Function at 0x14023a980
Capabilities:
Terminate thread

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x448
mov eax, 0x1c7d
mov word [rsp + 0x30], ax
movsx eax, byte [0x140288008]
cmp eax, 0xc
jge 0x14023ac91
movsx eax, byte [0x140288008]
add eax, 0x7e
cmp eax, 0x25
jge 0x14023a9ba
call fcn.14023a860
nop
mov dword [rsp + 0x34], 0x70975baa
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0x26dcc585
je 0x14023aa12
cmp dword [rsp + 0x48], 0x540eef1d
je 0x14023a9e0
jmp 0x14023aa5f
mov eax, dword [rsp + 0x34]
and eax, 0x3df85f72
mov dword [rsp + 0x34], eax
mov r9d, 0xf5
mov r8d, 8
mov edx, 0x4c
mov rcx, qword [rsp + 0x78]
call sub.COMCTL32.dll_DefSubclassProc
mov qword [rsp + 0x98], rax
jmp 0x14023aa5f
mov ecx, dword [rsp + 0x450]
call fcn.14023a980
mov eax, dword [rsp + 0x34]
or eax, 0x1d84a600
mov dword [rsp + 0x34], eax
mov edx, 0x4e
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x450], 0xc7154940
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rsp + 0x68], eax
movsx eax, word [rsp + 0x30]
shl eax, 0xe
mov word [rsp + 0x30], ax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0x268eafd8
je 0x14023aab9
cmp dword [rsp + 0x4c], 0x6706e6b3
je 0x14023aa8d
jmp 0x14023ab0e
movsx eax, word [rsp + 0x30]
xor eax, 0x37b2
mov word [rsp + 0x30], ax
lea r8, [fcn.14023bc60]
mov edx, 0xb2
mov ecx, 0x5f
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
mov dword [rsp + 0x44], eax
jmp 0x14023ab0e
cmp dword [rsp + 0x34], 0x10d0b504
jl 0x14023aaff
mov dword [rsp + 0x450], 0x29f83409
mov ecx, dword [rsp + 0x450]
call fcn.14023a980
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov dword [rsp + 0x5c], eax
movsx eax, word [rsp + 0x30]
sub eax, 0x7653
mov word [rsp + 0x30], ax
jmp 0x14023ab0e
movsx eax, word [rsp + 0x30]
add eax, 0x5305
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
mov word [rsp + 0x3c], ax
mov eax, 0x385
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x38]
cmp eax, 0xf40
jge 0x14023ac17
movzx eax, word [rsp + 0x38]
and eax, 0x8c8
cmp eax, 0xcc9
jne 0x14023ab7d
movzx r8d, word [rsp + 0x3c]
mov dl, 0x9e
mov cl, 0xe2
call fcn.14023b310
mov ecx, 0x27
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov dword [rsp + 0x44], eax
movsx eax, word [rsp + 0x30]
sub eax, 0x71d6
mov word [rsp + 0x3c], ax
mov eax, dword [rsp + 0x34]
add eax, 0x7b851bf1
mov dword [rsp + 0x34], eax
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x450]
mov dword [rsp + 0x54], eax
movsx eax, word [rsp + 0x30]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x665a
je 0x14023aba7
jmp 0x14023ac17
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0x14f98c44
je 0x14023abbb
jmp 0x14023abe0
mov r8d, 0xaa
lea rdx, str.Ruptured_Executed
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov qword [rsp + 0xa0], rax
jmp 0x14023ac17
movsx eax, word [rsp + 0x3c]
add eax, 0x2c08
mov word [rsp + 0x30], ax
lea r9, [rsp + 0x78]
mov r8d, 0x6a
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0xf429231
je 0x14023ac35
cmp dword [rsp + 0x50], 0xb7b988ec
je 0x14023ac80
jmp 0x14023ac8f
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x450], eax
lea rdx, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], 0x82
mov r9d, dword [rsp + 0x450]
mov r8b, 0xc8
mov edx, 0x7b
mov ecx, 9
call fcn.14023bff0
nop
jmp 0x14023ac8f
movzx eax, word [rsp + 0x40]
sub eax, 0xf48
mov word [rsp + 0x38], ax
jmp 0x14023ad0c
movsx eax, byte [0x140288008]
sub eax, 0x7e
cmp eax, 0x33
jne 0x14023ad0c
mov dword [rsp + 0x450], 0x5196d991
mov r9d, 0x99
movzx r8d, byte [0x140288008]
mov edx, dword [rsp + 0x450]
mov cx, 0x27
call fcn.14023ada0
mov dword [rsp + 0x450], 0xbe2a7304
mov r8w, 0xdd
mov dl, 0x69
mov cl, 0x31
call fcn.14023b310
lea r8, [rsp + 0x70]
mov edx, 0xca
lea rcx, [rsp + 0xa8]
call qword [sym.imp.ole32.dll_OleRegGetMiscStatus]
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x450], 0x867589bb
mov dword [rsp + 0x450], 0xb47c001
mov ecx, dword [rsp + 0x450]
call fcn.14023a980
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
call sub.WINSPOOL.DRV_FindNextPrinterChangeNotification
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x450], 0x7b382cb0
mov r9d, 0xd4
movzx r8d, byte [0x140288008]
mov edx, dword [rsp + 0x450]
mov cx, 0x8a
call fcn.14023ada0
lea r8, [rsp + 0x44]
mov dx, 0x63
mov cx, 0x32
call qword [sym.imp.ole32.dll_CoDosDateTimeToFileTime]
mov dword [rsp + 0x44], eax
movsx eax, byte [0x140288008]
add rsp, 0x448
ret