Function at 0x14016e870
Capabilities:
Terminate process

Disassembly:
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rbx, rsi
xchg rsi, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
mov qword [rsp], r12
nop
push 0x384e5457
mov qword [rsp], r13
push r10
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
mov rbp, rsp
sub rsp, 0x60
xchg rcx, r15
mov rcx, r9
xchg rcx, r15
xchg r13, r12
mov r13, r8
xchg r13, r12
mov r13d, edx
xchg rcx, r11
mov r14, r11
xchg r11, rcx
xchg rsi, r12
mov r12, qword [rcx + 0x2f8]
xchg rsi, r12
xchg r11, rbx
mov r11, qword [rcx + 0x2f0]
xchg rbx, r11
cmp rbx, rsi
je 0x14016e950
nop
xchg rdi, r11
mov r11, qword [rbx]
xchg rdi, r11
mov edx, 0xb4bbb72
add edx, 0x22c9de24
sub edx, 0x256dcc2e
add edx, 0x368ea656
xor edx, 0x2d66d5db
sub edx, 0x1250a601
xor ecx, ecx
call fcn.1401b0400
cmp eax, 0x1e
jge 0x14016e943
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
sub rbx, 0xfffffffffffffff8
cmp rbx, rsi
jne 0x14016e8fe
cmp dword [r14 + 0xe8], 0
je 0x14016ecf6
mov rcx, qword [0x140216fe0]
call fcn.14002d990
mov ebx, eax
test eax, eax
jle 0x14016eb14
mov byte [rbp - 0x38], 0x47
add byte [rbp - 0x38], 0x21
xor byte [rbp - 0x38], 0x12
xor byte [rbp - 0x38], 0x62
add byte [rbp - 0x38], 0x4d
sub byte [rbp - 0x38], 0x65
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.14004bb30
nop
mov byte [rbp - 0x28], 0x7b
sub byte [rbp - 0x28], 0x21
sub byte [rbp - 0x28], 0x4d
xor byte [rbp - 0x28], 0x6a
sub byte [rbp - 0x28], 0x66
add byte [rbp - 0x28], 0xe
xor byte [rbp - 0x28], 0xf
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14004bb30
nop
lea rdi, [r14 + 0x308]
lea r8, [rbp - 0x38]
mov edx, 0x3c89896d
xor edx, 0x495bc41
xor edx, 0x68741d83
xor edx, 0x2953bc
xor edx, 0x11ad11c3
sub edx, 0x2f48210e
xor edx, 0x120bdc57
xor edx, 0x926d65a
sub edx, 0x98943ca
xchg r8, rcx
mov r8, qword [rdi]
xchg r8, rcx
call fcn.14004f500
test al, al
je 0x14016eaf3
lea rax, [rbp - 0x18]
xchg rdi, rax
mov qword [rbp - 0x40], rdi
xchg rdi, rax
lea eax, [rbx + 0x277d]
mov dword [rbp + 0x30], eax
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.14007b8a0
xchg rdx, rax
mov rbx, rdx
xchg rdx, rax
mov edx, 0x66461f3
add edx, 0x5c9cd65e
sub edx, 0x2a0b535e
sub edx, 0x104fd7b
xor edx, 0x1cdfb833
add edx, 0x339f0ac7
sub edx, 0x5ece6a11
lea rcx, [rbp - 0x38]
call fcn.14004e1a0
mov rcx, rax
xchg rbx, rdx
mov rbx, rdx
xchg rdx, rbx
call fcn.14004dab0
xchg r13, rdi
mov rcx, r13
xchg r13, rdi
call fcn.14007e960
mov r9b, 0x54
sub r9b, 7
sub r9b, 0x33
add r9b, 0x4f
sub r9b, 0x43
sub r9b, 0x25
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
xchg r12, rcx
mov r12, rax
xchg rcx, r12
call fcn.14004fef0
mov ecx, 0x485259b
xor ecx, 0x5dd0a41f
add ecx, 0x19a1a01b
sub ecx, 0x11f4d963
xor ecx, 0x3ab382be
sub ecx, 0x313bf9b3
xor ecx, 0x4e6b64c6
add ecx, 0x9be14bf6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movzx edx, byte [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.140054290
nop
movzx edx, byte [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.140054290
nop
jmp 0x14016eb1b
lea rdi, [r14 + 0x308]
mov edx, 0x23b962dc
add edx, 0x1f626961
xor edx, 0x1297bcf8
xor edx, 0x45222853
xor edx, 0x4055abd0
sub edx, 0x54fbf2e2
xor ecx, ecx
call fcn.1401b0400
cmp eax, 0x1e
jge 0x14016ecf6
mov rcx, qword [0x140216fe0]
call fcn.14002c9b0
mov ebx, eax
test eax, eax
jle 0x14016ecf6
mov byte [rbp - 0x38], 0x3a
sub byte [rbp - 0x38], 0x29
add byte [rbp - 0x38], 0x22
add byte [rbp - 0x38], 3
xor byte [rbp - 0x38], 0x32
xor byte [rbp - 0x38], 0x25
add byte [rbp - 0x38], 2
sub byte [rbp - 0x38], 0x23
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.14004bb30
nop
mov byte [rbp - 0x28], reloc.SHLWAPI.dll_SHCreateMemStream
sub byte [rbp - 0x28], 9
xor byte [rbp - 0x28], 0x34
xor byte [rbp - 0x28], 0x4d
sub byte [rbp - 0x28], 0x46
sub byte [rbp - 0x28], 0x12
add byte [rbp - 0x28], 0x4c
sub byte [rbp - 0x28], 0x6e
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14004bb30
nop
lea r8, [rbp - 0x38]
mov edx, 0x59c080
add edx, 0x70fbcdbb
sub edx, 0x253d14c2
xor edx, 0x4c785e29
add edx, 0x5cfc16de
add edx, 0x86420d6
sub edx, 0x65c05eff
xchg rcx, rbx
mov rbx, qword [rdi]
xchg rbx, rcx
call fcn.14004f500
test al, al
je 0x14016ecda
lea rax, [rbp - 0x18]
mov qword [rbp - 0x40], rax
lea eax, [rbx + 0x27e1]
mov dword [rbp + 0x30], eax
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.14007b8a0
xchg r10, rbx
mov r10, rax
xchg r10, rbx
mov edx, 0x2336a706
xor edx, 0x56b1786f
sub edx, 0x2605ef54
xor edx, 0x58ed3fa2
xor edx, 0x74ac7ef4
xor edx, 0x2f2dcbc9
xor edx, 0x187302a1
sub edx, 0x549e782a
lea rcx, [rbp - 0x38]
call fcn.14004e1a0
xchg rcx, rbp
mov rbp, rax
xchg rbp, rcx
xchg rsi, rbx
mov rdx, rsi
xchg rbx, rsi
call fcn.14004dab0
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.14007e960
mov r9b, 2
add r9b, 0x3f
xor r9b, 0x20
sub r9b, 0x5d
xor r9b, 0x2e
sub r9b, 0x29
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x38]
mov rcx, rax
call fcn.14004fef0
mov ecx, 0x698a5d9c
xor ecx, 0x19c99530
sub ecx, 0x5570ea1c
add ecx, 0x37c3d187
sub ecx, 0x125789ce
sub ecx, 0xdde5930
xor ecx, 0xcd9f32e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
movzx edx, byte [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.140054290
nop
movzx edx, byte [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.140054290
nop
mov r9d, r13d
mov r8, r12
xchg rdx, r15
mov r15, rdx
xchg rdx, r15
xchg r12, rcx
mov r12, qword [r14 + 0x5b8]
xchg r12, rcx
lea r11, [rsp + 0x60]
xchg r9, rbx
mov r9, qword [r11 + 0x38]
xchg r9, rbx
mov rsi, qword [r11 + 0x40]
xchg rsi, rdi
mov rsi, qword [r11 + 0x48]
xchg rsi, rdi
mov rsp, r11
nop
xchg qword [rsp], r15
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r14
push rax
push rcx
push rcx
push rcx
push rbx
push rax
push rax
push rcx
xchg qword [rsp + 0x40], r13
pop rcx
pop rax
pop rax
pop rbx
pop rcx
pop rcx
pop rcx
pop rax
add rsp, 8
push rax
push rax
push rdx
push rdx
push rcx
push rax
xchg qword [rsp + 0x30], r12
pop rax
pop rcx
pop rdx
pop rdx
pop rax
pop rax
add rsp, 8
nop
xchg qword [rsp], rbp
add rsp, 8
jmp qword [sym.imp.USER32.dll_MessageBoxW]