Function at 0x18006a710
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [rsp + 0xb8]
lea r13d, [r9 + 0x672]
movaps xmmword [rsp + 0x50], xmm6
mov r15d, r9d
movaps xmmword [rsp + 0x40], xmm7
mov r14, r8
mov r12, rdx
mov rsi, rcx
cmp r9d, r13d
jae 0x18006a9ae
movsd xmm7, qword [0x180080b38]
mov ebp, dword [rsp + 0xb8]
movsd xmm6, qword [rsp + 0x38]
nop dword [rax + rax]
cmp r15d, 0x258
ja 0x18006a9e2
je 0x18006a994
mov eax, r15d
sub eax, 0xca
je 0x18006a97d
sub eax, 0x35
je 0x18006a954
sub eax, 0xf
je 0x18006a8fb
sub eax, 0x96
je 0x18006a7be
cmp eax, 0xf
jne 0x18006aa58
mov r15d, 0x1b3
jmp 0x18006aa58
movaps xmm0, xmm6
addsd xmm0, qword [r14 + 0x110]
comisd xmm7, xmm0
jbe 0x18006a880
mov eax, dword [rsi]
lea r8, [rsp + 0xb8]
lea rdx, [r14 + 0x108]
mov dword [rsp + 0xb8], eax
mov ecx, reloc.SHELL32.dll_ILAppendID
call fcn.18004f390
cmp eax, 0x1388
jb 0x18006a856
mov edi, 0x104
cmp edi, 0x104
je 0x18006a81c
cmp edi, 0x2490
jne 0x18006a848
mov dword [r12], 1
jmp 0x18006a848
xor r9d, r9d
lea rcx, [r14 + 0x108]
xor edx, edx
lea r8d, [r9 + 0x29]
call fcn.18004f5b0
mov r9d, 0xcc
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180076ed0
add edi, 0x238c
cmp edi, 0x4718
jbe 0x18006a802
mov edx, 0x33
lea rcx, [r14 + 0x108]
call fcn.18004f530
mov rsi, qword [rsp + 0xa0]
jmp 0x18006aa58
xor r9d, r9d
lea rcx, [r14 + 0x108]
xor edx, edx
lea r8d, [r9 + 0x29]
call fcn.18004f5b0
comisd xmm6, xmm7
lea rcx, [r14 + 0x108]
jb 0x18006a8ec
mov eax, dword [rsi]
lea r8, [rsp + 0xb8]
mov edx, 6
mov dword [rsp + 0xb8], eax
call fcn.18004f140
cmp eax, 0x1388
jb 0x18006aa58
lea rdx, [r14 + 0x48]
mov ecx, 0xd1
call fcn.18006aa70
mov edx, 0x33
lea rcx, [r14 + 0x108]
call fcn.18004f530
jmp 0x18006aa58
mov edx, 0x33
call fcn.18004f530
jmp 0x18006aa58
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18006aa58
nop
cmp ebp, 0x23
jne 0x18006a92f
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
cmp eax, 0xffffffff
je 0x18006a93f
cmp eax, 0xd
je 0x18006a93f
cmp eax, 0xa
jne 0x18006a915
jmp 0x18006a93f
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x18006a7b3
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getc]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x18006a910
jmp 0x18006aa58
lea r8, [rsp + 0x38]
mov dword [r12], 0
mov rdx, r14
mov ecx, reloc.SHELL32.dll_SHSetFolderPathW
call fcn.18004e330
test al, al
je 0x18006a9ae
movsd xmm6, qword [rsp + 0x38]
jmp 0x18006aa58
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
mov qword [r14 + 0x20], rax
jmp 0x18006aa58
cmp ebp, 0xffffffff
jne 0x18006aa58
mov eax, 0x57
cmp eax, 0x57
je 0x18006a9d2
cmp eax, 0x11e
jne 0x18006a9d4
movaps xmm6, xmmword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
add eax, 0xc7
cmp eax, 0x1e5
jb 0x18006a9a2
jmp 0x18006aa58
cmp r15d, 0x2fd
je 0x18006aa4d
cmp r15d, 0x3a2
je 0x18006aa0e
cmp r15d, 0x447
je 0x18006aa08
cmp r15d, 0x4ec
je 0x18006a9ae
jmp 0x18006aa58
mov ebx, dword [rsp + 0x30]
jmp 0x18006aa58
lea r8, [rsp + 0x30]
mov rcx, r14
lea rdx, [0x18007d3cc]
call fcn.180079070
cmp eax, 1
je 0x18006aa58
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ERROR_SESSION_CREDENTIAL_CONFLICT
call fcn.180079020
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, r14
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ungetc]
add r15d, 0xa5
cmp r15d, r13d
jb 0x18006a770
jmp 0x18006a9ae