Function at 0x14000559c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x50
mov r15d, 1
xor r14d, r14d
mov esi, edx
mov rdi, r8
mov rbx, rcx
mov rdx, r8
mov dword [0x14000fcbc], r15d
mov dword [0x14000fcc0], r14d
mov ecx, esi
call fcn.1400071ec
mov r9d, eax
test eax, eax
jle 0x140005a26
cmp eax, 0x69
jg 0x1400057dd
je 0x1400057a1
cmp eax, 0x54
jg 0x140005709
je 0x1400056fd
cmp eax, 0x34
jl 0x140005a01
cmp eax, 0x36
jle 0x1400056dc
cmp eax, 0x42
je 0x1400056a3
cmp eax, 0x47
je 0x140005689
cmp eax, 0x4b
je 0x14000567f
cmp eax, 0x4e
je 0x140005646
cmp eax, 0x50
jne 0x140005a01
mov byte [0x14000fd39], r15b
jmp 0x140005924
lea rcx, [0x14000faf4]
call fcn.140002214
test eax, eax
jne 0x140005924
lea rdx, str.1113__built_2020_03_28_17:29:45_UTC
lea rcx, str.vlmcs__s__n_nUsage:__s__options_____host__:_port____._domain________options__n_nOptions:_n_n___v_Be_verbose_n___l__app__n___4_Force_V4_protocol_n___5_Force_V5_protocol_n___6_Force_V6_protocol_n___i__IpVersion__Use_IP_protocol__4_or_6__n___j__file__Load_external_KMS_data_file__file__n___e_Show_some_valid_examples_n___x_Show_valid_Apps_n___d_no_DNS_names__use_Netbios_names__no_effect_if__w_is_used__n___V_show_version_information_and_exit_n_nAdvanced_options:_n_n___a__AppGUID__Use_custom_Application_GUID_n___s__ActGUID__Use_custom_Activation_Configuration_GUID_n___k__KmsGUID__Use_custom_KMS_GUID_n___c__ClientGUID__Use_custom_Client_GUID._Default:_Use_random_n___o__PreviousClientGUID__Use_custom_Prevoius_Client_GUID._Default:_ZeroGUID_n___K__ProtocolVersion__Use_a_specific__possibly_invalid__protocol_version_n___w__Workstation__Use_custom_workstation_name._Default:_Use_random_n___r__RequiredClientCount__Fake_required_clients_n___n__Requests__Fixed__of_requests__Default:_Enough_to_charge__n___m_Pretend_to_be_a_virtual_machine_n___G__file__Get_ePID_HwId_data_and_write_to__file_._Cant_be_used_with__l___4___5___6___a___s___k___r_and__n_n___T_Use_a_new_TCP_connection_for_each_request._n___N__01__disable_or_enable_NDR64._Default:_1_n___B__01__disable_or_enable_RPC_bind_time_feature_negotiation._Default:_1_n___t__LicenseStatus__Use_specfic_license_status__0___T___6__n___g__BindingExpiration__Use_a_specfic_binding_expiration_time_in_minutes._Default_43200_n___P_Ignore_priority_and_weight_in_DNS_SRV_records_n___p_Dont_use_multiplexed_RPC_bind_n_n_port_:_t_tTCP_port_name_of_the_KMS_to_use._Default_1688._n_host_:_t_thost_name_of_the_KMS_to_use._Default_127.0.0.1_n._domain_:_tfind_KMS_server_in__domain__via_DNS_n_app_:_t_t_Type__s__x_to_see_a_list_of_valid_apps__n_n
mov r9, rbx
mov r8, rbx
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3
call fcn.1400052a4
jmp 0x140005924
mov rax, qword [0x14000fed8]
or byte [0x14000fd3a], r15b
mov qword [0x14000fd70], rax
jmp 0x140005924
lea rcx, [0x14000faef]
call fcn.140002214
test eax, eax
jne 0x140005924
lea rdx, str.1113__built_2020_03_28_17:29:45_UTC
lea rcx, str.vlmcs__s__n_nUsage:__s__options_____host__:_port____._domain________options__n_nOptions:_n_n___v_Be_verbose_n___l__app__n___4_Force_V4_protocol_n___5_Force_V5_protocol_n___6_Force_V6_protocol_n___i__IpVersion__Use_IP_protocol__4_or_6__n___j__file__Load_external_KMS_data_file__file__n___e_Show_some_valid_examples_n___x_Show_valid_Apps_n___d_no_DNS_names__use_Netbios_names__no_effect_if__w_is_used__n___V_show_version_information_and_exit_n_nAdvanced_options:_n_n___a__AppGUID__Use_custom_Application_GUID_n___s__ActGUID__Use_custom_Activation_Configuration_GUID_n___k__KmsGUID__Use_custom_KMS_GUID_n___c__ClientGUID__Use_custom_Client_GUID._Default:_Use_random_n___o__PreviousClientGUID__Use_custom_Prevoius_Client_GUID._Default:_ZeroGUID_n___K__ProtocolVersion__Use_a_specific__possibly_invalid__protocol_version_n___w__Workstation__Use_custom_workstation_name._Default:_Use_random_n___r__RequiredClientCount__Fake_required_clients_n___n__Requests__Fixed__of_requests__Default:_Enough_to_charge__n___m_Pretend_to_be_a_virtual_machine_n___G__file__Get_ePID_HwId_data_and_write_to__file_._Cant_be_used_with__l___4___5___6___a___s___k___r_and__n_n___T_Use_a_new_TCP_connection_for_each_request._n___N__01__disable_or_enable_NDR64._Default:_1_n___B__01__disable_or_enable_RPC_bind_time_feature_negotiation._Default:_1_n___t__LicenseStatus__Use_specfic_license_status__0___T___6__n___g__BindingExpiration__Use_a_specfic_binding_expiration_time_in_minutes._Default_43200_n___P_Ignore_priority_and_weight_in_DNS_SRV_records_n___p_Dont_use_multiplexed_RPC_bind_n_n_port_:_t_tTCP_port_name_of_the_KMS_to_use._Default_1688._n_host_:_t_thost_name_of_the_KMS_to_use._Default_127.0.0.1_n._domain_:_tfind_KMS_server_in__domain__via_DNS_n_app_:_t_t_Type__s__x_to_see_a_list_of_valid_apps__n_n
mov r9, rbx
mov r8, rbx
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3
or byte [0x14000fd3a], 2
sub r9w, 0x30
mov word [0x14000fd40], r14w
mov word [0x14000fea0], r9w
jmp 0x140005924
mov byte [0x14000fd42], r15b
jmp 0x140005924
sub r9d, 0x56
je 0x140005964
sub r9d, 0xb
je 0x140005782
sub r9d, 2
je 0x14000575d
dec r9d
je 0x140005751
dec r9d
je 0x14000592c
cmp r9d, 2
jne 0x140005a01
xor edx, edx
mov r8d, 0x7fffffff
mov cl, 0x67
call fcn.14000204c
mov dword [0x14000fcb0], eax
jmp 0x140005924
mov byte [0x14000faf5], r14b
jmp 0x140005924
mov eax, dword [0x14000fd54]
test eax, eax
cmove eax, r15d
mov dword [0x14000fd54], eax
mov rax, qword [0x14000fed8]
mov qword [0x14000fd68], rax
jmp 0x140005924
lea rdx, [0x14000fec0]
mov rcx, qword [0x14000fed8]
or byte [0x14000fd3a], 2
call fcn.14000505c
jmp 0x140005924
mov edx, 4
mov cl, 0x69
lea r8d, [rdx + 2]
call fcn.14000204c
cmp eax, 4
je 0x1400057ce
cmp eax, 6
jne 0x1400059e4
mov dword [0x14000fd44], 0x17
jmp 0x140005924
mov dword [0x14000fd44], 2
jmp 0x140005924
cmp r9d, 0x70
jg 0x140005879
je 0x14000586d
sub r9d, 0x6a
je 0x140005924
dec r9d
je 0x140005861
dec r9d
je 0x140005855
dec r9d
je 0x140005849
dec r9d
je 0x140005827
dec r9d
jne 0x140005a01
mov rax, qword [0x14000fed8]
mov qword [0x14000fd30], rax
jmp 0x140005924
or byte [0x14000fd3a], 2
mov r8d, 0x7fffffff
mov edx, r15d
mov cl, WSAGetLastError
call fcn.14000204c
mov dword [0x14000fd54], eax
jmp 0x140005924
mov byte [0x14000fd38], r15b
jmp 0x140005924
or byte [0x14000fd3a], 2
jmp 0x140005924
lea rdx, [0x14000feb0]
jmp 0x140005789
mov byte [0x14000faee], r14b
jmp 0x140005924
sub r9d, 0x72
je 0x140005908
dec r9d
je 0x1400058fc
dec r9d
je 0x1400058d4
sub r9d, 2
je 0x1400058cb
dec r9d
jne 0x1400059fc
mov rdx, qword [0x14000fed8]
or rax, 0xffffffffffffffff
mov qword [0x14000fd60], rdx
inc rax
cmp byte [rdx + rax], r14b
jne 0x1400058ae
cmp rax, 0x3f
jbe 0x140005924
lea rcx, str._aWARNING__Truncating_workstation_name_to_63_characters___s_._n
call fcn.140003e6c
jmp 0x140005924
mov byte [0x14000fd3b], r15b
jmp 0x140005924
xor edx, edx
mov r8d, 0x7fffffff
mov cl, 0x74
call fcn.14000204c
mov dword [0x14000fcb8], eax
cmp eax, 6
jbe 0x140005924
lea rcx, str.Warning:_Correct_license_status_is_0___license_status___6._n
call fcn.140003e6c
jmp 0x140005924
lea rdx, [0x14000fe90]
jmp 0x140005789
or byte [0x14000fd3a], 2
xor edx, edx
mov r8d, 0x7fffffff
mov cl, WSAStartup
call fcn.14000204c
mov dword [0x14000fd50], eax
mov rdx, rdi
jmp 0x1400055d7
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rcx, str._nRequest_activation_for_Office_2013_using_V4_protocol_from_192.168.1.5:1688_n_t_s__l__Office_2013_Professional___4_192.168.1.5_n_t_s__l__Office_2013_Professional___4_192.168.1.5:1688_n_nRequest_activation_for_Windows_Server_2012_using_V4_protocol_from_localhost:1688_n_t_s__4__l__Windows_Server_2012___k_8665cb71_468c_4aa3_a337_cb9bc9d5eaac_n_t_s__4__l__Windows_Server_2012__n_t_s__4__l__Windows_Server_2012___::1_:1688_n_t_s__4__l__Windows_Server_2012__127.0.0.2:1688_n_nSend_100_000_requests_to_localhost:1688_n_t_s__n_100000_n_nRequest_Activation_for_Windows_8_from_10.0.0.1:4711_and_pretend_to_be_Steve_Ballmer_n_t_s__l__Windows_8_Professional___w_steveb1.redmond.microsoft.com_10.0.0.1:4711_n_n
mov r9, rbx
mov r8, rbx
mov rdx, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.msvcrt.dll_printf]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rdx, str.1113__built_2020_03_28_17:29:45_UTC
lea rcx, str.vlmcs__s__i_bit_n
mov r8d, 0x40
call qword [sym.imp.msvcrt.dll_printf]
xor r8d, r8d
lea rcx, str.Compiler:_VC__02i._02i_build__i_n
lea edx, [r8 + 0x12]
mov r9d, 0x9eb5
call qword [sym.imp.msvcrt.dll_printf]
lea r8, str.little_endian
lea rdx, str._Intel_x86_64_Windows64
lea rcx, str.Intended_platform:_s__s_n
call qword [sym.imp.msvcrt.dll_printf]
lea rdx, str.__CRYPTO_WINDOWS
lea rcx, str.Common_flags:_s_n
call qword [sym.imp.msvcrt.dll_printf]
lea rdx, str._DNS_PARSEROS
lea rcx, str.vlmcs_flags:_s_n
call qword [sym.imp.msvcrt.dll_printf]
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rcx, str.IPv5_does_not_exist._n
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3
dec r9d
je 0x140005a72
lea rdx, str.1113__built_2020_03_28_17:29:45_UTC
lea rcx, str.vlmcs__s__n_nUsage:__s__options_____host__:_port____._domain________options__n_nOptions:_n_n___v_Be_verbose_n___l__app__n___4_Force_V4_protocol_n___5_Force_V5_protocol_n___6_Force_V6_protocol_n___i__IpVersion__Use_IP_protocol__4_or_6__n___j__file__Load_external_KMS_data_file__file__n___e_Show_some_valid_examples_n___x_Show_valid_Apps_n___d_no_DNS_names__use_Netbios_names__no_effect_if__w_is_used__n___V_show_version_information_and_exit_n_nAdvanced_options:_n_n___a__AppGUID__Use_custom_Application_GUID_n___s__ActGUID__Use_custom_Activation_Configuration_GUID_n___k__KmsGUID__Use_custom_KMS_GUID_n___c__ClientGUID__Use_custom_Client_GUID._Default:_Use_random_n___o__PreviousClientGUID__Use_custom_Prevoius_Client_GUID._Default:_ZeroGUID_n___K__ProtocolVersion__Use_a_specific__possibly_invalid__protocol_version_n___w__Workstation__Use_custom_workstation_name._Default:_Use_random_n___r__RequiredClientCount__Fake_required_clients_n___n__Requests__Fixed__of_requests__Default:_Enough_to_charge__n___m_Pretend_to_be_a_virtual_machine_n___G__file__Get_ePID_HwId_data_and_write_to__file_._Cant_be_used_with__l___4___5___6___a___s___k___r_and__n_n___T_Use_a_new_TCP_connection_for_each_request._n___N__01__disable_or_enable_NDR64._Default:_1_n___B__01__disable_or_enable_RPC_bind_time_feature_negotiation._Default:_1_n___t__LicenseStatus__Use_specfic_license_status__0___T___6__n___g__BindingExpiration__Use_a_specfic_binding_expiration_time_in_minutes._Default_43200_n___P_Ignore_priority_and_weight_in_DNS_SRV_records_n___p_Dont_use_multiplexed_RPC_bind_n_n_port_:_t_tTCP_port_name_of_the_KMS_to_use._Default_1688._n_host_:_t_thost_name_of_the_KMS_to_use._Default_127.0.0.1_n._domain_:_tfind_KMS_server_in__domain__via_DNS_n_app_:_t_t_Type__s__x_to_see_a_list_of_valid_apps__n_n
mov r9, rbx
mov r8, rbx
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3
mov al, byte [0x14000fd3a]
and al, 3
cmp al, 3
jne 0x140005a57
lea rdx, str.1113__built_2020_03_28_17:29:45_UTC
lea rcx, str.vlmcs__s__n_nUsage:__s__options_____host__:_port____._domain________options__n_nOptions:_n_n___v_Be_verbose_n___l__app__n___4_Force_V4_protocol_n___5_Force_V5_protocol_n___6_Force_V6_protocol_n___i__IpVersion__Use_IP_protocol__4_or_6__n___j__file__Load_external_KMS_data_file__file__n___e_Show_some_valid_examples_n___x_Show_valid_Apps_n___d_no_DNS_names__use_Netbios_names__no_effect_if__w_is_used__n___V_show_version_information_and_exit_n_nAdvanced_options:_n_n___a__AppGUID__Use_custom_Application_GUID_n___s__ActGUID__Use_custom_Activation_Configuration_GUID_n___k__KmsGUID__Use_custom_KMS_GUID_n___c__ClientGUID__Use_custom_Client_GUID._Default:_Use_random_n___o__PreviousClientGUID__Use_custom_Prevoius_Client_GUID._Default:_ZeroGUID_n___K__ProtocolVersion__Use_a_specific__possibly_invalid__protocol_version_n___w__Workstation__Use_custom_workstation_name._Default:_Use_random_n___r__RequiredClientCount__Fake_required_clients_n___n__Requests__Fixed__of_requests__Default:_Enough_to_charge__n___m_Pretend_to_be_a_virtual_machine_n___G__file__Get_ePID_HwId_data_and_write_to__file_._Cant_be_used_with__l___4___5___6___a___s___k___r_and__n_n___T_Use_a_new_TCP_connection_for_each_request._n___N__01__disable_or_enable_NDR64._Default:_1_n___B__01__disable_or_enable_RPC_bind_time_feature_negotiation._Default:_1_n___t__LicenseStatus__Use_specfic_license_status__0___T___6__n___g__BindingExpiration__Use_a_specfic_binding_expiration_time_in_minutes._Default_43200_n___P_Ignore_priority_and_weight_in_DNS_SRV_records_n___p_Dont_use_multiplexed_RPC_bind_n_n_port_:_t_tTCP_port_name_of_the_KMS_to_use._Default_1688._n_host_:_t_thost_name_of_the_KMS_to_use._Default_127.0.0.1_n._domain_:_tfind_KMS_server_in__domain__via_DNS_n_app_:_t_t_Type__s__x_to_see_a_list_of_valid_apps__n_n
mov r9, rbx
mov r8, rbx
call fcn.140003e6c
mov ecx, 0x57
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop r15
ret
mov rcx, qword [sym.imp.msvcrt.dll_printf]
call fcn.14000509c
int3