Function at 0x14004b9d0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov r12, rcx
mov rcx, rdx
mov rsi, r9
mov rbp, r8
mov rdi, rdx
call fcn.1400400a0
movsxd rbx, eax
test eax, eax
jne 0x14004ba1d
lea rcx, str._n___7_.__zykz34__63_t
call fcn.1400dd2e0
mov r9, rdi
xor r8d, r8d
mov rdx, rax
mov rcx, r12
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.14003d490
cmp ebx, 1
je 0x14004c581
mov qword [rsp + 0x70], r13
cmp ebx, 2
je 0x14004c264
cmp ebx, 3
je 0x14004bdb4
jle 0x14004bda2
cmp ebx, 5
jg 0x14004bda2
xor edi, edi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r15
cmp word [rsi], di
je 0x14004ba83
mov rcx, rsi
xor r12b, r12b
call fcn.1400230c0
mulsd xmm0, qword [0x140153230]
cvttsd2si r13d, xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
jmp 0x14004ba8e
mov r14d, dword [rsp + 0x30]
mov r12b, 1
mov r13d, edi
mov r15, rbx
mov esi, 1
mov rcx, rbp
call fcn.1400796d0
mov ebx, eax
cmp r15, 4
jne 0x14004bac1
test eax, eax
je 0x14004bac5
mov rcx, qword [0x1401703d0]
mov rdx, rbx
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140001370
jmp 0x14004bb7e
test eax, eax
je 0x14004bae9
test r12b, r12b
jne 0x14004badb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [r14 + r13]
sub ecx, eax
cmp ecx, 5
jle 0x14004baaa
mov edx, esi
mov ecx, 0x64
call fcn.140001760
jmp 0x14004ba96
mov rbp, qword [0x1401703d0]
movzx eax, byte [rbp + 0x23]
test al, al
jne 0x14004bb16
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401296b4]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], sil
call fcn.1400e9bc0
jmp 0x14004bb7c
lea r12, [0x1401296b4]
cmp qword [rbp + 8], r12
jne 0x14004bb2c
mov r14, qword [rbp + 0x10]
shr r14, 1
jmp 0x14004bb2f
mov r14, rsi
lea rcx, [r14 + 1]
lea r13, [rcx + rcx]
cmp al, 2
jne 0x14004bb48
mov rdx, r14
mov rcx, r12
call fcn.140005910
jmp 0x14004bb7c
mov r8, qword [0x140169b08]
cmp r13, r8
jbe 0x14004bb9d
cmp r13, qword [rbp + 0x18]
jbe 0x14004bb9d
lea rcx, [0x14014bd60]
call fcn.1400dd2e0
lea r8, [0x1401295d4]
mov rdx, rax
lea rcx, [0x1401712e0]
call fcn.1400a5580
mov esi, eax
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
mov eax, esi
mov r13, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rcx, 2
jae 0x14004bbb4
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 4]
call fcn.1400ea290
jmp 0x14004bb7e
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14004bbd2
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r8, qword [0x140169b08]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp r13, r9
jbe 0x14004bd44
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14004bc04
cmp al, 2
je 0x14004bc44
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14004bd38
mov ebx, pe_nt_image_headers64
cmp r13, rbx
ja 0x14004bc44
cmp r13, 8
ja 0x14004bc1b
mov ebx, 8
jmp 0x14004bc27
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
cmp r13, rax
cmovbe rbx, rax
mov rcx, rbx
call fcn.1400dc2b0
test rax, rax
jne 0x14004bc3b
mov esi, edi
jmp 0x14004bb7e
mov byte [rbp + 0x20], sil
jmp 0x14004bd38
cmp r13, 0x20
jae 0x14004bc54
mov ebx, SafeArrayAllocDescriptor
jmp 0x14004bcfe
mov ebx, 0x208
cmp r13, rbx
jb 0x14004bcfe
cmp r13, 0x50000
jae 0x14004bcba
pxor xmm0, xmm0
cvtsi2sd xmm0, r13
test r13, r13
jns 0x14004bc81
addsd xmm0, qword [0x140152fd8]
mulsd xmm0, qword [0x140153040]
movsd xmm1, qword [0x140153038]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14004bcb0
