Function at 0x14008e7a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15d, 0x23
lea r12, vtable.expr_proc_call.0
xor esi, esi
mov r14, rcx
cmp qword [rcx + 0x100], rsi
mov rdi, rdx
lea r13d, [r15 + 0x2d]
mov ecx, r13d
je 0x14008e80f
call fcn.1400ca61c
mov rbx, rax
test rax, rax
je 0x14008e88e
mov rdx, rdi
mov rcx, r14
call fcn.1400682ec
mov ecx, dword [rbx + 0x10]
and ecx, 0xfffffffd
mov qword [rbx + 0x40], rax
or ecx, 1
mov dword [rbx + 0x10], ecx
jmp 0x14008e86d
call fcn.1400ca61c
mov rbx, rax
test rax, rax
je 0x14008e88e
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
lea r9, [0x14012cf68]
mov dword [rsp + 0x20], esi
mov rcx, rax
lea r8, [0x14012d4f8]
xor edx, edx
mov rdi, rax
call fcn.1400cbdc8
test rax, rax
je 0x14008e856
mov rcx, qword [rdi + 0x40]
jmp 0x14008e85d
lea rcx, [0x1400f48cb]
mov eax, dword [rbx + 0x10]
and eax, 0xfffffffd
mov qword [rbx + 0x40], rcx
or eax, 1
mov dword [rbx + 0x10], eax
mov word [rbx + 0x48], si
mov qword [rbx], r12
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x28], rsi
mov dword [rbx + 0x20], r15d
mov qword [rbx + 0x18], rsi
mov qword [rbx + 8], rsi
jmp 0x14008e891
mov rbx, rsi
mov r15, qword [r14 + 8]
or r12, 0xffffffffffffffff
test r15, r15
je 0x14008ea21
mov rcx, r15
mov rdi, r12
mov r15, qword [r15 + 0x10]
mov qword [rbp + 0x40], rcx
mov rax, qword [rcx + 8]
mov qword [rbp + 0x50], rax
mov rax, qword [rcx + 0x50]
mov rcx, qword [rax + 0x28]
inc rdi
cmp byte [rcx + rdi], sil
jne 0x14008e8c0
add rdi, 0xf
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x14008eb18
add dword [0x140134854], edi
lea r8, str.pParamStruct__
mov rdx, rdi
mov rcx, rax
call fcn.1400011d4
mov rax, qword [rbp + 0x40]
mov rdx, rdi
mov rcx, rsi
mov r8, qword [rax + 0x50]
mov r8, qword [r8 + 0x28]
call fcn.140001250
mov ecx, 0x40
call fcn.1400ca61c
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x14008e952
and dword [rdi + 0x10], 0xfffffffc
lea rcx, vtable.expr_variable.0
mov qword [rdi], rcx
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x38], rax
mov dword [rdi + 0x30], eax
jmp 0x14008e955
mov rdi, rax
mov rsi, qword [rbp + 0x50]
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x48]
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x14008e9da
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
and dword [rsp + 0x20], 0
lea r9, [0x14012d4d0]
mov rcx, rax
lea r8, [0x14012d4f8]
xor edx, edx
call fcn.1400cbdc8
mov rdx, rax
test rax, rax
je 0x14008e9da
mov rcx, qword [rax]
mov rax, qword [rcx + 0xe8]
mov rcx, rdx
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x14008e9da
mov ecx, 0x40
call fcn.1400ca61c
test rax, rax
je 0x14008e9d8
mov rdx, rdi
mov rcx, rax
call fcn.140001a68
mov rdi, rax
jmp 0x14008e9da
xor edi, edi
mov rcx, r13
call fcn.1400ca61c
mov rsi, rax
test rax, rax
je 0x14008ea0d
xor r9d, r9d
mov r8, rdi
mov rcx, rax
lea edx, [r9 + 0x24]
call fcn.1400017b8
and qword [rsi + 0x48], 0
lea rax, vtable.expr_param.0
mov qword [rsi], rax
jmp 0x14008ea0f
xor esi, esi
mov rdx, rsi
mov rcx, rbx
call fcn.1400c2d9c
xor esi, esi
jmp 0x14008e899
mov rdi, qword [rbp + 0x48]
test byte [rdi + 0x18], 0x40
je 0x14008ebe9
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 8
je 0x14008ebe9
lea rcx, [rbp - 0x10]
call fcn.1400aba80
mov rax, qword [rbp - 8]
lea rdx, [0x1401031b4]
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], esi
mov byte [rax], sil
call fcn.1400abaf0
mov rdx, qword [rdi + 0x58]
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
mov rcx, rdi
call fcn.1400a40cc
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
lea rdx, [0x140100968]
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
test dword [rdi + 0x18], 0x100
lea rax, str.SERVER_EPV
lea rdx, str.epv_t
cmovne rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
lea rdx, [0x1401031b8]
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
lea rdx, str._pRpcMessage__ManagerEpv
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
lea rdx, [0x1401031dc]
lea rcx, [rbp - 0x10]
call fcn.1400abaf0
mov r15, qword [rbp - 8]
mov rdi, r12
inc rdi
cmp byte [r15 + rdi], sil
jne 0x14008eaf5
inc rdi
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x14008eb3b
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], edi
inc r12
cmp byte [r15 + r12], 0
jne 0x14008eb41
lea rdx, [r12 + 1]
mov r8, r15
mov rcx, rsi
call fcn.1400011d4
mov ecx, 0x40
call fcn.1400ca61c
xor r12d, r12d
mov rdi, rax
test rax, rax
je 0x14008eb98
and dword [rdi + 0x10], 0xfffffffc
mov qword [rax + 0x18], r12
lea rax, vtable.expr_variable.0
mov qword [rdi], rax
mov qword [rdi + 0x20], rsi
mov qword [rdi + 8], r12
mov qword [rdi + 0x28], r12
mov qword [rdi + 0x38], r12
mov dword [rdi + 0x30], r12d
jmp 0x14008eb9b
mov rdi, r12
mov ecx, 0x48
call fcn.1400ca61c
mov rsi, rax
test rax, rax
je 0x14008ebd1
mov r9, rbx
mov r8, rdi
mov edx, 0x25
mov rcx, rax
call fcn.1400017b8
lea rax, vtable.expr_pointsto.0
mov rbx, rsi
mov qword [rsi], rax
xor esi, esi
jmp 0x14008ebd5
xor esi, esi
mov ebx, esi
test r15, r15
je 0x14008ebe9
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [r14 + 0xc0]
test rcx, rcx
je 0x14008edb0
test dword [r14 + 0x98], 0x8000
jne 0x14008edb0
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0x2e
jne 0x14008ed54
mov rcx, r13
call fcn.1400ca61c
mov rdi, rax
test rax, rax
je 0x14008ec76
mov qword [rax + 8], rsi
mov eax, dword [rax + 0x10]
and eax, 0xfffffffd
mov qword [rdi + 0x18], rsi
or eax, 1
mov dword [rdi + 0x20], 0x23
mov dword [rdi + 0x10], eax
lea rax, vtable.expr_proc_call.0
mov qword [rdi], rax
lea rax, str.NDRSContextValue
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x28], rsi
mov qword [rdi + 0x30], rsi
mov qword [rdi + 0x38], rsi
mov word [rdi + 0x48], si
jmp 0x14008ec79
mov rdi, rsi
mov rcx, r13
call fcn.1400ca61c
xor r15d, r15d
mov rsi, rax
test rax, rax
je 0x14008ecee
lea ecx, [r15 + 0x40]
call fcn.1400ca61c
test rax, rax
je 0x14008ecc9
and dword [rax + 0x10], 0xfffffffc
lea rcx, vtable.expr_variable.0
mov qword [rax], rcx
lea rcx, str.pParamStruct___RetVal
mov qword [rax + 0x20], rcx
mov qword [rax + 0x18], r15
mov qword [rax + 8], r15
mov qword [rax + 0x28], r15
mov qword [rax + 0x38], r15
mov dword [rax + 0x30], r15d
jmp 0x14008eccc
mov rax, r15
xor r9d, r9d
mov r8, rax
mov rcx, rsi
lea edx, [r9 + 0x24]
call fcn.1400017b8
lea rax, vtable.expr_param.0
mov qword [rsi + 0x48], r15
mov qword [rsi], rax
jmp 0x14008ecf1
mov rsi, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1400c2d9c
mov rcx, qword [r14 + 0xc0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rcx, rax
mov rdx, rdi
call fcn.1400c732c
mov ecx, 0x48
mov rsi, rax
call fcn.1400ca61c
mov rdi, rax
test rax, rax
je 0x14008ed4f
mov r8, rsi
mov r9, rbx
mov edx, 0x2a
mov rcx, rdi
call fcn.1400017b8
lea rax, vtable.expr_assign.0
mov qword [rdi], rax
jmp 0x14008edb3
mov rdi, r15
jmp 0x14008edb3
mov ecx, 0x48
call fcn.1400ca61c
mov rdi, rax
test rax, rax
je 0x14008edab
mov ecx, 0x40
call fcn.1400ca61c
test rax, rax
je 0x14008eda3
and dword [rax + 0x10], 0xfffffffc
lea rcx, vtable.expr_variable.0
mov qword [rax], rcx
lea rcx, str.pParamStruct___RetVal
mov qword [rax + 0x20], rcx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x28], rsi
mov qword [rax + 0x38], rsi
mov dword [rax + 0x30], esi
jmp 0x14008eda6
mov rax, rsi
mov r8, rax
jmp 0x14008ed33
mov rdi, rsi
jmp 0x14008edb3
mov rdi, rbx
mov rbx, qword [rbp + 0x48]
mov rcx, qword [rbx + 0x20]
call fcn.1400ca48c
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, qword [rbx + 0x20]
xor r9d, r9d
mov rcx, rdi
mov rax, qword [rax + 0xc8]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.1400ca48c