Function at 0x1401307d0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rcx, [0x140001450]
call fcn.140001410
mov ecx, 0x4030
call fcn.14000c627
test eax, eax
jns 0x14000149f
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
mov ecx, 1
call fcn.1400dd585
test eax, eax
je 0x140001495
mov ecx, 0x10
call fcn.1400f54c3
test eax, eax
je 0x140001495
mov r9d, 0x1000
mov r8d, 2
mov edx, 0x8010
mov ecx, 0xac44
call fcn.1400f6f0e
inc eax
je 0x140001495
mov edx, dword [0x140131004]
lea rcx, [0x14014dce0]
xor edi, edi
lea r14, str.ITS_A_PRANK_BRO
lea r15, [0x14014b011]
call fcn.14000cf2d
mov edx, dword [section..data]
lea rcx, [0x14014b020]
mov rsi, rax
call fcn.14000cf2d
mov rcx, rsi
mov rbx, rax
call fcn.1400e077d
mov edx, 1
mov rcx, rbx
mov r13, rax
call fcn.1400f6098
mov qword [rsp + 0x38], rax
call fcn.14000d342
mov edx, 0x18
movsxd rcx, eax
mov rsi, rcx
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
mov r12, rax
mov rbp, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
cmp edi, esi
jge 0x1400015fd
mov rdx, qword [rsp + 0x40]
mov ecx, edi
add rbp, 0x18
call fcn.14000d350
mov eax, dword [rsp + 0x64]
mov edx, edi
mov r9d, dword [rsp + 0x60]
mov dword [rsp + 0x28], 0x108310
or edx, 0x2fff0000
mov rcx, r14
inc edi
mov dword [rsp + 0x20], eax
mov r8d, edx
call fcn.14000d396
xor r8d, r8d
or edx, 0xffffffff
mov qword [rbp - 0x18], rax
mov rcx, rax
call fcn.14000cd9f
mov rdx, r13
mov qword [rbp - 0x10], rax
mov rcx, rax
mov rbx, rax
call fcn.14000cdc9
mov rcx, rbx
mov qword [rbp - 8], rax
mov qword [rsp + 0x48], rax
call fcn.14000cea8
mov rdx, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call fcn.14000cee7
mov rcx, rbx
call fcn.14000cefc
call fcn.14000c7e1
mov rcx, r15
mov rdx, rax
call fcn.140130080
jmp 0x140001556
mov rcx, qword [rsp + 0x40]
call fcn.14000c820
mov eax, dword [rsp + 0x58]
cmp eax, 0x300
je 0x140001619
cmp eax, 0x401
jne 0x140001629
mov rdx, qword [rsp + 0x38]
xor r8d, r8d
or ecx, 0xffffffff
call fcn.1400f67f3
lea rbx, [r12 + 8]
xor edi, edi
cmp edi, esi
jge 0x1400015fd
mov rbp, qword [rbx]
inc edi
add rbx, 0x18
mov rcx, rbp
call fcn.14000cea8
mov rdx, qword [rbx - 0x10]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call fcn.14000cee7
mov rcx, rbp
call fcn.14000cefc
jmp 0x140001630
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.1401226a0
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x14013081b
jmp 0x140130891
test cl, cl
je 0x140130848
and esi, 1
je 0x140130830
mov esi, 1
call sub.api_ms_win_crt_multibyte_l1_1_0.dll__ismbblead
test eax, eax
je 0x140130817
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x1401307f8
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x140130806
test cl, cl
je 0x140130848
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140130848
cmp al, 0x20
jle 0x140130838
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140130876
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1401c2230]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001468
lea rbx, [0x1401bd770]
jmp 0x140130848