Function at 0x18006b980
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea esi, [r9 - 0xd]
mov r12, rdx
mov r15, r8
mov rdx, rcx
cmp r9d, esi
jbe 0x18006be99
mov rdi, qword [rbp - 0x10]
lea ebx, [r9 - 0xaf]
mov r14, qword [rbp - 0x10]
movzx r13d, byte [rbp + 0x58]
lea r8, [0x180000000]
cmp ebx, 0x1c
ja case.0x18006b9e1.3
mov ecx, dword [r8 + rbx*4 + 0x6beb8]
add rcx, r8
jmp rcx
mov r9d, 0xef
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180042520
mov rdi, rax
mov qword [rbp - 0x28], 0
mov edx, 0x23
mov qword [rbp - 0x18], 1
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x22]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 2
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x21]
call fcn.180062560
jmp case.0x18006b9e1.3
cmp qword [r14 + 0x20], 0
je case.0x18006b9e1.3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__TypeDescriptor__extraBytes_175
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [r14 + 0x10]
cmp qword [rcx + 8], 2
jne 0x18006bdd4
mov rax, qword [rcx + 0x10]
cmp qword [rax + 8], 1
jne 0x18006bdae
mov rax, qword [rcx + 0x18]
cmp qword [rax + 8], 3
je case.0x18006b9e1.3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Nuclear_Acquisition_Group_Length
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rbp + 0x58]
mov byte [rbp + 0x58], 1
mov rdx, rdi
mov ecx, 0x91
call fcn.18006b1e0
mov rdi, rax
jmp case.0x18006b9e1.3
mov edx, 0x23
mov qword [rbp - 0x18], 6
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x1d]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 7
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x1c]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x1b]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 9
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x1a]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 0xa
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x19]
call fcn.180062560
jmp case.0x18006b9e1.3
lea r9, [rbp - 0x28]
mov qword [rbp - 0x18], 6
lea r8, [rbp - 0x18]
mov rdx, rdi
mov ecx, 0xec
call fcn.18005a4c0
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x10]
mov r9, rdi
mov qword [rbp - 0x10], 4
mov edx, 0x7f
call fcn.180062810
mov r14, rax
cmp qword [rax + 8], 4
je case.0x18006b9e1.3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.BTHF_EnableCallerIdNotify____s
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x23
mov qword [rbp - 0x18], 3
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x20]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 4
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x1f]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x18], 5
lea rax, [rbp - 0x28]
mov r9, rdi
lea r8, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x1e]
call fcn.180062560
jmp case.0x18006b9e1.3
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.GDI32.dll_BeginPath]
lea rcx, [0x18004f290]
mov qword [r12], rcx
test eax, eax
jne case.0x18006b9e1.3
xor r13b, r13b
jmp case.0x18006b9e1.3
test r13b, r13b
je 0x18006bccd
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.GDI32.dll_EndPath]
lea rcx, [r12 + 0xa]
cmp rcx, r15
je case.0x18006b9e1.3
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x18006bce8
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
call fcn.18004fd90
jmp case.0x18006b9e1.3
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + 0x10]
mov rcx, qword [rax + 0x18]
cmp qword [rcx + 8], 7
jne 0x18006bdfa
mov rax, qword [rdx + 0x18]
mov rcx, qword [rax + 0x18]
cmp qword [rcx + 8], 0xa
je case.0x18006b9e1.3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.ERROR_INSTALL_TRANSFORM_REJECTED
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx eax, word [rdx]
mov r8d, 0xb7
lea rdx, [rbp - 0x30]
mov word [rbp - 0x30], ax
mov rcx, r12
mov r13b, 1
call fcn.1800418a0
mov qword [rbp - 0x20], 0
jmp case.0x18006b9e1.3
mov rcx, qword [r14 + 0x18]
cmp qword [rcx + 8], 8
jne 0x18006be6c
mov rax, qword [rcx + 0x10]
cmp qword [rax + 8], 5
jne 0x18006be46
mov rax, qword [rcx + 0x18]
cmp qword [rax + 8], 9
jne 0x18006be20
dec ebx
lea eax, [rbx + 0xaf]
cmp eax, esi
jbe 0x18006be99
mov rdx, qword [rbp + 0x40]
jmp 0x18006b9c6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__localAdaptintegration_tau_:
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.____ZZZZZZZZ
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.No_entries_found_to_mark_expired
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.____Framework_structs_
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Opera.DSK.Stats.Histograms.Count
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.op_Ethernet_SetPciSlotNumber_in_
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, 1
jmp 0x18006be9d
mov rax, qword [rbp - 0x10]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret