Function at 0x1400011dc
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x290
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rbx, rdx
mov edi, ecx
or r15, 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea r13d, [r15 + 2]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
mov ecx, r13d
call fcn.1400036e8
mov rcx, rax
call fcn.140002944
lea esi, [r15 + 3]
mov ecx, esi
call fcn.1400036e8
mov rcx, rax
call fcn.140002944
cmp edi, r13d
jne 0x14000126f
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3
add rbx, 8
xor r12d, r12d
sub edi, r13d
mov ecx, r12d
mov dword [0x140006020], ecx
mov r8, qword [rbx]
test r8, r8
je 0x140001829
mov r9, r8
lea r14d, [r12 + 0x41]
mov r11d, 0x1000
movzx edx, word [r9]
mov r10d, 0xfffd
lea eax, [rdx - 0x2d]
test r10w, ax
je 0x1400012ef
test dx, dx
je 0x1400012d2
mov eax, 0x30
sub dx, ax
cmp dx, 9
ja 0x14000146e
add r9, rsi
movzx edx, word [r9]
test dx, dx
jne 0x1400012b9
mov rcx, r8
call qword [sym.imp.msvcrt.dll__wtoi]
mov ecx, dword [0x140006020]
mov r11d, 0x1000
mov r15d, eax
jmp 0x140001427
lea rdx, [r9 + 2]
mov r10d, r12d
cmp word [rdx], r12w
je 0x14000181b
movzx r8d, word [rdx]
mov r9, rdx
add rdx, rsi
test r8w, r8w
je 0x140001427
movzx ecx, r8w
sub ecx, r14d
je 0x140001393
sub ecx, 0xd
je 0x14000138c
sub ecx, 4
je 0x14000136d
sub ecx, r13d
je 0x140001366
sub ecx, 0xe
je 0x140001393
sub ecx, esi
je 0x140001356
sub ecx, 0xb
je 0x14000138c
sub ecx, 4
je 0x14000134f
cmp ecx, r13d
jne 0x14000147c
mov ecx, 0x10
jmp 0x14000135b
mov ecx, 4
jmp 0x14000135b
mov ecx, 8
mov dword [0x140006020], ecx
jmp 0x14000141e
mov ecx, 0x40
jmp 0x14000135b
cmp word [rdx], 0x52
mov ecx, 0x800
cmovne ecx, r11d
cmovne rdx, r9
mov dword [0x140006020], ecx
add rdx, rsi
jmp 0x14000141e
mov ecx, 0x200
jmp 0x14000135b
cmp r8w, r14w
mov word [rbp + 0x110], r12w
mov ecx, r13d
cmove ecx, esi
mov dword [0x140006020], ecx
sub edi, r13d
je 0x140001498
add rbx, 8
mov rdx, qword [rbx]
test rdx, rdx
je 0x14000148a
cmp word [rdx], r12w
je 0x14000148a
lea rax, [rbp + 0x110]
mov r10, rdx
sub r10, rax
lea r8, [rbp + 0x110]
mov r9d, 0x32
lea rax, [r9 + 0x7fffffcc]
test rax, rax
je 0x14000140a
movzx eax, word [r10 + r8]
test ax, ax
je 0x14000140a
mov word [r8], ax
add r8, rsi
sub r9, r13
jne 0x1400013e8
test r9, r9
lea rax, [r8 - 2]
cmovne rax, r8
mov word [rax], r12w
je 0x14000148a
mov r10d, r13d
test r10d, r10d
je 0x140001300
add rbx, 8
sub edi, r13d
mov r8, qword [rbx]
mov r9, r8
test r8, r8
jne 0x14000129c
test ecx, ecx
je 0x140001829
call fcn.140002410
mov ebx, eax
test eax, eax
jns 0x1400014a6
mov ecx, esi
call fcn.1400036e8
mov rcx, rax
mov edx, 0x2710
call fcn.140002d34
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3
mov eax, dword [0x1400065f0]
test eax, eax
jne 0x1400014ce
mov ecx, esi
call fcn.1400036e8
mov rcx, rax
mov edx, 0x2713
call fcn.140002d34
mov ecx, r13d
call qword [sym.imp.msvcrt.dll_exit]
int3
mov r14d, r12d
test eax, eax
je 0x1400017cc
mov eax, r14d
imul rsi, rax, 0x516
lea rax, [0x140007100]
add rsi, rax
cmp word [rsi], r12w
jne 0x1400014fc
or rdi, 0xffffffffffffffff
jmp 0x140001587
mov rdx, rsi
lea rcx, [rbp - 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x50], r12d
lea r9, [rbp - 0x40]
mov qword [rsp + 0x48], r12
lea r8, [rbp - 0x70]
mov dword [rsp + 0x40], r12d
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x38], 3
mov eax, 0x30
mov dword [rbp - 0x70], eax
xorps xmm0, xmm0
lea rax, [rbp - 0x80]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov edx, 0x2000000
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x20], r12
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x58], 0x40
movdqu xmmword [rbp - 0x50], xmm0
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov rdi, qword [rsp + 0x68]
test eax, eax
mov rax, 0xffffffffffffffff
cmovs rdi, rax
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x28], r12d
lea rdx, [rbp - 0x30]
mov r9d, 0x2100a6
mov qword [rsp + 0x20], r12
mov r8d, 0x104
mov rcx, rdi
call fcn.140002730
test eax, eax
mov ecx, r12d
cmove ecx, dword [rbp - 0x30]
mov dword [0x140006bc8], ecx
call qword [sym.imp.WS2_32.dll_ntohl]
test dword [0x140006020], 0x1804
mov dword [rsp + 0x64], eax
jne 0x14000161f
mov rcx, rsi
call fcn.140001088
mov rdx, rax
lea rcx, str._n_s:_n
call fcn.140001144
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x64]
call qword [sym.imp.ntdll.dll_RtlIpv4AddressToStringW]
test rax, rax
je 0x14000161f
mov ecx, r13d
call fcn.1400036e8
mov rcx, rax
lea r9, [0x140006be0]
lea r8, [rbp + 0xe0]
mov edx, 0x2716
call fcn.140002d34
mov r8d, dword [0x140006020]
test r8d, r8d
jle 0x14000179a
cmp r8d, 2
jle 0x140001747
cmp r8d, 4
je 0x14000173d
cmp r8d, 8
je 0x140001733
cmp r8d, 0x10
je 0x140001729
cmp r8d, 0x40
je 0x140001729
cmp r8d, 0x200
je 0x140001733
cmp r8d, 0x800
je 0x1400016c9
cmp r8d, 0x1000
jne 0x14000179a
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x60]
mov r9d, 0x218078
mov qword [rsp + 0x20], r12
mov r8d, r13d
mov rcx, rdi
call fcn.140002730
mov ecx, r13d
mov ebx, eax
call fcn.1400036e8
mov ecx, ebx
neg ecx
sbb edx, edx
neg edx
add edx, 0x2726
mov rcx, rax
call fcn.140002d34
jmp 0x1400017a3
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x61]
mov r9d, 0x2180cc
mov qword [rsp + 0x20], r12
mov r8d, r13d
mov rcx, rdi
call fcn.140002730
mov ebx, eax
mov ecx, r13d
test eax, eax
jne 0x1400016fe
call fcn.1400036e8
mov edx, 0x274d
jmp 0x1400016bc
call fcn.1400036e8
cmp ebx, 0xc00000b5
jne 0x140001715
mov ebx, r12d
mov edx, 0x274e
jmp 0x1400016bc
mov edx, 0x2752
cmp ebx, 0xc0000022
je 0x1400016bc
mov edx, 0x274f
jmp 0x1400016bc
mov rcx, rdi
call fcn.140001f94
jmp 0x140001796
mov rcx, rdi
call fcn.140001a00
jmp 0x140001796
mov rcx, rdi
call fcn.14000222c
jmp 0x140001796
cmp word [rbp + 0x110], r12w
je 0x14000179a
xor eax, eax
cmp dword [0x140006bc8], r12d
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
jne 0x140001782
mov ecx, r13d
call fcn.1400036e8
mov rcx, rax
mov edx, 0x2746
call fcn.140002d34
mov ebx, 0xc00000be
jmp 0x1400017a3
lea r9, [rsp + 0x70]
mov rcx, rdi
lea rdx, [rbp + 0x110]
call fcn.140001c34
mov ebx, eax
jmp 0x1400017a3
call fcn.1400018a4
or r15, 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
test dword [0x140006020], 0x1804
je 0x1400017bc
test ebx, ebx
jns 0x1400017cc
add r14d, r13d
cmp r14d, dword [0x1400065f0]
jb 0x1400014d9
test r15d, r15d
jle 0x1400017e9
imul ecx, r15d, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x1400065f0]
jmp 0x1400014ce
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400031e0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.1400018a4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
int3