Function at 0x14005af00
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov r12, rcx
mov rcx, rdx
mov rsi, r9
mov rbp, r8
mov rdi, rdx
call fcn.140026c30
movsxd rbx, eax
test eax, eax
jne 0x14005af45
lea rdx, str.Parameter_1_invalid.
mov r9, rdi
xor r8d, r8d
mov rcx, r12
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.14004e0c0
cmp ebx, 1
je 0x14005ba9b
mov qword [rsp + 0x70], r13
cmp ebx, 2
je 0x14005b786
cmp ebx, 3
je 0x14005b2d6
jle 0x14005b2c4
cmp ebx, 5
jg 0x14005b2c4
xor edi, edi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], r15
cmp word [rsi], di
je 0x14005afab
mov rcx, rsi
xor r12b, r12b
call fcn.140024250
mulsd xmm0, qword [0x140112038]
cvttsd2si r13d, xmm0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
jmp 0x14005afb6
mov r14d, dword [rsp + 0x30]
mov r12b, 1
mov r13d, edi
mov r15, rbx
mov esi, 1
nop
mov rcx, rbp
call fcn.14008e740
mov ebx, eax
cmp r15, 4
jne 0x14005afeb
test eax, eax
je 0x14005afef
mov rcx, qword [0x14012b620]
mov rdx, rbx
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140001090
jmp 0x14005b0a0
test eax, eax
je 0x14005b013
test r12b, r12b
jne 0x14005b005
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [r14 + r13]
sub ecx, eax
cmp ecx, 5
jle 0x14005afd4
mov edx, esi
mov ecx, WSAAsyncSelect
call fcn.140001b60
jmp 0x14005afc0
mov rbp, qword [0x14012b620]
movzx eax, byte [rbp + 0x23]
test al, al
jne 0x14005b040
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1400f1614]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], sil
call fcn.1400bd4c0
jmp 0x14005b09e
lea r12, [0x1400f1614]
cmp qword [rbp + 8], r12
jne 0x14005b056
mov r14, qword [rbp + 0x10]
shr r14, 1
jmp 0x14005b059
mov r14, rsi
lea rcx, [r14 + 1]
lea r13, [rcx + rcx]
cmp al, 2
jne 0x14005b072
mov rdx, r14
mov rcx, r12
call fcn.140006d40
jmp 0x14005b09e
mov r8, qword [0x1401255a0]
cmp r13, r8
jbe 0x14005b0bf
cmp r13, qword [rbp + 0x18]
jbe 0x14005b0bf
lea r8, [0x1400f1524]
lea rdx, str.Memory_limit_reached__see_MaxMem_in_the_help_file_.
lea rcx, [0x14012c5c0]
call fcn.14004e450
mov esi, eax
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x80]
mov eax, esi
mov r13, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp rcx, 2
jae 0x14005b0d6
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 4]
call fcn.1400bdb70
jmp 0x14005b0a0
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14005b0f4
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r8, qword [0x1401255a0]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp r13, r9
jbe 0x14005b266
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14005b126
cmp al, 2
je 0x14005b166
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14005b25a
mov ebx, 0x80
cmp r13, rbx
ja 0x14005b166
cmp r13, 8
ja 0x14005b13d
mov ebx, 8
jmp 0x14005b149
mov eax, reloc.WSOCK32.dll_recv
cmp r13, rax
cmovbe rbx, rax
mov rcx, rbx
call fcn.1400b5f20
test rax, rax
jne 0x14005b15d
mov esi, edi
jmp 0x14005b0a0
mov byte [rbp + 0x20], sil
jmp 0x14005b25a
cmp r13, 0x20
jae 0x14005b176
mov ebx, SafeArrayAllocDescriptor
jmp 0x14005b220
mov ebx, 0x208
cmp r13, rbx
jb 0x14005b220
cmp r13, 0x50000
jae 0x14005b1dc
pxor xmm0, xmm0
cvtsi2sd xmm0, r13
test r13, r13
jns 0x14005b1a3
addsd xmm0, qword [0x140112018]
mulsd xmm0, qword [0x140112050]
movsd xmm1, qword [0x140112048]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14005b1d2
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14005b1d2
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14005b220
cmp r13, 0x320000
jae 0x14005b1ee
lea rbx, [r13 + 0x8000]
jmp 0x14005b220
cmp r13, 0xc80000
jae 0x14005b219
movabs rax, 0x47ae147ae147ae15
mov rbx, r13
mul r13
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, r13
jmp 0x14005b220
lea rbx, [r13 + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14005b241
test r9, r9
je 0x14005b241
mov rcx, qword [rbp + 8]
movzx r13d, sil
call fcn.1400d6e48
jmp 0x14005b244
xor r13b, r13b
test rbx, rbx
js 0x14005b290
mov rcx, rbx
call fcn.1400d6d88
test rax, rax
je 0x14005b290
mov byte [rbp + 0x20], 2
and byte [rbp + 0x21], 0x7f
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rbx
mov rcx, qword [rbp + 8]
cmp rcx, r12
je 0x14005b27b
lea r8, [r14 + r14]
mov rdx, r12
call fcn.1400d78b0
mov rax, qword [rbp + 8]
lea rcx, [r14 + r14]
mov word [rcx + rax], di
mov qword [rbp + 0x10], rcx
jmp 0x14005b0a0
test r13b, r13b
je 0x14005b2a6
lea rax, [0x14012c4b8]
mov qword [rbp + 0x18], rdi
mov qword [rbp + 8], rax
jmp 0x14005b2ad
mov rax, qword [rbp + 8]
mov word [rax], di
mov qword [rbp + 0x10], rdi
lea r8, [0x1400f1524]
lea rdx, str.Out_of_memory.
jmp 0x14005b092
xor eax, eax
mov r13, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movzx ecx, word [rsi]
call fcn.1400d97a4
movzx r11d, ax
add r11d, 0xffffffbf
cmp r11d, 0x11
ja case.0x14005b309.67
lea rdx, [0x140000000]
movsxd rax, r11d
mov ebx, 0x80
mov ecx, dword [rdx + rax*4 + 0x5bad4]
add rcx, rdx
jmp rcx
mov edi, 0x40
jmp 0x14005b330
mov edi, 0x4000
jmp 0x14005b330
mov edi, SafeArrayAllocDescriptor
jmp 0x14005b330
mov edi, 0x8000
jmp 0x14005b330
mov edi, ebx
jmp 0x14005b330
mov edi, 0x100
cmp word [rbp], 0
je 0x14005b341
mov rcx, rbp
call fcn.14008e740
jmp 0x14005b347
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
test eax, eax
je 0x14005b3a8
mov r8d, eax
xor edx, edx
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x14005b3a8
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14012b620]
xor edi, edi
test ebx, ebx
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
cmovne edi, esi
mov edx, edi
call fcn.140001090
mov r13, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, qword [0x14012b620]
movzx eax, byte [rbp + 0x23]
test al, al
je 0x14005b7fe
lea r12, [0x1400f1614]
mov esi, 1
cmp qword [rbp + 8], r12
jne 0x14005b3d6
mov r13, qword [rbp + 0x10]
shr r13, 1
jmp 0x14005b3d9
mov r13, rsi
lea rcx, [r13 + 1]
lea rdi, [rcx + rcx]
cmp al, 2
je 0x14005b84b
mov r8, qword [0x1401255a0]
cmp rdi, r8
jbe 0x14005b3ff
cmp rdi, qword [rbp + 0x18]
ja 0x14005b86f
cmp rcx, 2
jb 0x14005b896
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14005b427
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r8, qword [0x1401255a0]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp rdi, r9
jbe 0x14005ba3f
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14005b459
cmp al, 2
je 0x14005b472
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14005ba33
cmp rdi, rbx
ja 0x14005b472
cmp rdi, 8
ja 0x14005b64d
mov ebx, 8
jmp 0x14005b659
cmp rdi, 0x20
jae 0x14005b482
mov ebx, SafeArrayAllocDescriptor
jmp 0x14005b52c
mov ebx, 0x208
cmp rdi, rbx
jb 0x14005b52c
cmp rdi, 0x50000
jae 0x14005b4e8
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14005b4af
addsd xmm0, qword [0x140112018]
mulsd xmm0, qword [0x140112050]
movsd xmm1, qword [0x140112048]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14005b4de
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14005b4de
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14005b52c
cmp rdi, 0x320000
jae 0x14005b4fa
lea rbx, [rdi + 0x8000]
jmp 0x14005b52c
cmp rdi, 0xc80000
jae 0x14005b525
movabs rax, 0x47ae147ae147ae15
mov rbx, rdi
mul rdi
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, rdi
jmp 0x14005b52c
lea rbx, [rdi + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14005b54d
test r9, r9
je 0x14005b54d
mov rcx, qword [rbp + 8]
movzx edi, sil
call fcn.1400d6e48
jmp 0x14005b550
xor dil, dil
test rbx, rbx
js 0x14005b566
mov rcx, rbx
call fcn.1400d6d88
test rax, rax
jne 0x14005ba2f
test dil, dil
je 0x14005ba6d
lea rax, [0x14012c4b8]
xor edi, edi
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rdi
jmp 0x14005ba76
mov rbp, qword [0x14012b620]
movzx eax, byte [rbp + 0x23]
test al, al
je 0x14005b7fe
lea r12, [0x1400f1614]
mov esi, 1
cmp qword [rbp + 8], r12
jne 0x14005b5b3
mov r13, qword [rbp + 0x10]
shr r13, 1
jmp 0x14005b5b6
mov r13, rsi
lea rcx, [r13 + 1]
lea rdi, [rcx + rcx]
cmp al, 2
je 0x14005b84b
mov r8, qword [0x1401255a0]
cmp rdi, r8
jbe 0x14005b5dc
cmp rdi, qword [rbp + 0x18]
ja 0x14005b86f
cmp rcx, 2
jb 0x14005b896
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14005b604
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r8, qword [0x1401255a0]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp rdi, r9
jbe 0x14005ba3f
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14005b636
cmp al, 2
je 0x14005b673
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14005ba33
mov ebx, 0x80
cmp rdi, rbx
ja 0x14005b673
cmp rdi, 8
ja 0x14005b64d
mov ebx, 8
jmp 0x14005b659
mov eax, reloc.WSOCK32.dll_recv
cmp rdi, rax
cmovbe rbx, rax
mov rcx, rbx
call fcn.1400b5f20
test rax, rax
je 0x14005b92e
mov byte [rbp + 0x20], sil
jmp 0x14005ba33
cmp rdi, 0x20
jae 0x14005b683
mov ebx, SafeArrayAllocDescriptor
jmp 0x14005b72d
mov ebx, 0x208
cmp rdi, rbx
jb 0x14005b72d
cmp rdi, 0x50000
jae 0x14005b6e9
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14005b6b0
addsd xmm0, qword [0x140112018]
mulsd xmm0, qword [0x140112050]
movsd xmm1, qword [0x140112048]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14005b6df
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14005b6df
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14005b72d
cmp rdi, 0x320000
jae 0x14005b6fb
lea rbx, [rdi + 0x8000]
jmp 0x14005b72d
cmp rdi, 0xc80000
jae 0x14005b726
movabs rax, 0x47ae147ae147ae15
mov rbx, rdi
mul rdi
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, rdi
jmp 0x14005b72d
lea rbx, [rdi + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14005b74e
test r9, r9
je 0x14005b74e
mov rcx, qword [rbp + 8]
movzx edi, sil
call fcn.1400d6e48
jmp 0x14005b751
xor dil, dil
test rbx, rbx
js 0x14005b767
mov rcx, rbx
call fcn.1400d6d88
test rax, rax
jne 0x14005ba2f
test dil, dil
je 0x14005ba6d
lea rax, [0x14012c4b8]
xor edi, edi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 8], rax
jmp 0x14005ba76
mov rcx, rbp
call fcn.14008e740
mov esi, eax
test eax, eax
je 0x14005b7ef
mov r8d, eax
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14005b7ef
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14012b620]
xor edi, edi
test ebx, ebx
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
cmovne edi, esi
mov edx, edi
call fcn.140001090
mov r13, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, qword [0x14012b620]
movzx eax, byte [rbp + 0x23]
test al, al
jne 0x14005b821
mov rcx, qword [rbp + 0x10]
lea rdx, [0x1400f1614]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400bd4c0
mov esi, eax
jmp 0x14005b0ad
lea r12, [0x1400f1614]
mov esi, 1
cmp qword [rbp + 8], r12
jne 0x14005b83c
mov r13, qword [rbp + 0x10]
shr r13, 1
jmp 0x14005b83f
mov r13, rsi
lea rcx, [r13 + 1]
lea rdi, [rcx + rcx]
cmp al, 2
jne 0x14005b85d
mov rdx, r13
mov rcx, r12
call fcn.140006d40
mov esi, eax
jmp 0x14005b0ad
mov r8, qword [0x1401255a0]
cmp rdi, r8
jbe 0x14005b890
cmp rdi, qword [rbp + 0x18]
jbe 0x14005b890
lea r8, [0x1400f1524]
lea rdx, str.Memory_limit_reached__see_MaxMem_in_the_help_file_.
lea rcx, [0x14012c5c0]
call fcn.14004e450
mov esi, eax
jmp 0x14005b0ad
cmp rcx, 2
jae 0x14005b8aa
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 4]
call fcn.1400bdb70
jmp 0x14005b0ad
movzx eax, byte [rbp + 0x21]
test al, 2
je 0x14005b8c8
mov rcx, qword [rbp]
and al, 0x3d
mov byte [rbp + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r8, qword [0x1401255a0]
mov r9, qword [rbp + 0x18]
and byte [rbp + 0x21], 0x82
cmp rdi, r9
jbe 0x14005ba3f
movzx r10d, byte [rbp + 0x20]
movzx eax, r10b
cmp r10b, sil
jbe 0x14005b8fa
cmp al, 2
je 0x14005b937
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14005ba33
mov ebx, 0x80
cmp rdi, rbx
ja 0x14005b937
cmp rdi, 8
ja 0x14005b911
mov ebx, 8
jmp 0x14005b91d
mov eax, reloc.WSOCK32.dll_recv
cmp rdi, rax
cmovbe rbx, rax
mov rcx, rbx
call fcn.1400b5f20
test rax, rax
jne 0x14005b66a
xor edi, edi
mov esi, edi
jmp 0x14005b0ad
cmp rdi, 0x20
jae 0x14005b947
mov ebx, SafeArrayAllocDescriptor
jmp 0x14005b9f1
mov ebx, 0x208
cmp rdi, rbx
jb 0x14005b9f1
cmp rdi, 0x50000
jae 0x14005b9ad
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14005b974
addsd xmm0, qword [0x140112018]
mulsd xmm0, qword [0x140112050]
movsd xmm1, qword [0x140112048]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14005b9a3
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14005b9a3
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rbx, xmm0
add rbx, rcx
jmp 0x14005b9f1
cmp rdi, 0x320000
jae 0x14005b9bf
lea rbx, [rdi + 0x8000]
jmp 0x14005b9f1
cmp rdi, 0xc80000
jae 0x14005b9ea
movabs rax, 0x47ae147ae147ae15
mov rbx, rdi
mul rdi
sub rbx, rdx
shr rbx, 1
add rbx, rdx
shr rbx, 6
add rbx, rdi
jmp 0x14005b9f1
lea rbx, [rdi + 0x20000]
cmp rbx, r8
cmova rbx, r8
cmp r10b, 2
jne 0x14005ba12
test r9, r9
je 0x14005ba12
mov rcx, qword [rbp + 8]
movzx edi, sil
call fcn.1400d6e48
jmp 0x14005ba15
xor dil, dil
test rbx, rbx
js 0x14005b767
mov rcx, rbx
call fcn.1400d6d88
test rax, rax
je 0x14005b767
mov byte [rbp + 0x20], 2
mov qword [rbp + 8], rax
mov qword [rbp + 0x18], rbx
and byte [rbp + 0x21], 0x7f
mov rcx, qword [rbp + 8]
cmp rcx, r12
je 0x14005ba55
lea r8, [r13 + r13]
mov rdx, r12
call fcn.1400d78b0
mov rax, qword [rbp + 8]
lea rcx, [r13 + r13]
xor edi, edi
mov word [rcx + rax], di
mov qword [rbp + 0x10], rcx
jmp 0x14005b0ad
mov rax, qword [rbp + 8]
xor edi, edi
mov word [rax], di
lea r8, [0x1400f1524]
lea rdx, str.Out_of_memory.
lea rcx, [0x14012c5c0]
mov qword [rbp + 0x10], rdi
call fcn.14004e450
mov esi, eax
jmp 0x14005b0ad
cmp word [rbp], 0
je 0x14005baac
mov rcx, rbp
call fcn.14008e740
jmp 0x14005bab2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x14012b620]
mov edx, eax
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.140001090
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret