Function at 0x180044630
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe8
mov rax, qword [0x180059178]
xor rax, rsp
mov qword [rbp - 9], rax
mov eax, dword [rbp + 0x7f]
mov r13, r9
mov r9, qword [rbp + 0x87]
mov r11, r8
mov r12, qword [rbp + 0x77]
mov rsi, rdx
mov qword [rsp + 0x58], r8
mov r14, rcx
mov r8, qword [rbp + 0x6f]
lea ebx, [rax - 7]
mov qword [rsp + 0x60], rdx
mov qword [rbp - 0x79], r8
mov qword [rsp + 0x48], r9
mov dword [rsp + 0x40], ebx
cmp eax, ebx
jbe case.0x1800446d0.0
lea r15d, [rax - 0xcd]
xor ebx, ebx
mov eax, dword [rsp + 0x40]
lea rdx, [0x180000000]
mov dword [rsp + 0x50], r15d
mov edi, SHSetFolderPathA
mov r10d, 0x2e
cmp r15d, 0x16
ja case.default.0x1800446d0
mov ecx, dword [rdx + r15*4 + 0x44eac]
add rcx, rdx
jmp rcx
xor eax, eax
lock cmpxchg dword [r13 + 0x11c], ebx
cmp eax, 1
je 0x180044c7a
xor eax, eax
lock cmpxchg dword [r13 + 0x120], ebx
cmp eax, 1
jne case.0x1800446d0.2
mov edi, 0x55
nop
cmp edi, 0x1c2
ja 0x1800447c1
je 0x1800447a9
mov eax, edi
sub eax, 0x55
je 0x1800447a0
sub eax, 0x49
je 0x18004477e
sub eax, 0x49
je 0x18004475c
sub eax, 0x49
je 0x180044749
cmp eax, 0x49
jne 0x18004488a
mov byte [rbp - 0x28], 0x3d
mov dword [rbp - 0x27], 0x4e614e20
mov byte [rbp - 0x23], 0
jmp 0x18004488a
mov byte [rbp - 0x2b], 0
lea rdx, [0x18004d832]
mov r8d, 3
jmp 0x18004478b
mov r8d, 4
lea rdx, [0x18004d810]
lea rcx, [rbp - 0x2f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r10d, 0x2e
jmp 0x18004488a
mov r8d, 2
lea rdx, [0x18004d7b9]
lea rcx, [rbp - 0x31]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r10d, 0x2e
jmp 0x18004488a
mov byte [rbp - 0x31], 0
jmp 0x18004488a
mov dword [rbp - 0x21], 0x756369
mov word [rbp - 0x1e], 0x64
mov word [rbp - 0x23], 0x3b
jmp 0x18004488a
mov eax, edi
sub eax, 0x20b
je 0x18004486c
sub eax, 0x49
je 0x180044850
sub eax, 0x49
je 0x18004481a
cmp eax, 0x49
jne 0x18004488a
xchg dword [r13 + 0x120], ebx
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rax, qword [rbp - 0x71]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1800461b0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 4
mov word [rbp - 0x10], r10w
lea rdx, [0x18004d850]
lea rcx, [rbp - 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov r8d, 0x120
call fcn.1800168b0
mov r10d, 0x2e
jmp 0x18004488a
mov eax, dword [str._ewo]
mov dword [rbp - 0x17], 0x727275
mov dword [rbp - 0x14], eax
movzx eax, byte [0x18004d7f8]
mov byte [rbp - 0x10], al
jmp 0x18004488a
movzx eax, word [0x18004d844]
mov word [rbp - 0x1d], ax
mov eax, dword [str.1l_c]
mov dword [rbp - 0x1b], eax
movzx eax, byte [0x18004d84c]
mov byte [rbp - 0x17], al
add edi, 0x49
cmp edi, 0x32f
jb 0x180044700
mov edi, SHSetFolderPathA
jmp 0x180044c40
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0x105
call fcn.180039750
mov dword [rbp - 0x71], eax
jmp 0x180044c40
movsxd rax, dword [r9]
movsxd rdx, dword [r14]
imul rax, rax, 0xb
add rax, r13
movzx ecx, byte [rdx + rax]
cmp cl, 0x2a
jne 0x180044a48
mov r15d, 0xfb
nop dword [rax]
cmp r15d, 0xfb
je 0x180044a06
cmp r15d, 0x2738
je 0x1800449f3
cmp r15d, 0x4d75
je 0x1800449c9
cmp r15d, 0x73b2
jne 0x180044a17
mov eax, dword [r9]
lea esi, [rax - 1]
inc eax
cmp esi, eax
jg 0x180044a17
mov rbx, qword [rsp + 0x60]
nop dword [rax]
mov eax, dword [r14]
lea edi, [rax - 1]
inc eax
cmp edi, eax
jg 0x1800449b6
nop dword [rax]
lea eax, [rsi - 1]
cmp eax, 9
ja 0x1800449a6
lea eax, [rdi - 1]
cmp eax, 9
ja 0x1800449a6
mov eax, dword [r8]
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x61], eax
mov r9, r13
lea rax, [rbp - 0x69]
mov dword [rbp - 0x59], edi
mov qword [rsp + 0x38], rax
mov r8, r11
mov dword [rsp + 0x30], 0xdc
lea rax, [rbp - 0x61]
mov qword [rsp + 0x28], r12
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x69], esi
call fcn.180044630
mov r8, qword [rbp - 0x79]
mov r11, qword [rsp + 0x58]
mov eax, dword [r14]
inc edi
inc eax
cmp edi, eax
jle 0x180044950
mov r9, qword [rsp + 0x48]
mov eax, dword [r9]
inc esi
inc eax
cmp esi, eax
jle 0x180044940
xor ebx, ebx
jmp 0x180044a17
movsxd rax, dword [r9]
xor r8d, r8d
movsxd rdx, dword [r14]
xor r9d, r9d
imul rax, rax, 0xb
xor ecx, ecx
mov qword [rsp + 0x20], rbx
add rax, r11
mov byte [rdx + rax], 0x4f
mov edx, 0x101
call fcn.1800241d0
jmp 0x180044a12
movsxd rax, dword [r9]
movsxd rdx, dword [r14]
imul rax, rax, 0xb
add rax, r13
mov byte [rdx + rax], 0x4f
jmp 0x180044a17
lea rcx, str.KEY_CREATE_SUB_KEY
call fcn.180045800
mov r9, qword [rsp + 0x48]
mov r8, qword [rbp - 0x79]
add r15d, 0x263d
mov r11, qword [rsp + 0x58]
cmp r15d, 0x98f4
jbe 0x1800448f0
mov rsi, qword [rsp + 0x60]
mov edi, SHSetFolderPathA
mov r15d, dword [rsp + 0x50]
jmp 0x180044c40
cmp cl, 0x4f
je 0x180044c40
cmp cl, 0x58
je 0x180044c40
lea eax, [rcx - 0x32]
cmp al, 3
jbe 0x180044abe
cmp cl, 0x7e
jne 0x180044c95
lea rcx, str.STRINGS_STR_GROUP_BOX_TITLE
call fcn.180045800
movsxd rdx, dword [r14]
xor r9d, r9d
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x20], rbx
movsxd rax, dword [r8]
imul rax, rax, 0xb
add rax, r13
mov byte [rdx + rax], 0x4f
movsxd rax, dword [r8]
xor r8d, r8d
movsxd rdx, dword [r14]
imul rcx, rax, 0xb
mov rax, qword [rsp + 0x58]
add rax, rcx
xor ecx, ecx
mov byte [rdx + rax], 0x4f
mov edx, 0x101
call fcn.1800241d0
jmp 0x180044c40
mov r15, qword [rbp - 0x79]
mov edi, 0x109
nop word [rax + rax]
mov eax, edi
sub eax, 0x109
je 0x180044b8f
sub eax, 1
je 0x180044b56
cmp eax, 1
jne 0x180044b72
mov eax, dword [rbp - 0x39]
lea r8, [rbp - 0x49]
mov dword [rbp - 0x51], eax
lea rdx, [rbp - 0x41]
mov eax, dword [r14]
mov ecx, 0x106
mov dword [rbp - 0x41], eax
mov eax, dword [r9]
lea r9, [rbp - 0x51]
mov dword [rbp - 0x49], eax
mov qword [rsp + 0x20], r13
call fcn.1800362c0
cmp al, 0x56
jne 0x180044b6d
lea rcx, str._INSTALL_TYPES
call fcn.180045800
dec dword [r12]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov edx, 0x101
xor ecx, ecx
call fcn.1800241d0
cmp dword [r12], 0
mov r9, qword [rsp + 0x48]
jne 0x180044b72
mov eax, dword [r15]
mov dword [rsi], eax
jmp 0x180044b72
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov edx, 0x101
xor ecx, ecx
call fcn.1800241d0
mov r9, qword [rsp + 0x48]
inc edi
cmp edi, 0x10c
jb 0x180044ad0
mov r15d, dword [rsp + 0x50]
mov edi, SHSetFolderPathA
jmp 0x180044c40
lea rcx, str.DataBitVector
call fcn.180045800
movsxd rdx, dword [r14]
mov r9, qword [rsp + 0x48]
movsxd rax, dword [r9]
imul rax, rax, 0xb
add rax, r13
movsx ecx, byte [rdx + rax]
mov byte [rdx + rax], 0x58
sub ecx, 0x30
movsxd rax, dword [r9]
movsxd rdx, dword [r14]
mov dword [rbp - 0x39], ecx
imul rcx, rax, 0xb
mov rax, qword [rsp + 0x58]
add rax, rcx
mov byte [rdx + rax], 0x58
jmp 0x180044b72
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov r9, r13
xor ecx, ecx
lea edx, [r8 + 0x50]
call fcn.180019e40
test al, al
mov ecx, 0xc9
mov r8, r13
cmove ecx, edi
xor edx, edx
call fcn.18002cfb0
jmp 0x180044c40
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9f
xor ecx, ecx
call fcn.18002e740
test al, al
je 0x180044caa
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0xb7
call fcn.1800380d0
cmp rax, 2
je 0x180044caa
lea rdx, [0x180000000]
mov eax, dword [rsp + 0x40]
mov r8d, dword [rbp + 0x7f]
dec r15d
dec r8d
mov dword [rsp + 0x50], r15d
mov dword [rbp + 0x7f], r8d
cmp r8d, eax
jbe case.0x1800446d0.0
mov r8, qword [rbp - 0x79]
mov r11, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
jmp 0x1800446b5
mov r8, r13
xor edx, edx
mov ecx, 0xc9
call fcn.18002cfb0
xchg dword [r13 + 0x11c], ebx
jmp case.0x1800446d0.0
lea rcx, str.__global___const_float__c_g_
call fcn.180045800
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, r13
xor edx, edx
mov ecx, 0xc9
call fcn.18002cfb0
jmp case.0x1800446d0.0
mov rcx, qword [r11]
movzx eax, byte [rcx + r13 - 1]
movzx r15d, byte [rax + rdx + 0x48cd0]
movzx eax, byte [r13]
movzx eax, byte [rax + rdx + 0x48cd0]
imul r15, rax
movabs rax, 0x842108421084211
imul r15, rcx
mul r15
mov rax, r15
sub rax, rdx
shr rax, 1
add rax, rdx
lea rdx, [0x180000000]
shr rax, 4
imul rax, rax, 0x1f
sub r15, rax
inc r15
imul r12, r15, 0x38
mov r14, qword [r12 + rdx + 0x4a9d0]
test r14, r14
je 0x180044e6c
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x60]
mov rax, qword [rsp + 0x60]
mov r8, qword [rsp + 0x60]
nop dword [rax]
mov r11, qword [r11]
cmp qword [r12 + rdx + 0x4a9d8], r11
jne 0x180044e74
mov esi, reloc.SHELL32.dll_SHTestTokenMembership
mov edi, 3
nop dword [rax + rax]
cmp edi, 9
ja case.default.0x180044d7c
mov ecx, edi
mov edx, dword [rdx + rcx*4 + 0x44f08]
lea rcx, [0x180000000]
add rdx, rcx
jmp rdx
test r14, r14
je 0x180044e3b
mov r9, r14
mov r10, r13
jmp case.0x180044d7c.4
cmp qword [r14 + 0x18], r13
je 0x180044e53
mov rdx, qword [r13 + 0x20]
test rdx, rdx
je 0x180044dad
mov rcx, qword [r13 + 0x18]
mov qword [rdx + 0x18], rcx
mov rdx, qword [r13 + 0x18]
test rdx, rdx
je 0x180044dbe
mov rcx, qword [r13 + 0x20]
mov qword [rdx + 0x20], rcx
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x180044dcf
mov qword [rcx + 0x20], r13
mov rcx, qword [r14 + 0x18]
mov qword [r13 + 0x18], rcx
jmp case.0x180044d7c.4
cmp r8, r11
jae case.0x180044d7c.4
nop word [rax + rax]
movzx ecx, byte [r10]
lea rbx, [0x180000000]
movzx edx, byte [r9]
movzx ecx, byte [rcx + rbx + 0x48cd0]
cmp byte [rdx + rbx + 0x48cd0], cl
mov ebx, 0
jne 0x180044e46
inc r9
inc r10
inc r8
cmp r8, r11
jb 0x180044de0
jmp case.0x180044d7c.4
mov r8, rbx
jmp case.0x180044d7c.4
mov qword [r13 + 0x20], r14
mov qword [r14 + 0x18], r13
lea rdx, [0x180000000]
dec esi
dec edi
cmp esi, 0xef
ja 0x180044d60
jmp 0x180044e4c
mov eax, 1
imul r12, r15, 0x38
jmp 0x180044e58
mov rax, r11
sub rax, r8
lea rcx, [0x180000000]
test rax, rax
je 0x180044e9d
lea rdx, [0x180000000]
mov r15, qword [r12 + rdx + 0x4a9f8]
test r15, r15
jne 0x180044e7e
mov rax, rbx
jmp 0x1800447fa
ja 0x180044e6c
mov r15, qword [r12 + rdx + 0x4a9f8]
imul r12, r15, 0x38
mov r14, qword [r12 + rdx + 0x4a9d0]
test r14, r14
je 0x180044e6c
mov r11, qword [rsp + 0x58]
jmp 0x180044d40
imul r12, r15, 0x38
lea rax, [rcx + 0x4a9d0]
add rax, r12
jmp 0x1800447fa