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14004bcb0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14004bcfe
cmp r13, 0x320000
jae 0x14004bccc
lea rbx, [r13 + 0x8000]
jmp 0x14004bcfe
cmp r13, 0xc80000
jae 0x14004bcf7
movabs rax, 0x47ae147ae147ae15
mov rbx, r13
mul r13
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, r13
jmp 0x14004bcfe
lea rbx, [r13 + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14004bd1f
test r9, r9
je 0x14004bd1f
mov rcx, qword [rbp + 8]
movzx r13d, sil
call fcn.140108f48
jmp 0x14004bd22
xor r13b, r13b
test rbx, rbx
js 0x14004bd6e
mov rcx, rbx
call fcn.1401084ac
test rax, rax
je 0x14004bd6e
mov byte [rbp + 0x20], 2
and byte [rbp + 0x21], 0x7f
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rbx
mov rcx, qword [rbp + 8]
cmp rcx, r12
je 0x14004bd59
lea r8, [r14 + r14]
mov rdx, r12
call fcn.140109100
mov rax, qword [rbp + 8]
lea rcx, [r14 + r14]
mov word [rcx + rax], di
mov qword [rbp + 0x10], rcx
jmp 0x14004bb7e
test r13b, r13b
je 0x14004bd84
lea rax, [0x140171290]
mov qword [rbp + 0x18], rdi
mov qword [rbp + 8], rax
jmp 0x14004bd8b
mov rax, qword [rbp + 8]
mov word [rax], di
mov qword [rbp + 0x10], rdi
lea r8, [0x1401295d4]
lea rdx, str.Out_of_memory.
jmp 0x14004bb70
xor eax, eax
mov r13, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ecx, word [rsi]
call fcn.14010a8a0
movzx r11d, ax
add r11d, 0xffffffbf
cmp r11d, 0x11
ja case.0x14004bde7.67
lea rdx, sym.MZ_b_4ix__UH3tlIju_n3bu_bRSDz8e8_6O__LTLn_u_28Wnitpw
movsxd rax, r11d
mov ebx, pe_nt_image_headers64
mov ecx, dword [rdx + rax*4 + 0x4c5bc]
add rcx, rdx
jmp rcx
mov edi, 0x40
jmp 0x14004be0e
mov edi, 0x4000
jmp 0x14004be0e
mov edi, SafeArrayAllocDescriptor
jmp 0x14004be0e
mov edi, 0x8000
jmp 0x14004be0e
mov edi, ebx
jmp 0x14004be0e
mov edi, 0x100
cmp word [rbp], 0
je 0x14004be1f
mov rcx, rbp
call fcn.1400796d0
jmp 0x14004be25
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
test eax, eax
je 0x14004be86
mov r8d, eax
xor edx, edx
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14004be86
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1401703d0]
xor edi, edi
test ebx, ebx
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
cmovne edi, esi
mov edx, edi
call fcn.140001370
mov r13, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, qword [0x1401703d0]
movzx eax, byte [rbp + 0x23]
test al, al
je 0x14004c2dc
lea r12, [0x1401296b4]
mov esi, 1
cmp qword [rbp + 8], r12
jne 0x14004beb4
mov r13, qword [rbp + 0x10]
shr r13, 1
jmp 0x14004beb7
mov r13, rsi
lea rcx, [r13 + 1]
lea rdi, [rcx + rcx]
cmp al, 2
je 0x14004c329
mov r8, qword [0x140169b08]
cmp rdi, r8
jbe 0x14004bedd
cmp rdi, qword [rbp + 0x18]
ja 0x14004c34d
cmp rcx, 2
jb 0x14004c37c
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14004bf05
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r8, qword [0x140169b08]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp rdi, r9
jbe 0x14004c525
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14004bf37
cmp al, 2
je 0x14004bf50
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14004c519
cmp rdi, rbx
ja 0x14004bf50
cmp rdi, 8
ja 0x14004c12b
mov ebx, 8
jmp 0x14004c137
cmp rdi, 0x20
jae 0x14004bf60
mov ebx, SafeArrayAllocDescriptor
jmp 0x14004c00a
mov ebx, 0x208
cmp rdi, rbx
jb 0x14004c00a
cmp rdi, 0x50000
jae 0x14004bfc6
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14004bf8d
addsd xmm0, qword [0x140152fd8]
mulsd xmm0, qword [0x140153040]
movsd xmm1, qword [0x140153038]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14004bfbc
