Function at 0x1400bcf90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
movzx edi, r8b
mov r14, rdx
mov ebx, ecx
test ecx, ecx
jne 0x1400bcfd2
call fcn.1400daa90
mov edx, dword [0x1401bf6c0]
mov eax, edx
shr eax, 8
movzx ecx, dl
and al, 1
je 0x1400bd007
cmp dword [0x1401bf6f0], 0
je 0x1400bd007
test dl, 1
jne 0x1400bd95d
test dil, dil
jne 0x1400bd010
lea rax, [fcn.1400ab910]
jmp 0x1400bd933
test cl, 1
jne 0x1400bd95d
xor edi, edi
mov dword [0x1401bf6ec], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x70], rdi
movdqu xmmword [rsp + 0x78], xmm0
mov eax, dword [0x1401bf6d4]
shr eax, 0x1f
test al, al
je 0x1400bd063
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rbp - 0x80], rax
mov edx, dword [0x1401bf6d4]
and edx, 0x3fffffff
lea rcx, [rsp + 0x70]
call fcn.1400d8d90
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8d, 0x9c
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400bd094
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea edx, [rbx + 0x12]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rbx], 0x9c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1400bd0cf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r8, r14
mov edx, 1
xor ecx, ecx
call fcn.140172ef0
call fcn.14009ab40
mov r13, rax
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x48], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x58], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x68], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rax + 0x78], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rax + 0x88], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rax + 0x98], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rax + 0xa8], xmm0
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rax + 0xb8], xmm1
movups xmm0, xmmword [rbx + 0x80]
movups xmmword [rax + 0xc8], xmm0
movsd xmm1, qword [rbx + 0x90]
movsd qword [rax + 0xd8], xmm1
mov eax, dword [rbx + 0x98]
mov dword [r13 + 0xe0], eax
mov rcx, r13
call fcn.1400a90f0
mov rcx, r13
call fcn.1400a90e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.14009aa80
mov r15, rax
mov rcx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rax + 0x2a0], rcx
mov qword [0x1401c13c8], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [r13 + 0x40], rax
mov eax, 0x601
cmp word [r13 + 0xa], ax
setae cl
mov byte [r15 + 0x4a1], cl
mov eax, 0x602
cmp word [r13 + 0xa], ax
setae al
mov byte [r15 + 0x4a2], al
mov eax, dword [0x1401bf6e0]
lea r12, [0x1401bf6c0]
mov rbx, r12
sub rbx, rax
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x50]
call fcn.140174eb0
mov r8d, 0x400
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [r13 + 0x38], rbx
lea rcx, [r13 + 0x10]
lea rdx, [rbp - 0x50]
call fcn.1400f6d70
call fcn.1400be1a0
mov qword [rsp + 0x68], rdi
mov ebx, dword [0x1401c0d20]
add rbx, r12
mov ecx, 0x40
call fcn.1401724f0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400bd268
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov edx, dword [0x1401c0d1c]
add rdx, rbx
mov rcx, rax
call fcn.1400f6430
mov rsi, rax
jmp 0x1400bd26b
mov rsi, rdi
mov rbx, qword [rsp + 0x68]
cmp rsi, rbx
je 0x1400bd28f
test rbx, rbx
je 0x1400bd28f
mov rcx, rbx
call fcn.140097200
mov edx, 0x40
mov rcx, rbx
call fcn.140172530
mov qword [rsp + 0x68], rsi
mov rdx, rsi
mov rcx, r15
call fcn.1400a5500
test al, al
jne 0x1400bd2b7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x1401bf6c0]
shr eax, 0xa
test al, 1
je 0x1400bd31b
cmp qword [r15 + 0x7a0], 0
je 0x1400bd31b
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x78]
call fcn.1400f7d40
nop
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.1400f8090
nop
lea rcx, [rax + 8]
cmp qword [rcx + 0x18], 0x10
jb 0x1400bd2f9
mov rcx, qword [rcx]
mov rax, qword [r15 + 0x7a0]
call qword [case.0x1400a115f.0]
nop
lea rcx, [rsp + 0x40]
call fcn.1400f7e10
nop
lea rcx, [rbp - 0x78]
call fcn.1400f7e10
call fcn.14009aae0
mov rsi, rax
cmp qword [0x1401c11b0], 0
jne 0x1400bd373
mov ecx, 0x800
call fcn.1401724f0
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400bd369
xor edx, edx
mov r8d, 0x800
mov rcx, rax
call fcn.140174eb0
call fcn.14009abe0
mov rdx, rax
mov r8, rsi
mov rcx, rbx
call fcn.1400b33e0
jmp 0x1400bd36c
mov rax, rdi
mov qword [0x1401c11b0], rax
mov rcx, r13
call fcn.1400a90d0
lea r8, [rsp + 0x68]
mov rdx, r12
mov rcx, rsi
call fcn.1400a2f80
mov rdx, r12
mov rcx, rsi
call fcn.1400b4bf0
test al, al
jne 0x1400bd4d0
mov eax, dword [0x1401bf6c0]
or eax, 1
mov dword [0x1401bf6c0], eax
shr eax, 8
test al, 1
je 0x1400bd40c
mov eax, dword [0x1401bf6c4]
shr eax, 4
test al, 1
je 0x1400bd3c9
mov rcx, r12
call fcn.1400b2960
call fcn.1400bb370
test r14, r14
jne 0x1400bd3fb
mov rbx, qword [0x1401c27e8]
test rbx, rbx
je 0x1400bd3fb
mov rcx, rbx
call fcn.140097eb0
mov edx, 0x4a8
mov rcx, rbx
call fcn.140172530
mov qword [0x1401c27e8], rdi
mov r8, r14
xor edx, edx
xor ecx, ecx
call fcn.140172ef0
jmp 0x1400bd4a1
mov rcx, qword [0x1401c1388]
test rcx, rcx
je 0x1400bd430
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1400a115f.0]
mov qword [0x1401c1388], rdi
mov rcx, qword [0x1401c1398]
test rcx, rcx
je 0x1400bd454
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1400a115f.0]
mov qword [0x1401c1398], rdi
mov rcx, qword [0x1401c13b8]
test rcx, rcx
je 0x1400bd478
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1400a115f.0]
mov qword [0x1401c13b8], rdi
mov rcx, qword [0x1401c1378]
test rcx, rcx
je 0x1400bd49c
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x1400a115f.0]
mov qword [0x1401c1378], rdi
call fcn.1400bb330
mov rdi, qword [0x1401bf6e4]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400bd4c8
mov rcx, rbx
call fcn.140097200
mov edx, 0x40
mov rcx, rbx
call fcn.140172530
nop
mov rax, rdi
jmp 0x1400bd933
mov eax, dword [rsi + 0x13c]
shr eax, 8
test al, 1
jne 0x1400bd51c
mov eax, dword [rsi + 0x138]
shr eax, 0x17
test al, 1
jne 0x1400bd51c
cmp qword [r15 + 0x4d0], 0
je 0x1400bd51c
xor ecx, ecx
mov rax, qword [r15 + 0x4e0]
call qword [case.0x1400a115f.0]
lea rdx, [0x1400bdc50]
mov ecx, 1
mov rax, qword [r15 + 0x4d0]
call qword [case.0x1400a115f.0]
mov rdx, r12
mov rcx, rsi
call fcn.1400b6290
call fcn.1400d78e0
mov r14d, dword [rsi + 0x138]
shr r14d, 0x11
and r14b, 1
mov rbx, qword [0x1401c1370]
test rbx, rbx
jne 0x1400bd5cc
lea ecx, [rbx + 0x40]
call fcn.1401724f0
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400bd5c2
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
call fcn.14009abe0
lea rcx, [0x140074758]
mov qword [rbx], rcx
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x38], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
call fcn.1400bcdd0
nop
lea rcx, [rbx + 0x30]
mov qword [rsp + 0x38], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
call fcn.1400bcda0
mov dword [rbx + 8], 0xffffffff
mov dword [rbx + 0xc], edi
mov word [rbx + 0x10], 1
jmp 0x1400bd5c5
mov rbx, rdi
mov qword [0x1401c1370], rbx
mov edx, dword [0x1401c10c5]
mov rcx, rsi
call fcn.1400a2bd0
mov r9, rax
xor r14b, 1
mov eax, dword [0x1401c10c1]
mov dword [rsp + 0x20], eax
movzx r8d, r14b
mov edx, dword [0x1401c10c9]
mov rcx, rbx
call fcn.1400a8090
mov dword [0x1401c10c9], edi
mov dword [0x1401c10c1], edi
mov rcx, rsi
call fcn.1400a1170
mov edx, dword [rsi + 0x13c]
shr edx, 8
not dl
and dl, 1
xor r8d, r8d
mov rcx, rsi
call fcn.1400a2be0
mov eax, dword [rsi + 0x138]
shr eax, 2
test al, 1
je 0x1400bd75a
mov rbx, qword [0x1401c13d8]
test rbx, rbx
jne 0x1400bd727
mov ecx, 0x98
call fcn.1401724f0
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400bd71d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
movups xmmword [rbx + 0x70], xmm0
movups xmmword [rbx + 0x80], xmm0
mov qword [rbx + 0x90], rax
lea rax, [0x140074778]
mov qword [rbx], rax
lea rcx, [rbx + 8]
mov word [rcx + 0x28], 0
call fcn.1400a6ec0
nop
lea rcx, [rbx + 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
call fcn.1400bce30
nop
lea rcx, [rbx + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
call fcn.1400bce30
nop
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
lea rcx, [rbx + 0x78]
mov qword [rsp + 0x30], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
call fcn.1400bce00
nop
lea rcx, [rbx + 0x88]
mov qword [rsp + 0x30], rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
call fcn.1400bce00
mov dword [rbx + 0x58], edi
jmp 0x1400bd720
mov rbx, rdi
mov qword [0x1401c13d8], rbx
mov edx, dword [0x1401c10fd]
mov rcx, rsi
call fcn.1400a2bd0
mov r8, rax
mov r9d, dword [0x1401c10f9]
mov edx, dword [0x1401c0cfc]
mov rcx, rbx
call fcn.1400c2d90
mov dword [0x1401c0cfc], edi
mov qword [0x1401c10f9], rdi
mov ebx, dword [rsi + 0x138]
mov eax, ebx
shr eax, 3
test al, 1
je 0x1400bd7b9
shr ebx, 0x12
and bl, 1
mov rax, qword [0x1401c13c0]
test rax, rax
jne 0x1400bd7b6
mov ecx, 0xa0
call fcn.1401724f0
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400bd7ac
xor edx, edx
mov r8d, 0xa0
mov rcx, rax
call fcn.140174eb0
mov rcx, r14
call fcn.1400ba970
jmp 0x1400bd7af
mov rax, rdi
mov qword [0x1401c13c0], rax
mov byte [rax + 9], bl
mov rbx, qword [0x1401c13a8]
test rbx, rbx
jne 0x1400bd815
lea ecx, [rbx + 0x40]
call fcn.1401724f0
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400bd80b
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov rcx, rax
call fcn.1400f7db0
lea rax, [0x140074768]
mov qword [rbx], rax
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0x38], edi
jmp 0x1400bd80e
mov rbx, rdi
mov qword [0x1401c13a8], rbx
movzx edx, word [0x1401c0d51]
mov rcx, qword [rsi + 0x168]
call fcn.1400f6400
mov rdx, rax
mov eax, dword [0x1401c1109]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x1401c1105]
mov r8d, dword [0x1401c1101]
mov rcx, rbx
call fcn.1400bcd00
mov eax, dword [0x1401c110d]
shr eax, 0x1c
test al, 1
je 0x1400bd873
mov ecx, dword [0x1401c32c8]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
inc dword [rax + rdx]
mov qword [0x1401c1105], rdi
movzx eax, byte [0x1401c110d]
and al, 0x30
cmp al, 0x20
jne 0x1400bd8c0
mov eax, dword [rsi + 0x138]
shr eax, 0x13
test al, 1
jne 0x1400bd8c0
mov eax, 0x600
cmp word [r13 + 0xa], ax
jae 0x1400bd8c0
call fcn.14009ab40
lea rcx, [rax + 0x18]
cmp qword [rcx + 0x18], 0x10
jb 0x1400bd8b3
mov rcx, qword [rcx]
mov rax, qword [r15 + 0x2b0]
call qword [case.0x1400a115f.0]
call fcn.14009ab40
mov ecx, dword [0x1401c1111]
add rcx, qword [rax + 0x38]
mov qword [0x1401bf6e4], rcx
mov eax, dword [0x1401bf6d4]
and eax, 0xc0000000
cmp eax, 0x80000000
jne 0x1400bd905
mov edx, dword [rsp + 0x74]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
or dword [0x1401bf6c0], 1
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400bd92c
mov rcx, rbx
call fcn.140097200
mov edx, 0x40
mov rcx, rbx
call fcn.140172530
nop
mov rax, qword [0x1401bf6e4]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140172c20
mov rbx, qword [rsp + 0x510]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test al, al
je 0x1400bda2c
mov ecx, dword [0x1401bf6c4]
mov eax, ecx
shr eax, 4
test al, 1
je 0x1400bd995
add ecx, ecx
mov dword [0x1401bf6c4], ecx
or edx, 5
mov dword [0x1401bf6c0], edx
lea rax, [fcn.1400ab910]
mov qword [0x1401bf6e4], rax
jmp 0x1400bd933
test ebx, ebx
jne 0x1400bd92c
shr ecx, 5
test cl, 1
jne 0x1400bd92c
mov eax, edx
and eax, 0x804
cmp eax, 0x804
je 0x1400bd92c
test byte [0x1401c0cd4], 0x80
je 0x1400bda01
call fcn.1400bb370
test r14, r14
jne 0x1400bd9f0
mov rbx, qword [0x1401c27e8]
test rbx, rbx
je 0x1400bd9f0
mov rcx, rbx
call fcn.140097eb0
mov edx, 0x4a8
mov rcx, rbx
call fcn.140172530
xor edi, edi
mov qword [0x1401c27e8], rdi
mov r8, r14
xor edx, edx
xor ecx, ecx
call fcn.140172ef0
jmp 0x1400bd92c
or edx, 4
mov dword [0x1401bf6c0], edx
call fcn.1400be0f0
mov rcx, rax
mov r8, r14
xor edx, edx
mov rax, qword [0x1401bf6e4]
call qword [case.0x1400a115f.0]
mov rcx, r14
call fcn.1400bde50
xor eax, eax
jmp 0x1400bd933