Function at 0x18000fe90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x18005a098]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [rsp + 0x50], r9
mov qword [rbp - 0x69], r8
mov r13d, edx
mov r12, rcx
lea ebx, [rdx + 0xcf0]
mov dword [rsp + 0x40], ebx
movzx edi, byte [rsp + 0x48]
cmp edx, ebx
jae 0x18001032f
mov ecx, 0x79
mov edx, 0x6f66
mov r10d, 0x6547
lea r11d, [rcx - 5]
mov r8, 0xffffffffffffffff
mov r15, qword [rbp - 0x79]
mov rsi, qword [rbp - 0x79]
mov rbx, qword [rbp - 0x79]
mov r14, qword [rbp - 0x79]
mov eax, dword [rsp + 0x40]
nop
cmp r13d, 0x27b
ja 0x180010225
je 0x180010215
cmp r13d, 0x11c
ja 0x180010064
je 0x18000ffe2
mov eax, r13d
sub eax, 0x47
je 0x18000ffb7
sub eax, 0x31
je 0x18000ff97
sub eax, 0x87
je 0x18000ff68
cmp eax, 0xc
jne 0x1800103dd
mov dword [rbp - 0x11], 0x746547
mov eax, 0x53
mov word [rbp - 0xe], ax
jmp 0x1800103dd
mov qword [rsp + 0x58], 3
mov r8d, 3
lea rax, [rbp - 0x71]
mov edx, 0xf0
mov r9, r15
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x58]
call fcn.18002ccc0
jmp 0x1800103bc
mov qword [rsp + 0x20], 0
mov r9, r12
xor edx, edx
xor ecx, ecx
mov r8d, 0x10a
call fcn.18000e210
jmp 0x1800103bc
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf6
call fcn.18000e210
mov r15, rax
mov qword [rbp - 0x71], 0
jmp 0x1800103bc
mov qword [rbp - 0x21], 0
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
inc r8
cmp byte [r12 + r8], 0
jne 0x18000fff6
mov rdx, r12
lea rcx, [rbp - 0x31]
call fcn.180015250
nop
lea r8, [rbp - 0x31]
mov edx, 0xef
mov rcx, qword [rbp - 0x69]
call fcn.180022530
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1800103bc
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001005a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800103f6
call fcn.1800431e4
jmp 0x1800103bc
mov eax, r13d
sub eax, 0x1b7
je 0x180010201
sub eax, 0xc
je 0x1800101f1
sub eax, 0x11
je 0x180010164
cmp eax, 0x9b
jne 0x1800103dd
mov qword [rsp + 0x58], 2
lea rax, [rbp - 0x71]
mov qword [rsp + 0x20], rax
mov r9, r15
mov edx, 0xf0
mov r8d, 2
lea rcx, [rsp + 0x58]
call fcn.18002ccc0
mov rsi, qword [rbp - 0x71]
test rsi, rsi
je 0x1800103fd
cmp qword [rsi + 8], 2
jne 0x1800103fd
mov edx, 0xb9
mov eax, edx
sub eax, 0xb9
je 0x18001012d
sub eax, 0x23
je 0x180010125
sub eax, 0x5d
je 0x1800100f5
sub eax, 0x23
je 0x1800100fd
cmp eax, 0x80
jne 0x18001014c
mov rsi, rbx
jmp 0x1800103bc
mov rcx, qword [rsi]
test rcx, rcx
je 0x180010120
mov rax, qword [r15]
test cl, 1
je 0x180010111
imul r14, rax
imul rax, rax
mov qword [r15], rax
shr qword [rsi], 1
mov rcx, qword [rsi]
jne 0x180010105
mov rbx, r14
jmp 0x18001014c
mov r14d, 1
jmp 0x18001014c
test rsi, rsi
je 0x18001014a
cmp qword [rsi + 8], 1
je 0x18001015c
jbe 0x180010141
mov rsi, qword [rsi + 0x10]
jmp 0x180010145
mov rsi, qword [rsi + 0x18]
test rsi, rsi
jne 0x180010132
xor ebx, ebx
sub edx, 0xffffff80
cmp edx, 0x339
jae 0x1800100f5
jmp 0x1800100d6
mov rbx, rsi
jmp 0x1800103bc
mov qword [rbp - 0x21], 0
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x180010180
mov rdx, r9
lea rcx, [rbp - 0x31]
call fcn.180015250
nop
lea r9, [rbp - 0x31]
xor r8d, r8d
mov rdx, qword [rbp - 0x69]
mov ecx, 0x100
call fcn.18000ccd0
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1800103bc
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800101e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010423
call fcn.1800431e4
jmp 0x1800103bc
mov word [rbp - 0xd], cx
mov dword [rbp - 0xc], 0x657473
jmp 0x1800103dd
mov qword [rsp + 0x58], 1
mov r8d, 1
jmp 0x18000ff77
mov dword [rbp - 9], 0x6e496d
mov word [rbp - 6], dx
jmp 0x1800103e1
cmp r13d, 0x55b
ja 0x180010310
je 0x180010300
mov eax, r13d
sub eax, 0x327
je 0x1800102d2
sub eax, 0xc
je 0x1800102c9
sub eax, 0xb8
je 0x180010296
cmp eax, 0xb8
jne 0x1800103dd
mov dword [rbp + 0x13], 0x6c
mov r8d, 2
lea rdx, [0x18004ae88]
lea rcx, [rbp + 0x15]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea r8, [rbp - 0x11]
lea rdx, [rbp - 1]
mov ecx, 0x43
call fcn.18003df30
mov qword [rbp - 0x79], rax
jmp 0x1800103bc
mov eax, dword [0x18004d35c]
mov dword [rbp - 1], eax
movsd xmm0, qword [str.rnel]
movsd qword [rbp + 3], xmm0
movsd xmm0, qword [str.32.d]
movsd qword [rbp + 0xb], xmm0
movzx eax, word [0x18004d380]
mov word [rbp + 0x13], ax
jmp 0x1800103dd
mov byte [rbp - 4], 0
jmp 0x1800103dd
mov r8, rsi
xor edx, edx
mov ecx, 0xb2
call fcn.18000c280
mov byte [rsp + 0x48], 1
lea r8, [rsp + 0x48]
mov rdx, r15
mov ecx, 0xec
call fcn.180030880
mov r15, rax
jmp 0x1800103bc
cmp qword [r12 + 0x20], 0
je 0x1800103e1
mov al, 1
jmp 0x180010333
cmp r13d, 0x613
je 0x180010380
cmp r13d, 0x6cb
je 0x18001035a
cmp r13d, 0x783
jne 0x1800103e1
movzx eax, dil
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1800436f0
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r12 + 0x28]
add rcx, rcx
mov eax, 0x30
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1800431ec
mov qword [r12 + 0x10], rax
mov dil, 1
jmp 0x1800103bc
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xd1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180008230
test al, al
je 0x18001042a
lea rcx, [rbp - 0x61]
call qword [rbp - 0x79]
mov eax, dword [rbp - 0x41]
mov dword [r12 + 0x28], eax
mov r11d, 0x74
mov r10d, 0x6547
mov r8, 0xffffffffffffffff
mov edx, 0x6f66
lea ecx, [r11 + 5]
mov r9, qword [rsp + 0x50]
mov eax, dword [rsp + 0x40]
add r13d, 0xb8
cmp r13d, eax
jae 0x18001032f
jmp 0x18000ff10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ERROR_LOG_SPACE_RESERVED_INVALID
call fcn.180042f40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor al, al
jmp 0x180010333