Function at 0x1401a4970
Capabilities:
Terminate process

Disassembly:
in al, 0xe6
mov bh, 0xe8
mov ecx, 0xea42b860
invalid
in al, 0xec
jb 0x1401543c8
in al, 0xb9
invalid
in eax, 3
mov dh, 0x5b
sahf
retf 0x463c
jae 0x1401543d6
pop rsp
retf 0x5ccc
invalid
push rdi
enter 0xffffffffffff8173, 0x32
fcmovu st(0), st(4)
cmp dword [rdi + rdx], 0xde764714
or al, 0x57
enter 0x6273, 0xffffffffffffffe0
loop 0x1401544ea
loopne 0x140154464
jo 0x14015440a
jo 0x14015440a
cmp al, 0x17
js 0x14015446d
out 0x73, al
jo 0x140154453
invalid
add eax, 0x299e5495
jmp 0x134824b2b
cld
pop r11
jmp 0x1401a497d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401a498d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401a4975
lea eax, [rcx + 1]
jmp 0x1401a499b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401a49ae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401a4994
sub eax, 3
jb 0x1401a49ce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401a4a1d
sar eax, 1
movsxd rbp, eax
jb 0x1401a4a04
jmp 0x1401a49dc
add ebx, ebx
jne 0x1401a49da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401a4a04
inc ecx
add ebx, ebx
jne 0x1401a49ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401a4a04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401a49fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401a49ec
add ecx, 2
jmp 0x1401a4a09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401a4932
jmp 0x1401a497d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x15f400
mov dl, 0x31
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401a4a6d
cmp rsi, rcx
jae 0x1401a4a75
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401a4a54
cmp al, 0x8f
ja 0x1401a4a54
cmp byte [rsi - 2], 0xf
je 0x1401a4a5a
sub al, 0xe8
cmp al, 1
ja 0x1401a4a3e
cmp rsi, rcx
jae 0x1401a4a75
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401a4a44
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401a4a75
lodsb al, byte [rsi]
jmp 0x1401a4a54
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1a0000]
mov eax, dword [rdi]
or eax, eax
je 0x1401a4ade
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1a41dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401a4a82
jns 0x1401a4ab7
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1401a4ac1
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401a4ad8
mov qword [rbx], rax
add rbx, 8
jmp 0x1401a4aa2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401a4b22
cmp al, 0xef
ja 0x1401a4b0a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401a4aea
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1401a4af9
mov eax, dword [rdi]
add rdi, 4
jmp 0x1401a4af9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401a4b76
sub rsp, 0xffffffffffffff80
jmp 0x140154480