Function at 0x1401ad3d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov r13, rdx
mov r12, rcx
xor edi, edi
mov dword [rbp + 0x67], edi
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 5]
call fcn.1401acdd0
mov eax, dword [rbp + 0x67]
test eax, eax
jne 0x1401ad468
lea rcx, [0x1400040c8]
call fcn.140dd6e5a
nop
mov rdi, rax
lea rcx, [0x1400040e0]
call fcn.140dd6e5a
nop
mov rbx, rax
mov r9d, 0x10
mov r8, rax
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, rdi
call fcn.140dd6e93
nop
mov rcx, rbx
call fcn.140dd6e93
nop
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, rax
cmp qword [r12 + 0x50], rax
jae 0x1401ad4bf
add rbx, 0x1e0
mov qword [r12 + 0x50], rbx
mov rdi, qword [r12 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
test rdi, rdi
jne 0x1401ad4ac
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1401ad4b8
mov r9, rbx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
xor edi, edi
mov qword [r12 + 0x48], rax
mov r9d, dword [r12 + 0x50]
mov dword [rbp + 0x67], r9d
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov r8, qword [r12 + 0x48]
mov edx, 5
mov rcx, r12
call fcn.1401acdd0
test eax, eax
js 0x1401ad971
mov rbx, qword [r12 + 0x48]
mov qword [rbp + 0x7f], rbx
cmp word [rbx + 0x38], 0
je 0x1401ad956
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
cmp qword [rbx + 0x50], rax
je 0x1401ad956
movzx esi, word [rbx + 0x38]
mov r15, qword [rbx + 0x40]
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rdi
lea r14, [rsi + rsi]
mov qword [rbp - 0x11], 7
lea rcx, [rbp - 0x29]
cmp rsi, 8
jae 0x1401ad558
mov qword [rbp - 0x19], rsi
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + r14 - 0x29], di
jmp 0x1401ad599
mov rdi, rsi
or rdi, 7
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
call fcn.14002f9d0
mov rbx, rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rdi
mov r8, r14
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov word [r14 + rbx], ax
lea rdi, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
setae al
mov rbx, qword [rbp - 0x29]
cmovae rdi, rbx
lea rcx, [rbp - 0x29]
test al, al
mov rax, qword [rbp - 0x19]
je 0x1401ad5c6
lea rsi, [rbx + rax*2]
jmp 0x1401ad5ce
lea rsi, [rcx + rax*2]
lea rbx, [rbp - 0x29]
cmp rbx, rsi
je 0x1401ad5fb
sub rdi, rbx
nop dword [rax]
movzx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x1401ad5e1
mov rax, qword [r12 + 0x38]
mov qword [rbp - 0x41], rax
mov r14, qword [r12 + 0x30]
cmp r14, rax
je 0x1401ad90a
mov r15, qword [rbp + 0x7f]
mov r11, qword [r14 + 0x10]
mov rbx, r14
cmp qword [r14 + 0x18], 8
jb 0x1401ad62b
mov rbx, qword [r14]
lea rdi, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdi, qword [rbp - 0x29]
mov rax, qword [rbp - 0x19]
cmp r11, rax
ja 0x1401ad8fc
sub rax, r11
test r11, r11
je 0x1401ad6f9
inc rax
lea rsi, [rdi + rax*2]
mov rax, rdi
movzx r10d, word [rbx]
nop word [rax + rax]
mov rcx, rsi
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x1401ad6a5
cmp word [rax], r10w
je 0x1401ad6a2
cmp rcx, 1
je 0x1401ad6a5
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x1401ad687
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1401ad8fc
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x1401ad6e9
mov r9, rax
sub r9, rbx
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x1401ad7d5
add rdx, 2
sub r8, 1
jne 0x1401ad6cd
sub rax, rdi
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x1401ad8fc
mov qword [rbp + 0x77], 0xffffffffffffffff
xor eax, eax
mov qword [rbp - 0x31], rax
mov rax, qword [r15 + 0x50]
mov qword [rbp - 0x39], rax
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movabs rbx, 0x852396afe3269
cmp qword [0x140216120], rbx
je 0x1401ad7de
mov rax, qword [0x140216130]
movabs rcx, 0xc562983199256
cmp rax, rcx
je 0x1401ad7de
cmp byte [0x140217100], 0
jne 0x1401ad76d
xor rax, rcx
lea rdx, [0x1401ad140]
mov ecx, 1
call rax
mov ecx, 1
call fcn.1401fc7c8
mov rdi, rax
mov rbx, qword [r12 + 0x10]
movabs rax, 0x5823597f19bdee7
xor rbx, rax
mov rcx, rdi
movabs rax, 0x582359278457259
xor rcx, rax
mov qword [rbp - 0x49], rcx
lea rdx, [rbp - 0x49]
lea rcx, [0x1402170f0]
call fcn.140029ed0
mov qword [rax], rbx
lea r9, [rbp - 0x39]
lea r8, [rbp - 9]
mov edx, 1
lea rcx, [rbp + 0x77]
call rdi
movabs rbx, 0x852396afe3269
jmp 0x1401ad803
add rax, 2
jmp 0x1401ad669
mov rax, qword [r12 + 0x10]
movabs rcx, 0x589deacbe
xor rax, rcx
lea r9, [rbp - 0x39]
lea r8, [rbp - 9]
mov edx, 1
lea rcx, [rbp + 0x77]
call rax
mov rsi, qword [rbp + 0x77]
cmp rsi, 0xffffffffffffffff
je 0x1401ad8fc
cmp qword [0x140216120], rbx
je 0x1401ad8a8
mov rax, qword [0x140216130]
movabs rcx, 0xc562983199256
cmp rax, rcx
je 0x1401ad8a8
cmp byte [0x140217100], 0
jne 0x1401ad856
xor rax, rcx
lea rdx, [0x1401ad140]
mov ecx, 1
call rax
mov ecx, 1
call fcn.1401fc7c8
mov rdi, rax
mov rbx, qword [r12 + 0x20]
movabs rax, 0x58235932f562fb5
xor rbx, rax
mov rdx, rdi
movabs rax, 0x582359278457259
xor rdx, rax
mov qword [rbp - 0x49], rdx
lea rdx, [rbp - 0x49]
lea rcx, [0x1402170f0]
call fcn.140029ed0
mov qword [rax], rbx
xor edx, edx
mov rcx, rsi
call rdi
jmp 0x1401ad8c1
mov rax, qword [r12 + 0x20]
movabs rcx, 0x157135dec
xor rax, rcx
xor edx, edx
mov rcx, rsi
call rax
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r13 + 8]
cmp rax, qword [r13 + 0x10]
je 0x1401ad8ee
mov rdx, r14
mov rcx, rax
call fcn.1400499e0
add qword [r13 + 8], 0x20
jmp 0x1401ad8fc
mov r8, r14
mov rdx, rax
mov rcx, r13
call fcn.14007f460
add r14, 0x20
cmp r14, qword [rbp - 0x41]
jne 0x1401ad616
mov rcx, qword [rbp - 0x11]
cmp rcx, 8
jb 0x1401ad952
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401ad94d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401ad96a
call fcn.1401fc804
mov rbx, qword [rbp + 0x7f]
mov eax, dword [rbx]
test eax, eax
je 0x1401ad971
add rbx, rax
xor edi, edi
jmp 0x1401ad4f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret