Function at 0x18004b1f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov ebx, dword [rbp + 0x50]
lea r14d, [rdx + 0xbe]
mov edi, edx
cmp edx, r14d
jae case.0x18004b251.16
mov r15, qword [rbp + 0x58]
lea esi, [rdx - 0x1d]
mov r13, qword [rbp + 0x58]
lea rdx, [0x180000000]
mov r12d, dword [rbp + 0x50]
cmp esi, 0xb8
ja case.0x18004b251.19
movzx eax, byte [rdx + rsi + 0x4b82c]
mov ecx, dword [rdx + rax*4 + 0x4b7dc]
add rcx, rdx
jmp rcx
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 1
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 1
call fcn.18005f180
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 2
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 2
call fcn.18005f180
lea rdx, [0x180000000]
jmp case.0x18004b251.19
mov rax, qword [0x180073a58]
mov byte [rax + 2], 0
jmp case.0x18004b251.19
mov r9d, 0xba
mov byte [rbp + 0x50], 1
lea r8, [rbp + 0x50]
xor edx, edx
mov rcx, r15
call fcn.1800401b0
mov r15, rax
lea rdx, [0x180000000]
jmp case.0x18004b251.19
mov rax, qword [r13 + 0x18]
mov rcx, qword [rax + 0x10]
cmp qword [rcx + 8], 6
jne 0x18004b6d5
mov rax, qword [rax + 0x18]
cmp qword [rax + 8], 9
jne 0x18004b6af
mov rax, qword [rcx + 0x10]
cmp qword [rax + 8], 5
je case.0x18004b251.19
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.GuestOpsCreateTemporaryDirectory
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9, r15
mov qword [rbp + 0x60], 8
lea r8, [rbp + 0x60]
mov edx, 0xd7
lea rcx, [rbp + 0x58]
call fcn.18002fee0
mov r8, qword [rbp + 0x58]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, r15
mov qword [rbp - 0x18], 4
mov ecx, 0x88
call fcn.180016bb0
mov r13, rax
cmp qword [rax + 8], 4
jne 0x18004b6fb
lea rdx, [0x180000000]
jmp case.0x18004b251.19
mov rax, qword [0x180073a58]
mov dword [rax + 0x48], 0
jmp case.0x18004b251.19
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 4
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 4
call fcn.18005f180
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 5
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 5
call fcn.18005f180
lea rdx, [0x180000000]
jmp case.0x18004b251.19
xor ebx, ebx
jmp case.0x18004b251.19
cmp qword [r13 + 0x20], 0
jne 0x18004b721
mov rax, qword [r13 + 0x10]
cmp qword [rax + 8], 2
je case.0x18004b251.19
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.std.ctype_unsigned_short_.dtor
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [r13 + 0x10]
mov rax, qword [rcx + 0x10]
cmp qword [rax + 8], 1
jne 0x18004b76d
mov rax, qword [rcx + 0x18]
cmp qword [rax + 8], 3
jne 0x18004b747
mov rax, qword [r13 + 0x18]
cmp qword [rax + 8], 7
je case.0x18004b251.19
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Preglednik_datoteka__s_nije_na
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf1
call fcn.180021380
mov r15, rax
mov qword [rbp + 0x58], 0
lea rdx, [0x180000000]
jmp case.0x18004b251.19
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 3
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 3
call fcn.18005f180
lea rdx, [0x180000000]
jmp case.0x18004b251.19
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 9
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 9
call fcn.18005f180
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 0xa
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 0xa
call fcn.18005f180
lea rdx, [0x180000000]
jmp case.0x18004b251.19
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 8
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 8
call fcn.18005f180
lea rdx, [0x180000000]
jmp case.0x18004b251.19
mov eax, 0xea
cmp eax, 0xea
je 0x18004b793
add eax, 0x9e
cmp eax, 0x188
jb 0x18004b5a1
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov r8d, 0xe2
call fcn.180034cc0
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
test rax, rax
je 0x18004b7a9
lea r9, [rbp + 0x60]
mov qword [rbp - 0x10], 0x30
lea r8, [rbp - 0x10]
mov qword [rbp + 0x60], 0x100
mov edx, 0xaf
mov rcx, rax
call fcn.1800396c0
mov r12d, eax
lea rdx, [0x180000000]
jmp case.0x18004b251.19
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 6
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 6
call fcn.18005f180
lea rax, [rbp + 0x58]
mov qword [rbp + 0x60], 7
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r8d, 0xbb
mov rdx, r15
mov ecx, 7
call fcn.18005f180
lea rdx, [0x180000000]
jmp case.0x18004b251.19
mov rax, qword [r13 + 0x18]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x18]
cmp qword [rax + 8], 0xa
jne 0x18004b7b3
add edi, 0xa
add esi, 0xa
cmp edi, r14d
jb 0x18004b233
mov eax, ebx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.IOCTL_BATTERY_QUERY_TAG_failed:
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.About_to_sink_phi_destination...
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.DebuggerCallback::UnloadAssembly
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Hasilkan_Checksum_dari_Image_ISO
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.__builtin_ia32_vpshldvq256_maskz
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.vim.LicenseManager.decodeLicense
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test r12d, r12d
je 0x18004b7a2
mov eax, 1
jmp 0x18004b69e
xor eax, eax
jmp 0x18004b69e
mov eax, 2
jmp 0x18004b69e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.OnCacheQueryReturn:_id_not_found
call fcn.18005f980
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3