Function at 0x1400013e0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
test ecx, ecx
js 0x140001d6e
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rdx - 0x100]
mov rsi, r8
test rax, 0xfffffffffffffffb
jne 0x140001d64
mov eax, dword [r8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
cmp eax, 0x10
je 0x140001434
cmp eax, 0xa1
je 0x140001434
cmp eax, 0xa0
je 0x140001434
movzx eax, byte [0x140008998]
jmp 0x14000143c
mov al, 1
mov byte [0x140008998], al
xor ebx, ebx
mov dword [rbp - 0x10], 0x23402129
mov dword [rbp - 0xc], 0x265e2524
mov word [rbp - 8], 0x282a
lea edi, [rbx + 0x30]
test al, al
je 0x1400014b6
cmp dword [rsi], edi
jne 0x1400014b6
movzx r8d, byte [rbp + rbx - 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400014af
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000152c
call fcn.140003cac
movzx eax, byte [0x140008998]
inc edi
inc rbx
cmp rbx, 0xa
jl 0x140001455
mov ecx, dword [rsi]
cmp ecx, 0xba
jne 0x140001588
lea rcx, [rbp - 0x30]
test al, al
je 0x140001533
mov r8b, 0x3a
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x3b
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xbf
jne 0x140001646
lea rcx, [rbp - 0x30]
test al, al
je 0x1400015f1
mov r8b, 0x3f
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x2f
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xc0
jne 0x140001704
lea rcx, [rbp - 0x30]
test al, al
je 0x1400016af
mov r8b, 0x7e
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x60
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xdb
jne 0x1400017c2
lea rcx, [rbp - 0x30]
test al, al
je 0x14000176d
mov r8b, 0x7b
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x5b
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xdc
jne 0x140001880
lea rcx, [rbp - 0x30]
test al, al
je 0x14000182b
mov r8b, 0x7c
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x5c
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xdd
jne 0x14000193e
lea rcx, [rbp - 0x30]
test al, al
je 0x1400018e9
mov r8b, 0x7d
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x5d
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xde
jne 0x1400019fc
lea rcx, [rbp - 0x30]
test al, al
je 0x1400019a7
mov r8b, 0x22
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x27
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xbc
jne 0x140001aba
lea rcx, [rbp - 0x30]
test al, al
je 0x140001a65
mov r8b, 0x3c
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x2c
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xbe
jne 0x140001b78
lea rcx, [rbp - 0x30]
test al, al
je 0x140001b23
mov r8b, 0x3e
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x2e
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xbd
jne 0x140001c36
lea rcx, [rbp - 0x30]
test al, al
je 0x140001be1
mov r8b, 0x5f
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x2d
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 0xbb
jne 0x140001cf4
lea rcx, [rbp - 0x30]
test al, al
je 0x140001c9f
mov r8b, 0x2b
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8b, 0x3d
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp ecx, 8
jne 0x140001d6f
lea r8, str._BACKSPACE
lea rcx, [rbp - 0x30]
call fcn.140003320
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d4f
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d4a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cac
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
cmp ecx, 0x13
jne 0x140001d94
call fcn.140003490
call fcn.140002bb0
mov rcx, qword [0x140008990]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp ecx, 0x14
je 0x140001d5a
cmp ecx, 0xd
jne 0x140001df9
lea r8, str._ENTER
lea rcx, [rbp - 0x30]
call fcn.140003320
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001d5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001def
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001def
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003cac
jmp 0x140001d5a
test al, al
jne 0x140001d5a
mov ebx, 7
mov r8d, dword [rsi]
cmp r8d, ebx
jne 0x140001e56
lea rcx, [rbp - 0x30]
call fcn.1400031e0
mov rdx, rax
call fcn.140002c60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001e56
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e51
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e65
call fcn.140003cac
inc ebx
cmp ebx, 0x80
jl 0x140001e06
jmp 0x140001d5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3