Function at 0x180043e70
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xf8
mov rax, qword [0x1800737f8]
xor rax, rsp
mov qword [rbp - 9], rax
mov rdi, r9
mov r15, r8
mov qword [rbp - 0x59], rdx
mov qword [rsp + 0x58], rcx
mov r12, qword [rbp + 0x77]
mov qword [rbp - 0x51], r12
xor esi, esi
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], ILRemoveLastID
mov byte [rbp - 0x29], sil
mov qword [rbp - 0x39], rsi
mov eax, ILRemoveLastID
mov qword [rbp - 0x31], rax
mov byte [rbp - 0x49], sil
mov ecx, dword [rbp + 0x7f]
mov r13d, ecx
lea ebx, [rcx + 0x168]
mov dword [rbp - 0x69], ebx
lea r8, [0x180000000]
mov r10, qword [rbp - 0x59]
mov qword [rsp + 0x50], r10
cmp ecx, ebx
jae 0x180044499
lea r12d, [rcx - 0x62]
lea r9, [0x180065c38]
cmp r12d, 0xa4
ja case.0x180043f24.11
movzx eax, byte [r8 + r12 + 0x44984]
mov ecx, dword [r8 + rax*4 + 0x44954]
add rcx, r8
jmp rcx
mov byte [0x180074a80], 1
test r15, r15
je 0x1800440b2
mov rax, qword [0x180074a78]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x180043f44
mov r9, r15
mov r8d, 1
mov rcx, qword [0x180074a78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x1800440ad
mov r9, r15
mov edx, 1
mov r8d, edx
lea rcx, [0x180074a80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x1800440ad
mov r9, r15
mov edx, 0x68
lea r8d, [rdx - 0x67]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x1800440ad
mov r14d, 0xa1
mov eax, r14d
sub eax, 0xa1
je 0x180044055
cmp eax, 1
jne 0x18004409a
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x180044003
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180043ffe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800448f2
call fcn.18005fd08
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], ILRemoveLastID
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18004404e
inc rdx
mov rcx, qword [rbp - 0x29]
mov r8, rcx
cmp rdx, 0x1000
jb 0x180044049
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x18004494d
call fcn.18005fd08
mov eax, esi
jmp 0x180044453
cmp dword [rdi + 8], 0
jle 0x180044098
xor ebx, ebx
nop dword [rax]
mov rax, qword [rdi + 0x30]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x180044098
movsxd rdx, dword [rdi + 0xc]
shl rdx, 2
mov r9, r15
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
test rax, rax
je 0x1800442a5
inc esi
add rbx, 8
cmp esi, dword [rdi + 8]
jl 0x180044060
xor esi, esi
inc r14d
cmp r14d, 0xa3
jb 0x180043fb1
mov ebx, dword [rbp - 0x69]
mov r10, qword [rsp + 0x50]
mov dword [rbp - 0x79], 0xffffffff
jmp case.0x180043f24.11
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf1
call fcn.180021380
mov r10, rax
mov qword [rsp + 0x50], rax
jmp case.0x180043f24.11
test byte [rdi + 0x20], 4
jne 0x180044339
mov dword [rdi + 0x20], 4
jmp case.0x180043f24.11
mov qword [rsp + 0x68], rsi
jmp case.0x180043f24.11
mov eax, dword [rdx]
test eax, eax
je case.0x180043f24.7
cmp qword [rdi + 0x10], 0
je case.0x180043f24.7
cmp qword [r15 + 0x10], 0
je case.0x180043f24.7
mov dword [rbp - 0x61], eax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x69
lea r9, [rbp - 0x61]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180013570
mov r10, qword [rsp + 0x50]
jmp case.0x180043f24.11
mov qword [rbp - 0x71], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
mov r8d, 0xbb
mov rdx, r10
mov ecx, 4
call fcn.18005f180
mov qword [rbp - 0x71], 5
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
mov r8d, 0xbb
mov rdx, qword [rsp + 0x50]
mov ecx, 5
call fcn.18005f180
mov r10, qword [rsp + 0x50]
jmp case.0x180043f24.11
mov qword [rbp - 0x71], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
mov r8d, 0xbb
mov rdx, r10
mov ecx, 1
call fcn.18005f180
mov qword [rbp - 0x71], 2
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
mov r8d, 0xbb
mov rdx, qword [rsp + 0x50]
mov ecx, 2
call fcn.18005f180
mov qword [rbp - 0x71], 3
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x71]
mov r8d, 0xbb
mov rdx, qword [rsp + 0x50]
mov ecx, 3
call fcn.18005f180
mov r10, qword [rsp + 0x50]
jmp case.0x180043f24.11
mov qword [0x180074a78], r9
jmp case.0x180043f24.11
test byte [rdi + 0x20], 4
jne 0x18004427f
nop word [rax + rax]
mov rax, qword [rdi + 0x38]
mov r8, qword [rax + 0x30]
xor edx, edx
mov ecx, 0x139
call fcn.180038180
test byte [rdi + 0x20], 4
je 0x180044260
mov r10, qword [rsp + 0x50]
mov dword [rbp - 0x79], esi
add r13d, 0x1e
add r12d, 0x1e
lea r8, [0x180000000]
cmp r13d, ebx
jae 0x18004448e
mov rdx, qword [rbp - 0x59]
xor esi, esi
jmp 0x180043efc
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x1800442e0
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800442db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800448f2
call fcn.18005fd08
mov qword [rbp - 0x39], 0
mov qword [rbp - 0x31], ILRemoveLastID
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18004432f
inc rdx
mov rcx, qword [rbp - 0x29]
mov r8, rcx
cmp rdx, 0x1000
jb 0x18004432a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x18004494d
call fcn.18005fd08
mov eax, 0xffffffff
jmp 0x180044453
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x180044374
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004436f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800448f2
call fcn.18005fd08
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], ILRemoveLastID
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x18004404e
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800443be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004494d
call fcn.18005fd08
mov eax, esi
jmp 0x180044453
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x180044405
inc rdx
mov rcx, qword [rbp - 0x49]
cmp rdx, 0x1000
mov rax, rcx
jb 0x180044400
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800448f2
call fcn.18005fd08
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], ILRemoveLastID
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x180044450
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004444b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004494d
call fcn.18005fd08
mov eax, dword [rbp - 0x79]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1800604b0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rdi, rdi
je 0x180044485
movzx eax, word [rdi + 0x28]
mov word [rbp - 0x79], ax
jmp case.0x180043f24.7
mov word [rbp - 0x79], si
jmp case.0x180043f24.7
mov rax, qword [rbp - 0x31]
mov ecx, dword [rbp + 0x7f]
mov r12, qword [rbp - 0x51]
lea r14d, [rcx - 0xc]
cmp ecx, r14d
jbe 0x1800448c3
lea ebx, [rcx - 0x61]
mov rsi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x58]
cmp ebx, 0x10
ja case.0x1800444c7.2
mov ecx, dword [r8 + rbx*4 + 0x44a2c]
add rcx, r8
jmp rcx
mov rcx, qword [rsi + 0x18]
cmp qword [rcx + 8], 8
jne 0x180044827
mov rax, qword [rcx + 0x10]
cmp qword [rax + 8], 5
jne 0x180044801
mov rax, qword [rcx + 0x18]
cmp qword [rax + 8], 9
je case.0x1800444c7.2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.vim.dvs.OpaqueCmdData.ResultInfo
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rdi + 0x10]
cmp qword [r15 + 0x10], rcx
cmovae rcx, qword [r15 + 0x10]
mov qword [rsp + 0x58], rcx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0xc2
lea r8, [rbp - 0x49]
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.18003cc40
jmp 0x1800447de
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + 0x10]
mov rcx, qword [rax + 0x18]
cmp qword [rcx + 8], 7
jne 0x18004484d
mov rax, qword [rdx + 0x18]
mov rcx, qword [rax + 0x18]
cmp qword [rcx + 8], 0xa
je case.0x1800444c7.2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Y__Y_____AB_BITS___INTER_BITS__
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rsp + 0x60], 1
mov r9d, 0xba
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, r10
call fcn.1800401b0
mov r10, rax
mov qword [rsp + 0x50], rax
jmp case.0x1800444c7.2
cmp qword [rsi + 8], 4
je case.0x1800444c7.2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Check_failed:_request___NULL.
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rsi + 0x20], 0
je case.0x1800444c7.2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__clean_type_info_names_internal
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x68]
mov rdx, r10
mov ecx, 0x88
call fcn.180016bb0
mov rsi, rax
jmp 0x1800447de
mov rcx, qword [rsi + 0x10]
cmp qword [rcx + 8], 2
jne 0x180044899
mov rax, qword [rcx + 0x10]
cmp qword [rax + 8], 1
jne 0x180044873
mov rax, qword [rcx + 0x18]
cmp qword [rax + 8], 3
je case.0x1800444c7.2
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.DevObjGetDeviceInterfaceProperty
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp r12, rdi
je 0x1800446cd
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800446c1
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, r12
call fcn.1800203c0
mov rax, qword [r13]
mov qword [rsp + 0x58], rax
lea r9, [rbp - 0x49]
mov r8, r12
mov edx, 0x95
lea rcx, [rsp + 0x58]
call fcn.18000bed0
jmp 0x1800447de
mov qword [rsp + 0x58], 6
mov rdx, r10
mov ecx, 6
jmp 0x1800447c4
mov qword [rsp + 0x58], 0xa
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 0xbb
mov rdx, r10
mov ecx, 0xa
call fcn.18005f180
mov qword [rsp + 0x58], 6
mov r9, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
mov edx, 0xd7
lea rcx, [rsp + 0x68]
call fcn.18002fee0
jmp 0x1800447de
mov qword [rsp + 0x58], 7
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 0xbb
mov rdx, r10
mov ecx, 7
call fcn.18005f180
mov qword [rsp + 0x58], 8
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 0xbb
mov rdx, qword [rsp + 0x50]
mov ecx, 8
call fcn.18005f180
mov qword [rsp + 0x58], 9
mov rdx, qword [rsp + 0x50]
mov ecx, 9
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
mov r8d, 0xbb
call fcn.18005f180
mov r10, qword [rsp + 0x50]
dec ebx
lea eax, [rbx + 0x61]
cmp eax, r14d
jbe 0x1800448bf
mov r12, qword [rbp - 0x51]
lea r8, [0x180000000]
jmp 0x1800444b3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Reached_end_of_credential_caches
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.msocbvcrppslidebdractiveselected
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.944F8312FB104FDC968E1E232B0C9065
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.advixe_tpssmrte_javaprof_1.0.dll
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.kInstantiateComponentFromPackage
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x1800448fe
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800448f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800448f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005fd08
xor eax, eax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], ILRemoveLastID
mov byte [rbp - 0x49], al
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x180044450
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004444b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004444b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3