Function at 0x14ba0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x18a8
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x0001a100]
xor rax, rsp
mov qword [rsp + 0x1890], rax
mov qword [rsp + 0x1458], 0
mov qword [rsp + 0x1450], 0
mov qword [rsp + 0x1860], 0
mov qword [rsp + 0x1030], 0
xor eax, eax
mov word [rsp + 0x30], ax
lea rdi, [rsp + 0x32]
xor eax, eax
mov ecx, 0xffe
rep stosb byte [rdi], al
mov qword [rsp + 0x1868], 0
mov dword [rsp + 0x1448], 0
xor eax, eax
mov word [rsp + 0x1040], ax
lea rdi, [rsp + 0x1042]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x1460], ax
lea rdi, [rsp + 0x1462]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
cmp qword [rsp + 0x18c0], 0
jne 0x14c68
jmp 0x150b1
lea rdx, [0x000173e0]
lea rcx, str.http:__ai.taobao.com_pidmm_34440408_12080698_70620668
call qword [sym.imp.ntoskrnl.exe__wcsicmp]
test eax, eax
jne 0x14c85
jmp 0x150b1
mov rax, qword [rsp + 0x18c0]
add rax, 0x20
mov qword [rsp + 0x1458], rax
mov rax, qword [rsp + 0x1458]
mov rax, qword [rax]
mov qword [rsp + 0x1450], rax
mov rax, qword [rsp + 0x1450]
add rax, 0x70
mov qword [rsp + 0x1860], rax
mov rax, qword [rsp + 0x1450]
add rax, 0x60
mov qword [rsp + 0x1030], rax
mov rax, qword [rsp + 0x1860]
mov qword [rsp + 0x1868], rax
mov rax, qword [rsp + 0x1868]
movzx r9d, word [rax + 2]
mov rax, qword [rsp + 0x1868]
movzx r8d, word [rax]
mov rdx, qword [rsp + 0x1868]
mov rdx, qword [rdx + 8]
lea rcx, [0x00018160]
call fcn.00013920
cmp qword [rsp + 0x1868], 0
jne 0x14d25
jmp 0x150b1
mov rax, qword [rsp + 0x1868]
movzx eax, word [rax]
cmp eax, 0x800
jle 0x14d3c
jmp 0x150b1
mov rax, qword [rsp + 0x1868]
movzx ecx, word [rax]
lea rdi, [rsp + 0x30]
mov rsi, qword [rsp + 0x1868]
mov rsi, qword [rsi + 8]
rep movsb byte [rdi], byte [rsi]
lea rdx, [0x000180a0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14d86
mov dword [rsp + 0x1448], 1
jmp 0x14e4d
lea rdx, [0x000180b0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14db2
mov dword [rsp + 0x1448], 1
jmp 0x14e4d
lea rdx, [0x000180c0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14dd8
mov dword [rsp + 0x1448], 1
jmp 0x14e4d
lea rdx, [0x000180d0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14dfe
mov dword [rsp + 0x1448], 2
jmp 0x14e4d
lea rdx, [0x000180e0]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14e24
mov dword [rsp + 0x1448], 3
jmp 0x14e4d
lea rdx, [0x00018100]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_wcsstr]
test rax, rax
je 0x14e48
mov dword [rsp + 0x1448], 4
jmp 0x14e4d
jmp 0x150b1
mov rax, qword [rsp + 0x1030]
mov qword [rsp + 0x1440], rax
lea rdi, [rsp + 0x1040]
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x00018120]
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x1440]
movzx r8d, word [rax]
mov rdx, qword [rsp + 0x1440]
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x1460]
call qword [sym.imp.ntoskrnl.exe_wcsncpy]
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, [rsp + 0x1460]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14edc
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rsi, [0x00018120]
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
cmp dword [rsp + 0x1448], 1
jne 0x14f54
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__ai.taobao.com_pidmm_34440408_12080698_70620668
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14f3e
jmp 0x1500c
cmp dword [rsp + 0x1448], 2
jne 0x14f92
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__www.woniulock.com_tuguan.php_namejd
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14f7f
jmp 0x1500c
cmp dword [rsp + 0x1448], 3
jne 0x14fd0
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__www.woniulock.com_tuguan.php_namegm
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14fbd
jmp 0x1500c
cmp dword [rsp + 0x1448], 4
jne 0x1500c
lea rdi, [rsp + 0x1040]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
sub rdi, 2
lea rdx, str.http:__www.woniulock.com_tuguan.php_namesn
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, 2
test ax, ax
jne 0x14ffb
lea rax, [rsp + 0x1040]
mov qword [rsp + 0x1870], rax
mov rax, qword [rsp + 0x1868]
mov rax, qword [rax + 8]
mov qword [rsp + 0x1878], rax
mov rax, qword [rsp + 0x1878]
mov qword [rsp + 0x1880], rax
mov rax, qword [rsp + 0x1870]
movzx eax, word [rax]
mov word [rsp + 0x1888], ax
mov rcx, qword [rsp + 0x1878]
movzx eax, word [rsp + 0x1888]
mov word [rcx], ax
mov rax, qword [rsp + 0x1870]
add rax, 2
mov qword [rsp + 0x1870], rax
mov rax, qword [rsp + 0x1878]
add rax, 2
mov qword [rsp + 0x1878], rax
cmp word [rsp + 0x1888], 0
jne 0x15040
mov rdx, qword [rsp + 0x1868]
mov rdx, qword [rdx + 8]
lea rcx, [0x000181a0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x1890]
xor rcx, rsp
call fcn.00017030
add rsp, 0x18a8
pop rdi
pop rsi
ret