Function at 0x1800774b0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
mov rax, qword [0x18017d2b8]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r14d, dword [rbp + 0xe0]
xor r10d, r10d
mov r15, r9
mov qword [rsp + 0x60], rdx
mov r13, r8
mov r12, rcx
mov edi, r14d
lea esi, [r14 - 0xb]
cmp r14d, esi
jbe 0x1800777ae
movsd xmm8, qword [0x18015b530]
lea r8d, [r10 + 0x50]
movsd xmm7, qword [0x18015b6d0]
lea r10d, [r8 - 1]
movsd xmm6, qword [0x180159948]
lea r11d, [r8 + 0x20]
movsd xmm9, qword [0x18015de50]
lea ebx, [r14 - 0xd1]
movsd xmm10, qword [0x18015e350]
lea rdx, [0x180000000]
mov r9d, 0x6e65
nop dword [rax]
cmp ebx, 0x2f
ja case.0x18007758b.11
movzx eax, byte [rdx + rbx + 0x779fc]
mov ecx, dword [rdx + rax*4 + 0x779cc]
add rcx, rdx
jmp rcx
xor edx, edx
nop
cmp qword [r15 + 0x18], 0x10
mov rax, r15
jb 0x18007759d
mov rax, qword [r15]
mov rcx, qword [r13]
movzx eax, byte [rcx + rax]
sub al, 0x67
cmp al, 0x13
ja 0x18007781e
inc rdx
lea rax, [rcx + 1]
mov qword [r13], rax
cmp rdx, 4
jb 0x180077590
mov byte [rsp + 0x50], 1
jmp 0x180077798
mov eax, 0x65
mov dword [rbp - 0x1b], 0x636f72
mov word [rbp - 0x18], ax
jmp case.0x18007758b.11
mov word [rbp - 0x1c], r8w
jmp case.0x18007758b.11
mov word [rbp - 0x1e], r9w
jmp case.0x18007758b.11
mov word [rbp - 0x20], r10w
mov word [rbp - 0x1f], r11w
jmp case.0x18007758b.11
movaps xmm0, xmmword [0x180168ea0]
movups xmmword [rbp - 0x68], xmm0
movsd qword [rbp - 0x58], xmm8
jmp case.0x18007758b.11
movaps xmm0, xmmword [0x180169e40]
lea r9, [rbp - 0x80]
mov r8d, SHSetFolderPathA
movsd qword [rbp - 0x70], xmm7
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x68]
movups xmmword [rbp - 0x80], xmm0
call fcn.1800e6cd0
jmp 0x180077784
movsd xmm0, qword [r13]
lea rax, [rbp - 0x38]
movsd xmm1, qword [r15]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
movsd qword [rsp + 0x40], xmm0
mov edx, 0xa0
movsd qword [rsp + 0x48], xmm1
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.1800d3940
mov rax, qword [rsp + 0x60]
lea r9, [rsp + 0x48]
movsd xmm1, qword [r12]
lea r8, [rsp + 0x40]
mov edx, 0xa0
movsd qword [rsp + 0x40], xmm1
xor ecx, ecx
movsd xmm0, qword [rax]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
movsd qword [rsp + 0x48], xmm0
call fcn.1800d3940
jmp 0x180077784
movsd xmm0, qword [rsp + 0x78]
lea rax, [rsp + 0x48]
movsd qword [rsp + 0x40], xmm0
lea r9, [rsp + 0x40]
movsd qword [rsp + 0x58], xmm6
lea r8, [0x180113a98]
movsd qword [rsp + 0x48], xmm7
lea rcx, [rsp + 0x58]
jmp 0x180077766
movsd xmm0, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea r8, [0x180113a9c]
lea rdx, str.eraPxp
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x40]
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x58], xmm9
movsd qword [rsp + 0x48], xmm0
call fcn.1800fe9c0
movsd xmm0, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
movsd qword [rsp + 0x48], xmm0
lea r9, [rsp + 0x48]
movsd qword [rsp + 0x40], xmm6
lea r8, [0x18014da40]
movsd qword [rsp + 0x58], xmm10
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rdx, str.eraPxp
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
mov qword [rsp + 0x20], r15
call fcn.1800fe9c0
mov r11d, 0x70
mov r9d, 0x6e65
lea r10d, [r11 - 0x21]
lea r8d, [r11 - 0x20]
lea rdx, [0x180000000]
dec edi
dec ebx
cmp edi, esi
ja 0x180077570
xor r10d, r10d
lea ebx, [r14 + 0x44c]
mov dword [rsp + 0x40], ebx
cmp r14d, ebx
jae case.0x18007758b.4
mov rbx, qword [rsp + 0x50]
mov ecx, 0x73
mov r12, qword [rsp + 0x58]
mov eax, dword [rsp + 0x40]
lea edx, [rcx - 7]
lea r8d, [rcx - 0x40]
lea r9d, [rcx - 0x41]
cmp r14d, 0x19c
ja 0x180077890
je 0x18007787d
mov eax, r14d
sub eax, 0xd4
je 0x180077874
sub eax, 0x21
je 0x180077954
sub eax, 0xb
je 0x18007783d
sub eax, 0x38
je 0x18007782d
cmp eax, 0x2c
je 0x180077989
jmp 0x18007793f
mov byte [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
jmp 0x18007798c
mov word [rbp - 0x16], cx
mov dword [rbp - 0x10], 0x65006b
jmp 0x18007793f
mov qword [rsp + 0x28], r10
lea r8, [rbp - 0x50]
xor r9d, r9d
mov dword [rsp + 0x20], 0x39
xor edx, edx
lea rcx, [rbp - 0x38]
call fcn.1800d8c70
mov rbx, rax
mov ecx, 0x73
lea edx, [rcx - 7]
lea r8d, [rcx - 0x40]
lea r9d, [rcx - 0x41]
jmp 0x18007793f
mov word [rbp - 0x17], cx
jmp 0x18007793f
mov dword [rbp - 0xc], 0x6e0072
mov dword [rbp - 8], 0x6c0065
jmp 0x180077943
mov eax, r14d
sub eax, 0x200
je 0x180077931
sub eax, 0x64
je 0x180077928
sub eax, 0x64
je 0x180077909
sub eax, 0x64
je 0x1800778bf
cmp eax, 0x64
je 0x180077989
jmp 0x18007793f
cmp dword [0x18017d630], 0
mov esi, r10d
jle 0x18007793f
mov rdi, r10
nop
mov rax, qword [0x18017d768]
mov r8d, dword [rdi + rax]
test r8d, r8d
je 0x1800778f6
xor edx, edx
lea ecx, [rdx + 1]
call r12
mov rcx, rax
mov edx, 3
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
inc esi
add rdi, 4
cmp esi, dword [0x18017d630]
jl 0x1800778d0
jmp 0x18007785f
lea r8, [rbp - 0x20]
mov word [rbp + 8], r10w
mov edx, 0x29
lea rcx, [rbp - 0x10]
call fcn.180012590
mov r12, rax
jmp 0x18007785f
mov dword [rbp + 4], 0x6c006c
jmp 0x18007793f
mov dword [rbp - 4], 0x320033
mov dword [rbp], 0x64002e
mov eax, dword [rsp + 0x40]
add r14d, 0x64
cmp r14d, eax
jae 0x180077989
xor r10d, r10d
jmp 0x1800777e0
movsd xmm0, qword [r15]
subsd xmm0, qword [0x18015cfb0]
addsd xmm0, qword [r13]
divsd xmm0, qword [0x18015c738]
addsd xmm0, qword [0x18015ca38]
movsd qword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x50]
jmp 0x18007798c
mov rbx, qword [rsp + 0x50]
mov rax, rbx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.180110960
lea r11, [rsp + 0x178]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret