Function at 0x18001c3e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1800b43d8]
xor rax, rsp
mov qword [rsp + 0x90], rax
imul eax, r9d, 0x495
mov r13, r8
mov dword [rsp + 0x78], r9d
mov rsi, rdx
mov qword [rsp + 0x70], rdx
mov r8, rcx
mov qword [rsp + 0x60], rcx
mov ebp, r9d
mov dword [rsp + 0x58], eax
mov ebx, dword [rsp + 0x58]
cmp r9d, eax
ja 0x18001c555
mov r15, qword [rsp + 0x70]
lea r9, [0x1800ee608]
mov r12, qword [rsp + 0x70]
mov edi, 0xffffffff
mov r14, qword [rsp + 0x68]
nop word [rax + rax]
cmp ebp, 0x3296
ja 0x18001c6b1
je 0x18001c619
cmp ebp, 0xf5
ja 0x18001c5bc
je 0x18001c5a8
mov eax, ebp
sub eax, 0xc
je 0x18001c582
sub eax, 0x7c
je 0x18001c7b9
sub eax, 0x1d
je 0x18001c540
cmp eax, 0x14
jne 0x18001c7a3
mov dword [rsp + 0x28], 0xc4
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.18004c270
xor edx, edx
mov qword [rsp + 0x68], rax
mov esi, edx
lea r14, [rsp + 0x80]
mov rcx, rax
nop
mov qword [rsp + 0x40], rdx
lea eax, [rsi + 0xb]
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], 0x3e
call fcn.18004da80
mov rcx, qword [rsp + 0x68]
lea r14, [r14 + 4]
inc esi
mov edx, 0
cmp esi, 4
jb 0x18001c4e0
mov rsi, qword [rsp + 0x70]
lea r9, [0x1800ee608]
mov r14, rcx
jmp 0x18001c79e
mov edx, dword [r13 + 8]
mov ecx, dword [r8]
cmp ecx, edx
ja 0x18001c555
add ecx, dword [rsi]
cmp ecx, edx
jbe 0x18001c7a3
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800602e0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx edx, byte [r13]
lea rcx, [0x1800ed608]
xor eax, eax
cmp byte [rcx], dl
je 0x18001c7d1
inc eax
sub rcx, 0xffffffffffffff80
cmp rcx, r9
jl 0x18001c590
jmp 0x18001c7a3
mov eax, dword [r8]
cmp dword [r13], eax
jle 0x18001c7a3
mov eax, 1
jmp 0x18001c557
cmp ebp, 0x348
je 0x18001c612
cmp ebp, 0x684
je 0x18001c555
cmp ebp, 0x2d1e
jne 0x18001c7a3
mov r10d, dword [r8]
mov ecx, dword [rsi]
mov r8d, dword [r13 + 8]
mov r9, qword [r13]
sub r8d, ecx
sub r8d, r10d
lea eax, [rcx + r10]
shl r8, 3
lea rdx, [r9 + rax*8]
lea rcx, [r9 + r10*8]
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [rsi]
lea r9, [0x1800ee608]
sub dword [r13 + 8], eax
jmp 0x18001c79e
mov ebx, edi
jmp 0x18001c7a3
xor esi, esi
nop dword [rax + rax]
mov qword [rsp + 0x40], 0
lea eax, [rsi + 7]
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov dword [rsp + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x3e
call fcn.18004da80
xor r9d, r9d
mov r8d, 0x119
mov rdx, rax
xor ecx, ecx
call fcn.18005ddc0
inc esi
cmp esi, 4
jb 0x18001c620
mov r9, r14
mov dword [rsp + 0x68], 4
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], 7
lea rdx, [rsp + 0x68]
mov ecx, pe_nt_image_headers64
call fcn.18004e490
mov rsi, qword [rsp + 0x70]
lea r9, [0x1800ee608]
jmp 0x18001c79e
cmp ebp, 0xc710
ja 0x18001c74c
je 0x18001c739
cmp ebp, 0x42fe
je 0x18001c729
cmp ebp, 0x6473
je 0x18001c7a3
cmp ebp, 0x8507
je 0x18001c716
cmp ebp, 0x9650
jne 0x18001c7a3
mov r9d, 0x139
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.180047b40
mov r8d, 0x57
mov rdx, r14
xor ecx, ecx
call fcn.180051b60
lea r9, [0x1800ee608]
jmp 0x18001c79e
mov eax, dword [r13]
dec eax
movsxd rcx, eax
mov rax, qword [r13 + 0x10]
lea r12, [rax + rcx*4]
jmp 0x18001c7a3
mov eax, dword [r8]
cmp dword [r13], eax
jge 0x18001c7a3
mov eax, edi
jmp 0x18001c557
mov eax, dword [r13]
dec eax
movsxd rcx, eax
mov rax, qword [r8 + 0x10]
lea r15, [rax + rcx*4]
jmp 0x18001c7a3
cmp ebp, 0x10919
je 0x18001c76e
cmp ebp, 0x14b22
je 0x18001c76a
cmp ebp, 0x18d2b
je 0x18001c555
jmp 0x18001c7a3
xor ebx, ebx
jmp 0x18001c7a3
mov r8d, dword [r13]
xor edx, edx
test r8d, r8d
jle 0x18001c79e
nop dword [rax]
mov eax, dword [r12]
cmp eax, dword [r15]
ja 0x18001c5b5
jb 0x18001c732
inc edx
sub r12, 4
sub r15, 4
cmp edx, r8d
jl 0x18001c780
mov r8, qword [rsp + 0x60]
imul eax, dword [rsp + 0x78], 0x45
add ebp, eax
cmp ebp, dword [rsp + 0x58]
jbe 0x18001c460
jmp 0x18001c555
mov rdx, r13
lea rcx, str.0y5BDbllT66COI9KmTds7w
call fcn.18005fbf0
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsxd rcx, eax
lea rdx, [0x1800ed600]
shl rcx, 7
cmp qword [rcx + rdx], 0
cmove eax, edi
jmp 0x18001c557