rcx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [rbp + 0xb0]
mov r9d, 0x26
mov qword [rbp + 8], rcx
mov rcx, rax
mov rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 8]
call rax
mov dword [rbp + 4], eax
jmp 0x14000c6f1
mov eax, dword [rbp + 4]
cmp eax, 0
jne 0x14000c70d
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xor ecx, ecx
call rax
jmp 0x14000c70d
mov rax, qword [rbp + 0xa0]
mov r9, qword [rbp + 0xa8]
lea rcx, [rbp + 0x1e0]
mov qword [rbp - 8], rax
mov qword [rbp - 0x10], r9
call fcn.140005e10
mov rcx, rsp
mov rdx, qword [rbp - 8]
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x30], 0
mov dword [rcx + 0x28], 0
mov rcx, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor r8d, r8d
mov edx, r8d
mov qword [rbp - 0x18], rcx
mov rcx, rax
mov qword [rbp - 0x20], rdx
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
call rax
jmp 0x14000c774
jmp 0x14000c779
mov rdx, qword [rbp + 0xa0]
lea rcx, [rbp + 0x1e0]
mov qword [rbp - 0x28], rdx
call fcn.140005e10
mov rcx, rsp
mov qword [rcx + 0x20], 0
mov rcx, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea r8, [rbp + 0xb0]
mov r9d, 0x26
mov qword [rbp - 0x30], rcx
mov rcx, rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
call rax
mov dword [rbp - 0x34], eax
jmp 0x14000c7c8
mov eax, dword [rbp - 0x34]
cmp eax, 0
jne 0x14000c7d9
jmp 0x14000c804
mov al, byte [rbp + 0xd5]
cmp al, 0
je 0x14000c7ec
jmp 0x14000c804
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call rax
jmp 0x14000c7ff
jmp 0x14000c779
movzx eax, byte [rbp + 0xd4]
cmp eax, 1
je 0x14000c854
lea rcx, [rbp + 0x1e0]
call fcn.140005e10
mov rcx, qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 1
mov qword [rbp - 0x40], rcx
mov rcx, rax
mov rax, qword [rbp - 0x40]
call rax
jmp 0x14000c83e
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8ac
mov r8, qword [rbp + 0x248]
mov edx, dword [rbp + 0x244]
lea rcx, [rbp + 0x148]
call fcn.140006450
mov byte [rbp - 0x41], al
jmp 0x14000c875
mov al, byte [rbp - 0x41]
test al, 1
jne 0x14000c89b
jmp 0x14000c885
mov byte [rbp + 0x257], 0
mov dword [rbp + 0x200], 1
jmp 0x14000c8ac
mov byte [rbp + 0x257], 1
mov dword [rbp + 0x200], 1
lea rcx, [rbp + 0x1c0]
call fcn.140001250
jmp 0x14000c8bd
lea rcx, [rbp + 0x1e0]
call fcn.14000cbf0
jmp 0x14000c8ce
lea rcx, [rbp + 0x208]
call fcn.140001250
mov al, byte [rbp + 0x257]
and al, 1
movzx eax, al
add rsp, 0x2e0
pop rbp
ret