Function at 0x1800d5e60
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x298
mov rax, qword [0x1801eef68]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, dword [rsp + 0x310]
mov r14, rdx
mov rdx, qword [rsp + 0x308]
mov r12, r9
mov r15, qword [rsp + 0x300]
mov r10, r8
mov qword [rsp + 0x50], r8
lea r13d, [rbx + 0x46d]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x58], rdx
cmp ebx, r13d
jae 0x1800d613a
mov rsi, qword [rsp + 0x60]
mov ebp, dword [rsp + 0x38]
nop
cmp ebx, 0x112
ja 0x1800d6051
je 0x1800d6045
mov eax, ebx
sub eax, 0x8b
je 0x1800d601c
sub eax, 0x20
je 0x1800d5fe3
sub eax, 0xe
je 0x1800d5f9a
sub eax, 9
je 0x1800d5f4b
cmp eax, 0x30
jne 0x1800d60e0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x10a
call fcn.180005550
test al, al
jne 0x1800d611a
mov ebx, 0xe9
nop
mov eax, ebx
sub eax, 0xe9
je 0x1800d60ee
cmp eax, 0x6e
je 0x1800d613a
jmp 0x1800d610b
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 8
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
xor edx, edx
mov ecx, 0xb3
call fcn.180081490
test eax, eax
jne 0x1800d613e
mov rax, qword [r14]
mov r10, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rsi, qword [rax + 0x30]
sub rsi, qword [rax + 0x20]
shr rsi, 3
inc rsi
jmp 0x1800d60db
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], PathMakeUniqueName
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x68]
xor edx, edx
mov ecx, 0xb3
call fcn.180081490
test eax, eax
jne 0x1800d6162
mov rax, qword [rsp + 0x68]
mov rcx, qword [r15]
mov r10, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rax + 0x18], rcx
jmp 0x1800d60db
mov eax, dword [r15]
mov r9d, dword [rcx]
mov r8, qword [r12]
mov rcx, qword [r14]
mov dword [rsp + 0x48], eax
mov rax, qword [r10 + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rdx]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x20], eax
call qword [r10]
mov r10, qword [rsp + 0x50]
mov ebp, eax
mov rdx, qword [rsp + 0x58]
jmp 0x1800d60db
xor r9d, r9d
mov r8, r14
mov edx, 0xa3
xor ecx, ecx
call fcn.1800bdec0
test al, al
jne 0x1800d617b
mov r10, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
jmp 0x1800d60db
mov eax, dword [rsp + 0x48]
mov qword [r15], rax
jmp 0x1800d60e0
mov eax, ebx
sub eax, 0x120
je 0x1800d60c6
sub eax, 9
je 0x1800d607e
sub eax, 0x50
je 0x1800d6078
sub eax, 0x17
je 0x1800d613a
cmp eax, 0x50
je 0x1800d613a
jmp 0x1800d60e0
mov dword [rsp + 0x30], ebp
jmp 0x1800d60e0
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x38], esi
mov ecx, 0xb3
call fcn.180081490
mov edi, eax
test eax, eax
jne 0x1800d61b2
mov rcx, qword [r14]
mov rax, qword [rsp + 0x60]
mov r10, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [rcx + 0x50], rax
mov dword [rsp + 0x30], edi
jmp 0x1800d60db
mov rax, qword [rsp + 0x68]
mov rcx, qword [r12]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x68]
mov qword [r14], rax
mov rcx, qword [rsp + 0x40]
add ebx, 0x67
cmp ebx, r13d
jb 0x1800d5ed0
jmp 0x1800d613a
mov r9d, 0x104
lea r8, [rsp + 0x70]
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_DragQueryFileW]
mov byte [rsp + 0x30], 0
add ebx, 0x6e
cmp ebx, 0x1c5
jb 0x1800d5f30
mov r9d, 0x61
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, r14
xor ecx, ecx
call fcn.1800bb4d0
mov byte [rsp + 0x30], al
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800d7250
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.12CDeviceMgrUI
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x6a
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.180045dd0
test al, al
jne 0x1800d6198
mov byte [rsp + 0x30], al
jmp 0x1800d613a
mov rax, qword [r15]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea r8d, [r9 + 2]
call fcn.180010d40
jmp 0x1800d6136
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r9d, 0x10b
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call fcn.180015c80
mov eax, edi
jmp 0x1800d613e