Function at 0x18006e100
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x18009a1f0]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov r14, qword [rsp + 0x50]
mov rax, rdx
mov r12, qword [rsp + 0x50]
mov r15d, ecx
imul edi, ecx, 0xad0
mov ebx, ecx
mov qword [rbp - 0x38], rdx
xor edx, edx
lea r8d, [rdx + 0x50]
cmp ecx, edi
ja 0x18006e422
lea esi, [rdx + 0x6f]
lea ecx, [rdx + 0x65]
lea r13d, [rdx + 0x3a]
nop dword [rax]
cmp ebx, 0x69a0
ja 0x18006e2e2
je 0x18006e2af
cmp ebx, 0x2358
ja 0x18006e25f
je 0x18006e220
cmp ebx, 0x34
je 0x18006e1c1
cmp ebx, 0x5e
je 0x18006e4bf
cmp ebx, esi
jne 0x18006e40d
mov word [rbp + 0x250], r8w
mov dword [rbp + 0x252], 0x690073
jmp 0x18006e40d
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov qword [rsp + 0x20], rdx
xor ecx, ecx
xor edx, edx
mov r8d, 0xbe
call fcn.180052fc0
xor edx, edx
mov qword [rsp + 0x50], 3
mov r12, rax
mov qword [rsp + 0x60], rdx
lea rax, [rsp + 0x50]
lea r9d, [rdx + 3]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rdx, r12
mov ecx, 0x95
call fcn.18003d680
mov ecx, 0x65
xor edx, edx
lea r8d, [rcx - 0x15]
jmp 0x18006e40d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x68], 1
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov rdx, r12
mov ecx, 0x95
call fcn.18003d680
lea rax, [rbp - 0x40]
mov qword [rbp - 0x40], 2
mov r9d, 2
jmp 0x18006e1f9
cmp ebx, 0x467c
je 0x18006e298
cmp ebx, 0x4b72
je 0x18006e289
cmp ebx, 0x6546
jne 0x18006e40d
mov eax, dword [rax]
mov dword [0x42420000], eax
jmp 0x18006e40d
mov dword [rbp + 0x256], 0x630049
jmp 0x18006e40d
mov qword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov r9d, 4
jmp 0x18006e1f9
xor r9d, r9d
mov qword [rbp - 0x48], 4
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r12
mov edx, 0x122
lea rcx, [rbp - 0x48]
call fcn.18002a630
mov ecx, 0x65
xor edx, edx
lea r8d, [rcx - 0x15]
jmp 0x18006e40d
cmp ebx, 0xd30c
ja 0x18006e3b7
je 0x18006e37f
cmp ebx, 0x8cc4
je 0x18006e34d
cmp ebx, 0x9675
je 0x18006e341
cmp ebx, 0xafe8
jne 0x18006e40d
cmp qword [r14 + 8], 1
je 0x18006e40d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Delete_right_to_end_of_next_word
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov word [rbp + 0x25a], si
jmp 0x18006e40d
mov r9, qword [rsp + 0x60]
lea rcx, [rbp - 0x50]
mov r8d, 0x75
mov qword [rbp - 0x50], 1
mov rdx, r12
call fcn.18006aa40
mov ecx, 0x65
mov r14, rax
xor edx, edx
lea r8d, [rcx - 0x15]
jmp 0x18006e40d
cmp qword [r14 + 0x10], 0
jne 0x18006e4c9
cmp qword [r14 + 0x18], 0
je 0x18006e40d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.palette_shift__d_is_out_of_range
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp ebx, 0xe178
je 0x18006e3fb
cmp ebx, 0x12c7b
je 0x18006e3db
cmp ebx, 0x1777e
jne 0x18006e40d
mov dword [rbp + 0x26e], 0x65
jmp 0x18006e40d
mov dword [rbp + 0x262], 0x720050
mov dword [rbp + 0x266], 0x760069
mov dword [rbp + 0x26a], 0x740061
jmp 0x18006e40d
mov dword [rbp + 0x25c], 0x3a006e
mov word [rbp + 0x260], r13w
imul eax, r15d, 0xad
add ebx, eax
mov rax, qword [rbp - 0x38]
cmp ebx, edi
jbe 0x18006e170
lea edi, [r15 + 0x8d0]
mov dword [rbp - 0x30], edi
cmp r15d, edi
jae case.0x18006e6bd.0
mov r13d, dword [rsp + 0x68]
movzx esi, byte [rsp + 0x58]
nop
cmp r15d, 0x268
ja 0x18006e640
je 0x18006e60f
cmp r15d, 0x14e
ja 0x18006e59f
je 0x18006e596
mov eax, r15d
sub eax, 0x34
je 0x18006e55c
sub eax, 0x3b
je 0x18006e550
sub eax, 0x52
je 0x18006e4ef
cmp eax, 0x3b
jne 0x18006ea1f
lea r8d, [rax - 0x37]
lea rdx, [0x18008f0f0]
lea rcx, [rbp + 0x240]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x18008f111]
mov dword [rbp + 0x244], eax
movzx eax, byte [0x18008f115]
mov byte [rbp + 0x248], al
jmp 0x18006ea1f
mov eax, 1
jmp 0x18006e860
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.opnd_set_size:_unknown_opnd_type
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [r14 + 0x10]
test rax, rax
je 0x18006ea60
cmp qword [rax + 8], 1
jne 0x18006ea60
mov rax, qword [r14 + 0x18]
test rax, rax
je 0x18006ea3a
cmp qword [rax + 8], 3
jne 0x18006ea3a
cmp qword [r14 + 0x20], 0
je 0x18006ea1f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.RenderGrid__relative_positioned_
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rbp + 0x240], 0
jmp 0x18006ea1f
mov r14, qword [r14 + 0x20]
test r14, r14
je 0x18006e570
cmp qword [r14 + 8], 2
je 0x18006ea1f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.guarantee_PageArmed__0__failed
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r14, qword [r14 + 0x18]
jmp 0x18006ea1f
mov eax, r15d
sub eax, 0x189
je 0x18006e603
sub eax, 0x52
je 0x18006e5c7
cmp eax, 0x3b
jne 0x18006ea1f
mov byte [rbp + 0x24a], 0
mov qword [rbp + 0x10], rdx
jmp 0x18006ea1f
cmp qword [r14 + 8], 3
jne 0x18006ea86
cmp qword [r14 + 0x10], 0
je 0x18006ea1f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ViEBase_released_too_many_times.
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rbp + 0x249], 0x70
jmp 0x18006ea1f
cmp qword [r14 + 0x18], 0
je 0x18006ea1f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Number_of_tracks_in_the_material
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp r15d, 0x3bd
ja 0x18006e83c
je 0x18006e82f
mov eax, r15d
sub eax, 0x2a3
je 0x18006e807
sub eax, 0x52
je 0x18006e7d2
cmp eax, 0x3b
jne 0x18006ea1f
mov qword [rbp], rdx
mov ecx, 0x202
mov dword [rbp - 0x40], edx
lea rdx, [rbp + 0xa0]
call qword [rbp - 0x18]
test eax, eax
je 0x18006ea1f
mov ebx, 0xb
xor edx, edx
nop dword [rax + rax]
cmp ebx, 0xb
ja case.default.0x18006e6bd
lea r8, [0x180000000]
mov eax, ebx
mov ecx, dword [r8 + rax*4 + 0x6ead4]
add rcx, r8
jmp rcx
mov qword [rbp - 0x28], rdx
mov dword [rbp - 0x7c], 0x2d
mov dword [rbp - 0x80], 0x36
jmp case.default.0x18006e6bd
mov dword [rbp - 0x78], 1
mov dword [rsp + 0x7c], 0x64
jmp case.default.0x18006e6bd
xorps xmm0, xmm0
mov dword [rsp + 0x78], 0x50
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
jmp case.default.0x18006e6bd
mov byte [rsp + 0x50], 0
jmp case.default.0x18006e6bd
mov eax, dword [rbp - 0x70]
mov r9d, dword [rsp + 0x7c]
mov r8d, dword [rbp - 0x80]
mov edx, dword [rbp - 0x7c]
mov rcx, qword [rbp - 0x20]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_Arc]
mov r8d, dword [rbp - 0x74]
lea r9, [rbp + 0x20]
mov edx, dword [rbp - 0x78]
xor eax, eax
mov rcx, qword [rbp - 0x28]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call sub.IMM32.dll_ImmGetImeMenuItemsA
xor edx, edx
jmp case.default.0x18006e6bd
mov dword [rbp - 0x74], 0x10
jmp case.default.0x18006e6bd
mov qword [rbp - 0x20], rdx
jmp case.default.0x18006e6bd
mov dword [rbp - 0x70], 0x50
mov dword [rbp + 0x20], 0x80
jmp case.default.0x18006e6bd
mov dword [rbp - 0x6c], 0x3c
jmp case.default.0x18006e6bd
mov dword [rbp - 0x68], 0x64
jmp case.default.0x18006e6bd
mov dword [rbp - 0x64], 0x3c
dec ebx
lea eax, [rbx + 0x69]
cmp eax, 0x68
ja 0x18006e6a0
jmp 0x18006ea1f
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x18006eaac
cmp qword [rax + 8], 2
jne 0x18006eaac
lea r8, [rbp - 0x60]
mov byte [rbp - 0x60], 1
mov edx, 9
mov rcx, r12
call fcn.180029880
mov r12, rax
jmp 0x18006ea1f
mov qword [rbp + 8], rdx
lea r9, str.ws2_32.dll
xor edx, edx
lea rcx, [rbp + 0x240]
mov r8d, 0x114
call fcn.180030ed0
mov qword [rbp - 0x18], rax
jmp 0x18006ea1f
mov dword [rsp + 0x68], 5
jmp 0x18006ea1f
cmp r15d, 0x44a
je 0x18006e8a6
cmp r15d, 0x4d7
je 0x18006e890
cmp r15d, 0x564
jne 0x18006ea1f
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.180082e70
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
xor r8d, r8d
lea ecx, [rdx + 0x62]
call fcn.180031840
mov byte [rsp + 0x50], al
jmp 0x18006ea1f
xor edx, edx
mov r8d, 0x100
mov rcx, rax
call fcn.180042a60
test al, al
jne 0x18006e9f3
mov edi, 0x45
cmp edi, 0x7317
ja 0x18006e956
je 0x18006e925
cmp edi, 0x45
je 0x18006e90f
cmp edi, 0x268b
je 0x18006e904
cmp edi, 0x4cd1
jne 0x18006e9de
xor eax, eax
mov dword [rbp - 0x58], 0x20008
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x50], 0x104
jmp 0x18006e9de
mov r13d, 3
jmp 0x18006e9de
xor eax, eax
mov qword [rbp - 0x10], 0xffffffffffffffff
mov qword [rbp - 8], rax
mov sil, 1
jmp 0x18006e9de
mov edx, dword [rbp - 0x58]
lea r8, [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov r9d, dword [rbp - 0x50]
lea r8, [rbp + 0x280]
mov rcx, qword [rbp - 8]
mov edx, r13d
mov dword [rbp - 0x48], eax
call sub.IMM32.dll_ImmGetGuideLineW
jmp 0x18006e9de
cmp edi, 0x995d
je 0x18006e96c
cmp edi, 0xbfa3
je case.0x18006e6bd.0
jmp 0x18006e9de
xor eax, eax
mov ecx, eax
movzx eax, sil
cmp dword [rbp - 0x48], ecx
cmovne ecx, eax
movzx esi, cl
test cl, cl
je 0x18006e9d9
mov ebx, 0x75
cmp ebx, 0x75
je 0x18006e9c0
cmp ebx, 0x107
je 0x18006e9ad
cmp ebx, 0x199
jne 0x18006e9cb
test sil, sil
je 0x18006e9cb
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18006e9cb
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x18006e9cb
xor sil, sil
jmp 0x18006e9cb
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
add ebx, 0x92
cmp ebx, 0x22b
jb 0x18006e986
mov byte [rsp + 0x50], 0
add edi, 0x2646
cmp edi, 0xe5a4
jbe 0x18006e8c3
mov edi, dword [rbp - 0x30]
mov r9d, dword [rbp - 0x40]
lea r8, [rbp + 0x250]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov r9d, dword [rsp + 0x68]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.GDI32.dll_CombineRgn]
add r15d, 0x8d
cmp r15d, edi
jae case.0x18006e6bd.0
mov rax, qword [rbp - 0x38]
xor edx, edx
jmp 0x18006e440
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.disable_2d_canvas_image_chromium
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._s_usage:_d__SSRC:_0x_x__idx:_u_
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__builtin_ia32_vfmaddps512_mask3
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.fs.unlinkSync__function_path__
call fcn.1800824b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3