Function at 0x14690
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b0]
add eax, 0x10
mov dword [rsp + 0x1048], eax
mov dword [rsp + 0x1044], 0
mov dword [rsp + 0x1450], 0
mov dword [rsp + 0x1030], 0
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0xffe
rep stosb byte [rdi], al
mov qword [rsp + 0x1458], 0
xor eax, eax
mov word [rsp + 0x1050], ax
lea rdi, [rsp + 0x1052]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov dword [rsp + 0x1040], 0
cmp qword [rsp + 0x14b0], 0
jne 0x1473f
jmp 0x14b73
lea rdx, [0x000173e0]
lea rcx, str.http:__ai.taobao.com_pidmm_34440408_12080698_70620668
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x1475c
jmp 0x14b73
mov eax, dword [rsp + 0x1048]
mov eax, dword [rax]
mov dword [rsp + 0x1044], eax
mov eax, dword [rsp + 0x1044]
add eax, 0x40
mov dword [rsp + 0x1450], eax
mov eax, dword [rsp + 0x1044]
add eax, 0x38
mov dword [rsp + 0x1030], eax
mov eax, dword [rsp + 0x1450]
mov qword [rsp + 0x1458], rax
cmp qword [rsp + 0x1458], 0
jne 0x147ad
jmp 0x14b73
mov rax, qword [rsp + 0x1458]
movzx r9d, word [rax + 2]
mov rax, qword [rsp + 0x1458]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x1458]
mov edx, dword [rax + 4]
lea rcx, [0x00018060]
call fcn.00013920
mov rdx, qword [rsp + 0x1458]
movzx eax, word [rdx]
cmp eax, 0x800
jle 0x147f4
jmp 0x14b73
mov rax, qword [rsp + 0x1458]
movzx ecx, word [rax]
mov rax, qword [rsp + 0x1458]
mov esi, dword [rax + 4]
lea rdi, [rsp + 0x30]
rep movsb byte [rdi], byte [rsi]
lea rdx, [0x000180a0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x1483d
mov dword [rsp + 0x1040], 1
jmp 0x1491c
lea rdx, [0x000180b0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14869
mov dword [rsp + 0x1040], 1
jmp 0x1491c
lea rdx, [0x000180c0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14895
mov dword [rsp + 0x1040], 1
jmp 0x1491c
lea rdx, [0x000180d0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x148bb
mov dword [rsp + 0x1040], 2
jmp 0x1491c
lea rdx, [0x000180e0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x148e1
mov dword [rsp + 0x1040], 3
jmp 0x1491c
lea rdx, [0x00018100]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14917
mov dword [rsp + 0x1040], 4
mov rax, qword [rsp + 0x1458]
movzx eax, word [rax + 2]
cmp rax, 0x58
jbe 0x14917
jmp 0x1491c
jmp 0x14b73
mov eax, dword [rsp + 0x1030]
mov qword [rsp + 0x1038], rax
lea rdi, [0x0001f3b0]
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x00018120]
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x1038]
movzx r8d, word [rax]
mov rax, qword [rsp + 0x1038]
mov edx, dword [rax + 4]
lea rcx, [rsp + 0x1050]
call qword [sym.imp.ntoskrnl.exe_wcsncpy]
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, [rsp + 0x1050]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x149a6
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x00018120]
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x1040], 1
jne 0x14a1c
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__ai.taobao.com_pidmm_34440408_12080698_70620668
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14a06
jmp 0x14ad1
cmp dword [rsp + 0x1040], 2
jne 0x14a59
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__www.woniulock.com_tuguan.php_namejd
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14a46
jmp 0x14ad1
cmp dword [rsp + 0x1040], 3
jne 0x14a96
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__www.woniulock.com_tuguan.php_namegm
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14a83
jmp 0x14ad1
cmp dword [rsp + 0x1040], 4
jne 0x14ad1
lea rdi, [0x0001f3b0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__www.woniulock.com_tuguan.php_namesn
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14ac0
lea rax, [0x0001f3b0]
mov qword [rsp + 0x1460], rax
mov rax, qword [rsp + 0x1458]
mov eax, dword [rax + 4]
mov qword [rsp + 0x1468], rax
mov rax, qword [rsp + 0x1468]
mov qword [rsp + 0x1470], rax
mov rax, qword [rsp + 0x1460]
movzx eax, word [rax]
mov word [rsp + 0x1478], ax
mov rcx, qword [rsp + 0x1468]
movzx eax, word [rsp + 0x1478]
mov word [rcx], ax
mov rax, qword [rsp + 0x1460]
add rax, 2
mov qword [rsp + 0x1460], rax
mov rax, qword [rsp + 0x1468]
add rax, 2
mov qword [rsp + 0x1468], rax
cmp word [rsp + 0x1478], 0
jne 0x14b03
mov rax, qword [rsp + 0x1458]
mov edx, dword [rax + 4]
lea rcx, [0x00018130]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.00017030
add rsp, 0x1498
pop rdi
pop rsi
ret