Function at 0x14000b4c0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov rax, qword [0x14003ae50]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rdx
mov r14, rcx
mov qword [rbp - 0x38], rdx
mov rax, qword [rdx]
test rax, rax
jne 0x14000b539
mov rbx, qword [rdx + 8]
test rbx, rbx
je 0x14000b532
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
dec eax
jne 0x14000b532
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock dec dword [rbx + 0xc]
jne 0x14000b532
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
xor al, al
jmp 0x14000b94c
movzx ebx, byte [rax + 6]
mov ecx, 0x30
call fcn.140018b7c
mov qword [rbp - 0x50], rax
xor esi, esi
test rax, rax
je 0x14000b55f
mov rcx, rax
call fcn.14000ff30
mov r13, rax
jmp 0x14000b562
mov r13, rsi
mov r8d, 0xb
lea rdx, [0x140038058]
mov rcx, r13
call fcn.14000ffb0
movzx r11d, bl
or rdi, 0xffffffffffffffff
sub r11d, 0x65
je 0x14000b81b
dec r11d
je 0x14000b78d
dec r11d
je 0x14000b68a
dec r11d
je 0x14000b632
dec r11d
jne 0x14000b909
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0x70]
cmp byte [rcx + 8], r11b
je 0x14000b909
lea r8d, [rdi + 0xc]
lea rdx, [0x140038040]
mov rcx, r13
call fcn.14000ffa0
lea ecx, [rdi + 0x29]
call fcn.140018b7c
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000b5f3
mov rdx, rax
mov rcx, r13
call fcn.1400106c0
mov rbx, rax
jmp 0x14000b5f6
mov rbx, rsi
mov qword [rbp - 0x50], rbx
mov r8, qword [rbx + 0x10]
mov rax, rdi
sub rax, r8
cmp rax, 1
ja 0x14000b617
lea rcx, str.string_too_long
call fcn.1400184c8
int3
lea r12, [r8 + 1]
cmp r12, 0xfffffffffffffffe
jbe 0x14000b717
lea rcx, str.string_too_long
call fcn.1400184c8
int3
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0x70]
cmp byte [rcx + 8], 0
mov rcx, r13
jne 0x14000b652
mov r8d, 0x18
lea rdx, [0x140037fa0]
jmp 0x14000b65f
mov r8d, 0x19
lea rdx, [0x140037f80]
call fcn.14000ffa0
mov ecx, 0x28
call fcn.140018b7c
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000b685
mov rdx, rax
mov rcx, r13
call fcn.1400106c0
mov rsi, rax
jmp 0x14000b8fc
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0x70]
cmp byte [rcx + 8], 0
je 0x14000b909
mov rax, qword [r15]
mov r12, qword [rax + 0x10]
mov ecx, 0x28
call fcn.140018b7c
mov rbx, rax
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000b6dc
mov rcx, qword [r15]
mov rdx, qword [rcx + 8]
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rsi
mov byte [rax], 0
mov r8, r12
mov rcx, rax
call fcn.1400082b0
jmp 0x14000b6df
mov rbx, rsi
mov qword [rbp - 0x50], rbx
mov r8, qword [rbx + 0x10]
mov rax, rdi
sub rax, r8
cmp rax, 1
ja 0x14000b700
lea rcx, str.string_too_long
call fcn.1400184c8
int3
lea r12, [r8 + 1]
cmp r12, 0xfffffffffffffffe
jbe 0x14000b717
lea rcx, str.string_too_long
call fcn.1400184c8
int3
mov rax, qword [rbx + 0x18]
cmp rax, r12
jae 0x14000b72d
mov rdx, r12
mov rcx, rbx
call fcn.140007720
jmp 0x14000b747
test r12, r12
jne 0x14000b74a
mov qword [rbx + 0x10], rsi
cmp rax, 0x10
jb 0x14000b741
mov rax, qword [rbx]
jmp 0x14000b744
mov rax, rbx
mov byte [rax], 0
test r12, r12
setne al
test al, al
je 0x14000b77b
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14000b761
mov rax, qword [rbx]
jmp 0x14000b764
mov rax, rbx
mov byte [rax + rcx], 0xa
cmp qword [rbx + 0x18], 0x10
mov qword [rbx + 0x10], r12
jb 0x14000b776
mov rbx, qword [rbx]
mov byte [rbx + r12], 0
lea rcx, [r14 + 0x38]
lea rdx, [rbp - 0x50]
call fcn.14000afb0
jmp 0x14000b909
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0x70]
cmp byte [rcx + 8], 0
je 0x14000b909
mov rbx, qword [rcx + 0x10]
cmp rbx, 0xffffffffffffffff
je 0x14000b7e0
mov dword [rbp - 0x48], esi
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
mov rcx, r13
test al, al
je 0x14000b7e3
mov r8d, 0x14
lea rdx, [0x140037f48]
jmp 0x14000b7f0
mov rcx, r13
lea rdx, [0x140037f60]
mov r8d, 0x1b
call fcn.14000ffa0
mov ecx, 0x28
call fcn.140018b7c
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000b816
mov rdx, rax
mov rcx, r13
call fcn.1400106c0
mov rsi, rax
jmp 0x14000b8fc
mov rax, qword [r14 + 0x30]
mov rcx, qword [rax + 0x70]
cmp byte [rcx + 8], 0
jne 0x14000b909
mov dword [rbp - 0x30], 0x6e72656b
mov dword [rbp - 0x2c], 0x32336c65
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], 0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14000b864
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x14000b8ad
mov dword [rbp - 0x20], 0x61657243
mov dword [rbp - 0x1c], 0x68546574
mov dword [rbp - 0x18], 0x64616572
mov byte [rbp - 0x14], 0
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b8ad
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
mov r9, qword [r14 + 0x30]
lea r8, [0x14000adc0]
xor edx, edx
xor ecx, ecx
call rax
mov qword [r14 + 0x28], rax
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11, qword [r14 + 0x30]
mov rax, qword [r11 + 0x70]
cmp byte [rax + 8], 0
jne 0x14000b909
mov r8d, 0x1c
lea rdx, [0x140037f28]
mov rcx, r13
call fcn.14000ffa0
mov ecx, 0x28
call fcn.140018b7c
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000b8fc
mov rdx, rax
mov rcx, r13
call fcn.1400106c0
mov rsi, rax
lea rcx, [r14 + 0x10]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
test r13, r13
je 0x14000b91f
mov rcx, r13
call fcn.14000ff70
mov rcx, r13
call fcn.1400187b4
nop
mov rbx, qword [r15 + 8]
test rbx, rbx
je 0x14000b94a
mov eax, edi
lock xadd dword [rbx + 8], eax
dec eax
jne 0x14000b94a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock dec dword [rbx + 0xc]
jne 0x14000b94a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400194d0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret