Function at 0x140089640
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rbp, r9
mov rdi, r8
mov r14d, edx
mov rbx, rcx
cmp edx, 0x465
ja 0x1400897a8
cmp edx, 0x465
je 0x14008979b
mov eax, edx
sub eax, 0x10
je 0x140089735
sub eax, 0x103
je 0x14008972b
sub eax, 0xee
je 0x1400896f0
cmp eax, 4
jne case.default.0x140089ab9
mov rcx, qword [rcx + 0xa78]
mov edx, dword [rcx + 0x708]
sub edx, 1
je 0x1400896e0
sub edx, 2
je 0x1400896d0
cmp edx, 1
jne 0x140089b84
mov r8, r9
mov rcx, rbx
call fcn.140096460
jmp 0x140089ba3
mov r8, rbp
mov rcx, rbx
call fcn.140091590
jmp 0x140089ba3
mov r8, rbp
mov rcx, rbx
call fcn.14009ace0
jmp 0x140089ba3
mov rcx, qword [rcx + 0xa78]
mov edx, dword [rcx + 0x708]
sub edx, 3
je 0x14008971b
cmp edx, 1
jne 0x140089b84
mov r8, rbp
mov rcx, rbx
call fcn.1400960d0
jmp 0x140089ba3
mov r8, rbp
mov rcx, rbx
call fcn.140091100
jmp 0x140089ba3
call fcn.14008c550
jmp 0x140089ba3
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140089752
mov rcx, qword [rbx + 8]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
mov dword [0x140455b64], 1
call fcn.14008ef50
call fcn.14012a590
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140089792
mov rcx, qword [rbx + 8]
xor r9d, r9d
lea edx, [r9 + 0x10]
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rdi
call fcn.14009af20
jmp 0x140089ba3
cmp r14d, 0x5f5
ja 0x140089a99
je 0x140089a8c
lea eax, [rdx - 0x4c9]
cmp eax, 0xcb
ja case.default.0x140089ab9
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x89c1c]
mov ecx, dword [rdx + rax*4 + 0x89bd0]
add rcx, rdx
jmp rcx
mov rcx, qword [rbx + 0xaf0]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x58]
test rdi, rdi
je case.default.0x140089ab9
mov rcx, rdi
call fcn.140125e14
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.14008c760
jmp case.default.0x140089ab9
mov rcx, rbx
call fcn.14008cda0
jmp case.default.0x140089ab9
mov qword [rsp + 0x50], rsi
mov rsi, qword [rbx + 0xae8]
cmp edi, dword [rsi + 0x5ec]
je 0x140089868
cmp edi, dword [rsi + 0x5e8]
jl 0x140089868
cmp edi, dword [rsi + 0x5e4]
jg 0x140089868
mov rcx, rsi
mov dword [rsi + 0x5ec], edi
call fcn.1400db4e0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x310]
mov rsi, qword [rsp + 0x50]
test ebp, ebp
jle case.default.0x140089ab9
mov rcx, qword [rbx + 0xae8]
mov dword [rcx + 0x5e4], ebp
call fcn.1400db4e0
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.14008cf50
jmp case.default.0x140089ab9
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.14008d080
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.14008d1e0
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.14008f3a0
jmp case.default.0x140089ab9
test rdi, rdi
je case.default.0x140089ab9
mov rcx, qword [rbx + 0xb70]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.14008f4a0
jmp case.default.0x140089ab9
mov rcx, rbx
call fcn.140090530
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.1400908b0
jmp case.default.0x140089ab9
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.140090b00
jmp case.default.0x140089ab9
mov rcx, qword [rbx + 0xb90]
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jle case.default.0x140089ab9
mov rcx, qword [rbx + 0xb90]
mov edx, edi
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax]
test rax, rax
je case.default.0x140089ab9
mov rcx, qword [rbx + 0xb90]
mov edx, edi
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax + gethostname]
jmp case.default.0x140089ab9
mov rdx, rdi
mov rcx, rbx
call fcn.140091f70
jmp case.default.0x140089ab9
mov rcx, qword [rbx + 0xc90]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je case.default.0x140089ab9
mov qword [rsp + 0x28], r15
lea r8, [0x140091f60]
mov r9, rbx
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xc90], rax
jmp case.default.0x140089ab9
test rdi, rdi
je case.default.0x140089ab9
mov rcx, qword [rbx + 0xc38]
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
test eax, eax
jle 0x140089a1a
mov rdx, qword [rdi + 0x4a8]
test rdx, rdx
je 0x140089a1a
mov rcx, qword [rbx + 0xc38]
add rcx, 0x5a8
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, rdi
call fcn.140125e14
jmp case.default.0x140089ab9
test rdi, rdi
je case.default.0x140089ab9
mov rax, qword [r8]
mov rcx, rdi
call qword [rax + 0x1f0]
test rax, rax
je 0x140089a52
mov dword [rax + 0x490], 1
mov qword [rax + 0x488], r15
mov rax, qword [rdi]
lea r8, [0x14032ee28]
xor r9d, r9d
lea rdx, [0x1400c1bd0]
mov rcx, rdi
call qword [rax + 0x268]
test rax, rax
je case.default.0x140089ab9
mov r8, qword [rax]
xor edx, edx
mov rcx, rax
call qword [r8 + 0x208]
jmp case.default.0x140089ab9
mov rdx, rdi
call fcn.140096cf0
jmp 0x140089ba3
lea eax, [rdx - 0x5f6]
cmp eax, 8
ja case.default.0x140089ab9
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x89ce8]
add rax, rdx
jmp rax
mov rdx, rdi
call fcn.1400972e0
jmp case.default.0x140089ab9
mov rcx, qword [rcx + 0xcd8]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbx + 0xcd8]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x198]
jmp 0x1400897f7
mov rcx, qword [rcx + 0xe08]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbx + 0xe08]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x198]
jmp 0x1400897f7
mov rdx, rdi
call fcn.140098340
jmp case.default.0x140089ab9
call fcn.140098630
jmp case.default.0x140089ab9
mov rcx, qword [rcx + 0xe28]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbx + 0xe28]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x198]
jmp 0x1400897f7
mov rdx, rdi
call fcn.140098d10
jmp case.default.0x140089ab9
mov r8, rbp
mov rdx, rdi
call fcn.140099350
jmp case.default.0x140089ab9
mov rdx, rdi
call fcn.140099940
cmp r14d, 0x112
jne 0x140089b84
cmp rdi, 0xf032
jne 0x140089ba3
jmp 0x140089bb7
cmp r14d, 0x100
jne 0x140089ba3
cmp rdi, 0x20
ja 0x140089ba3
movabs rax, 0x108002000
bt rax, rdi
jb 0x140089bb7
mov r9, rbp
mov r8, rdi
mov edx, r14d
mov rcx, rbx
call fcn.1400c5180
mov r15, rax
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret