Function at 0x1404208ad
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1404208ba
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1404208ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1404208b2
lea eax, [rcx + 1]
jmp 0x1404208d8
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1404208eb
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1404208d1
sub eax, 3
jb 0x14042090b
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14042095a
sar eax, 1
movsxd rbp, eax
jb 0x140420941
jmp 0x140420919
add ebx, ebx
jne 0x140420917
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140420941
inc ecx
add ebx, ebx
jne 0x140420927
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140420941
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14042093a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140420929
add ecx, 2
jmp 0x140420946
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
jmp 0x14042252e
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x134a00
mov dl, 0x21
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1404209aa
cmp rsi, rcx
jae 0x1404209b2
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140420991
cmp al, 0x8f
ja 0x140420991
cmp byte [rsi - 2], 0xf
je 0x140420997
sub al, 0xe8
cmp al, 1
ja 0x14042097b
cmp rsi, rcx
jae 0x1404209b2
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140420981
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1404209b2
lodsb al, byte [rsi]
jmp 0x140420991
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x41d000]
mov eax, dword [rdi]
or eax, eax
je 0x140420a1b
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4201dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1404209bf
jns 0x1404209f4
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1404209fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140420a15
mov qword [rbx], rax
add rbx, 8
jmp 0x1404209df
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140420a5f
cmp al, 0xef
ja 0x140420a47
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140420a27
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140420a36
mov eax, dword [rdi]
add rdi, 4
jmp 0x140420a36
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x247]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
movabs rbp, 0x80000001
pop rbp
movabs rdi, 0x80000002
pop rdi
movabs rsi, 0x80000003
pop rsi
movabs rbx, 0x80000004
pop rbx
lea rax, [rsp - 0x80]
push rax
mov rax, 1
pop rax
push 0
cmp rsp, rax
push rax
mov rax, 2
pop rax
jne 0x140420ae4
sub rsp, 0xfffffffffffffff0
sub rsp, 0xfffffffffffffff0
sub rsp, 0xfffffffffffffff0
add rsp, 0x10
sub rsp, 0xfffffffffffffff0
sub rsp, 0xfffffffffffffff0
sub rsp, 0xfffffffffffffff0
sub rsp, 0xfffffffffffffff0
sub rsp, 0xffffffffffffffe0
push rcx
lea rax, [0x140103b0c]
xor rcx, rcx
pop rcx
push rax
je 0x140420b29
call rcx
ret