Function at 0x1800e4c20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
lea ebp, [r9 - 9]
mov r15, r8
mov rsi, rdx
mov r13, rcx
cmp r9d, ebp
jbe case.0x1800e4c9b.4
mov r14, qword [rsp + 0x58]
lea ebx, [r9 - 0x95]
mov edi, dword [rsp + 0xc8]
lea r9, [0x18010646e]
mov r12, qword [rsp + 0x58]
lea rdx, [0x180000000]
nop dword [rax + rax]
cmp ebx, 0x1e
ja case.0x1800e4c9b.8
movzx eax, byte [rdx + rbx + 0xe5078]
mov ecx, dword [rdx + rax*4 + 0xe5054]
add rcx, rdx
jmp rcx
mov r9d, 0x6d
mov qword [rsp + 0x20], 0
mov r8, rsi
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.18009e460
lea r9, [0x18010646e]
mov dword [rsp + 0x58], 0
lea rdx, [0x180000000]
jmp case.0x1800e4c9b.8
mov edx, 1
lea ecx, [rdx + 0x17]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1800e4e59
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800e4d5c
lea rax, [rsp + 0x48]
mov byte [rsp + 0xc8], 1
mov qword [rsp + 0x30], rax
lea r9, [0x18010646e]
lea rax, [rsp + 0xc8]
mov dword [rsp + 0x28], 0x34
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [0x18010646e]
mov byte [rsp + 0x40], 2
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], 0
call fcn.180096080
mov r12, qword [rsi]
lea r9, [0x18010646e]
mov qword [r14], r15
lea rdx, [0x180000000]
mov qword [r14 + 8], r13
jmp case.0x1800e4c9b.8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], 0
mov edx, 0xdb
mov rcx, r9
call fcn.18005a5b0
mov qword [rsp + 0x58], rax
lea r9, [0x18010646e]
lea rdx, [0x180000000]
jmp case.0x1800e4c9b.8
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800e4e1f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x111
xor ecx, ecx
call fcn.18005f2c0
lea r9, [rsp + 0xc8]
mov dword [rsp + 0xc8], 0
lea r8, [0x18010646e]
mov edx, 0x77
lea rcx, [0x18010646e]
call fcn.1800b78f0
xor r9d, r9d
mov dword [rsp + 0x28], 0xd2
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.1800e5fa0
test rsi, rsi
je 0x1800e4e79
test r15, r15
je 0x1800e4e79
test r13, r13
je 0x1800e4e79
lea r9, [0x18010646e]
lea rdx, [0x180000000]
jmp case.0x1800e4c9b.8
mov edi, dword [0x18012172c]
dec ebx
lea eax, [rbx + 0x95]
cmp eax, ebp
ja 0x1800e4c80
jmp case.0x1800e4c9b.4
mov r8d, 0xe
lea rdx, str.eventForwarder
lea ecx, [r8 - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800e4f4b
mov ebx, 0x1c
lea rbp, str.Invalid_whitelist_entry
nop
mov eax, ebx
sub eax, 0x1b
je 0x1800e4ec9
cmp eax, 1
jne 0x1800e4f40
xor r9d, r9d
mov dword [rsp + 0x20], 0xc3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800c13c0
jmp 0x1800e4f40
cmp edi, dword [0x18012172c]
je 0x1800e4f01
lea rcx, str.Check_failed:_crashed_status____base::TERMINATION_STATUS_STILL_RUNNING.
call fcn.1800fcfa0
lea rsi, [0x18010646e]
xor r9d, r9d
mov r8, rsi
lea rcx, str.Shufflevector_rematerialization
mov rdx, rsi
call fcn.1800fcfa0
mov dword [0x18012172c], edi
jmp 0x1800e4f08
lea rsi, [0x18010646e]
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0xc8]
lea r8, str.ELF_file_not_accessible
mov dword [rsp + 0x20], 0x59
mov rdx, rsi
mov qword [0x180121770], rbp
xor ecx, ecx
mov dword [rsp + 0xc8], 0
call fcn.18002be30
dec ebx
cmp ebx, 0x1a
ja 0x1800e4ea0
mov dword [rsp + 0x58], 0xffffffff
jmp case.0x1800e4c9b.4
mov eax, dword [r15]
lea rcx, [rsp + 0xc8]
mov r9, qword [rsi + 8]
xor edx, edx
mov r8d, 0xfe
mov dword [rsp + 0xc8], eax
call fcn.1800dee70
mov dword [rsp + 0x58], eax
jmp case.0x1800e4c9b.4
mov qword [r14 + 0x10], r12
xor r9d, r9d
inc dword [rsi + 8]
xor edx, edx
xor ecx, ecx
mov qword [rsi], r14
mov r8d, 0xde
call fcn.18009c830
test al, al
je 0x1800e5023
xor r9d, r9d
mov dword [rsp + 0x20], 0xc3
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800c13c0
mov r8d, dword [0x18012172c]
cmp edi, r8d
je 0x1800e4ff9
mov edx, edi
lea rcx, str.ymfraHtuM6kMgiioTGohQBUgDCZbg8KpFhXAJIJdKxatymP2dACw30PEEGBWZ2NFAgMBAAGjgf8w
call fcn.1800fcfa0
lea rbx, [0x18010646e]
xor r9d, r9d
mov r8, rbx
lea rcx, str.The_expected_pid_was_not_found_
mov rdx, rbx
call fcn.1800fcfa0
mov dword [0x18012172c], edi
jmp 0x1800e5000
lea rbx, [0x18010646e]
lea r9, [rsp + 0xc8]
mov dword [rsp + 0xc8], 0
mov r8, rbx
mov edx, 0x77
mov rcx, rbx
call fcn.1800b78f0
mov dword [rsp + 0x58], 0
mov rax, qword [rsp + 0x58]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret