Function at 0x140025090
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
mov rdi, rcx
mov rsi, rdx
mov rcx, r8
rep movsb byte [rdi], byte [rsi]
pop rsi
pop rdi
ret
mov rax, rcx
lea r10, [0x140000000]
cmp r8, 0xf
ja case.default.0x1400250bb
nop word [rax + rax]
mov r9d, dword [r10 + r8*4 + 0x2fd90]
add r9, r10
jmp r9
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
movzx r9d, word [rdx + 0xc]
movzx r10d, byte [rdx + 0xe]
mov qword [rax], r8
mov dword [rax + 8], ecx
mov word [rax + 0xc], r9w
mov byte [rax + 0xe], r10b
ret
mov r8, qword [rdx]
movzx ecx, word [rdx + 8]
movzx r9d, byte [rdx + 0xa]
mov qword [rax], r8
mov word [rax + 8], cx
mov byte [rax + 0xa], r9b
ret
movzx ecx, word [rdx]
mov word [rax], cx
ret
mov ecx, dword [rdx]
movzx r8d, word [rdx + 4]
movzx r9d, byte [rdx + 6]
mov dword [rax], ecx
mov word [rax + 4], r8w
mov byte [rax + 6], r9b
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
movzx r9d, word [rdx + 0xc]
mov qword [rax], r8
mov dword [rax + 8], ecx
mov word [rax + 0xc], r9w
ret
movzx ecx, word [rdx]
movzx r8d, byte [rdx + 2]
mov word [rax], cx
mov byte [rax + 2], r8b
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
movzx r9d, byte [rdx + 0xc]
mov qword [rax], r8
mov dword [rax + 8], ecx
mov byte [rax + 0xc], r9b
ret
mov r8, qword [rdx]
movzx ecx, word [rdx + 8]
mov qword [rax], r8
mov word [rax + 8], cx
ret
mov r8, qword [rdx]
movzx ecx, byte [rdx + 8]
mov qword [rax], r8
mov byte [rax + 8], cl
ret
mov r8, qword [rdx]
mov ecx, dword [rdx + 8]
mov qword [rax], r8
mov dword [rax + 8], ecx
ret
mov ecx, dword [rdx]
movzx r8d, word [rdx + 4]
mov dword [rax], ecx
mov word [rax + 4], r8w
ret
mov ecx, dword [rdx]
movzx r8d, byte [rdx + 4]
mov dword [rax], ecx
mov byte [rax + 4], r8b
ret
mov rcx, qword [rdx]
mov qword [rax], rcx
ret
movzx ecx, byte [rdx]
mov byte [rax], cl
ret
mov ecx, dword [rdx]
mov dword [rax], ecx
ret
cmp r8, 0x20
ja 0x1400251cd
movdqu xmm1, xmmword [rdx]
movdqu xmm2, xmmword [rdx + r8 - 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm2
ret
lea r9, [rdx + r8]
cmp rcx, rdx
cmovbe r9, rcx
cmp rcx, r9
jb 0x140025620
cmp dword [0x140035090], 3
jb 0x1400254d0
cmp r8, 0x2000
jbe 0x14002520d
cmp r8, 0x180000
ja 0x14002520d
test byte [0x140036870], 2
jne 0x140025080
vmovdqu ymm0, ymmword [rdx]
vmovdqu ymm5, ymmword [rdx + r8 - 0x20]
cmp r8, 0x100
jbe 0x1400252e8
mov r9, rcx
and r9, 0x1f
sub r9, 0x20
sub rcx, r9
sub rdx, r9
add r8, r9
cmp r8, 0x100
jbe 0x1400252e8
cmp r8, 0x180000
ja 0x140025390
nop word [rax + rax]
vmovdqu ymm1, ymmword [rdx]
vmovdqu ymm2, ymmword [rdx + 0x20]
vmovdqu ymm3, ymmword [rdx + 0x40]
vmovdqu ymm4, ymmword [rdx + 0x60]
vmovdqa ymmword [rcx], ymm1
vmovdqa ymmword [rcx + 0x20], ymm2
vmovdqa ymmword [rcx + 0x40], ymm3
vmovdqa ymmword [rcx + 0x60], ymm4
vmovdqu ymm1, ymmword [rdx + 0x80]
