Function at 0x1400892b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [0x140134380]
xor ebx, ebx
mov rbp, rcx
mov r8, qword [rax + 0x160]
mov rax, qword [r8 + 8]
mov r15, qword [rax + 8]
cmp qword [rcx + 0x100], rbx
je 0x1400892fb
call fcn.1400682ec
mov rdi, rax
jmp 0x14008940e
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
lea r9, [0x14012cf68]
mov dword [rsp + 0x20], ebx
mov rcx, rax
lea r8, [0x14012d4f8]
xor edx, edx
mov rdi, rax
call fcn.1400cbdc8
test r15, r15
je 0x1400893fc
lea rsi, [0x1400f48cb]
test rax, rax
je 0x140089342
mov rdx, qword [rdi + 0x40]
jmp 0x140089345
mov rdx, rsi
or rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp byte [rdx + rcx], bl
jne 0x14008934c
inc rax
cmp byte [r15 + rax], bl
jne 0x140089354
lea r14, [rax + 1]
add r14, rcx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14008939e
mov ebx, 0x7d5
xor edx, edx
mov r8d, ebx
xor r9d, r9d
xor ecx, ecx
call fcn.1400c9744
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
add dword [0x140134854], r14d
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.1400011d4
mov rax, qword [rbp]
mov rcx, rbp
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
lea r9, [0x14012cf68]
mov dword [rsp + 0x20], ebx
mov rcx, rax
lea r8, [0x14012d4f8]
xor edx, edx
mov r15, rax
call fcn.1400cbdc8
test rax, rax
je 0x1400893ec
mov rsi, qword [r15 + 0x40]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.140001250
jmp 0x14008940e
test rax, rax
je 0x140089407
mov rdi, qword [rdi + 0x40]
jmp 0x14008940e
lea rdi, [0x1400f48cb]
mov ecx, 0x50
call fcn.1400ca61c
lea rcx, vtable.expr_proc_call.0
mov r14, rax
test rax, rax
je 0x14008945e
mov qword [rax + 8], rbx
mov eax, dword [rax + 0x10]
and eax, 0xfffffffd
mov qword [r14 + 0x18], rbx
or eax, 1
mov dword [r14 + 0x20], 0x23
mov dword [r14 + 0x10], eax
mov qword [r14 + 0x28], rbx
mov qword [r14 + 0x30], rbx
mov qword [r14 + 0x38], rbx
mov qword [r14], rcx
mov qword [r14 + 0x40], rdi
mov word [r14 + 0x48], bx
jmp 0x140089461
mov r14, rbx
mov r13, qword [rbp + 8]
mov r15d, 0x40
lea rbp, vtable.expr_variable.0
test r13, r13
je 0x1400896dc
mov r12, r13
mov r13, qword [r13 + 0x10]
test dword [r12 + 0x98], 0x400
jne 0x140089472
mov rdi, qword [r12 + 0xa0]
test rdi, rdi
je 0x140089472
mov rsi, qword [r12 + 8]
mov rcx, rsi
mov rax, qword [rsi]
mov rax, qword [rax + 0x40]
call qword [case.0x1400cd70e.0]
test eax, eax
jne 0x1400894e0
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0x2d
jne 0x140089500
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x1400cd70e.0]
test eax, eax
je 0x140089500
mov rcx, r15
call fcn.1400ca61c
test rax, rax
je 0x1400894fd
mov rdx, rdi
mov rcx, rax
call fcn.140001a68
mov rdi, rax
jmp 0x140089500
mov rdi, rbx
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0x2e
je 0x140089548
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0x11
jne 0x140089695
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
cmp eax, 0x2e
jne 0x140089695
mov r15d, 0x50
mov ecx, r15d
call fcn.1400ca61c
mov rdi, rax
test rax, rax
je 0x1400895a0
mov qword [rax + 8], rbx
mov eax, dword [rax + 0x10]
and eax, 0xfffffffd
mov qword [rdi + 0x18], rbx
or eax, 1
mov dword [rdi + 0x20], 0x23
mov dword [rdi + 0x10], eax
lea rax, vtable.expr_proc_call.0
mov qword [rdi], rax
lea rax, str.NDRSContextValue
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
mov word [rdi + 0x48], bx
jmp 0x1400895a3
mov rdi, rbx
mov rcx, r15
call fcn.1400ca61c
mov r15, rax
test rax, rax
je 0x140089612
mov ecx, 0x40
call fcn.1400ca61c
mov r8, rax
test rax, rax
je 0x1400895f0
mov rax, qword [r12 + 0x50]
mov rcx, qword [rax + 0x28]
and dword [r8 + 0x10], 0xfffffffc
mov qword [r8 + 0x20], rcx
mov qword [r8 + 0x18], rbx
mov qword [r8], rbp
mov qword [r8 + 8], rbx
mov qword [r8 + 0x28], rbx
mov qword [r8 + 0x38], rbx
mov dword [r8 + 0x30], ebx
jmp 0x1400895f3
mov r8, rbx
xor r9d, r9d
mov rcx, r15
lea edx, [r9 + 0x24]
call fcn.1400017b8
lea rax, vtable.expr_param.0
mov qword [r15 + 0x48], rbx
mov qword [r15], rax
jmp 0x140089615
mov r15, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1400c2d9c
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov r15d, 0x40
cmp eax, 0x2e
jne 0x14008965b
mov ecx, r15d
call fcn.1400ca61c
test rax, rax
je 0x140089658
mov rdx, rdi
mov rcx, rax
call fcn.140001a68
mov rdi, rax
jmp 0x14008965b
mov rdi, rbx
mov ecx, 0x58
call fcn.1400ca61c
mov rsi, rax
test rax, rax
je 0x140089692
mov rax, qword [r12]
mov rcx, r12
mov rax, qword [rax + 0x38]
call qword [case.0x1400cd70e.0]
mov r8, rdi
mov rcx, rsi
mov rdx, qword [rax + 8]
call fcn.140001b40
mov rdi, rax
jmp 0x140089695
mov rdi, rbx
mov ecx, 0x50
call fcn.1400ca61c
mov rsi, rax
test rax, rax
je 0x1400896c9
xor r9d, r9d
mov r8, rdi
mov rcx, rax
lea edx, [r9 + 0x24]
call fcn.1400017b8
lea rax, vtable.expr_param.0
mov qword [rsi + 0x48], rbx
mov qword [rsi], rax
jmp 0x1400896cc
mov rsi, rbx
mov rdx, rsi
mov rcx, r14
call fcn.1400c2d9c
jmp 0x140089472
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x1400896fa
call fcn.14008bcfc
mov r12, rax
jmp 0x1400896fd
mov r12, rbx
test dword [rbp + 0x98], 0x200
mov r13, qword [rsp + 0x88]
je 0x14008983c
mov rdi, qword [r13 + 0x20]
mov rcx, r15
call fcn.1400ca61c
mov rsi, rax
test rax, rax
je 0x140089757
and dword [rsi + 0x10], 0xfffffffc
mov qword [rax + 0x18], rbx
lea rax, vtable.expr_variable.0
mov qword [rsi], rax
lea rax, str.__MIDL_NotifyFlag
mov qword [rsi + 0x20], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x38], rbx
mov dword [rsi + 0x30], ebx
jmp 0x14008975a
mov rsi, rbx
mov ecx, 0x48
call fcn.1400ca61c
mov r15, rax
test rax, rax
je 0x1400897cb
mov ecx, 0x40
call fcn.1400ca61c
test rax, rax
je 0x1400897a9
and dword [rax + 0x10], 0xfffffffc
lea rcx, vtable.expr_variable.0
mov qword [rax], rcx
lea rcx, str.TRUE
mov qword [rax + 0x20], rcx
mov qword [rax + 0x18], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x28], rbx
mov qword [rax + 0x38], rbx
mov dword [rax + 0x30], ebx
jmp 0x1400897ac
mov rax, rbx
mov r9, rax
mov r8, rsi
mov edx, 0x2a
mov rcx, r15
call fcn.1400017b8
lea rax, vtable.expr_assign.0
mov qword [r15], rax
jmp 0x1400897ce
mov r15, rbx
mov rcx, rdi
call fcn.1400ca48c
mov rax, qword [r15]
mov rdx, rdi
mov rcx, r15
mov rax, qword [rax + 0xc0]
call qword [case.0x1400cd70e.0]
cmp byte [rdi], 2
je 0x140089834
cmp byte [rdi + 3], bl
jne 0x140089834
cmp byte [rdi + 4], bl
jne 0x140089834
cmp byte [rdi], 1
jne 0x140089817
mov rdx, qword [rdi + 0x10]
mov ecx, 0x3b
call qword [sym.imp.msvcrt.dll_putc]
nop dword [rax + rax]
jmp 0x140089834
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x28]
jb 0x14008982d
mov rcx, rdi
call fcn.1400ca274
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x3b
inc qword [rdi + 0x18]
mov rcx, rdi
call fcn.1400ca48c
mov rax, qword [rbp]
mov rcx, rbp
mov rax, qword [rax + 0x28]
call qword [case.0x1400cd70e.0]
mov r8, r12
mov rdx, r14
cmp eax, 8
mov rcx, r13
sete bl
mov r9d, ebx
call fcn.140060d40
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret