Function at 0x140015420
Capabilities:
Terminate process

Disassembly:
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1402930e8]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, Ordinal_50
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140015681
movabs rax, 0xfe38983aeee19f3e
movabs rcx, 0xfe579848ee939f7b
mov qword [rbp], rax
movabs rdx, 0x1178f9c52b02ec48
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x1178f9c52b02ec3a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rdx
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0xa8], rax
movabs rax, 0xfe22982beef69f28
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x1101f9b12b6bec3a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xa280b3579cfcd1cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xdfded78fa485ae5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x87dee56c0072e490
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xbb72132c6e926da9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x7aa1a6466e2ff045
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x663f067fd22b4e05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xa2efb33e9c8ad1ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xdfb7d7fba4e4ae32
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x87bae54c001ce4ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xbb1113496ee66dcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x7a81a6226e4af031
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x663f067fd21a4e26
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x20]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [rbp + 0x78]
lea r9, [rbp + 0x90]
mov rcx, qword [rbp + 0x60]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400158be
movabs rax, 0xfe38983aeee19f3e
movabs rcx, 0xfe579848ee939f7b
mov qword [rbp], rax
movabs rdx, 0x1178f9c52b02ec48
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x1178f9c52b02ec3a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rdx
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0xa8], rax
movabs rax, 0xfe22982beef69f28
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x1101f9b12b6bec3a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xa280b3579cfcd1cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xdfded78fa485ae5e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x87dee56c0072e490
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xbb72132c6e926da9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x7aa1a6466e2ff045
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x663f067fd22b4e05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xa2efb33e9c8ad1ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xdfb7d7fba4e4ae32
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x87bae54c001ce4ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xbb1113496ee66dcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x7a81a6226e4af031
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x663f067fd21a4e26
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x20]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor al, al
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140106b10
add rsp, 0x150
pop rbp
ret