Function at 0x1400052ed
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x398
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x330], rcx
mov qword [rbp + 0x338], rdx
mov dword [rbp + 0x340], r8d
lea rax, [rbp + 0x310]
sub rax, 0x340
add rax, 0x1f
shr rax, 5
shl rax, 5
mov rbx, rax
mov dword [rbp + 0x308], 0
vpxor xmm0, xmm0, xmm0
vmovdqa xmmword [rbp + 0x140], xmm0
vmovdqa xmmword [rbp + 0x150], xmm0
vmovdqa xmmword [rbp + 0x160], xmm0
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x14000539d
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x300], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x300]
mov qword [str.BABUBE], rax
jmp 0x1400053e8
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x170]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x170]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x170]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov qword [rbp + 0x2f8], 0
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140005445
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x2f0], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x2f0]
mov qword [str.BABUBE], rax
jmp 0x140005490
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov dword [rbp + 0x2ec], 0
mov byte [rbp + 0x30f], 0
mov eax, dword [rbp + 0x340]
add eax, 0x10
mov dword [rbp + 0x2e8], eax
mov eax, dword [rbp + 0x2e8]
cdqe
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp + 0x2e0], rax
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140005522
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x2d8], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x2d8]
mov qword [str.BABUBE], rax
jmp 0x14000556d
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov dword [rbp + 0x140], 0x30
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x1400055df
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x2d0], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x2d0]
mov qword [str.BABUBE], rax
jmp 0x14000562a
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
lea rdx, [rbp + 0x140]
mov rax, qword [rbp + 0x2f8]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov edx, 0x1f0003
mov rcx, rax
call sym.NtCreateEvent
mov dword [rbp + 0x2ec], eax
cmp dword [rbp + 0x2ec], 0
jns 0x140005bc1
mov ecx, dword [rbp + 0x2e8]
mov rdx, qword [rbp + 0x2f8]
mov rax, qword [rbp + 0x330]
mov dword [rsp + 0x48], ecx
mov rcx, qword [rbp + 0x2e0]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x11400c
lea rcx, [rbp + 0x130]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov r8d, 0
mov rcx, rax
call sym.NtFsControlFile
mov dword [rbp + 0x308], eax
cmp dword [rbp + 0x308], 0
jns 0x140005aa8
movabs rax, 0x74e1fb509ab4eaf0
mov qword [rbp + 0x250], rax
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x250], rax
mov rax, qword [rbp + 0x250]
mov qword [rbx + 0x40], rax
movabs rax, 0x8256871573da5f53
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rbx + 0x48], rax
movabs rax, 0x95ad9b74c6596dd5
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x240]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x240]
mov qword [rbx + 0x50], rax
movabs rax, 0xe1ac404efd335be2
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbx + 0x58], rax
movabs rax, 0x41d13b84347dce4b
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbx + 0x60], rax
movabs rax, 0xdfc582b3a9c2eee0
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rbx + 0x68], rax
movabs rdx, 0xd4e581ccb9c801a9
mov qword [rbp + 0x220], rdx
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x220]
mov qword [rbx + 0x70], rax
movabs rcx, 0x671795a997ee7d16
mov qword [rbp + 0x218], rcx
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov qword [rbx + 0x78], rax
nop
movabs rax, 0x54bca902d5e6afab
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbx], rax
movabs rax, 0xfa73a72f16be3030
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbx + 8], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp + 0x2b0], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x2b0], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rbx + 0x10], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbx + 0x18], rax
movabs rax, 0x61bc54f6525daf3f
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov qword [rbx + 0x20], rax
movabs rax, 0x9a95cbe389a78694
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x298]
mov qword [rbx + 0x28], rax
mov qword [rbp + 0x290], rdx
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x290], rax
mov rax, qword [rbp + 0x290]
mov qword [rbx + 0x30], rax
mov qword [rbp + 0x288], rcx
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
mov qword [rbx + 0x38], rax
mov qword [rbp + 0x280], rbx
mov rax, qword [rbp + 0x280]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x40]
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0x120], ymm0
vmovdqa ymmword [rbx + 0x100], ymm1
vmovdqa ymm1, ymmword [rbx + 0x120]
vmovdqa ymm0, ymmword [rbx + 0x100]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x40]
mov qword [rbp + 0x270], rax
vmovdqa ymmword [rbx + 0xe0], ymm0
mov rax, qword [rbp + 0x270]
vmovdqa ymm0, ymmword [rbx + 0xe0]
vmovdqa ymmword [rax], ymm0
nop
lea rax, [rbx + 0x20]
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x268]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x40]
add rax, 0x20
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x260]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0xc0], ymm0
vmovdqa ymmword [rbx + 0xa0], ymm1
vmovdqa ymm1, ymmword [rbx + 0xc0]
vmovdqa ymm0, ymmword [rbx + 0xa0]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x40]
add rax, 0x20
mov qword [rbp + 0x258], rax
vmovdqa ymmword [rbx + 0x80], ymm0
mov rax, qword [rbp + 0x258]
vmovdqa ymm0, ymmword [rbx + 0x80]
vmovdqa ymmword [rax], ymm0
nop
lea rcx, [rbx + 0x40]
mov eax, dword [rbp + 0x308]
mov edx, eax
call sym.printf_char_const__::_
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
cmp dword [rbp + 0x308], 0x103
jne 0x140005ace
mov rax, qword [rbp + 0x2f8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.NtWaitForSingleObject
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140005b16
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x2c8], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x2c8]
mov qword [str.BABUBE], rax
jmp 0x140005b61
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x1f0]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x1f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x1f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov eax, dword [rbp + 0x340]
movsxd rcx, eax
mov rax, qword [rbp + 0x2e0]
lea rdx, [rax + 0x10]
mov rax, qword [rbp + 0x338]
mov r8, rcx
mov rcx, rax
call sym.memmove
mov rax, qword [rbp + 0x2f8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.NtWaitForSingleObject
mov rax, qword [rbp + 0x2f8]
mov rcx, rax
call sym.NtClose
mov byte [rbp + 0x30f], 1
mov rax, qword [rbp + 0x2e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
movzx eax, byte [rbp + 0x30f]
add rsp, 0x398
pop rbx
pop rbp
ret