Function at 0x18002b3c0
Capabilities:
Print debug messages
Terminate process

Disassembly:
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x2c8
mov rax, qword [0x1802bb7b8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x44], 0
lea rax, [rsp + 0x1e0]
mov rdi, rax
xor eax, eax
mov ecx, 0xc8
rep stosb byte [rdi], al
cmp dword [rsp + 0x2e0], 4
jbe 0x18002b708
xor r9d, r9d
mov r8d, dword [rsp + 0x2e0]
xor edx, edx
mov ecx, 1
call sym.VisualLibrary.dll_xHunter_OpenProcess
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18002b623
cmp qword [rsp + 0x48], 0xffffffffffffffff
je 0x18002b623
mov edx, 8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x18002b533
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
lea rcx, [0x1800bd780]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x26
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x18002b49b
mov dword [rsp + 0x34], 1
jmp 0x18002b4a3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x18002b4fa
mov dword [rsp + 0x20], 0
jmp 0x18002b4c0
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x27
jge 0x18002b4fa
movsxd rax, dword [rsp + 0x20]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x20]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x50]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x20]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18002b4b6
lea rax, [rsp + 0x60]
mov r8d, dword [rsp + 0x2e0]
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [rsp + 0x44], 1
jmp 0x18002b613
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0xb0]
lea rcx, [0x1800bd7d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2b
movzx eax, word [rsp + rax + 0xb0]
test eax, eax
je 0x18002b57f
mov dword [rsp + 0x38], 1
jmp 0x18002b587
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x18002b5e4
mov dword [rsp + 0x24], 0
jmp 0x18002b5a4
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x2c
jge 0x18002b5e4
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0xb0]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x54]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0xb0], ax
jmp 0x18002b59a
lea rax, [rsp + 0xb0]
mov r8d, dword [rsp + 0x2e0]
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002b703
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x110]
lea rcx, [0x1800bd830]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x5c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2d
movzx eax, word [rsp + rax + 0x110]
test eax, eax
je 0x18002b66f
mov dword [rsp + 0x3c], 1
jmp 0x18002b677
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
test eax, eax
je 0x18002b6d4
mov dword [rsp + 0x28], 0
jmp 0x18002b694
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x2e
jge 0x18002b6d4
movsxd rax, dword [rsp + 0x28]
movzx eax, word [rsp + rax*2 + 0x110]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x28]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x58]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x28]
mov word [rsp + rcx*2 + 0x110], ax
jmp 0x18002b68a
lea rax, [rsp + 0x110]
mov r8d, dword [rsp + 0x2e0]
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x18002b7e8
lea rax, [rsp + 0x33]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x170]
lea rcx, str.z__XeDX_IHuy
mov rdi, rax
mov rsi, rcx
mov ecx, 0x62
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x30
movzx eax, word [rsp + rax + 0x170]
test eax, eax
je 0x18002b754
mov dword [rsp + 0x40], 1
jmp 0x18002b75c
mov dword [rsp + 0x40], 0
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x18002b7b9
mov dword [rsp + 0x2c], 0
jmp 0x18002b779
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x31
jge 0x18002b7b9
movsxd rax, dword [rsp + 0x2c]
movzx eax, word [rsp + rax*2 + 0x170]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x2c]
cdq
mov ecx, 0x3a
idiv ecx
mov eax, edx
add eax, 0x31
mov ecx, dword [rsp + 0x5c]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x2c]
mov word [rsp + rcx*2 + 0x170], ax
jmp 0x18002b76f
lea rax, [rsp + 0x170]
mov r8d, dword [rsp + 0x2e0]
mov rdx, rax
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.18004e560
add rsp, 0x2c8
pop rdi
pop rsi
ret