Function at 0x6e141946
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [esp + 4], 0x400
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalFlags]
call eax
sub esp, 4
cmp eax, 0x8000
jne 0x6e141980
mov byte [0x6e1dd400], 1
movzx eax, byte [0x6e1dd400]
xor eax, 1
test al, al
je 0x6e141ba9
call fcn.6e14185f
mov dword [0x6e1df010], eax
call fcn.6e141823
mov dword [0x6e1df00c], eax
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0xf8238034
mov dword [esp], eax
call fcn.6e1410fa
mov dword [0x6e1df008], eax
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0x4128ba25
mov dword [esp], eax
call fcn.6e1410fa
mov dword [section..bss], eax
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0x831e6281
mov dword [esp], eax
call fcn.6e1410fa
mov dword [0x6e1df004], eax
mov dword [ebp - 0xc], 0
call fcn.6e1417bb
add dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2b0a
jle 0x6e1419fb
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0x4128ba25
mov dword [esp], eax
call fcn.6e1410fa
mov dword [section..bss], eax
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0x831e6281
mov dword [esp], eax
call fcn.6e1410fa
mov dword [0x6e1df004], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x6e141a6e
mov eax, dword [ebp - 0x14]
add eax, section..data
movzx eax, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, section..data
mov byte [edx], al
add dword [ebp - 0x10], 1
add dword [ebp - 0x14], 2
mov eax, dword [ebp - 0x14]
cmp eax, 0x9b3ff
jbe 0x6e141a50
mov dword [ebp - 0x18], 0x361cad
mov dword [ebp - 0x2c], 0x201c65e2
mov dword [ebp - 0x28], 0x4d7f6699
mov dword [ebp - 0x24], 0x400c84dc
mov dword [ebp - 0x20], 0xc2785763
mov eax, dword [ebp - 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x2c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call fcn.6e1410bb
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4da00
mov dword [esp + 4], 0x6e142000
mov dword [esp], section..data
call fcn.6e141215
mov dword [0x6e1df024], 0x6e142000
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0xc4966432
mov dword [esp], eax
call fcn.6e1410fa
mov dword [0x6e1df014], eax
mov eax, dword [0x6e1df014]
mov dword [esp + 4], 0x6e1414d6
mov dword [esp], eax
call fcn.6e1413ae
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x40], 0x6d0063
mov dword [ebp - 0x3c], 0x2e0064
mov dword [ebp - 0x38], 0x780065
mov dword [ebp - 0x34], 0x65
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov word [ebp - 0x48], 0xe
mov word [ebp - 0x46], 0xe
mov eax, dword [0x6e1df010]
mov dword [esp + 4], 0xf70bd5c
mov dword [esp], eax
call fcn.6e1410fa
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x48]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x1c]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x6e141ba8
mov eax, dword [ebp - 0x30]
mov edx, eax
mov eax, dword [0x6e1df020]
add eax, edx
mov dword [0x6e1df028], eax
call fcn.6e1417ab
nop
nop
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
nop
push ecx
push eax
cmp eax, 0x3e8
lea ecx, [esp + 0xc]
jb 0x6e141bda
sub ecx, 0x3e8
or dword [ecx], 0
sub eax, 0x3e8
cmp eax, 0x3e8
ja 0x6e141bc5
sub ecx, eax
or dword [ecx], 0
pop eax
pop ecx
ret