Function at 0x14006d020
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rdi, rcx
mov rsi, rdx
mov rcx, r8
rep movsb byte [rdi], byte [rsi]
pop rsi
pop rdi
ret
mov rax, rcx
lea r10, [0x140000000]
cmp r8, 0xf
ja case.default.0x14006d04b
nop word [rax + rax]
mov r9d, dword [r10 + r8*4 + 0x81650]
add r9, r10
jmp r9
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
movzx r9d, word [rdx + 0xc]
movzx r10d, byte [rdx + 0xe]
mov qword [rax], r8
mov dword [rax + 8], ecx
mov word [rax + 0xc], r9w
mov byte [rax + 0xe], r10b
ret
mov r8, qword [rdx]
movzx ecx, word [rdx + 8]
movzx r9d, byte [rdx + 0xa]
mov qword [rax], r8
mov word [rax + 8], cx
mov byte [rax + 0xa], r9b
ret
movzx ecx, word [rdx]
mov word [rax], cx
ret
mov ecx, dword [rdx]
movzx r8d, word [rdx + 4]
movzx r9d, byte [rdx + 6]
mov dword [rax], ecx
mov word [rax + 4], r8w
mov byte [rax + 6], r9b
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
movzx r9d, word [rdx + 0xc]
mov qword [rax], r8
mov dword [rax + 8], ecx
mov word [rax + 0xc], r9w
ret
movzx ecx, word [rdx]
movzx r8d, byte [rdx + 2]
mov word [rax], cx
mov byte [rax + 2], r8b
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
movzx r9d, byte [rdx + 0xc]
mov qword [rax], r8
mov dword [rax + 8], ecx
mov byte [rax + 0xc], r9b
ret
mov r8, qword [rdx]
movzx ecx, word [rdx + 8]
mov qword [rax], r8
mov word [rax + 8], cx
ret
mov r8, qword [rdx]
movzx ecx, byte [rdx + 8]
mov qword [rax], r8
mov byte [rax + 8], cl
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
mov qword [rax], r8
mov dword [rax + 8], ecx
ret
mov ecx, dword [rdx]
movzx r8d, word [rdx + 4]
mov dword [rax], ecx
mov word [rax + 4], r8w
ret
mov ecx, dword [rdx]
movzx r8d, byte [rdx + 4]
mov dword [rax], ecx
mov byte [rax + 4], r8b
ret
mov rcx, qword [rdx]
mov qword [rax], rcx
ret
movzx ecx, byte [rdx]
mov byte [rax], cl
ret
mov ecx, dword [rdx]
mov dword [rax], ecx
ret
cmp r8, 0x20
ja 0x14006d15d
movdqu xmm1, xmmword [rdx]
movdqu xmm2, xmmword [rdx + r8 - 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm2
ret
lea r9, [rdx + r8]
cmp rcx, rdx
cmovbe r9, rcx
cmp rcx, r9
jb 0x14006d5b0
cmp dword [0x14008d010], 3
jb 0x14006d460
cmp r8, 0x2000
jbe 0x14006d19d
cmp r8, 0x180000
ja 0x14006d19d
test byte [0x140091680], 2
jne 0x14006d010
vmovdqu ymm0, ymmword [rdx]
vmovdqu ymm5, ymmword [rdx + r8 - 0x20]
cmp r8, 0x100
jbe 0x14006d278
mov r9, rcx
and r9, 0x1f
sub r9, 0x20
sub rcx, r9
sub rdx, r9
add r8, r9
cmp r8, 0x100
jbe 0x14006d278
cmp r8, 0x180000
ja 0x14006d320
nop word [rax + rax]
vmovdqu ymm1, ymmword [rdx]
vmovdqu ymm2, ymmword [rdx + 0x20]
vmovdqu ymm3, ymmword [rdx + 0x40]
vmovdqu ymm4, ymmword [rdx + 0x60]
vmovdqa ymmword [rcx], ymm1
vmovdqa ymmword [rcx + 0x20], ymm2
vmovdqa ymmword [rcx + 0x40], ymm3
vmovdqa ymmword [rcx + 0x60], ymm4
vmovdqu ymm1, ymmword [rdx + 0x80]
vmovdqu ymm2, ymmword [rdx + 0xa0]
vmovdqu ymm3, ymmword [rdx + 0xc0]
vmovdqu ymm4, ymmword [rdx + 0xe0]
vmovdqa ymmword [rcx + 0x80], ymm1
vmovdqa ymmword [rcx + 0xa0], ymm2
vmovdqa ymmword [rcx + 0xc0], ymm3
vmovdqa ymmword [rcx + 0xe0], ymm4
add rcx, 0x100
add rdx, 0x100
sub r8, 0x100
cmp r8, 0x100
jae 0x14006d1f0
lea r9, [r8 + 0x1f]
and r9, 0xffffffffffffffe0
mov r11, r9
shr r11, 5
mov r11d, dword [r10 + r11*4 + 0x81690]
add r11, r10
jmp r11
vmovdqu ymm1, ymmword [rdx + r9 - 0x100]
vmovdqu ymmword [rcx + r9 - 0x100], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0xe0]
vmovdqu ymmword [rcx + r9 - 0xe0], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0xc0]
vmovdqu ymmword [rcx + r9 - 0xc0], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0xa0]
vmovdqu ymmword [rcx + r9 - 0xa0], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0x80]
vmovdqu ymmword [rcx + r9 - 0x80], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0x60]
vmovdqu ymmword [rcx + r9 - 0x60], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0x40]
vmovdqu ymmword [rcx + r9 - 0x40], ymm1
vmovdqu ymmword [rcx + r8 - 0x20], ymm5
vmovdqu ymmword [rax], ymm0
vzeroupper
ret
leave
xor ecx, ecx
mov edx, ecx
mov eax, ecx
mov r8, r9
cmp word [r8], 0x5c
cmove eax, edx
cmp word [r8], cx
je 0x14006d340
inc edx
add r8, 2
jmp 0x14006d32a
inc eax
movsxd rcx, eax
lea rax, [r9 + rcx*2]
ret
invalid
je 0x14006d3e3
inc ecx
cmp word [rax + rcx*2], bp
jne 0x14006d3db
cmp cl, byte [rbx]
je 0x14006d3f5
cmp cl, byte [rbx + 1]
je 0x14006d3f5
xor ecx, ecx
leave
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rax
call fcn.14006d34a
cmp eax, dword [rbx + 4]
je 0x14006d410
invalid
invalid
cmp eax, dword [rbx + 8]
je 0x14006d410
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, dword [0x14008ebf8]
mov dword [rsp + 0x30], ebp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add byte [rcx - 0xcfdb94], cl
adc eax, 0x1da8
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8, rbp
mov rcx, qword [str.VirtualProtect]
mov edx, dword [rcx + r8]
mov dword [r8 + rax], edx
add byte [rcx - 0x7d], cl
rol byte [rcx + rcx*2], 0x83
clc
invalid
jl case.0x14006d292.11
add byte [rcx - 0x7d], cl
rol byte [rcx + rcx*2], 0x83
clc
and byte [rdi + riz*8 + 0x48], bh
mov edx, eax
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x14006d4ea
add byte [rax], al
mov rbx, qword [0x14008ec10]
lea r9, [rsp + 0x30]
mov r8d, dword [0x14008ebfc]
mov ebp, 0x6000
mov edx, ebp
mov rcx, rbx
call rdi
mov r9, qword [0x14008ec3c]
lea r8, [rbx + 8]
mov r9d, r9d
mov r10d, 0x17fe
add r9, rsi
mov r11d, dword [r9 + 4]
sub r9, rbx
mov ecx, dword [r9 + r8]
add ecx, r11d
mov dword [r8], ecx
lea r8, [r8 + 4]
sub r10, 1
jne 0x14006d49f
mov eax, dword [0x14008ec30]
lea r9, [rsp + 0x30]
mov dword [rbx + 8], eax
mov rdx, rbp
mov r8d, dword [rsp + 0x30]
mov rcx, rbx
call rdi
mov eax, dword [0x14008ebe8]
mov r8d, dword [rbx + 0xc]
mov ecx, dword [0x14008ebe8]
add r8, rax
add r8, rbx
add rcx, rbx
call r8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqu xmm1, xmmword [rdx + r9 - 0x80]
movdqu xmmword [rcx + r9 - 0x80], xmm1
movdqu xmm1, xmmword [rdx + r9 - 0x70]
movdqu xmmword [rcx + r9 - 0x70], xmm1
movdqu xmm1, xmmword [rdx + r9 - 0x60]
movdqu xmmword [rcx + r9 - 0x60], xmm1
movdqu xmm1, xmmword [rdx + r9 - 0x50]
movdqu xmmword [rcx + r9 - 0x50], xmm1
movdqu xmm1, xmmword [rdx + r9 - 0x40]
movdqu xmmword [rcx + r9 - 0x40], xmm1
movdqu xmm1, xmmword [rdx + r9 - 0x30]
movdqu xmmword [rcx + r9 - 0x30], xmm1
movdqu xmm1, xmmword [rdx + r9 - 0x20]
movdqu xmmword [rcx + r9 - 0x20], xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm5
movdqu xmmword [rax], xmm0
ret
movups xmm2, xmmword [rdx]
sub rdx, rcx
add rcx, r8
movups xmm0, xmmword [rcx + rdx - 0x10]
sub rcx, 0x10
sub r8, 0x10
test cl, 0xf
je 0x14006d5e3
mov r9, rcx
and rcx, 0xfffffffffffffff0
movups xmm1, xmm0
movups xmm0, xmmword [rcx + rdx]
movups xmmword [r9], xmm1
mov r8, rcx
sub r8, rax
mov r9, r8
shr r9, 7
je 0x14006d65d
movaps xmmword [rcx], xmm0
jmp 0x14006d607
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm1
movups xmm0, xmmword [rcx + rdx - 0x10]
movups xmm1, xmmword [rcx + rdx - 0x20]
sub rcx, 0x80
movaps xmmword [rcx + 0x70], xmm0
movaps xmmword [rcx + 0x60], xmm1
movups xmm0, xmmword [rcx + rdx + 0x50]
movups xmm1, xmmword [rcx + rdx + 0x40]
dec r9
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm1
movups xmm0, xmmword [rcx + rdx + 0x30]
movups xmm1, xmmword [rcx + rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm1
movups xmm0, xmmword [rcx + rdx + 0x10]
movups xmm1, xmmword [rcx + rdx]
jne 0x14006d600
movaps xmmword [rcx + 0x10], xmm0
and r8, 0x7f
movaps xmm0, xmm1
mov r9, r8
shr r9, 4
je 0x14006d680
nop word [rax + rax]
movups xmmword [rcx], xmm0
sub rcx, 0x10
movups xmm0, xmmword [rcx + rdx]
dec r9
jne 0x14006d670
and r8, 0xf
je 0x14006d689
movups xmmword [rax], xmm2
movups xmmword [rcx], xmm0
ret