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14004bfbc
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14004c00a
cmp rdi, 0x320000
jae 0x14004bfd8
lea rbx, [rdi + 0x8000]
jmp 0x14004c00a
cmp rdi, 0xc80000
jae 0x14004c003
movabs rax, 0x47ae147ae147ae15
mov rbx, rdi
mul rdi
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, rdi
jmp 0x14004c00a
lea rbx, [rdi + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14004c02b
test r9, r9
je 0x14004c02b
mov rcx, qword [rbp + 8]
movzx edi, sil
call fcn.140108f48
jmp 0x14004c02e
xor dil, dil
test rbx, rbx
js 0x14004c044
mov rcx, rbx
call fcn.1401084ac
test rax, rax
jne 0x14004c515
test dil, dil
je 0x14004c553
lea rax, [0x140171290]
xor edi, edi
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rdi
jmp 0x14004c55c
mov rbp, qword [0x1401703d0]
movzx eax, byte [rbp + 0x23]
test al, al
je 0x14004c2dc
lea r12, [0x1401296b4]
mov esi, 1
cmp qword [rbp + 8], r12
jne 0x14004c091
mov r13, qword [rbp + 0x10]
shr r13, 1
jmp 0x14004c094
mov r13, rsi
lea rcx, [r13 + 1]
lea rdi, [rcx + rcx]
cmp al, 2
je 0x14004c329
mov r8, qword [0x140169b08]
cmp rdi, r8
jbe 0x14004c0ba
cmp rdi, qword [rbp + 0x18]
ja 0x14004c34d
cmp rcx, 2
jb 0x14004c37c
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14004c0e2
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r8, qword [0x140169b08]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp rdi, r9
jbe 0x14004c525
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14004c114
cmp al, 2
je 0x14004c151
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14004c519
mov ebx, pe_nt_image_headers64
cmp rdi, rbx
ja 0x14004c151
cmp rdi, 8
ja 0x14004c12b
mov ebx, 8
jmp 0x14004c137
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
cmp rdi, rax
cmovbe rbx, rax
mov rcx, rbx
call fcn.1400dc2b0
test rax, rax
je 0x14004c414
mov byte [rbp + 0x20], sil
jmp 0x14004c519
cmp rdi, 0x20
jae 0x14004c161
mov ebx, SafeArrayAllocDescriptor
jmp 0x14004c20b
mov ebx, 0x208
cmp rdi, rbx
jb 0x14004c20b
cmp rdi, 0x50000
jae 0x14004c1c7
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14004c18e
addsd xmm0, qword [0x140152fd8]
mulsd xmm0, qword [0x140153040]
movsd xmm1, qword [0x140153038]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14004c1bd
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14004c1bd
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14004c20b
cmp rdi, 0x320000
jae 0x14004c1d9
lea rbx, [rdi + 0x8000]
jmp 0x14004c20b
cmp rdi, 0xc80000
jae 0x14004c204
movabs rax, 0x47ae147ae147ae15
mov rbx, rdi
mul rdi
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, rdi
jmp 0x14004c20b
lea rbx, [rdi + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14004c22c
test r9, r9
je 0x14004c22c
mov rcx, qword [rbp + 8]
movzx edi, sil
call fcn.140108f48
jmp 0x14004c22f
xor dil, dil
test rbx, rbx
js 0x14004c245
mov rcx, rbx
call fcn.1401084ac
test rax, rax
jne 0x14004c515
test dil, dil
je 0x14004c553
lea rax, [0x140171290]
xor edi, edi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 8], rax
jmp 0x14004c55c
mov rcx, rbp
call fcn.1400796d0
mov esi, eax
test eax, eax
je 0x14004c2cd
mov r8d, eax
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14004c2cd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1401703d0]
xor edi, edi
test ebx, ebx
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
cmovne edi, esi
mov edx, edi
call fcn.140001370
mov r13, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, qword [0x1401703d0]
movzx eax, byte [rbp + 0x23]
test al, al
jne 0x14004c2ff
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1401296b4]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
mov esi, eax
jmp 0x14004bb8b
lea r12, [0x1401296b4]
mov esi, 1
cmp qword [rbp + 8], r12
jne 0x14004c31a
mov r13, qword [rbp + 0x10]
shr r13, 1
jmp 0x14004c31d
mov r13, rsi
lea rcx, [r13 + 1]
lea rdi, [rcx + rcx]
cmp al, 2
jne 0x14004c33b
mov rdx, r13
mov rcx, r12
call fcn.140005910
mov esi, eax
jmp 0x14004bb8b
mov r8, qword [0x140169b08]
cmp rdi, r8
jbe 0x14004c376
cmp rdi, qword [rbp + 0x18]
jbe 0x14004c376
lea rcx, [0x14014bd60]
call fcn.1400dd2e0
lea r8, [0x1401295d4]
lea rcx, [0x1401712e0]
mov rdx, rax
call fcn.1400a5580
mov esi, eax
jmp 0x14004bb8b
cmp rcx, 2
jae 0x14004c390
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 4]
call fcn.1400ea290
jmp 0x14004bb8b
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14004c3ae
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r8, qword [0x140169b08]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp rdi, r9
jbe 0x14004c525
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14004c3e0
cmp al, 2
je 0x14004c41d
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14004c519
mov ebx, pe_nt_image_headers64
cmp rdi, rbx
ja 0x14004c41d
cmp rdi, 8
ja 0x14004c3f7
mov ebx, 8
jmp 0x14004c403
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
cmp rdi, rax
cmovbe rbx, rax
mov rcx, rbx
call fcn.1400dc2b0
test rax, rax
jne 0x14004c148
xor edi, edi
mov esi, edi
jmp 0x14004bb8b
cmp rdi, 0x20
jae 0x14004c42d
mov ebx, SafeArrayAllocDescriptor
jmp 0x14004c4d7
mov ebx, 0x208
cmp rdi, rbx
jb 0x14004c4d7
cmp rdi, 0x50000
jae 0x14004c493
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14004c45a
addsd xmm0, qword [0x140152fd8]
mulsd xmm0, qword [0x140153040]
movsd xmm1, qword [0x140153038]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14004c489
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14004c489
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14004c4d7
cmp rdi, 0x320000
jae 0x14004c4a5
lea rbx, [rdi + 0x8000]
jmp 0x14004c4d7
cmp rdi, 0xc80000
jae 0x14004c4d0
movabs rax, 0x47ae147ae147ae15
mov rbx, rdi
mul rdi
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, rdi
jmp 0x14004c4d7
lea rbx, [rdi + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14004c4f8
test r9, r9
je 0x14004c4f8
mov rcx, qword [rbp + 8]
movzx edi, sil
call fcn.140108f48
jmp 0x14004c4fb
xor dil, dil
test rbx, rbx
js 0x14004c245
mov rcx, rbx
call fcn.1401084ac
test rax, rax
je 0x14004c245
mov byte [rbp + 0x20], 2
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rbx
and byte [rbp + 0x21], 0x7f
mov rcx, qword [rbp + 8]
cmp rcx, r12
je 0x14004c53b
lea r8, [r13 + r13]
mov rdx, r12
call fcn.140109100
mov rax, qword [rbp + 8]
lea rcx, [r13 + r13]
xor edi, edi
mov word [rcx + rax], di
mov qword [rbp + 0x10], rcx
jmp 0x14004bb8b
mov rax, qword [rbp + 8]
xor edi, edi
mov word [rax], di
lea r8, [0x1401295d4]
lea rdx, str.Out_of_memory.
lea rcx, [0x1401712e0]
mov qword [rbp + 0x10], rdi
call fcn.1400a5580
mov esi, eax
jmp 0x14004bb8b
cmp word [rbp], 0
je 0x14004c592
mov rcx, rbp
call fcn.1400796d0
jmp 0x14004c598
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x1401703d0]
mov edx, eax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140001370
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret