Function at 0x18002a800
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd8
mov eax, dword [rbp + 0x77]
mov r12, rdx
mov rsi, qword [rbp - 0x31]
mov r13, r9
mov rdx, rcx
lea ebx, [rax + 0x524]
mov dword [rbp - 0x71], ebx
cmp eax, ebx
jae 0x18002aebb
mov edi, dword [rbp + 0x77]
lea r9, [0x180082428]
mov ebx, dword [rbp + 0x77]
lea r10, [0x180068390]
mov ecx, dword [rbp - 0x71]
mov qword [rbp - 0x31], rdi
mov qword [rbp - 1], rsi
nop dword [rax]
cmp eax, 0x1d1
ja 0x18002ae95
je 0x18002ad19
cmp eax, 0x115
ja 0x18002a9a3
je 0x18002a98a
sub eax, 0x59
je 0x18002a974
sub eax, 0x5e
je 0x18002a8ef
cmp eax, 0x44
jne 0x18002ae7f
xor r14d, r14d
lea ecx, [rax - 0x43]
mov edx, 0xb18
mov dword [rbp - 0x5d], r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8d, 0x10c
mov dword [rbp - 0x69], 0x18
mov r14, rax
mov qword [rbp - 0x51], rax
mov rax, qword [r12 + 0x20]
lea rcx, [rbp - 0x69]
mov rdx, r13
mov qword [rbp - 9], rax
call fcn.18004fc60
mov dword [r14], eax
jmp 0x18002ae66
xor r15d, r15d
cmp dword [r13], r15d
jle 0x18002a954
mov r14, r12
nop dword [rax + rax]
mov eax, dword [r8]
test eax, eax
jne 0x18002a920
mov eax, dword [r14]
lea r9, [rbp - 0x69]
xor edx, edx
mov dword [rbp - 0x69], eax
xor ecx, ecx
mov r8d, 0x127
call fcn.180007dc0
mov dword [rbp - 0x69], eax
lea r9, [rbp - 0x69]
mov eax, dword [r14]
lea rdx, [0x180082408]
mov r8d, 0xc0
mov dword [rbp - 0x79], eax
lea rcx, [rbp - 0x79]
call fcn.18003d3c0
mov r8, qword [rbp + 0x67]
inc r15d
add r14, 4
cmp r15d, dword [r13]
jl 0x18002a900
xor r9d, r9d
lea rdx, [0x180082408]
mov r8d, SHUnicodeToAnsi
xor ecx, ecx
call fcn.18003d3c0
mov qword [rbp - 0x39], rax
jmp 0x18002ae66
lea rdx, [0x180082408]
mov ecx, 0x10f
call fcn.18002fec0
jmp 0x18002ae66
mov edx, 0x11e
lea rcx, [0x180082408]
call fcn.180033000
mov dword [rbp - 0x59], eax
jmp 0x18002ae66
sub eax, 0x159
je 0x18002ac66
sub eax, 0x1a
je 0x18002abea
cmp eax, 0x44
jne 0x18002ae7f
mov rax, qword [rbp - 0x51]
xor r12d, r12d
cmp dword [rax + 0xc], r12d
jle 0x18002aac8
lea r15, [rax + 0x18]
nop word [rax + rax]
mov r14d, 0xfe
cmp r14d, 0xfe
je 0x18002aa5b
cmp r14d, 0x780e
je 0x18002aa2b
cmp r14d, 0xef1e
je 0x18002aa26
cmp r14d, 0x1662e
jne 0x18002aa9f
lea r8, [rbp - 0x79]
mov dword [rbp - 0x79], ebx
xor edx, edx
mov ecx, 0xc3
call fcn.1800314f0
add dword [rbp - 0x5d], eax
jmp 0x18002aa9f
mov dword [r15], ebx
jmp 0x18002aa9f
test edi, edi
je 0x18002aa9f
mov r8d, 0x10c
mov dword [rbp - 0x79], 5
mov rdx, r13
lea rcx, [rbp - 0x79]
call fcn.18004fc60
test eax, eax
js 0x18002acec
lea ecx, [rax*8]
or ebx, ecx
jmp 0x18002aa9f
mov r8d, 0x10c
mov dword [rbp - 0x79], 3
mov rdx, r13
lea rcx, [rbp - 0x79]
call fcn.18004fc60
mov r8d, 0x10c
mov dword [rbp - 0x79], 1
mov rdx, r13
lea rcx, [rbp - 0x79]
mov rbx, rax
call fcn.18004fc60
mov qword [rbp - 0x31], rax
mov rdi, rax
test eax, eax
js 0x18002acec
add r14d, 0x7710
cmp r14d, 0x1dc40
jbe 0x18002a9e6
mov rax, qword [rbp - 0x51]
inc r12d
add r15, 4
cmp r12d, dword [rax + 0xc]
jl 0x18002a9e0
movsxd r14, dword [rbp - 0x5d]
xor r15d, r15d
mov r12, r14
test r14d, r14d
jle 0x18002ab14
lea r14, [rax + reloc.SHLWAPI.dll_SHRegGetIntW]
nop
mov r8d, 0x10c
mov dword [rbp - 0x79], 8
mov rdx, r13
lea rcx, [rbp - 0x79]
call fcn.18004fc60
test eax, eax
js 0x18002acec
mov dword [r14], eax
inc r15
add r14, 4
cmp r15, r12
jl 0x18002aae0
mov r14d, dword [rbp - 0x5d]
mov r15, qword [rbp - 0x51]
mov rcx, qword [rbp - 9]
movsxd r10, dword [r15 + 0x14]
mov r9d, dword [rcx + 0x18]
cmp r10d, r9d
jge 0x18002acf0
xor r8d, r8d
test r14d, r14d
jle 0x18002ab6e
lea rdx, [r15 + reloc.SHLWAPI.dll_SHRegGetIntW]
nop dword [rax]
movsxd rax, dword [rdx]
cmp eax, r9d
jge 0x18002acf0
mov rcx, qword [rcx + rax*8 + 0xb20]
cmp dword [rcx + 0x10], 0
je 0x18002acf0
mov rcx, qword [rbp - 9]
inc r8
add rdx, 4
cmp r8, r12
jl 0x18002ab40
mov edx, 0x27
mov eax, edx
sub eax, 0x27
je 0x18002abc0
cmp eax, 1
jne 0x18002abda
mov ecx, dword [rbp - 0x49]
cmp ecx, eax
jl 0x18002acf0
mov eax, dword [r15 + 0xc]
mov r8d, dword [rbp - 0x45]
mov r9d, dword [rbp - 0x29]
nop word [rax + rax]
imul r8d, eax
mov dword [rbp - 0x45], r8d
cmp r8d, r9d
jg 0x18002acf0
dec ecx
mov dword [rbp - 0x49], ecx
test ecx, ecx
jg 0x18002aba0
mov dword [r15 + 0x10], r8d
jmp 0x18002abda
mov rcx, qword [rcx + r10*8 + 0xb20]
mov dword [rbp - 0x45], 1
mov eax, dword [rcx + 4]
mov dword [rbp - 0x29], eax
mov eax, dword [rcx]
mov dword [rbp - 0x49], eax
mov rcx, qword [rbp - 9]
inc edx
cmp edx, 0x29
jb 0x18002ab73
jmp 0x18002ae66
mov r9, qword [rbp + 0x7f]
mov eax, dword [rbp - 0x59]
cmp eax, dword [r9]
je 0x18002ae78
mov r14d, 0x76
mov eax, r14d
sub eax, 0x76
je 0x18002b33a
sub eax, 3
je 0x18002ac51
cmp eax, 1
jne 0x18002ac58
movsxd r15, dword [rbp - 0x25]
lea r8, str.inline_success_reason
xor r9d, r9d
mov dword [rbp - 0x79], r15d
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
test r15d, r15d
jle 0x18002ac58
mov r8, r15
xor edx, edx
movabs rcx, 0x735f656e696c6e69
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002ac58
mov dword [rbp - 0x25], 0
inc r14d
cmp r14d, 0x79
jb 0x18002ac00
jmp 0x18002ae66
mov r8d, 0x10c
mov dword [rbp - 0x79], 0x18
mov rdx, r13
lea rcx, [rbp - 0x79]
call fcn.18004fc60
mov r15, qword [rbp - 0x51]
lea rcx, [rbp - 0x79]
mov r8d, 0x10c
mov dword [rbp - 0x79], 0x18
mov rdx, r13
mov dword [r15 + 4], eax
call fcn.18004fc60
inc eax
mov dword [rbp - 0x79], 6
mov r8d, 0x10c
mov dword [r15 + 8], eax
mov rdx, r13
lea rcx, [rbp - 0x79]
call fcn.18004fc60
inc eax
mov dword [rbp - 0x79], 8
mov r8d, 0x10c
mov dword [r15 + 0xc], eax
mov rdx, r13
lea rcx, [rbp - 0x79]
call fcn.18004fc60
mov dword [r15 + 0x14], eax
test eax, eax
jns 0x18002ae66
jmp 0x18002acf0
mov r15, qword [rbp - 0x51]
xor eax, eax
mov dword [rbp + 0x77], 0x273
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov rdx, r15
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [rax + 0x3f]
call fcn.180022330
jmp 0x18002ae66
movsxd r14, dword [rbp - 0x59]
xor r13d, r13d
xor r15d, r15d
mov r12, r14
test r14d, r14d
jle 0x18002ae24
mov rcx, qword [rbp - 0x39]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
cmp eax, dword [rdx + r15*4]
je 0x18002ae0e
mov rsi, qword [rbp - 0x39]
xor r15d, r15d
mov rdi, qword [rbp + 0x57]
mov r13d, r14d
nop dword [rax]
movzx r14d, byte [r15 + rsi]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [rdi + r15*4]
lea rdx, str._x__x_n
mov rcx, rax
mov r8d, r14d
call fcn.18005f710
inc r15
cmp r15, r12
jl 0x18002ad60
mov rdi, qword [rbp - 0x31]
mov r14d, 0x76
mov rsi, qword [rbp - 1]
nop dword [rax]
mov eax, r14d
sub eax, 0x76
je 0x18002b367
sub eax, 3
je 0x18002adf2
cmp eax, 1
jne 0x18002adf9
mov eax, dword [rbp - 0x41]
lea r8, str.sourceSsaPhiInstruction
xor r9d, r9d
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
movsxd rax, dword [rbp - 0x41]
test eax, eax
jle 0x18002adf9
mov r8, rax
xor edx, edx
movabs rcx, 0x7353656372756f73
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002adf9
mov dword [rbp - 0x41], 0
inc r14d
cmp r14d, 0x79
jb 0x18002ada0
mov rcx, qword [rbp - 0x39]
mov rdx, qword [rbp + 0x57]
mov r14d, dword [rbp - 0x59]
inc r13d
inc r15
cmp r15, r12
jl 0x18002ad40
lea r9, [0x180082428]
mov rcx, qword [rbp - 0x39]
lea r8, [rbp - 0x79]
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x38], r9
xor r9d, r9d
mov dword [rsp + 0x30], 0xbe
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov dword [rbp - 0x79], r14d
call fcn.18004a100
mov r13, qword [rbp + 0x6f]
mov ecx, dword [rbp - 0x71]
lea r10, [0x180068390]
mov rdx, qword [rbp + 0x57]
mov r8, qword [rbp + 0x67]
lea r9, [0x180082428]
mov eax, dword [rbp + 0x77]
add eax, 0x5e
mov dword [rbp + 0x77], eax
cmp eax, ecx
jae 0x18002aebb
mov r12, qword [rbp + 0x5f]
jmp 0x18002a870
cmp eax, 0x28d
ja 0x18002b31a
je 0x18002b298
sub eax, 0x215
je 0x18002b28b
sub eax, 0x1a
je 0x18002aed2
cmp eax, 0x44
jne 0x18002ae7f
mov rax, rsi
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [r13], 0
mov dword [rbp - 0x69], 0
jle 0x18002ae7f
mov r13, r12
mov r12d, 0xdd
nop dword [rax]
cmp r12d, 0xdd
je 0x18002b213
cmp r12d, 0x4f6c
je 0x18002b046
cmp r12d, 0x9dfb
jne 0x18002b23a
movsxd r15, dword [rbp - 0x61]
mov rcx, r9
lea r14, [r10 + r15*4]
cmp r15d, 1
jne 0x18002afb6
lea edx, [r15 + 0x41]
call fcn.180036ea0
mov ecx, dword [r13]
and ecx, dword [r14]
cmp eax, ecx
je 0x18002b23a
mov r14d, 0x76
nop word [rax + rax]
mov eax, r14d
sub eax, 0x76
je 0x18002b394
sub eax, 3
je 0x18002afa1
cmp eax, 1
jne 0x18002afa8
movsxd r15, dword [rbp - 0x21]
lea r8, str.ConverterParamsAgentCloningParams
xor r9d, r9d
mov dword [rbp - 0x79], r15d
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
test r15d, r15d
jle 0x18002afa8
mov r8, r15
xor edx, edx
movabs rcx, 0x65747265766e6f43
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002afa8
mov dword [rbp - 0x21], 0
inc r14d
cmp r14d, 0x79
jb 0x18002af50
jmp 0x18002b23a
lea r8, [rbp - 0x79]
mov dword [rbp - 0x79], r15d
mov edx, 0x35
call fcn.180006b30
mov ecx, dword [r13]
and ecx, dword [r14]
cmp eax, ecx
je 0x18002b23a
mov r14d, 0x76
nop dword [rax]
mov eax, r14d
sub eax, 0x76
je 0x18002b3c1
sub eax, 3
je 0x18002b031
cmp eax, 1
jne 0x18002b038
movsxd r15, dword [rbp - 0x1d]
lea r8, str.remove_OnCreateProcess
xor r9d, r9d
mov dword [rbp - 0x79], r15d
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
test r15d, r15d
jle 0x18002b038
mov r8, r15
xor edx, edx
movabs rcx, 0x4f5f65766f6d6572
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002b038
mov dword [rbp - 0x1d], 0
inc r14d
cmp r14d, 0x79
jb 0x18002afe0
jmp 0x18002b23a
mov r14d, dword [rbp - 0x61]
lea r8, [rbp - 0x79]
mov edx, reloc.SHLWAPI.dll_SHUnicodeToAnsi
mov dword [rbp - 0x79], r14d
mov rcx, r9
call fcn.18003ced0
cmp eax, 0xffffffff
jne 0x18002b0d5
mov r14d, 0x76
nop word [rax + rax]
mov eax, r14d
sub eax, 0x76
je 0x18002b3ee
sub eax, 3
je 0x18002b0c1
cmp eax, 1
jne 0x18002b0c8
movsxd r15, dword [rbp - 0x19]
lea r8, str.MatchToMiddle
xor r9d, r9d
mov dword [rbp - 0x79], r15d
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
test r15d, r15d
jle 0x18002b0c8
mov r8, r15
xor edx, edx
movabs rcx, 0x4d6f54686374614d
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002b0c8
mov dword [rbp - 0x19], 0
inc r14d
cmp r14d, 0x79
jb 0x18002b070
mov r14d, dword [rbp - 0x61]
lea r8, [rbp - 0x79]
mov dword [rbp - 0x79], r14d
mov edx, reloc.SHLWAPI.dll_SHUnicodeToAnsi
lea rcx, [0x180082428]
call fcn.18003ced0
movsxd rcx, r14d
lea rdx, [0x180068390]
lea r15, [rdx + rcx*4]
mov ecx, dword [r13]
and ecx, dword [r15]
cmp eax, ecx
je 0x18002b176
mov r14d, 0x76
nop dword [rax]
mov eax, r14d
sub eax, 0x76
je 0x18002b41b
sub eax, 3
je 0x18002b162
cmp eax, 1
jne 0x18002b169
mov eax, dword [rbp - 0x3d]
lea r8, str.Unknown_bitstream_filter__s
xor r9d, r9d
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
movsxd rax, dword [rbp - 0x3d]
test eax, eax
jle 0x18002b169
mov r8, rax
xor edx, edx
movabs rcx, 0x206e776f6e6b6e55
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002b169
mov dword [rbp - 0x3d], 0
inc r14d
cmp r14d, 0x79
jb 0x18002b110
mov r14d, dword [rbp - 0x61]
cmp r14d, 1
jne 0x18002b23a
xor r8d, r8d
lea rdx, [0x180082428]
mov ecx, 0xc2
call fcn.18000ac30
mov ecx, dword [r13]
and ecx, dword [r15]
cmp eax, ecx
je 0x18002b23a
mov r14d, 0x76
nop dword [rax]
mov eax, r14d
sub eax, 0x76
je 0x18002b448
sub eax, 3
je 0x18002b201
cmp eax, 1
jne 0x18002b208
movsxd r15, dword [rbp - 0x15]
lea r8, str.OOBELib_IAL_Communication_Error_Cancel
xor r9d, r9d
mov dword [rbp - 0x79], r15d
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
test r15d, r15d
jle 0x18002b208
mov r8, r15
xor edx, edx
movabs rcx, 0x2062694c45424f4f
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002b208
mov dword [rbp - 0x15], 0
inc r14d
cmp r14d, 0x79
jb 0x18002b1b0
jmp 0x18002b23a
mov eax, dword [r8]
mov dword [rbp - 0x61], eax
test eax, eax
jne 0x18002b23a
mov eax, dword [r13]
lea r9, [rbp - 0x79]
xor edx, edx
mov dword [rbp - 0x79], eax
xor ecx, ecx
mov r8d, 0x127
call fcn.180007dc0
mov dword [rbp - 0x61], eax
mov r8, qword [rbp + 0x67]
lea r9, [0x180082428]
add r12d, 0x4e8f
lea r10, [0x180068390]
cmp r12d, 0xebad
jbe 0x18002aef0
mov eax, dword [rbp - 0x69]
lea r9, [0x180082428]
mov rcx, qword [rbp + 0x6f]
lea r10, [0x180068390]
inc eax
add r13, 4
mov dword [rbp - 0x69], eax
cmp eax, dword [rcx]
jl 0x18002aee3
jmp 0x18002ae62
mov rsi, qword [rbp - 0x51]
mov qword [rbp - 1], rsi
jmp 0x18002ae7f
mov edx, 0x11e
mov rcx, r9
call fcn.180033000
cmp eax, dword [rbp - 0x59]
je 0x18002ae66
mov r14d, 0x76
mov eax, r14d
sub eax, 0x76
je 0x18002b475
sub eax, 3
je 0x18002b305
cmp eax, 1
jne 0x18002b30c
movsxd r15, dword [rbp - 0x11]
lea r8, str.Invalid_separator_s__found.
xor r9d, r9d
mov dword [rbp - 0x79], r15d
lea rdx, [rbp - 0x79]
mov ecx, 0x128
call fcn.180045490
test r15d, r15d
jle 0x18002b30c
mov r8, r15
xor edx, edx
movabs rcx, 0x2064696c61766e49
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18002b30c
mov dword [rbp - 0x11], 0
inc r14d
cmp r14d, 0x79
jb 0x18002b2b4
jmp 0x18002ae66
sub eax, 0x2d1
je 0x18002b32f
cmp eax, 0x5e
je 0x18002aebb
jmp 0x18002ae7f
xor esi, esi
mov qword [rbp - 1], rsi
jmp 0x18002ae7f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.inline_success_reason
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.sourceSsaPhiInstruction
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.ConverterParamsAgentCloningParams
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.remove_OnCreateProcess
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.MatchToMiddle
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Unknown_bitstream_filter__s
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
add bh, bh
adc eax, 0x37101
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.OOBELib_IAL_Communication_Error_Cancel
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Invalid_separator_s__found.
lea rdx, [0x18007a85c]
call fcn.18005f710
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3