Function at 0x18000bee0
Capabilities:
Create thread
Execute command
Manipulate console buffer
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x18007b130]
xor rax, rsp
mov qword [rbp + 0x20], rax
imul r14d, edx, 0x5a0
mov esi, edx
mov rdi, rcx
mov ebx, edx
cmp edx, r14d
ja 0x18000c0a5
mov r15d, dword [rsp + 0x50]
lea r12, str.Auto
xor r9d, r9d
lea r13, str.Stereo
lea rcx, str.productState
lea rdx, str.Mono
lea r8, str.0_Imivimbo
lea rax, str.J_Stereo
cmp ebx, 0x339d
ja 0x18000c03f
je 0x18000c0de
cmp ebx, 0x42
je 0x18000bfe3
cmp ebx, 0x49
je 0x18000bfa5
cmp ebx, 0xd9
je 0x18000bf95
cmp ebx, 0x2eaa
jne 0x18000c094
mov byte [rsp + 0x50], 1
jmp 0x18000c094
mov dword [rsp + 0x40], 1
mov r15d, r9d
jmp 0x18000c094
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], r13
movups xmm0, xmmword [rbp - 0x10]
mov qword [rbp], rax
mov qword [rbp + 8], rcx
movups xmm1, xmmword [rbp]
mov qword [rbp + 0x10], rdx
movups xmmword [0x18007f468], xmm0
mov qword [rbp + 0x18], r8
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [0x18007f478], xmm1
movups xmmword [0x18007f488], xmm0
jmp 0x18000c094
mov qword [rsp + 0x28], r9
lea r8, [0x180011b10]
mov dword [rsp + 0x20], r9d
xor edx, edx
mov r9, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
test rax, rax
je 0x18000c0d7
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x130
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov dword [rsp + 0x58], 1
call fcn.180027370
jmp 0x18000c07c
cmp ebx, 0x5d12
je 0x18000c0a5
cmp ebx, 0x996d
je 0x18000c06f
cmp ebx, 0x13201
jne 0x18000c094
mov r14d, dword [rsp + 0x40]
mov esi, 0x1c
mov r13d, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x40]
jmp 0x18000c106
lea rcx, [0x180059a88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.0_Imivimbo
lea rdx, str.Mono
lea rcx, str.productState
imul eax, esi, 0xb4
add ebx, eax
cmp ebx, r14d
jbe 0x18000bf54
mov rax, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800439f0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov byte [rsp + 0x50], 0
jmp 0x18000c0a5
movsxd rcx, dword [rdi + 0x18]
lea eax, [rcx + 1]
cmp eax, 4
ja 0x18000c0fa
mov rax, rcx
lea rcx, [0x18007f470]
mov rax, qword [rcx + rax*8]
jmp 0x18000c0aa
mov rax, qword [0x18007f490]
jmp 0x18000c0aa
xor r9d, r9d
test r15d, r15d
jne 0x18000c1ff
lea rcx, [0x180059a88]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov edi, 0x103
cmp edi, 0x7f7a
ja 0x18000c1cd
je 0x18000c1b8
mov eax, edi
sub eax, 0xa2
je 0x18000c1d5
sub eax, 0x61
je 0x18000c1ac
cmp eax, 0x4eb9
jne 0x18000c1d5
mov esi, dword [rsp + 0x50]
mov ebx, 7
nop dword [rax]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x60], esi
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x58], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x1c
jl 0x18000c160
mov r9d, 0xc7
mov dword [rsp + 0x48], esi
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
mov esi, 0x1c
jmp 0x18000c1d5
mov dword [0x18007b2b0], 0x6001c
jmp 0x18000c1d5
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c1d5
cmp edi, 0xedf0
je 0x18000c1e7
add edi, 0x7e77
cmp edi, 0x2f6ca
jbe 0x18000c121
lea rcx, str.:res_grid_settings_btn.png
call fcn.1800432b0
mov r14d, dword [rsp + 0x40]
xor r9d, r9d
mov ebx, dword [rsp + 0x40]
cmp ebx, r15d
je 0x18000caee
cmp ebx, 1
jne 0x18000c4df
mov esi, 0x8e
lea r15d, [rbx + 0x1f]
jmp 0x18000c223
xor r9d, r9d
mov eax, esi
sub eax, 0x8d
je 0x18000c3fe
cmp eax, 1
jne 0x18000c4cc
mov edi, 0x103
nop
cmp edi, 0x7f7a
ja 0x18000c2da
je 0x18000c2c5
mov eax, edi
sub eax, 0xa2
je 0x18000c2e7
sub eax, 0x61
je 0x18000c2b9
cmp eax, 0x4eb9
jne 0x18000c2e7
mov ebx, 7
lea rax, [rsp + 0x68]
mov dword [rsp + 0x70], r14d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov dword [rsp + 0x68], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c270
mov r9d, 0xc7
mov dword [rsp + 0x48], r14d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c2e7
mov dword [0x18007b2b0], 0x80020
jmp 0x18000c2e7
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c2e7
test r9b, r9b
jne 0x18000c2ff
cmp edi, 0xedf0
je 0x18000c2ff
add edi, 0x7e77
mov r9d, 0
cmp edi, 0x2f6ca
jbe 0x18000c240
mov rcx, qword [0x18007b2a8]
mov edx, 0xf0
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.get_StackIPs
call fcn.1800432b0
mov r12d, dword [rsp + 0x40]
mov edi, 0x103
mov r13d, dword [rsp + 0x40]
mov r15d, 0x20
cmp edi, 0x7f7a
ja 0x18000c3c8
je 0x18000c3b3
mov eax, edi
sub eax, 0xa2
je 0x18000c3d0
sub eax, 0x61
je 0x18000c3a7
cmp eax, 0x4eb9
jne 0x18000c3d0
mov ebx, 7
nop
lea rax, [rsp + 0x78]
mov dword [rbp - 0x80], r12d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x80]
mov dword [rsp + 0x78], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, r15d
jl 0x18000c360
mov r9d, 0xc7
mov dword [rsp + 0x48], r12d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c3d0
mov dword [0x18007b2b0], 0x90020
jmp 0x18000c3d0
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c3d0
cmp edi, 0xedf0
je 0x18000c3e2
add edi, 0x7e77
cmp edi, 0x2f6ca
jbe 0x18000c332
mov rcx, qword [0x18007b2a8]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r14d, dword [rsp + 0x40]
jmp 0x18000c4cc
lea rcx, str.SEMI_VOICED
call fcn.1800432b0
mov edi, 0x103
nop
cmp edi, 0x7f7a
ja 0x18000c4a6
je 0x18000c491
mov eax, edi
sub eax, 0xa2
je 0x18000c4ae
sub eax, 0x61
je 0x18000c485
cmp eax, 0x4eb9
jne 0x18000c4ae
mov ebx, 7
nop dword [rax]
lea rax, [rbp - 0x78]
mov dword [rbp - 0x70], r13d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x70]
mov dword [rbp - 0x78], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c440
mov r9d, 0xc7
mov dword [rsp + 0x48], r13d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c4ae
mov dword [0x18007b2b0], 0xa0020
jmp 0x18000c4ae
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c4ae
cmp edi, 0xedf0
je 0x18000c4c0
add edi, 0x7e77
cmp edi, 0x2f6ca
jbe 0x18000c410
lea rcx, str.3.EXIT
call fcn.1800432b0
dec esi
cmp esi, 0x8c
ja 0x18000c220
jmp 0x18000cae7
cmp ebx, 2
jne 0x18000c7d9
mov esi, 0x10d
jmp 0x18000c4f3
xor r9d, r9d
mov eax, esi
sub eax, 0x10b
je 0x18000c7b5
sub eax, 1
je 0x18000c609
cmp eax, 1
jne 0x18000c7c1
mov edi, 0x103
nop word [rax + rax]
cmp edi, 0x7f7a
ja 0x18000c5c6
je 0x18000c5b1
mov eax, edi
sub eax, 0xa2
je 0x18000c5d3
sub eax, 0x61
je 0x18000c5a5
cmp eax, 0x4eb9
jne 0x18000c5d3
mov r15d, dword [rsp + 0x50]
mov ebx, 7
nop dword [rax]
lea rax, [rbp - 0x68]
mov dword [rbp - 0x60], r15d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x60]
mov dword [rbp - 0x68], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c560
mov r9d, 0xc7
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c5d3
mov dword [0x18007b2b0], 0x80020
jmp 0x18000c5d3
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c5d3
test r9b, r9b
jne 0x18000c5eb
cmp edi, 0xedf0
je 0x18000c5eb
add edi, 0x7e77
mov r9d, 0
cmp edi, 0x2f6ca
jbe 0x18000c520
mov rcx, qword [0x18007b2a8]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.IV_SHLSAT_2L
jmp 0x18000c7bc
mov edi, 0x103
nop
cmp edi, 0x7f7a
ja 0x18000c6a7
je 0x18000c692
mov eax, edi
sub eax, 0xa2
je 0x18000c6b4
sub eax, 0x61
je 0x18000c686
cmp eax, 0x4eb9
jne 0x18000c6b4
mov r15d, dword [rsp + 0x50]
mov ebx, 7
lea rax, [rbp - 0x58]
mov dword [rbp - 0x50], r15d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x50]
mov dword [rbp - 0x58], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c641
mov r9d, 0xc7
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c6b4
mov dword [0x18007b2b0], 0x90020
jmp 0x18000c6b4
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c6b4
test r9b, r9b
jne 0x18000c6cc
cmp edi, 0xedf0
je 0x18000c6cc
add edi, 0x7e77
mov r9d, 0
cmp edi, 0x2f6ca
jbe 0x18000c610
mov rcx, qword [0x18007b2a8]
mov edx, 0xf0
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.GST__Guama_
call fcn.1800432b0
mov edi, 0x103
nop
cmp edi, 0x7f7a
ja 0x18000c787
je 0x18000c772
mov eax, edi
sub eax, 0xa2
je 0x18000c78f
sub eax, 0x61
je 0x18000c766
cmp eax, 0x4eb9
jne 0x18000c78f
mov r15d, dword [rsp + 0x50]
mov ebx, 7
lea rax, [rbp - 0x48]
mov dword [rbp - 0x40], r15d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x40]
mov dword [rbp - 0x48], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c721
mov r9d, 0xc7
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c78f
mov dword [0x18007b2b0], 0xa0020
jmp 0x18000c78f
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c78f
cmp edi, 0xedf0
je 0x18000c7a1
add edi, 0x7e77
cmp edi, 0x2f6ca
jbe 0x18000c6f0
mov rcx, qword [0x18007b2a8]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x18000c7c1
lea rcx, str.3.EXIT
call fcn.1800432b0
dec esi
cmp esi, 0x10a
ja 0x18000c4f0
mov r13d, dword [rsp + 0x40]
jmp 0x18000cae2
cmp ebx, 3
jne 0x18000caeb
mov esi, 0xa7
lea r14d, [rbx + 5]
jmp 0x18000c7f3
xor r9d, r9d
mov eax, esi
sub eax, 0xa7
je 0x18000c918
sub eax, 1
je 0x18000c83b
sub eax, 1
je 0x18000c824
cmp eax, 1
jne 0x18000cad4
lea rcx, str.3.EXIT
call fcn.1800432b0
jmp 0x18000cad4
mov rcx, qword [0x18007b2a8]
mov edx, 0xf0
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x18000cad4
mov edi, 0x103
cmp edi, 0x7f7a
ja 0x18000c8e6
je 0x18000c8d1
mov eax, edi
sub eax, 0xa2
je 0x18000c8fb
sub eax, 0x61
je 0x18000c8c5
cmp eax, 0x4eb9
jne 0x18000c8fb
mov r15d, dword [rsp + 0x50]
mov ebx, 7
nop dword [rax]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x30], r15d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
mov dword [rbp - 0x38], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c880
mov r9d, 0xc7
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c8fb
mov dword [0x18007b2b0], 0xa0020
jmp 0x18000c8fb
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c8fb
test r9b, r9b
jne 0x18000cad4
cmp edi, 0xedf0
je 0x18000cad4
add edi, 0x7e77
mov r9d, 0
cmp edi, 0x2f6ca
jbe 0x18000c840
jmp 0x18000cad4
mov edi, 0x103
nop dword [rax]
cmp edi, 0x7f7a
ja 0x18000c9b7
je 0x18000c9a2
mov eax, edi
sub eax, 0xa2
je 0x18000c9c4
sub eax, 0x61
je 0x18000c996
cmp eax, 0x4eb9
jne 0x18000c9c4
mov r15d, dword [rsp + 0x50]
mov ebx, 7
lea rax, [rbp - 0x28]
mov dword [rbp - 0x20], r15d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x28], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000c951
mov r9d, 0xc7
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000c9c4
mov dword [0x18007b2b0], 0x80020
jmp 0x18000c9c4
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000c9c4
test r9b, r9b
jne 0x18000c9dc
cmp edi, 0xedf0
je 0x18000c9dc
add edi, 0x7e77
mov r9d, 0
cmp edi, 0x2f6ca
jbe 0x18000c920
mov rcx, qword [0x18007b2a8]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.fo_c_ffc460
call fcn.1800432b0
mov edi, 0x103
nop
cmp edi, 0x7f7a
ja 0x18000caa8
je 0x18000ca93
mov eax, edi
sub eax, 0xa2
je 0x18000cab0
sub eax, 0x61
je 0x18000ca87
cmp eax, 0x4eb9
jne 0x18000cab0
mov r15d, dword [rsp + 0x50]
mov ebx, 7
nop dword [rax]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x50], r15d
mov r9d, 0x7f
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
mov dword [rbp - 0x18], ebx
xor edx, edx
xor ecx, ecx
call fcn.18001f380
inc ebx
cmp ebx, 0x20
jl 0x18000ca40
mov r9d, 0xc7
mov dword [rsp + 0x48], r15d
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
jmp 0x18000cab0
mov dword [0x18007b2b0], 0x90020
jmp 0x18000cab0
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x18000cab0
cmp edi, 0xedf0
je 0x18000cac2
add edi, 0x7e77
cmp edi, 0x2f6ca
jbe 0x18000ca00
lea rcx, str.ich_lr2_el2
call fcn.1800432b0
mov r14d, 8
inc esi
cmp esi, 0xab
jb 0x18000c7f0
mov r14d, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x40]
mov r15d, ebx
mov rcx, qword [0x18007b2a8]
mov edx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
mov esi, 0x1c
test eax, eax
je 0x18000c103
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov edx, eax
lea ecx, [rax - 0x48]
cmp cl, 0x2f
ja 0x18000cb4d
movabs rax, 0x800000008001
bt rax, rcx
jae 0x18000cb4d
sub ebx, 1
mov eax, 3
cmove ebx, eax
xor r9d, r9d
mov r15d, r9d
mov dword [rsp + 0x40], ebx
jmp 0x18000c106
lea eax, [rdx - 0x50]
cmp al, 0x23
ja 0x18000cb83
movabs rcx, 0x800000009
bt rcx, rax
jae 0x18000cb83
mov eax, ebx
lea ecx, [rbx + 1]
cmp eax, 3
mov ebx, 1
cmovne ebx, ecx
xor r9d, r9d
mov r15d, r9d
mov dword [rsp + 0x40], ebx
jmp 0x18000c106
cmp dl, 0xd
je 0x18000cb8d
cmp dl, 0xa
jne 0x18000cbd8
cmp ebx, 1
jne 0x18000cbaa
xor r8d, r8d
lea ecx, [rbx + 0x6c]
xor edx, edx
call fcn.18000e390
xor r9d, r9d
mov r15d, r9d
jmp 0x18000c106
cmp ebx, 2
jne 0x18000cbd3
xor eax, eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov r8d, 0xe7
call fcn.18002e5d0
xor r9d, r9d
mov r15d, r9d
jmp 0x18000c106
cmp ebx, 3
je 0x18000cbe3
xor r9d, r9d
mov r15d, r9d
jmp 0x18000c106
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3