Function at 0x1401a4010
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov esi, edx
mov rdi, rcx
jne 0x1401a430b
movzx eax, byte [rcx + 0xe]
test al, al
jne 0x1401a4056
mov rcx, qword [rcx + 0x230]
test rcx, rcx
je 0x1401a4050
cmp byte [rcx], al
je 0x1401a4050
shr edx, 1
and edx, 1
call fcn.140197fc0
mov byte [rdi + 0xe], al
jmp 0x1401a4056
mov byte [rdi + 0xe], 1
mov al, 1
movzx ecx, al
cmp ecx, 6
ja case.default.0x1401a406f
lea rdx, [0x140000000]
mov ecx, dword [rdx + rcx*4 + 0x1a4378]
add rcx, rdx
jmp rcx
lea r9, str.apndvfs
jmp 0x1401a40a7
mov rdx, rdi
xor ecx, ecx
call fcn.1401bab10
jmp case.default.0x1401a406f
mov rdx, rdi
lea rcx, str.:memory:
call fcn.1401bab10
jmp case.default.0x1401a406f
mov r8d, dword [rdi + 0x24]
or r8d, 1
xor r9d, r9d
jmp 0x1401a40af
xor r9d, r9d
mov r8d, dword [rdi + 0x24]
or r8d, 6
mov rcx, qword [rdi + 0x230]
mov rdx, rdi
call fcn.1401babf0
mov rcx, qword [rdi]
mov qword [rsp + 0x50], rbx
mov qword [0x1403c5cb0], rcx
test rcx, rcx
je 0x1401a4316
call fcn.1401baf00
test eax, eax
jne 0x1401a4316
mov rcx, qword [rdi]
lea edx, [rax + 1]
call fcn.1402156d0
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1401a9c30
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1401a9da0
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1401a9630
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1401a9ea0
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1401a9640
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1401a9d00
mov rcx, qword [rdi]
lea rax, [0x1401a6aa0]
xor esi, esi
lea rdx, str.shell_add_schema
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea r9d, [rsi + 1]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 3]
call fcn.1401ad770
mov rcx, qword [rdi]
lea rax, [0x1401a7530]
mov qword [rsp + 0x38], rsi
lea rdx, str.shell_module_schema
mov r9d, 1
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov r8d, r9d
mov qword [rsp + 0x20], rsi
call fcn.1401ad770
mov rcx, qword [rdi]
lea rax, [0x1401a76b0]
mov qword [rsp + 0x38], rsi
lea rdx, str.shell_putsnl
mov r9d, 1
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov r8d, r9d
mov qword [rsp + 0x20], rdi
call fcn.1401ad770
mov rcx, qword [rdi]
lea rax, [0x1401a6dd0]
mov qword [rsp + 0x38], rsi
lea rdx, str.shell_escape_crnl
mov r9d, 1
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov r8d, r9d
mov qword [rsp + 0x20], rsi
call fcn.1401ad770
mov rcx, qword [rdi]
lea rax, [0x1401a7450]
mov qword [rsp + 0x38], rsi
lea r9d, [rsi + 1]
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 2]
mov qword [rsp + 0x28], rax
lea rdx, str.shell_int32
mov qword [rsp + 0x20], rsi
call fcn.1401ad770
mov qword [rsp + 0x38], rsi
lea rax, [0x1401a7400]
mov qword [rsp + 0x30], rsi
mov rcx, qword [rdi]
lea rdx, str.shell_idquote
mov r9d, 1
mov qword [rsp + 0x28], rax
mov r8d, r9d
mov qword [rsp + 0x20], rsi
call fcn.1401ad770
mov rcx, qword [rdi]
lea rbx, [0x14019ebc0]
mov qword [rsp + 0x38], rsi
lea rdx, str.edit
mov r9d, 1
mov qword [rsp + 0x30], rsi
mov r8d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call fcn.1401ad770
mov rcx, qword [rdi]
lea r9d, [rsi + 1]
mov qword [rsp + 0x38], rsi
lea r8d, [rsi + 2]
mov qword [rsp + 0x30], rsi
lea rdx, str.edit
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call fcn.1401ad770
cmp byte [rdi + 0xe], 3
jne 0x1401a4306
mov rdx, qword [rdi + 0x230]
lea rcx, str.CREATE_VIRTUAL_TABLE_zip_USING_zipfile__Q__
call fcn.1401ba3f0
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, rax
mov rbx, rax
call fcn.1401b9870
mov rcx, rbx
call fcn.1401ba620
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi]
call fcn.1401baf90
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rdi + 0x230]
lea rdx, str.Error:_unable_to_open_database___s_:__s_n
mov rcx, rax
mov r9, rbx
call fcn.1401ab380
test sil, 1
je 0x1401a4369
mov rdx, rdi
lea rcx, str.:memory:
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp fcn.1401bab10
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3