Function at 0x18000e390
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea ebp, [rcx - 7]
mov r14, r8
mov r15, rdx
cmp ecx, ebp
jbe 0x18000e5ee
lea esi, [rcx - 0x66]
xor r12d, r12d
lea r13, [0x180000000]
nop word [rax + rax]
cmp esi, 0xe
ja case.0x18000e3e4.1
mov ecx, dword [r13 + rsi*4 + 0xe630]
add rcx, r13
jmp rcx
mov rdi, qword [r14]
test rdi, rdi
je 0x18000e40e
nop
mov rcx, qword [rdi]
mov rbx, qword [rdi + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rbx
test rbx, rbx
jne 0x18000e3f0
mov qword [r14], r12
jmp case.0x18000e3e4.1
mov dword [0x18007b240], r12d
mov dword [0x18007b2bc], r12d
jmp case.0x18000e3e4.1
lea rcx, [0x180059a88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov edx, 0xe7
xor ecx, ecx
call fcn.1800230c0
mov rcx, qword [0x18007b2a8]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor edx, edx
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea ecx, [rdx + 0x1a]
call fcn.180025e70
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp case.0x18000e3e4.1
xor edx, edx
mov dword [0x180064020], 1
mov r8d, 0x480
lea rcx, [0x18007b2d0]
call sub.VCRUNTIME140.dll_memset
jmp case.0x18000e3e4.1
cmp dword [0x18007b240], r12d
jne case.0x18000e3e4.1
nop
mov ebx, 3
cmp ebx, 3
je 0x18000e4fb
cmp ebx, 0x11
je 0x18000e4ea
cmp ebx, 0x1f
jne 0x18000e550
mov ecx, dword [0x180064014]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [rbx + 0x27]
call fcn.180019c50
jmp 0x18000e550
xor edx, edx
xor ecx, ecx
mov r8d, 0xb9
call fcn.18001a9b0
jmp 0x18000e550
mov edx, 0x6f
xor ecx, ecx
call fcn.18001c230
xor edx, edx
xor ecx, ecx
mov r8d, 0xb9
call fcn.18001a9b0
mov ecx, dword [0x180064010]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x97
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000fe60
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
mov r8d, 0x101
call fcn.18001d6d0
add ebx, 0xe
cmp ebx, 0x2d
jb 0x18000e4c5
cmp dword [0x18007b240], r12d
je 0x18000e4c0
jmp case.0x18000e3e4.1
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x18006401c]
mov dword [0x18007b29c], edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8d, eax
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 7
xor edx, edx
sub r8d, ecx
mov ecx, 0xfe
mov dword [0x18007b24c], r8d
xor r8d, r8d
call fcn.180014b20
mov dword [rsp + 0x30], 0x23
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call fcn.1800389f0
dec esi
lea eax, [rsi + 0x66]
cmp eax, ebp
ja 0x18000e3d0
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx ecx, byte [r15]
mov rax, qword [r14]
cmp rcx, rax
jbe 0x18000e62b
sub rax, rcx
add rax, 0x40
jmp 0x18000e5f6
sub rax, rcx
jmp 0x18000e5f6