vmovdqu ymm2, ymmword [rdx + 0xa0]
vmovdqu ymm3, ymmword [rdx + 0xc0]
vmovdqu ymm4, ymmword [rdx + 0xe0]
vmovdqa ymmword [rcx + 0x80], ymm1
vmovdqa ymmword [rcx + 0xa0], ymm2
vmovdqa ymmword [rcx + 0xc0], ymm3
vmovdqa ymmword [rcx + 0xe0], ymm4
add rcx, 0x100
add rdx, 0x100
sub r8, 0x100
cmp r8, 0x100
jae 0x140025260
lea r9, [r8 + 0x1f]
and r9, 0xffffffffffffffe0
mov r11, r9
shr r11, 5
mov r11d, dword [r10 + r11*4 + 0x2fdd0]
add r11, r10
jmp r11
vmovdqu ymm1, ymmword [rdx + r9 - 0x100]
vmovdqu ymmword [rcx + r9 - 0x100], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0xe0]
vmovdqu ymmword [rcx + r9 - 0xe0], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0xc0]
vmovdqu ymmword [rcx + r9 - 0xc0], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0xa0]
vmovdqu ymmword [rcx + r9 - 0xa0], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0x80]
vmovdqu ymmword [rcx + r9 - 0x80], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0x60]
vmovdqu ymmword [rcx + r9 - 0x60], ymm1
vmovdqu ymm1, ymmword [rdx + r9 - 0x40]
vmovdqu ymmword [rcx + r9 - 0x40], ymm1
vmovdqu ymmword [rcx + r8 - 0x20], ymm5
vmovdqu ymmword [rax], ymm0
vzeroupper
ret
xor r8d, r8d
jmp 0x1400253a7
test dx, dx
je 0x1400253be
add rax, 1
movzx edx, word [rcx + rax*2]
cmp dx, 0x5c
jne 0x14002539e
movsxd r8, eax
jmp 0x1400253a3
lea rax, [rcx + r8*2 + 2]
ret
je 0x1400254c0
movsxd rax, dword [rcx + 0x3c]
mov esi, dword [rcx + rax + 0x88]
add rsi, rcx
mov eax, dword [rsi + 0x18]
mov r8d, dword [rsi + 0x20]
test eax, eax
je 0x1400254c0
movzx ebx, byte [rdx]
lea ebp, [rax - 1]
xor eax, eax
lea rdi, [rcx + r8]
lea edi, [rcx + rax]
lea edi, [rcx + rax]
mov r9d, dword [rdi + rax*4]
cmp byte [rcx + r9], bl
jne 0x140025495
test bl, bl
je 0x1400254a3
lea r11, [rcx + r9]
xor r8d, r8d
jmp 0x140025483
or dword [rbp + 0x31], eax
shr bl, 0xc
nop dword [rax]
test r10b, r10b
je 0x1400254a3
lea r9d, [r8 + 1]
movzx r10d, byte [r11 + r9]
mov r8, r9
cmp r10b, byte [rdx + r9]
add qword [rdi + 0xf], rax
mov dh, 0x14
or ecx, dword [rbp - 0x77]
enter 0x3a46, 0x14
or dh, byte [rcx + rbp*8 + 0x4c]
je 0x14002547e
lea r8, [rax + 1]
je 0x14002547e
lea r8, [rax + 1]
cmp rbp, rax
je 0x1400254c0
mov rax, r8
jmp 0x140025460
mov edx, dword [rsi + 0x24]
lea rax, [rcx + rax*2]
movzx edx, word [rax + rdx]
mov eax, dword [rsi + 0x1c]
sbb al, 0x48
lea edx, [rcx + rdx*4]
sbb al, 0x48
lea edx, [rcx + rdx*4]
mov eax, dword [rdx + rax]
add al, 2
add rax, rcx
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [0x60]
ret
mov rbx, qword [rbx]
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x140025570
test rdx, rdx
je 0x140025584
mov qword [rdx], rax
test ecx, ecx
je 0x1400255c8
mov r8, qword [rbx + 0x60]
movzx eax, word [r8]
test ax, ax
je 0x140025570
add r8, 2
xor r9d, r9d
nop
lea r11d, [rax - 0x41]
lea r10d, [rax + 0x20]
cmp r11w, 0x1a
sti
sbb al, byte [rcx + 0xf]
ret 0x8349
rol byte [rdx], 0xf
mov bh, 0xc0
add r9d, eax
add ecx, eax
sti
sbb al, byte [rcx + 0xf]
ret 0x8349
add ecx, eax
movzx eax, word [r8 - 2]
test ax, ax
jne 0x14002559e
cmp ecx, r9d
leave
jne 0x140025570
mov rax, qword [rbx + 0x30]
pop rbx
ret
sub esp, 0x38
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
sbb byte [rax - 0x7d], cl
invalid
invalid
sbb byte [rax - 0x7d], cl
rcl byte [rax], 0x48
mov eax, dword [rax]
mov rax, qword [rax]
mov rbx, qword [rax + 0x60]
test rbx, rbx
test ebx, ebx
test ebx, ebx
je 0x1400255e7
mov ecx, dword [0x140035980]
xor edx, edx
mov rsi, qword [rax + 0x30]
jo 0x14002562f
jo 0x14002562f
call fcn.14002555e
mov r8, qword [0x1400359a0]
mov rdi, rax
mov eax, dword [r8]
test eax, eax
invalid
je 0x14002566f
sal byte [rdx + rbx*2 + 0xf], 0xb7
adc eax, dword [rbp + 0xf]
mov dh, 8
movzx edx, word [rbx]
movzx r9d, byte [r8]
test dx, dx
je 0x14002578a
test byte [rbp + 1], ah
add byte [rax], al
xor eax, eax
nop dword [rax]
lea ecx, [rax + 1]
cmp word [rbx + rcx*2], 0
mov rax, rcx
jne 0x14002562e
add qword [rsi - 0x7d], rsp
cmp al, 0x4b
add byte [rax - 0x77], cl
enter 0xfffffffffffff375, 0x41
cmp cl, cl
cmp r9b, cl
je 0x14002564a
cmp byte [r8 + 1], cl
jne 0x140025782
lea rax, [rbx + 2]
xor ecx, ecx
add rax, 2
add ecx, edx
movzx edx, word [rax - 2]
test dx, dx
jne 0x140025650
cmp dword [r8 + 4], ecx
je 0x14002566f
cmp dword [r8 + 8], ecx
jne 0x140025782
mov ebx, dword [0x140035964]
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [0x140035994]
xor ecx, ecx
xor r8d, r8d
test edx, edx
je 0x1400256c7
mov r9, qword [str.VirtualProtect]
mov r9d, dword [r9 + rcx]
mov dword [rax + rcx], r9d
mov ecx, dword [0x1400359ac]
mov r9d, dword [0x140035994]
add r8d, ecx
cmp r9d, r8d
movsxd rcx, r8d
ja 0x1400256a0
mov rcx, rdi
mov rdx, rax
call fcn.14002542e
test rax, rax
mov rdi, rax
je 0x140025782
mov rbx, qword [0x140035970]
lea rbp, [rsp + 0x2c]
mov r8d, dword [0x140035994]
mov r9, rbp
mov edx, dword [0x1400359b0]
mov rcx, rbx
call rdi
mov rax, qword [0x140035954]
mov edx, 8
mov ecx, dword [0x1400359b0]
mov eax, eax
add rsi, rax
cmp ecx, 8
mov eax, 8
mov r8d, dword [rsi + 4]
jbe 0x14002574c
nop word cs:[rax + rax]
mov ecx, dword [rsi + rax]
add ecx, r8d
mov dword [rbx + rax], ecx
mov eax, dword [0x1400359ac]
mov ecx, dword [0x1400359b0]
add edx, eax
cmp ecx, edx
movsxd rax, edx
ja 0x14002572e
mov eax, dword [0x1400359a8]
mov rcx, rbx
mov r9, rbp
mov r8d, dword [rsp + 0x2c]
mov dword [rbx + 8], eax
mov edx, dword [0x1400359b0]
call rdi
mov edx, dword [0x1400359b4]
mov eax, dword [rbx + 0xc]
mov ecx, dword [0x1400359b4]
add rax, rdx
add rcx, rbx
add rbx, rax
call rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test r9b, r9b
je 0x140025796
cmp byte [r8 + 1], 0
jne 0x140025782
xor ecx, ecx
jmp 0x14002565f