Function at 0x14000a160
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rcx
cmp byte [rcx + 0x3d], 0
jne 0x140009fb7
cmp edx, 0x10
jne 0x140009f93
mov eax, dword [rcx + 0xb0]
cmp eax, edx
jb 0x140009f93
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14000a122
nop dword [rax + rax]
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x140009e95
and qword [rsi + 0x40], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov qword [rsi + 0x40], rdi
mov ebp, dword [rsp + 0x88]
mov r14d, dword [rsi + 0xb0]
lea r15, [rsi + 0xa4]
test rbp, rbp
je 0x140009f0a
test rdi, rdi
jne 0x140009ec6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140009f03
test r15, r15
je 0x140009ee0
cmp r14, rbp
jb 0x140009ee0
mov r8, rbp
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140009f0a
mov r8, r14
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
test r15, r15
je 0x140009eb8
cmp r14, rbp
jae 0x140009f0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
nop
mov edi, dword [rsi + 0xb0]
cmp edi, dword [rsp + 0x88]
je 0x140009fb7
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsi + 0x48]
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rcx + 0x10], xmm1
mov word [rsi + 0x3c], 0x101
mov rdx, qword [rsi + 0x40]
add rdx, 0x10
lea r8d, [rdi - 0x10]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x88]
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x140009f7b
mov al, 1
jmp 0x14000a0fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x140009f74
mov byte [rsi + 0x3c], 0
mov edx, 0x31463c7
jmp 0x140009f98
mov edx, 0x31463c5
mov rax, qword [0x140083518]
lea rcx, [0x140083518]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
xor al, al
jmp 0x14000a0fc
lea r14, [rsi + 0x40]
mov rbp, qword [r14]
test rbp, rbp
je 0x14000a131
test dword [rbp + 4], 0x2000000
je 0x14000a057
mov r15d, dword [rbp + 0xc]
mov ecx, r15d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edi, edi
test rax, rax
cmovne rdi, rax
je 0x14000a141
test r15, r15
je 0x14000a01d
test rdi, rdi
jne 0x14000a00e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x14000a01d
mov r8, r15
mov rdx, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
nop
mov rcx, qword [rsi + 0x30]
mov rbp, rdi
test rcx, rcx
je 0x14000a040
xor r9d, r9d
mov r8, rdi
mov edx, dword [rsi + 0x38]
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
test eax, eax
je 0x14000a040
xor edi, edi
xor ebp, ebp
test rbp, rbp
je 0x14000a0e0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000a0e0
mov r8d, dword [rsi + 0xac]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.14000a208
mov rdi, qword [rsp + 0x80]
test rdi, rdi
je 0x14000a0e0
mov rax, qword [r14]
test rax, rax
je 0x14000a112
test dword [rax + 4], 0x1000000
je 0x14000a09d
mov edx, dword [rax]
test edx, edx
js 0x14000a0bf
mov edx, 0x8007000d
jmp 0x14000a0bf
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
mov rdx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x140015ba5.0]
xor ecx, ecx
mov edx, 0x8007000d
test al, al
cmove ecx, edx
mov edx, ecx
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x140015ba5.0]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x14000a0f3
and qword [r14], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rcx, rsi
call fcn.140009d90
nop
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
xor edx, edx
mov ecx, 0x8c2697
call fcn.140007ee0
nop
jmp 0x14000a121
nop
mov ecx, 0x31463c6
call fcn.140007f74
nop
jmp 0x14000a130
nop
xor edx, edx
mov ecx, 0x8c2697
call fcn.140007ee0
nop
jmp 0x14000a140
nop
test rdi, rdi
je 0x14000a150
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov ecx, 0x31463c9
call fcn.140007f74
nop
jmp 0x14000a15d
nop
nop
nop
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r9d
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
mov eax, r9d
test r9d, r9d
je 0x14000a1aa
sub eax, 0x6d
je 0x14000a1aa
sub eax, 0x7c
je 0x14000a1aa
cmp eax, 0x2fa
je 0x14000a1aa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rax, [rbx + 0x40]
cmp rbp, rax
jne 0x14000a1f3
mov byte [rbx + 0x34], 0
test edi, edi
jne 0x14000a1c8
lea rcx, [rbx - 8]
mov edx, esi
call fcn.140009e24
jmp 0x14000a1f3
cmp edi, 0x3e3
jne 0x14000a1db
lea rcx, [rbx - 8]
call fcn.140009d90
jmp 0x14000a1f3
cmp qword [rbx + 0x20], 0
je 0x14000a1f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret