Function at 0x180041990
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc8
mov r15d, dword [rbp + 0x7f]
mov r14, rdx
mov rbx, qword [rbp - 0x59]
mov rdi, r9
mov rdx, rcx
lea eax, [r15 + 0x214]
mov dword [rbp - 0x51], eax
cmp r15d, eax
jae case.0x180041a2c.109
mov r12, qword [rbp - 0x59]
mov r13, qword [rbp - 0x39]
mov rsi, qword [rbp + 0x77]
xor r8d, r8d
lea r9, [0x180000000]
cmp r15d, 0x172
ja 0x180041dda
je 0x180041d4e
lea eax, [r15 - 0x6b]
cmp eax, 0xe1
ja case.0x180041a2c.117
movzx eax, byte [r9 + rax + 0x41ebc]
mov ecx, dword [r9 + rax*4 + 0x41e90]
add rcx, r9
jmp rcx
mov ecx, 0x4d
mov rax, qword [rbp - 0x69]
cmp ecx, 0x4d
cmove rax, r8
dec ecx
mov qword [rbp - 0x69], rax
cmp ecx, 0x4b
ja 0x180041a33
jmp case.0x180041a2c.117
mov qword [rbp - 0x61], r12
jmp case.0x180041a2c.117
test r12, r12
jne 0x180041a77
lea r9d, [r12 + 0x30]
mov dword [rsp + 0x20], 6
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.18002d150
lea rax, [0x1801070a0]
mov r8d, 0x43
mov rdx, r12
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x31]
call fcn.1800a9ce0
cdqe
add rax, r12
mov qword [rbp - 0x41], rax
jmp case.0x180041a2c.117
mov rsi, qword [rbp + 0x77]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x180041ab0
movsxd rcx, eax
test eax, eax
je case.0x180041a2c.117
lea rdi, [rcx + rsi]
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [rdi - 1]
dec rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je case.0x180041a2c.115
mov byte [rdi], 0
cmp rdi, rsi
jne 0x180041ad0
add r15d, 0x26
cmp r15d, dword [rbp - 0x51]
jae case.0x180041a2c.109
mov rdi, qword [rbp + 0x67]
mov rdx, qword [rbp + 0x4f]
mov r14, qword [rbp + 0x57]
jmp 0x1800419ec
movsxd rdx, dword [rdi]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [rbp + 0x77], rax
test rax, rax
je 0x180041e64
mov rbx, rax
mov rsi, rax
jmp case.0x180041a2c.117
mov dword [rsp + 0x28], 0x5d
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor edx, edx
xor r8d, r8d
xor ecx, ecx
call fcn.1800a9920
mov r13, rax
mov qword [rbp - 0x39], rax
jmp case.0x180041a2c.117
mov r15d, 0x14a
jmp case.0x180041a2c.117
mov r15d, dword [rbp - 0x71]
cmp r15d, dword [rdx]
jge 0x180041ca4
nop dword [rax]
nop word [rax + rax]
mov r14d, 0x69
cmp r14d, 0x69
je 0x180041c39
cmp r14d, 0x4623
je 0x180041ba3
cmp r14d, 0x8bdd
jne 0x180041c7b
mov rax, qword [rbp - 0x29]
mov qword [rbp - 0x61], rax
jmp 0x180041c7b
mov edi, dword [rbp - 0x61]
mov rax, qword [r13 + 8]
sub edi, r12d
movsxd rcx, edi
cmp rcx, qword [rax]
jge 0x180041c00
lea rsi, [rcx + r12]
mov r15d, 0x100
nop
movzx edx, byte [rsi]
lea r9, [rbp - 0x69]
movzx eax, byte [rsi + 1]
lea r8, [rbp + 0x7f]
movzx ecx, r15w
imul edx, ecx
xor ecx, ecx
add dx, ax
mov word [rbp + 0x7f], dx
mov edx, 0xe4
call fcn.18008a4a0
mov rax, qword [r13 + 8]
lea rsi, [rsi + 2]
add edi, 2
movsxd rcx, edi
cmp rcx, qword [rax]
jl 0x180041bc0
mov r15d, dword [rbp - 0x71]
mov rax, qword [rbp + 0x5f]
lea r9, [rbp - 0x69]
mov rdi, qword [rbp + 0x67]
mov ecx, 0x9c
mov rdx, qword [rbp + 0x77]
mov r8, rdi
mov qword [rsp + 0x30], r12
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call fcn.1800ab4f0
inc r15d
mov dword [rbp - 0x71], r15d
jmp 0x180041c7b
mov rax, qword [rbp + 0x6f]
lea rcx, [rbp - 0x29]
mov r8, qword [rbp - 0x61]
mov r9, rdi
mov rdx, qword [rbp + 0x77]
mov qword [rsp + 0x40], rcx
mov ecx, 0xa0
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x41]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
call fcn.18005d540
test eax, eax
je 0x180041c9c
add r14d, 0x45ba
cmp r14d, 0xd12e
jbe 0x180041b76
mov rdx, qword [rbp + 0x4f]
cmp r15d, dword [rdx]
jl 0x180041b70
mov rsi, qword [rbp + 0x77]
mov r14, qword [rbp + 0x57]
cmp dword [rbp - 0x71], 0
mov r15d, 0x14c
jne case.0x180041a2c.117
mov edi, 0xd5
nop dword [rax]
mov eax, edi
sub eax, 0xd4
je case.0x180041a2c.109
cmp eax, 1
jne 0x180041d22
mov rax, qword [0x1800fb9d8]
lea rdx, [rbp - 0x49]
mov r8d, 0x6d
mov qword [rbp - 0x49], rax
mov rcx, r12
call fcn.1800809f0
xor ecx, ecx
mov dword [rbp + 0x7f], 1
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov r8, r13
lea rcx, [rbp - 0x21]
mov edx, 0xb2
call fcn.1800a4110
mov rbx, r14
dec edi
cmp edi, 0xd3
ja 0x180041cc0
jmp case.0x180041a2c.117
mov rcx, qword [r14 + 0x10]
xor edx, edx
mov dword [rbp - 0x71], r8d
mov r8d, 0xb7
call fcn.180036a30
mov r12, rax
jmp case.0x180041a2c.117
mov edi, dword [rbp - 0x61]
mov r14, qword [rbp - 0x41]
sub edi, r12d
movsxd rax, edi
sub r14, r12
cmp rax, r14
jge 0x180041dac
lea rsi, [rax + r12]
mov r13d, 0x100
nop dword [rax]
movzx edx, byte [rsi]
lea r9, [rbp - 0x69]
movzx eax, byte [rsi + 1]
lea r8, [rbp + 0x7f]
movzx ecx, r13w
imul edx, ecx
xor ecx, ecx
add dx, ax
mov word [rbp + 0x7f], dx
mov edx, 0xe4
call fcn.18008a4a0
add edi, 2
lea rsi, [rsi + 2]
movsxd rax, edi
cmp rax, r14
jl 0x180041d70
mov r13, qword [rbp - 0x39]
mov rax, qword [rbp - 0x69]
xor r9d, r9d
mov r8, qword [rbp + 0x77]
xor edx, edx
mov dword [rsp + 0x28], 0x77
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18005d250
mov rsi, qword [rbp + 0x77]
mov qword [rbp - 0x59], rax
jmp case.0x180041a2c.117
mov eax, r15d
sub eax, 0x198
je 0x180041e12
sub eax, 0x26
je 0x180041e09
cmp eax, 0x26
jne case.0x180041a2c.117
mov rax, rbx
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rbx, qword [rbp - 0x59]
jmp case.0x180041a2c.117
mov rax, qword [0x1800fb9d8]
lea rdx, [rbp - 0x49]
mov r8d, 0x6d
mov qword [rbp - 0x49], rax
mov rcx, r12
call fcn.1800809f0
xor ecx, ecx
mov dword [rbp + 0x7f], 1
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov r8, r13
lea rcx, [rbp - 0x21]
mov edx, 0xb2
call fcn.1800a4110
jmp case.0x180041a2c.117
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, dword [rdi]
lea rdx, str.AntiMalwareInstallResult
mov rcx, rax
call fcn.1800ba9c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3