Function at 0x140020720
Capabilities:
Terminate process

Disassembly:
rcl r13b, 1
or ecx, ebp
sbb eax, 0xd0a83ea
stc
stosq qword [rdi], rax
imul dword [rdi + rsi*2 - 0x24e276a1]
and dword [rax + rsi*8], 1
insd dword [rdi], dx
cmp word es:[rax - 0x3ff31391], dx
or eax, 0xf7ab48f9
lodsb al, byte [rsi]
ja 0x140015960
mov dword [0x13025dce2], ebx
add dword [rbp + 0x66], ebp
cmp dword es:[rax - 0x3ff31391], edx
nop
mov ebx, esp
sbb qword [r9 + 0x58], 0xc8f59c4
mov esi, 0x3bb31416
test al, 0x5b
jg 0x1400158f9
je 0x14001599c
or edi, edi
jmp 0x13742f750
stosb byte [rdi], al
pop rsp
cmp al, byte [rcx - 0x55261bcf]
adc eax, dword [rax + 0x7c]
fistp word [rax]
xchg byte [rax + 0x23], ch
invalid
sub al, 0x36
mov dword [rsi], eax
or byte [rax - 0x73f6f3ba], bl
jae 0x1400159b8
imul eax, dword [rsi + 4], 0xd95eba90
mov edx, 0xb74c6552
invalid
pop rbp
push 0x2a1094a4
frstor dword [rax - 0x44]
invalid
cld
pop r11
jmp 0x14002072d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002073d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140020725
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140020755
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140020742
sub eax, 3
jb 0x14002076f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400207a6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140020796
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140020794
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140020783
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400206e2
jmp 0x14002072d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x14e00
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400207f2
cmp rsi, rcx
jae 0x1400207fa
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400207d9
cmp al, 0x8f
ja 0x1400207d9
cmp byte [rsi - 2], 0xf
je 0x1400207df
sub al, 0xe8
cmp al, 1
ja 0x1400207c3
cmp rsi, rcx
jae 0x1400207fa
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400207c9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400207fa
lodsb al, byte [rsi]
jmp 0x1400207d9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1e000]
mov eax, dword [rdi]
or eax, eax
je 0x140020857
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x207b0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140020807
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140020851
mov qword [rbx], rax
add rbx, 8
jmp 0x140020827
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400208af
sub rsp, 0xffffffffffffff80
jmp 0x1400158f0