Function at 0x140686d80
Capabilities:
Terminate process

Disassembly:
movabs byte [0x7200c843234cca3], al
adc ecx, dword [rcx + 0x33]
rcr byte [rsp + rax*4 + 0x13], cl
movabs dword [0xa4b98b1276f04e48], eax
pop rbx
insd dword [rdi], dx
xor al, 0x73
leave
adc dword [rdx - 0x54], esi
xchg ecx, eax
adc dword [rax + 0x48cd3c8c], ecx
adc dword [rsp + riz*4], edi
movsd dword [rdi], dword [rsi]
invalid
cld
pop r11
jmp 0x140686d8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140686d9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140686d85
lea eax, [rcx + 1]
jmp 0x140686dab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140686dbe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140686da4
sub eax, 3
jb 0x140686ddc
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140686e14
sar eax, 1
movsxd rbp, eax
jmp 0x140686ddf
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140686e00
inc ecx
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140686dfb
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140686dea
add ecx, 2
cmp rbp, 0xfffffffffffffb00
adc ecx, 1
call fcn.140686d42
jmp 0x140686d8d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xf3e00
mov dl, 0x25
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140686e64
cmp rsi, rcx
jae 0x140686e6c
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140686e4b
cmp al, 0x8f
ja 0x140686e4b
cmp byte [rsi - 2], 0xf
je 0x140686e51
sub al, 0xe8
cmp al, 1
ja 0x140686e35
cmp rsi, rcx
jae 0x140686e6c
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140686e3b
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140686e6c
lodsb al, byte [rsi]
jmp 0x140686e4b
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x638000]
mov eax, dword [rdi]
or eax, eax
je 0x140686ed5
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6871e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140686e79
jns 0x140686eae
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140686eb8
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140686ecf
mov qword [rbx], rax
add rbx, 8
jmp 0x140686e99
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140686f19
cmp al, 0xef
ja 0x140686f01
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140686ee1
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140686ef0
mov eax, dword [rdi]
add rdi, 4
jmp 0x140686ef0
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140686f6d
sub rsp, 0xffffffffffffff80
jmp 0x1400ba980