Function at 0x140001bd0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001fc0
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x11c
call rax
mov eax, dword [rsp + 0x6c]
cmp eax, 0x47bb
ja 0x140001cd1
je 0x140001ca7
cmp eax, 0x42ee
ja 0x140001c95
je 0x140001c56
cmp eax, 0x3839
je 0x140001c83
cmp eax, 0x3ad7
je 0x140001c56
cmp eax, 0x3fab
jne 0x140001fc0
mov qword [rbx + 8], 0x2e0
mov qword [rbx + 0x10], 0x2e8
mov qword [rbx + 0x18], 0x338
mov qword [rbx + 0x20], 0x3c0
mov qword [rbx + 0x28], 0x450
jmp 0x140001d25
mov qword [rbx + 8], 0x2e8
mov qword [rbx + 0x10], 0x2f0
jmp 0x140001c66
cmp eax, 0x4563
je 0x140001c56
cmp eax, 0x47ba
jne 0x140001fc0
mov qword [rbx + 8], 0x2e8
mov qword [rbx + 0x10], 0x2f0
mov qword [rbx + 0x18], 0x340
mov qword [rbx + 0x20], 0x3c8
mov qword [rbx + 0x28], 0x450
jmp 0x140001d25
cmp eax, 0x4a64
ja 0x140001ceb
je 0x140001cfd
sub eax, 0x4a61
je 0x140001cfd
sub eax, 1
je 0x140001cfd
cmp eax, 1
jmp 0x140001cf7
cmp eax, 0x4a65
je 0x140001cfd
cmp eax, 0x55f0
jne 0x140001fc0
mov qword [rbx + 0x28], 0x5a8
mov qword [rbx + 0x20], 0x520
mov qword [rbx + 0x18], 0x498
mov qword [rbx + 0x10], 0x448
mov qword [rbx + 8], 0x440
mov rcx, rbx
mov qword [rsp + 0x1f8], rdi
call fcn.140001a30
mov qword [rbx + 0xa8], rax
test rax, rax
je 0x140001fbc
mov rcx, rbx
call fcn.140001830
mov rdi, rax
test rax, rax
je 0x140001fbc
mov qword [rsp + 0x1e8], rbp
lea rcx, str._n__system_kprocess_______llx_n
mov qword [rsp + 0x1f0], rsi
mov rdx, rax
mov qword [rsp + 0x1b8], r14
mov qword [rsp + 0x1b0], r15
call fcn.140001090
mov rdx, qword [rbx + 0xa8]
lea rcx, str.__system_cr3_____0x_p_n
call fcn.140001090
mov r14, qword [rbx + 0x10]
add r14, rdi
mov qword [rsp + 0x1c8], r12
xor r15d, r15d
mov qword [rsp + 0x38], r14
mov ebp, r15d
mov qword [rsp + 0x1c0], r13
nop dword [rax]
mov r9d, 8
lea r8, [rsp + 0x38]
mov rdx, r14
mov rcx, rbx
call fcn.140002370
mov rdx, qword [rbx + 0x18]
lea r8, [rsp + 0x40]
mov r14, qword [rsp + 0x38]
mov r9d, 8
mov rsi, r14
mov rcx, rbx
sub rsi, qword [rbx + 0x10]
add rdx, rsi
call fcn.140002370
test al, al
je 0x140001f13
cmp qword [rsp + 0x40], r15
je 0x140001f13
mov rdx, qword [rbx]
lea r8, [rsp + 0x48]
add rdx, rsi
mov r9d, 8
mov rcx, rbx
call fcn.140002370
mov rdx, qword [rbx + 0x20]
lea r8, [rsp + 0x50]
mov r13, qword [rsp + 0x48]
test al, al
mov r9d, 8
mov rcx, rbx
cmove r13, r15
add rdx, rsi
call fcn.140002370
mov rdx, qword [rbx + 0x28]
lea r8, [rsp + 0x190]
mov r12, qword [rsp + 0x50]
test al, al
xorps xmm0, xmm0
mov r9d, 0x10
cmove r12, r15
mov rcx, rbx
add rdx, rsi
movups xmmword [rsp + 0x190], xmm0
call fcn.140002370
mov rdx, qword [rbx + 8]
lea r8, [rsp + 0x30]
add rdx, rsi
mov dword [rsp + 0x30], r15d
mov r9d, 4
mov rcx, rbx
call fcn.140002370
lea rdx, [rsp + 0x190]
lea rcx, str.access.exe
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140001f13
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rsp + 0x60], 0x130
nop
lea rdx, str.access.exe
lea rcx, [rsp + 0x8c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rdi
test eax, eax
je 0x140001eff
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001ed0
lea ecx, [rax + 1]
jmp 0x140001f09
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x68]
movsxd rdx, dword [rsp + 0x30]
cmp rdx, rcx
je 0x140001f23
inc ebp
cmp ebp, 0x190
jb 0x140001dc0
jmp 0x140001f68
lea rcx, str.__pid______i_n
mov qword [rbx + 0xa8], r13
mov r15, r12
mov dword [rbx + 0xb8], edx
mov qword [rbx + 0xb0], rsi
call fcn.140001090
mov rdx, r12
lea rcx, str.__image_base______I64d_n
call fcn.140001090
mov rdx, qword [rbx + 0xa8]
lea rcx, str.__cr3_____0x_p_n
call fcn.140001090
mov r14, qword [rsp + 0x1b8]
mov rax, r15
mov r15, qword [rsp + 0x1b0]
mov r13, qword [rsp + 0x1c0]
mov r12, qword [rsp + 0x1c8]
mov rsi, qword [rsp + 0x1f0]
mov rbp, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0x1f8]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.140009c50
add rsp, 0x1d0
pop rbx
ret
xor eax, eax
jmp 0x140001f9b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3