Function at 0x180009320
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x180106b38]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13d, dword [rbp + 0x70]
xor r11d, r11d
mov r14, qword [rbp + 0x78]
mov r10, r9
mov qword [rsp + 0x70], r9
mov r12, r8
mov qword [rsp + 0x78], r8
mov r9, rcx
lea r15d, [r13 + 0x5f9]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], rcx
mov r8, rdx
mov edi, r13d
cmp r13d, r15d
jae 0x180009689
mov rsi, qword [rsp + 0x78]
lea rbx, str.type
movabs rdx, 0x230023003a0023
movabs rcx, 0x2d002400240040
cmp edi, 0x10f
ja 0x18000950f
je 0x1800094a6
mov eax, edi
sub eax, 0x19
je 0x18000948a
sub eax, 0x24
je 0x18000941f
sub eax, 0x66
je 0x1800093e8
sub eax, 1
je 0x1800093df
cmp eax, 0x24
je 0x1800099a2
jmp 0x18000966b
mov qword [rbp - 0x3a], rcx
jmp 0x18000966b
mov qword [rsp + 0x38], r11
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], r11
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILClone
mov dword [rsp + 0x50], r11d
call fcn.18004e110
mov rsi, qword [rax]
jmp 0x180009668
mov ebx, 0x24
cmp ebx, 3
je 0x18000945a
cmp ebx, 0x24
je 0x180009440
cmp ebx, 0x1c8
je 0x18000946c
cmp ebx, 0x1560
je 0x18000946c
jmp 0x18000945e
mov ecx, 0x3dc58
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x1800096e6
mov qword [rbp - 0x80], rax
jmp 0x18000945e
mov byte [rbp - 0x80], 1
add ebx, 0x153c
cmp ebx, 0x54f0
jbe 0x180009424
mov rbx, qword [rbp - 0x80]
xor edx, edx
mov rcx, rbx
mov r8d, 0x3dc58
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x60], rbx
jmp 0x180009668
mov r8d, 3
lea rdx, [0x1800f327a]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x180009668
mov rax, qword [r8 + 0x10]
cmp dword [rax], 4
je 0x18000966b
mov rax, qword [0x1800fb5d8]
lea r9, [rsp + 0x48]
lea r8, [0x1800e3d02]
mov qword [rbp - 0x78], rax
mov edx, 0x54
mov dword [rsp + 0x48], r11d
lea rcx, [rbp - 0x78]
call fcn.180012120
mov r9d, PathYetAnotherMakeUniqueName
lea r8, str.CPackageTreeListViewCtrlClass::PostCreate
xor edx, edx
xor ecx, ecx
call fcn.180030130
mov rdx, qword [rsp + 0x58]
lea rcx, str.type.._d_n
mov rax, qword [rdx + 0x10]
mov edx, dword [rax]
call fcn.180011460
jmp 0x180009668
mov eax, edi
sub eax, 0x12e
je 0x1800095ea
sub eax, 1
je 0x1800095d2
sub eax, 0x6b
je 0x180009566
sub eax, 0x1f
je 0x18000955a
cmp eax, 1
jne 0x18000966b
mov qword [rbp - 0x2a], rdx
lea rcx, [rbp - 0x40]
lea rdx, [0x1800f32c2]
mov word [rbp - 0x22], r11w
mov r8d, eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180009668
mov dword [r10], 6
jmp 0x18000966b
mov ebx, 0xb1
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xb1
je 0x180009584
cmp eax, 0x4d
je 0x1800099a2
jmp 0x1800095c4
mov eax, dword [r9]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov r9, r14
mov rax, qword [r8 + 0x10]
mov rdx, r12
mov dword [rsp + 0x28], 0x7c
mov qword [rsp + 0x20], r10
mov r8, qword [rax + 8]
call fcn.180008be0
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
add ebx, 0x4d
cmp ebx, 0x14b
jb 0x180009570
xor r11d, r11d
movabs rax, 0x23002000230023
mov word [rbp - 0x2a], r11w
mov qword [rbp - 0x32], rax
jmp 0x18000966b
mov eax, dword [rsi]
cmp eax, 2
je 0x18000963c
xor r9d, r9d
mov dword [rsp + 0x48], eax
xor r8d, r8d
lea rcx, [rsp + 0x48]
lea edx, [r9 + 0x25]
call fcn.18000c730
mov rdx, qword [rsp + 0x58]
mov r9d, 0x1c
mov dword [rsp + 0x38], 6
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 3
call fcn.18002d150
xor r11d, r11d
mov eax, dword [rsi + 8]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x30], 0xf0
mov r9, r14
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x48], eax
call fcn.18007d670
xor r11d, r11d
mov r8, qword [rsp + 0x58]
add edi, 0x8b
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
cmp edi, r15d
jb 0x18000938a
lea eax, [r13 + 0x96]
mov dword [rsp + 0x48], eax
cmp r13d, eax
jae 0x1800099a2
mov rdi, qword [rsp + 0x78]
mov esi, dword [rsp + 0x48]
mov r12d, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x48]
lea eax, [r13 - 0x19]
movabs rdx, 0x2a002000230023
lea r11, [0x180000000]
cmp eax, 0x87
ja case.0x1800096e4.34
movzx eax, byte [r11 + rax + 0x99f0]
mov ecx, dword [r11 + rax*4 + 0x99c8]
add rcx, r11
jmp rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x3dc58
lea rdx, str.vim.fault.MethodDisabled
mov rcx, rax
call fcn.1800ba9c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test r10, r10
je 0x18000971a
mov dword [r10], esi
cmp byte [rsp + 0x40], 0
movsxd rax, esi
mov byte [rax + r14], 0
je case.0x1800096e4.34
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.WINMM.dll_mciGetCreatorTask]
jmp case.0x1800096e4.34
xor eax, eax
mov esi, eax
jmp case.0x1800096e4.34
xor eax, eax
mov r12d, eax
jmp case.0x1800096e4.34
lea rcx, [rbp - 0x40]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDW]
mov dword [rsp + 0x50], eax
mov edx, esi
cmp r15d, 0x3d
jne case.0x1800096e4.34
mov ecx, r12d
and ecx, 0x80000003
jge 0x18000977b
dec ecx
or ecx, 0xfffffffc
inc ecx
sub ecx, 1
je 0x180009996
sub ecx, 1
je 0x180009793
cmp ecx, 1
je 0x180009796
jmp case.0x1800096e4.34
lea edx, [rsi + 1]
movsxd rax, edx
mov byte [rax + r14], 0
jmp case.0x1800096e4.34
mov rdi, qword [rsp + 0x78]
xor eax, eax
mov word [rbp - 0x18], ax
mov qword [rbp - 0x20], rdx
jmp case.0x1800096e4.34
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x40]
cmp dword [rsp + 0x50], ecx
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp case.0x1800096e4.34
movzx r15d, byte [rdi]
test r15d, r15d
je 0x18000996d
movsxd rbx, esi
mov eax, dword [r8]
inc rdi
lea edx, [rax - 1]
mov dword [r8], edx
test eax, eax
je case.0x1800096e4.34
cmp r15d, 0x3d
jne 0x180009859
movzx ecx, byte [rdi]
cmp cl, r15b
je 0x18000995c
mov eax, r12d
and eax, 0x80000003
jge 0x180009817
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 1
je 0x180009996
cmp byte [r9], 0
je 0x18000995c
test edx, edx
je 0x18000995c
movzx ecx, byte [rdi + 1]
inc rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
jne 0x180009832
cmp byte [rdi], al
jne 0x180009996
xor cl, cl
lea r11, [0x180000000]
jmp 0x180009957
cmp byte [r9], 0
movsx edx, byte [r15 + r11 + 0xc5940]
jne 0x180009870
test dl, dl
js 0x180009954
cmp edx, 0xffffffff
je 0x180009954
cmp edx, 0xfffffffe
je 0x180009996
mov ecx, r12d
and ecx, 0x80000003
jge 0x180009894
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x180009944
sub ecx, 1
je 0x1800098b4
sub ecx, 1
je 0x180009902
cmp ecx, 1
je 0x180009939
jmp 0x18000994b
mov ecx, reloc.SHELL32.dll_ILFree
nop dword [rax]
cmp ecx, 0x9b
je 0x1800098e6
cmp ecx, 0x2a62
je 0x1800098da
cmp ecx, 0x5429
je 0x18000994b
jmp 0x1800098f4
movzx eax, dl
shl al, 4
mov byte [r14 + rbx], al
jmp 0x1800098f4
mov eax, edx
inc esi
sar eax, 4
or byte [r14 + rbx], al
inc rbx
add ecx, 0x29c7
cmp ecx, 0x7d55
jbe 0x1800098c0
mov ecx, reloc.SHELL32.dll_ILFree
mov eax, ecx
sub eax, 0x9b
je 0x180009917
cmp eax, 1
je 0x18000994b
jmp 0x18000992f
mov eax, edx
inc esi
sar eax, 2
or byte [r14 + rbx], al
inc rbx
movzx eax, dl
shl al, 6
mov byte [r14 + rbx], al
inc ecx
cmp ecx, 0x9d
jb 0x180009907
or byte [r14 + rbx], dl
inc esi
inc rbx
jmp 0x18000994b
shl dl, 2
mov byte [r14 + rbx], dl
mov r13d, 0x64
inc r12d
movzx ecx, byte [rdi]
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x68]
movzx r15d, cl
test cl, cl
jne 0x1800097e0
inc rdi
jmp case.0x1800096e4.34
mov byte [rsp + 0x40], 1
add r13d, 0xf
cmp r13d, dword [rsp + 0x48]
jae 0x1800099a2
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x68]
mov r10, qword [rsp + 0x70]
jmp 0x1800096b0
mov byte [rsp + 0x60], 0
jmp 0x1800099a2
mov byte [rsp + 0x60], 1
mov rax, qword [rsp + 0x60]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800bfc40
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret