Function at 0x18002be50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
lea ebx, [rdx + 7]
mov r12, r8
mov dword [rsp + 0x40], ebx
mov r13d, edx
mov rbp, rcx
cmp edx, ebx
jae 0x18002c496
mov r15, qword [rsp + 0x58]
lea r14d, [rdx - 0x6d]
mov eax, dword [rsp + 0x40]
lea rdx, [0x180000000]
mov dword [rsp + 0xb8], r14d
mov esi, dword [rsp + 0xb8]
mov ebx, dword [rsp + 0xb8]
lea rdi, [0x18002fa85]
cmp r14d, 8
ja case.default.0x18002bec8
mov ecx, dword [rdx + r14*4 + 0x2c4b0]
add rcx, rdx
jmp rcx
mov esi, dword [0x18003cb1c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18002bf59
movzx edx, byte [0x18003cbb1]
mov ecx, 0x4f
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x4c
je 0x18002bf1a
sub eax, 1
je 0x18002bf24
cmp eax, 2
jne 0x18002bf1d
mov byte [0x18003900c], 0x2b
jmp 0x18002bf1d
or dl, 2
inc ecx
cmp ecx, 0x52
jb 0x18002bf00
mov byte [0x18003cbb1], dl
lea r8, [rsp + 0xb8]
mov rdx, rdi
mov dword [rsp + 0xb8], 0
mov r9, rdi
mov ecx, 0x5d
call fcn.180007790
xor edx, edx
mov ecx, 0xcb
call fcn.18002b650
mov r8d, 0x5d
lea rcx, [0x18003cb70]
mov rdx, rbp
call fcn.180013060
mov r15, rax
mov qword [rsp + 0x58], rax
jmp 0x18002c391
movsxd rdx, dword [0x180039008]
mov rcx, qword [0x18003d2f8]
shl rdx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [0x18003d2f8], rax
test rax, rax
jne 0x18002c119
mov r14d, 0x10
nop dword [rax]
mov eax, r14d
sub eax, 0x10
je 0x18002c3b8
cmp eax, 1
jne 0x18002c0f5
mov ebp, 0xa9
nop word [rax + rax]
mov eax, ebp
sub eax, 0xa8
je case.0x18002bec8.8
cmp eax, 1
jne 0x18002c0e7
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18002c0e2
mov edi, 0xf0
lea r12, [0x18002fa85]
lea r15, str.Audio_Bestanden
nop dword [rax]
mov eax, edi
sub eax, 0xf0
je 0x18002c0ba
cmp eax, 1
jne 0x18002c0c7
cmp esi, dword [0x18003cb1c]
je 0x18002c084
mov ebx, 0xf9
mov eax, ebx
sub eax, 0xf8
je 0x18002c05f
cmp eax, 1
jne 0x18002c07a
lea rcx, str.aslr_areas_readwrite__D:drmemory_packagedynamoriocorewin32_aslr.c:240
call fcn.18002cfd0
jmp 0x18002c07a
xor r9d, r9d
lea rcx, str.::ch_ch_FONIPA_::und_FONIPA_fa_
mov r8, r12
mov rdx, r12
call fcn.18002cfd0
mov dword [0x18003cb1c], esi
dec ebx
cmp ebx, 0xf7
ja 0x18002c043
mov r9d, 0xda
mov qword [0x18003cb60], r15
lea r8, [rsp + 0xc8]
mov dword [rsp + 0xc8], 0
lea rdx, str.icudt46l_cy.res
mov qword [rsp + 0x20], r12
mov rcx, r12
call fcn.1800186f0
jmp 0x18002c0c7
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x15]
call fcn.18002a460
inc edi
cmp edi, 0xf2
jb 0x18002c020
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0xc0]
mov ebx, 0xffffffff
dec ebp
cmp ebp, 0xa7
ja 0x18002bfd0
inc r14d
cmp r14d, 0x12
jb 0x18002bfb0
mov rbp, qword [rsp + 0xb0]
lea rdi, [0x18002fa85]
mov r14d, dword [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18002c391
mov eax, dword [0x18003d2f8]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0xb8]
mov byte [rsp + 0xb8], 2
mov qword [rsp + 0x30], rax
mov r8, rdi
lea rax, [rsp + 0xc8]
mov dword [rsp + 0x28], 0x121
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov byte [rsp + 0xc8], 2
mov dword [rsp + 0x50], 0
call fcn.18001c8f0
jmp 0x18002c391
test r15, r15
je 0x18002c211
mov edi, 0x1b
mov eax, edi
sub eax, 0x19
je 0x18002c1ee
sub eax, 1
je 0x18002c1d5
cmp eax, 1
jne 0x18002c20a
mov eax, dword [r15]
lea r8, [0x18003cb70]
mov r9, r12
mov dword [r12], eax
mov rdx, rbp
mov ecx, 0x7b
call fcn.180025410
jmp 0x18002c20a
mov edx, dword [r12]
mov rax, qword [0x18003d2f8]
add rdx, rdx
mov ecx, dword [r12 + 8]
mov dword [rax + rdx*8 + 8], ecx
jmp 0x18002c20a
mov eax, 0x8b
cmp eax, 0x8b
je 0x18002c3d8
add eax, 0x54b4
cmp eax, 0x54b4
jbe 0x18002c1f3
dec edi
cmp edi, 0x18
ja 0x18002c1a4
mov qword [rsp + 0x28], 0
lea rdx, [0x18003cb70]
mov r9, rbp
mov qword [rsp + 0x20], 0
mov r8, r12
mov ecx, 0x68
call fcn.180026880
inc dword [0x180039008]
jmp 0x18002c391
mov eax, dword [0x180039008]
dec eax
movsxd rcx, eax
mov rax, qword [0x18003d2f8]
add rcx, rcx
mov qword [rax + rcx*8], rbp
mov eax, dword [0x180039008]
mov ecx, dword [r12 + 8]
dec eax
movsxd rdx, eax
mov rax, qword [0x18003d2f8]
add rdx, rdx
mov dword [rax + rdx*8 + 8], ecx
jmp 0x18002c391
movzx ebx, byte [rbp]
movzx eax, byte [0x18003cbb1]
and ebx, eax
jmp case.0x18002bec8.5
mov eax, dword [0x180039008]
mov edi, 0x5b
dec eax
mov dword [r12], eax
mov eax, edi
sub eax, 0x5a
je case.0x18002bec8.8
cmp eax, 1
jne 0x18002c386
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18002c384
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x15]
call fcn.18002a460
mov r8d, dword [0x18003cb1c]
cmp esi, r8d
je 0x18002c35a
mov ebx, 0xb6
nop dword [rax]
cmp ebx, 0xb6
je 0x18002c337
cmp ebx, 0x7604
jne 0x18002c34c
lea rax, [0x18002fa85]
xor r9d, r9d
mov r8, rax
lea rcx, str.vmx_cfgState_val_useVirtualExec
mov rdx, rax
call fcn.18002cfd0
mov r8d, esi
mov dword [0x18003cb1c], esi
jmp 0x18002c34c
mov edx, esi
lea rcx, str.wVY18BTcZTYJbqukB8c10cIDMzZbdSZtQvESa0NvS3GUjQd7RNuyoB_mC9suWXY6QIDAQABo4HU
call fcn.18002cfd0
mov r8d, dword [0x18003cb1c]
add ebx, 0x754e
cmp ebx, 0xea9c
jbe 0x18002c300
lea rax, [0x18002fa85]
mov dword [rsp + 0xb8], 0
mov r9, rax
lea r8, [rsp + 0xb8]
mov rdx, rax
mov ecx, 0x5d
call fcn.180007790
xor ebx, ebx
dec edi
cmp edi, 0x59
ja 0x18002c2a4
lea rdx, [0x180000000]
mov eax, dword [rsp + 0x40]
inc r14d
inc r13d
mov dword [rsp + 0xb8], r14d
cmp r13d, eax
jae case.0x18002bec8.8
jmp 0x18002beac
mov r8d, 0xe
lea rdx, str.gsBufferSymbol
lea ecx, [r8 - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18002c492
mov ebx, 0xee
mov eax, ebx
sub eax, 0xed
je 0x18002c459
cmp eax, 1
jne 0x18002c484
xor edx, edx
lea r8d, [rax + 0x14]
xor ecx, ecx
call fcn.18002a460
mov r8d, dword [0x18003cb1c]
cmp esi, r8d
je 0x18002c484
mov edx, esi
lea rcx, str.BAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEaMBgGA1UE
call fcn.18002cfd0
lea rdi, [0x18002fa85]
xor r9d, r9d
mov r8, rdi
lea rcx, str.session__obq_flood_counter____0
mov rdx, rdi
call fcn.18002cfd0
mov dword [0x18003cb1c], esi
jmp 0x18002c484
lea r9, [0x18002fa85]
mov dword [rsp + 0xb8], 0
lea r8, [rsp + 0xb8]
mov ecx, 0x5d
lea rdx, [0x18002fa85]
call fcn.180007790
dec ebx
cmp ebx, 0xec
ja 0x18002c400
xor eax, eax
jmp 0x18002c49f
mov ebx, dword [rsp + 0xb8]
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret