Function at 0x140001090
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov dword [rsp + 8], ecx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r10, qword [0x140298670]
xor ebx, ebx
mov r9d, ecx
mov r15d, 0x9f49bac6
mov r14d, 0xfeedbef3
test r10, r10
je 0x1400011d1
movzx eax, byte [r11 + 0xa]
mov ecx, r14d
movzx edx, byte [r11 + 0xb]
shl edx, 8
add edx, eax
movzx r8d, r9b
movzx eax, byte [r11 + 9]
add r8d, 0x112410d
shl edx, 8
add edx, eax
shl edx, 8
add r8d, edx
mov edx, r15d
xor r8d, 0x7f76d
sub edx, r8d
mov eax, r8d
shl eax, 8
xor edx, eax
sub ecx, edx
mov eax, edx
sub ecx, r8d
shr eax, 0xd
xor ecx, eax
sub r8d, edx
sub r8d, ecx
mov eax, ecx
shr eax, 0xc
xor r8d, eax
sub edx, r8d
mov eax, r8d
sub edx, ecx
shl eax, 0x10
xor edx, eax
sub ecx, edx
mov eax, edx
sub ecx, r8d
shr eax, 5
xor ecx, eax
sub r8d, edx
sub r8d, ecx
mov eax, ecx
shr eax, 3
xor r8d, eax
sub edx, r8d
mov eax, r8d
sub edx, ecx
shl eax, 0xa
xor edx, eax
sub ecx, edx
shr edx, 0xf
sub ecx, r8d
mov r8, qword [r10 + 0x38]
xor ecx, edx
mov r11d, ecx
mov ecx, dword [r8 + 8]
mov rax, qword [r8]
dec ecx
and rcx, r11
add rcx, rcx
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x1400011d1
sub rdx, qword [r8 + 0x20]
je 0x1400011d1
cmp dword [rdx + 0x6c], r11d
jne 0x1400011b5
cmp dword [rdx + 0x68], 4
jne 0x1400011b5
mov rax, qword [rdx + 0x60]
cmp dword [rax], r9d
je 0x1400011c4
mov rdx, qword [rdx + 0x58]
test rdx, rdx
je 0x1400011d1
sub rdx, qword [r8 + 0x20]
jne 0x1400011a0
test rdx, rdx
je 0x1400011d1
mov rax, rdx
jmp 0x140001279
mov rax, qword gs:[0x60]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x104
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
call sub.VCRUNTIME140.dll_memset
cmp rdi, rsi
je 0x140001277
mov r12d, dword [rsp + 0x170]
lea rbp, [rdi - 0x10]
mov rdx, rbx
movzx eax, word [rbp + 0x58]
cmp bx, ax
jae 0x14000122b
mov rax, qword [rbp + 0x60]
mov cl, byte [rax + rdx*2]
mov byte [rsp + rdx + 0x20], cl
inc rdx
movzx eax, word [rbp + 0x58]
cmp rdx, rax
jb 0x140001214
movzx ecx, ax
cmp rcx, 0x104
jae 0x140001636
mov byte [rsp + rcx + 0x20], bl
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strlwr]
movzx ecx, byte [rsp + 0x20]
lea rdx, [rsp + 0x20]
mov eax, ebx
jmp 0x140001266
inc rdx
imul eax, eax, 0x1003f
add eax, ecx
movzx ecx, byte [rdx]
test ecx, ecx
jne 0x140001258
cmp r12d, eax
je 0x1400012a5
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140001204
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140295910
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x70
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140001277
mov r9, qword [rbp + 0x30]
lea rdi, [rsi + 0x38]
movsxd rax, dword [r9 + 0x3c]
mov eax, dword [rax + r9 + 0x88]
add rax, r9
mov r8d, dword [rax + 0x20]
mov edx, dword [rax + 0x1c]
add r8, r9
mov ecx, dword [rax + 0x24]
add rdx, r9
mov qword [rsi + 8], rbp
add rcx, r9
mov dword [rsi], r12d
mov qword [rsi + 0x10], r9
mov eax, dword [rax + 0x18]
mov dword [rsi + 0x18], eax
mov qword [rsi + 0x20], r8
mov qword [rsi + 0x28], rdx
mov qword [rsi + 0x30], rcx
movzx eax, byte [rsi + 2]
movzx edx, byte [rsi]
movzx ecx, byte [rsi + 3]
add edx, 0x112410d
shl ecx, 8
add ecx, eax
movzx eax, byte [rsi + 1]
shl ecx, 8
add ecx, eax
shl ecx, 8
add edx, ecx
xor edx, 0x7f76d
sub r15d, edx
mov eax, edx
shl eax, 8
xor r15d, eax
sub r14d, r15d
mov eax, r15d
sub r14d, edx
shr eax, 0xd
xor r14d, eax
sub edx, r15d
sub edx, r14d
mov eax, r14d
shr eax, 0xc
xor edx, eax
sub r15d, edx
mov eax, edx
sub r15d, r14d
shl eax, 0x10
xor r15d, eax
sub r14d, r15d
mov eax, r15d
sub r14d, edx
shr eax, 5
xor r14d, eax
sub edx, r15d
sub edx, r14d
mov eax, r14d
shr eax, 3
xor edx, eax
sub r15d, edx
mov eax, edx
sub r15d, r14d
shl eax, 0xa
xor r15d, eax
sub r14d, r15d
shr r15d, 0xf
sub r14d, edx
mov rdx, qword [0x140298670]
xor r14d, r15d
or r15, 0xffffffffffffffff
mov dword [rsi + 0x6c], r14d
mov qword [rsi + 0x60], rsi
mov dword [rsi + 0x68], 4
test rdx, rdx
jne 0x14000144e
lea ebp, [rdx + 0x40]
mov qword [rsi + 0x48], rbx
mov ecx, ebp
mov qword [rsi + 0x40], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi], rax
test rax, rax
je 0x1400014fa
mov r8d, ebp
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rdi]
mov ebp, 0x200
mov ecx, ebp
mov qword [rax + 0x18], rdi
mov rax, qword [rdi]
mov dword [rax + 8], 0x20
mov rax, qword [rdi]
mov dword [rax + 0xc], 5
mov rax, qword [rdi]
mov qword [rax + 0x20], 0x38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi]
mov dword [rax + 0x38], 0xa0111fe1
mov rax, qword [rdi]
cmp qword [rax], rbx
je 0x1400014fa
mov rcx, qword [rax]
mov r8d, ebp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, rsi
mov qword [0x140298670], rdx
jmp 0x14000147d
mov rax, qword [rdx + 0x38]
mov qword [rdi], rax
mov qword [rsi + 0x48], rbx
mov rax, qword [rdx + 0x38]
mov rcx, qword [rax + 0x18]
sub rcx, qword [rax + 0x20]
mov qword [rsi + 0x40], rcx
mov rax, qword [rdx + 0x38]
mov rcx, qword [rax + 0x18]
mov qword [rcx + 0x10], rsi
mov rax, qword [rdx + 0x38]
mov qword [rax + 0x18], rdi
mov rax, qword [rdx + 0x38]
inc dword [rax + 0x10]
mov rcx, qword [rdx + 0x38]
mov eax, r14d
mov edx, dword [rcx + 8]
dec edx
and rdx, rax
shl rdx, 4
add rdx, qword [rcx]
mov rax, qword [rdx]
inc dword [rdx + 8]
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x50], rbx
mov rax, qword [rdx]
test rax, rax
je 0x1400014b4
mov qword [rax + 0x18], rdi
mov eax, dword [rdx + 0xc]
inc eax
mov qword [rdx], rdi
lea eax, [rax + rax*4]
add eax, eax
cmp dword [rdx + 8], eax
jb 0x14000162e
mov rax, qword [rdi]
cmp dword [rax + 0x34], ebx
jne 0x14000162e
mov edx, dword [rax + 8]
mov eax, 2
shl rdx, 4
mul rdx
cmovo rax, r15
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x140001504
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rdi]
xor edx, edx
mov rcx, rbp
mov r8d, dword [rax + 8]
shl r8, 5
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rdi]
mov eax, dword [r9 + 8]
mov ecx, dword [r9 + 0xc]
mov r8d, dword [r9 + 0x10]
inc ecx
shr r8d, cl
lea eax, [rax*2 - 1]
test dword [r9 + 0x10], eax
mov eax, ebx
setne al
add r8d, eax
mov dword [r9 + 0x28], r8d
mov r9d, ebx
mov rax, qword [rdi]
mov dword [rax + 0x2c], ebx
mov rax, qword [rdi]
cmp dword [rax + 8], ebx
jbe 0x1400015e9
mov rax, qword [rax]
mov ecx, r9d
add rcx, rcx
mov r8, qword [rax + rcx*8]
test r8, r8
je 0x1400015d9
mov rax, qword [rdi]
mov r11, qword [r8 + 0x20]
mov ecx, dword [rax + 8]
mov eax, dword [r8 + 0x34]
lea edx, [rcx*2 - 1]
and rdx, rax
shl rdx, 4
add rdx, rbp
mov eax, dword [rdx + 8]
inc eax
mov dword [rdx + 8], eax
mov rcx, qword [rdi]
cmp eax, dword [rcx + 0x28]
jbe 0x1400015b7
inc dword [rcx + 0x2c]
mov rax, qword [rdi]
mov r10d, dword [rdx + 0xc]
mov ecx, r10d
imul ecx, dword [rax + 0x28]
cmp dword [rdx + 8], ecx
jbe 0x1400015b7
lea eax, [r10 + 1]
mov dword [rdx + 0xc], eax
mov qword [r8 + 0x18], rbx
mov rax, qword [rdx]
mov qword [r8 + 0x20], rax
mov rax, qword [rdx]
test rax, rax
je 0x1400015ce
mov qword [rax + 0x18], r8
mov qword [rdx], r8
mov r8, r11
test r11, r11
jne 0x14000156b
mov rax, qword [rdi]
inc r9d
cmp r9d, dword [rax + 8]
jb 0x140001559
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rdi]
mov eax, dword [rcx + 8]
add eax, eax
mov dword [rcx + 8], eax
mov rax, qword [rdi]
inc dword [rax + 0xc]
mov rax, qword [rdi]
mov qword [rax], rbp
mov rcx, qword [rdi]
mov eax, dword [rcx + 0x10]
shr eax, 1
cmp dword [rcx + 0x2c], eax
jbe 0x14000161b
mov ebx, dword [rcx + 0x30]
inc ebx
mov dword [rcx + 0x30], ebx
mov rax, qword [rdi]
cmp dword [rax + 0x30], 1
jbe 0x14000162e
mov dword [rax + 0x34], 1
mov rax, rsi
jmp 0x140001279
call fcn.140295a38
int3