Function at 0x140003a50
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x60
mov rdx, qword [0x14001c6d8]
mov r14, rcx
test rdx, rdx
je 0x140003dda
mov rax, qword [0x14001c6e0]
test rax, rax
je 0x140003dda
cmp qword [0x14001c6e8], 0
je 0x140003dda
mov qword [r11 + 8], rbx
lea rbx, [0x14001c058]
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
xor r12d, r12d
xor edi, edi
mov qword [r11 - 0x30], r13
mov dword [rsp + 0x78], edi
mov qword [r11 - 0x38], r15
mov qword [0x14001c058], rdx
mov qword [0x14001c088], rax
mov qword [rsp + 0x80], rbx
nop dword [rax]
mov rdx, qword [rbx - 8]
lea rcx, str.____ObjectCallblacks__tEnumerating__s_object_callbacks_:__n
call fcn.1400014f0
mov rcx, qword [rbx]
call fcn.140007490
mov r13, qword [0x14001c6e8]
mov rbx, rax
add r13, rax
mov qword [rsp + 0x28], rax
mov rcx, r13
call fcn.140007310
mov rbp, rax
cmp rax, r13
je 0x140003d8a
nop
cmp qword [r14], 0x100
jae 0x140003e34
lea rcx, [rbp + 0x20]
call fcn.140007310
cmp rax, rbx
jne 0x140003e1d
lea rcx, [rbp + 0x10]
call fcn.140007190
sub eax, 1
je 0x140003b5d
sub eax, 1
je 0x140003b54
cmp eax, 1
jne 0x140003def
lea r8, str.creations__duplications
jmp 0x140003b64
lea r8, str.duplications
jmp 0x140003b64
lea r8, str.creations
mov rdx, rbp
lea rcx, str.____ObjectCallblacks__t_tCallback_at__p_for_handle__s:_n
call fcn.1400014f0
lea r15, [rbp + 0x14]
mov rcx, r15
call fcn.140007190
mov esi, eax
cmp eax, 1
ja 0x140003e06
test eax, eax
lea rdx, str.Disabled
lea rax, str.Enabled
cmovne rdx, rax
lea rcx, str.____ObjectCallblacks__t_t_tStatus:__s_n
call fcn.1400014f0
lea rcx, [rbp + 0x28]
call fcn.140007310
mov rdi, rax
test rax, rax
je 0x140003c90
lea rdx, [rsp + 0x88]
mov rcx, rax
call fcn.140007980
mov r9, qword [rsp + 0x88]
lea rcx, str.____ObjectCallblacks__t_t_tPreoperation_at_0x_016llx___s__0x_llx__n
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.1400014f0
xor r10d, r10d
lea r9, str.360qpesv.sys
nop word [rax + rax]
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140003c24
add rax, 2
test ecx, ecx
jne 0x140003c10
test edx, edx
je 0x140003c3a
inc r10d
add r9, 8
cmp r10d, 0x405
jb 0x140003c00
jmp 0x140003c90
lea rcx, str.____ObjectCallblacks__t_t_tCallback_belongs_to_an_EDR
call fcn.1400014f0
test esi, esi
je 0x140003c84
lea rcx, str.and_is_enabled_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
imul rax, qword [r14], 0x38
mov dword [rax + r14 + 8], 1
mov qword [rax + r14 + 0x10], rbx
mov dword [rax + r14 + 0x38], 0
mov qword [rax + r14 + 0x30], rdi
mov qword [rax + r14 + 0x18], r15
inc qword [r14]
or r12d, 1
jmp 0x140003c90
lea rcx, str.but_is_disabled.
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
lea rcx, [rbp + 0x30]
call fcn.140007310
mov rdi, rax
test rax, rax
je 0x140003d6d
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140007980
mov r9, qword [rsp + 0x20]
lea rcx, str.____ObjectCallblacks__t_t_tPostoperation_at_0x_016llx___s__0x_llx__n
mov r8, rax
mov rdx, rdi
mov rbx, rax
call fcn.1400014f0
test esi, esi
je 0x140003d6d
xor r10d, r10d
lea r9, str.360qpesv.sys
nop
mov r8, qword [r9]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140003d04
add rax, 2
test ecx, ecx
jne 0x140003cf0
test edx, edx
je 0x140003d1a
inc r10d
add r9, 8
cmp r10d, 0x405
jb 0x140003ce0
jmp 0x140003d6d
lea rcx, str.____ObjectCallblacks__t_t_tCallback_belongs_to_an_EDR
call fcn.1400014f0
lea rcx, str.and_is_enabled_
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov rax, qword [r14]
imul rcx, rax, 0x38
test rax, rax
je 0x140003d45
cmp qword [rcx + r14 - 0x20], r15
je 0x140003d6d
mov dword [rcx + r14 + 8], 1
mov qword [rcx + r14 + 0x10], rbx
mov dword [rcx + r14 + 0x38], 0
mov qword [rcx + r14 + 0x30], rdi
mov qword [rcx + r14 + 0x18], r15
inc qword [r14]
or r12d, 1
mov rcx, rbp
call fcn.140007310
mov rbx, qword [rsp + 0x28]
mov rbp, rax
cmp rax, r13
jne 0x140003b10
mov edi, dword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
inc edi
add rbx, 0x30
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x80], rbx
cmp edi, 2
jb 0x140003ad0
mov r13, qword [rsp + 0x38]
mov eax, r12d
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x60
pop r14
ret
lea rcx, str.Object_callback_offsets_not_loaded___Aborting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
xor eax, eax
add rsp, 0x60
pop r14
ret
lea rcx, str.Unexpected_value_in_callback_entry__Operations___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unexpected_value_in_callback_entry__Enabled___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.Unexpected_value_in_callback_entry__ObjectTypeField___exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
lea rcx, str.____No_more_space_to_store_object_callbacks_____This_should_not_happen._Exiting...
call sub.api_ms_win_crt_stdio_l1_1_0.dll__putws
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3