Function at 0x140088b30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
mov rsi, rdx
lea rcx, [rbp - 0x30]
call fcn.1400be59c
xor r13d, r13d
cmp qword [rdi + 0x100], r13
je 0x140088b81
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rsi + 0x148]
mov rdx, rax
call fcn.14005bee0
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov ebx, 1
cmp eax, 0xe
je 0x140088bb3
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov r15d, r13d
cmp eax, 0xd
jne 0x140088bb6
mov r15d, ebx
mov dword [rsi + 0x164], ebx
mov rdx, rsi
mov dword [rsi + 0x160], ebx
mov rcx, rdi
movzx eax, word [rdi + 0xc8]
or word [rbp - 0x24], ax
mov word [rsi + 0x30], ax
mov dword [rbp - 0x28], ebx
mov dword [rbp - 0x2c], 2
call fcn.140083f08
movzx eax, word [rsi + 0x30]
lea rdx, [rbp - 0x30]
or word [rbp - 0x24], ax
mov eax, dword [rsi + 0x18]
mov ecx, eax
and eax, 0x600
and ecx, 0x800
add ecx, ecx
or ecx, eax
mov eax, dword [rbp - 0x30]
and eax, 0xffffe9ff
or ecx, eax
mov rax, qword [rdi]
mov dword [rbp - 0x30], ecx
mov rcx, rdi
mov rax, qword [rax + 0x350]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov rax, qword [rax + 0x1f8]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov rax, qword [rax + 0x200]
call qword [case.0x1400cd70e.0]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call fcn.1400bf2c0
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov rax, qword [rax + 0x248]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov dword [rbp - 0x2c], 3
mov rax, qword [rax + 0x1e0]
call qword [case.0x1400cd70e.0]
lea rax, str.MIDL_user_allocate
mov rcx, rdi
mov qword [rbp + 0x48], rax
lea rax, str.MIDL_user_free
mov qword [rbp + 0x40], rax
mov rax, qword [rdi]
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x140088ccf
lea r14, str.NdrOleAllocate
lea r12, str.NdrOleFree
jmp 0x140088cf2
lea rax, [rbp + 0x40]
mov r8d, ebx
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, rdi
call fcn.14008bef0
mov r12, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
mov rax, qword [rdi]
mov rcx, rdi
mov rbx, qword [rbp - 0x20]
mov rax, qword [rax + 0x288]
call qword [case.0x1400cd70e.0]
mov qword [rsi + 0x78], r12
mov r12d, 1
movzx ecx, ax
mov dword [rsi + 0x64], ecx
mov dword [rsi + 0x6c], r13d
mov qword [rsi + 0x70], r14
mov qword [rsi + 0x98], rbx
test dword [rdi + 0x98], 0x300
je 0x140088d65
lea rcx, [rsi + 0x300]
movzx ebx, r13w
mov rax, qword [rcx]
test rax, rax
je 0x140088d56
cmp qword [rax + 8], rdi
je 0x140088d5e
mov rax, qword [rax]
add bx, r12w
jmp 0x140088d42
mov rdx, rdi
call fcn.140027d7c
mov word [rdi + 0x12a], bx
mov rax, qword [rdi]
mov rcx, rdi
movzx r14d, word [rdi + 0xc8]
shr r14d, 1
and r14d, r12d
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0xe
jne 0x140088d8c
or r14d, 8
mov rax, qword [rdi]
mov rcx, rdi
mov rbx, qword [rsi + 0x38]
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov rcx, qword [rbx + 0xd8]
lea r9, [0x14012cf68]
and dword [rsp + 0x20], 0
lea r8, [0x14012d4f8]
xor edx, edx
mov r13, rax
mov r12, qword [rcx]
mov rcx, rax
call fcn.1400cbdc8
test rax, rax
je 0x140088dd5
mov rbx, qword [r13 + 0x40]
jmp 0x140088ddc
lea rbx, [0x1400f48cb]
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
test rax, rax
jne 0x140088e15
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], 0x18
mov rdx, rax
mov rcx, r12
mov qword [rax], rbx
mov dword [rax + 0x10], r14d
mov qword [rax + 8], r13
call fcn.1400c9ae8
xor r14d, r14d
test r15d, r15d
jne 0x140088ea5
mov rdx, rsi
mov rcx, rdi
call fcn.140083f08
test eax, eax
je 0x140088ea5
lea r8d, [r14 + 1]
mov rdx, rsi
mov rcx, rdi
call fcn.140083f64
test eax, eax
je 0x140088e67
mov rdx, rsi
mov rcx, rdi
call fcn.14008ee04
mov rax, qword [0x140134380]
cmp dword [rax + 0x7c], r14d
jne 0x140088e96
cmp dword [rax + 0x78], r14d
je 0x14008914e
mov rcx, qword [rsi + 0x318]
mov rdx, rdi
mov r8, qword [rcx + 8]
call fcn.1400b23f0
jmp 0x140089133
mov rax, qword [rdi]
mov rax, qword [rax + 0x138]
jmp 0x140089127
mov rax, qword [0x140134380]
mov qword [rsi + 0x188], rdi
cmp dword [rax + 0x7c], r14d
je 0x140088ed1
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x138]
call qword [case.0x1400cd70e.0]
jmp 0x140088ee4
mov rcx, qword [rsi + 0x318]
mov rdx, rdi
mov r8, qword [rcx + 8]
call fcn.1400b23f0
test r15d, r15d
jne 0x140089133
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x318]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x130]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x250]
call qword [case.0x1400cd70e.0]
mov rcx, rsi
call fcn.1400ac0b8
mov r12d, 0x10000
test dword [rsi + 0x18], r12d
je 0x140088f68
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x70]
call qword [case.0x1400cd70e.0]
test eax, eax
jne 0x140088f68
lea r15d, [rax + 1]
mov rcx, rsi
mov ebx, r15d
call fcn.1400ac2e8
jmp 0x140088f71
mov ebx, r14d
mov r15d, 1
mov eax, dword [rdi + 0x98]
test al, al
jns 0x140088f89
mov rcx, rsi
call fcn.1400633d0
mov eax, dword [rdi + 0x98]
test r12d, eax
je 0x140088f96
mov rcx, rsi
call fcn.14008bf70
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x100]
call qword [case.0x1400cd70e.0]
test dword [rdi + 0x98], r12d
je 0x140088fc4
lea rdx, str.NdrCorrelationPass
mov rcx, rsi
call fcn.14008c0e8
test ebx, ebx
je 0x140088ff8
xor edx, edx
mov rcx, rsi
call fcn.140066ee8
lea rdx, str.RPC_BAD_STUB_DATA_EXCEPTION_FILTER
mov rcx, rsi
call fcn.1400ac374
lea rdx, str.RPC_X_BAD_STUB_DATA
mov rcx, rsi
call fcn.1400abf78
mov rcx, rsi
call fcn.1400ac498
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x128]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x348]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x2e8]
call qword [case.0x1400cd70e.0]
mov dword [rsi + 0x160], r14d
mov rdx, rsi
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0xf0]
call qword [case.0x1400cd70e.0]
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0xf8]
call qword [case.0x1400cd70e.0]
mov rcx, rsi
call fcn.1400ac144
mov eax, dword [rdi + 0x98]
test r12d, eax
je 0x140089095
lea rdx, str.NdrCorrelationFree
mov rcx, rsi
call fcn.14008c0e8
mov eax, dword [rdi + 0x98]
mov ebx, 0x300
test ebx, eax
je 0x1400890a6
mov rcx, rsi
call fcn.1400ac0b8
mov rax, qword [rdi]
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x108]
call qword [case.0x1400cd70e.0]
mov eax, dword [rdi + 0x98]
bt eax, 0xb
jae 0x1400890d6
mov rcx, rsi
call fcn.1400655fc
mov eax, dword [rdi + 0x98]
test al, al
jns 0x1400890e8
mov rcx, rsi
call fcn.140063630
mov eax, dword [rdi + 0x98]
test ebx, eax
je 0x140089115
mov rcx, rsi
call fcn.1400ac144
mov r8d, dword [rdi + 0x98]
mov rdx, rsi
shr r8d, 9
mov rcx, rdi
and r8d, r15d
call fcn.14008a174
mov rcx, rsi
call fcn.1400ac240
mov rcx, rsi
call fcn.1400ac240
mov rax, qword [rdi]
mov rax, qword [rax + 0x308]
mov rdx, rsi
mov rcx, rdi
call qword [case.0x1400cd70e.0]
mov rbx, qword [rsp + 0xb0]
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, str.pCommand__IsNDRRun____pCommand__IsNDR64Run__
mov edx, 0x47e
lea rcx, str.com_rpcmidlcodegenprocgen.cxx
call fcn.1400c7a2c
int3