Function at 0x180032200
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, qword [rbp + 0xe8]
mov r15d, r8d
mov r8, qword [rbp + 0xe0]
mov r10, rdx
mov qword [rbp - 0x18], r9
mov qword [rsp + 0x50], rdx
lea eax, [r15 + 0x11]
mov qword [rbp - 0x20], rcx
mov dword [rsp + 0x58], eax
mov ebx, dword [rsp + 0x58]
mov qword [rsp + 0x48], r8
mov qword [rbp - 0x40], rdi
cmp r15d, eax
jae case.0x1800322b2.287
mov r12, qword [rbp - 0x40]
lea rdx, [0x180000000]
mov r13d, dword [rsp + 0x58]
mov r14, qword [rbp - 0x48]
mov rsi, qword [rsp + 0x60]
lea eax, [r15 - 0x114]
cmp eax, 0x26
ja case.default.0x18003283b
movzx eax, byte [rdx + rax + 0x32b40]
mov ecx, dword [rdx + rax*4 + 0x32af8]
add rcx, rdx
jmp rcx
mov r8d, 0x20
lea rdx, [0x1800c5e98]
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180032a50
lea r8, [0x1800c5ed8]
mov edx, 0xf4
lea rcx, [rbp + 0x20]
call fcn.18002a700
mov r8d, 0x20
lea rdx, [0x1800c5eb8]
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180032a28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x1800a3b9b]
mov rcx, rax
lea rdx, str.audio_type
lea rax, str.dst___NULL__dst__htable__NULL__dst__th_htable__NULL
mov qword [rsp + 0x20], rax
call fcn.1800a0de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
cmp qword [0x1800c5e90], 0
jne 0x180032372
mov r9d, 0xc2
mov dword [rbp - 0x80], 0
lea r8, [rsp + 0x78]
mov dword [rsp + 0x78], 3
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.180006800
mov qword [0x1800c5e90], rax
mov eax, dword [rdi]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x40]
mov rax, qword [0x1800c5e90]
mov r8d, 0xc0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 2
call fcn.1800786e0
jmp 0x180032a28
mov qword [0x1800c5e90], 0
jmp case.default.0x18003283b
cmp byte [r8], 0x2d
jne 0x1800323ea
cmp byte [r8 + 1], 0
jne 0x1800323ea
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r12, rax
jmp 0x180032a28
lea rdx, [0x1800aa204]
mov rcx, r8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r12, rax
test rax, rax
jne 0x180032a28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
lea ecx, [r12 + 2]
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [rsp + 0x48]
lea rdx, str.ourStatement2Batch
mov rcx, rax
mov r9, rbx
call fcn.1800a0de0
lea ecx, [r12 - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, qword [0x1800c5e90]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rdi + 0x85]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, ILAppendID
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], 0x14
mov dword [rsp + 0x30], 0
call fcn.1800286c0
mov rcx, qword [0x1800c5e90]
lea rdx, [0x1800a54bc]
call fcn.1800a0de0
xor ebx, ebx
jmp 0x180032a28
mov r8, qword [0x1800c5e90]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rdi + 4]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, ILAppendID
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], 0x19
mov dword [rsp + 0x30], 0
call fcn.1800286c0
cmp dword [0x1800c3b10], 0
je 0x18003250a
movsd xmm0, qword [0x1800b8570]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
cvttsd2si eax, xmm0
jmp 0x18003250d
mov eax, dword [rdi + 0x40]
mov r8, qword [0x1800c5e90]
lea r9, [rdi + 0x24]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x28], rax
mov edx, ILAppendID
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x20], rax
call fcn.1800286c0
mov r8, qword [0x1800c5e90]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rdi + 0x44]
lea rax, [rbp - 0x70]
mov dword [rbp - 0x70], 1
mov edx, ILAppendID
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x68]
mov dword [rbp - 0x78], 0xa
mov dword [rbp - 0x68], 0
call fcn.1800286c0
jmp 0x180032a28
mov edi, 0xa1
nop dword [rax]
cmp edi, 0xa1
je 0x1800325e2
cmp edi, 0x3758
jne 0x1800325ee
mov eax, ebx
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1800a1820
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ebx, r13d
add edi, 0x36b7
cmp edi, 0x6d6e
jbe 0x1800325a0
lea r8, [rbp - 0x10]
mov ecx, 0x27
lea rdx, [0x1800c5ed8]
call fcn.18009fa20
test eax, eax
je 0x180032a87
lea r8, [0x1800c5ed8]
mov edx, 0x50
lea rcx, [rbp + 0x60]
call fcn.1800178d0
jmp 0x180032a28
mov r8, qword [0x1800c5e90]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rdi + 0x54]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], 1
mov edx, ILAppendID
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x60], ILFindLastID
mov dword [rsp + 0x68], 0
call fcn.1800286c0
mov r8, qword [0x1800c5e90]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rdi + 0x68]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, ILAppendID
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], ILFindLastID
mov dword [rsp + 0x30], 0
call fcn.1800286c0
mov r8, qword [0x1800c5e90]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rdi + 0x75]
lea rax, [rbp - 0x58]
mov dword [rbp - 0x58], 1
mov edx, ILAppendID
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x60], ILFindLastID
mov dword [rbp - 0x50], 0
call fcn.1800286c0
jmp 0x180032a28
mov dword [rbp + 0x40], 0x3020100
mov dword [rbp + 0x44], 0x7060504
mov dword [rbp + 0x48], 0x14131211
mov dword [rbp + 0x4c], 0x18171615
movups xmm0, xmmword [rbp + 0x40]
mov dword [rbp + 0x50], 0x25242322
mov dword [rbp + 0x54], 0x29282726
mov dword [rbp + 0x58], 0x36353433
mov dword [rbp + 0x5c], 0x40393837
movups xmm1, xmmword [rbp + 0x50]
mov dword [0x1800c5eb8], 0x37383940
movups xmmword [0x1800c5e98], xmm0
mov dword [0x1800c5ebc], 0x33343536
movups xmmword [0x1800c5ea8], xmm1
mov dword [0x1800c5ec0], 0x26272829
mov dword [0x1800c5ec4], 0x22232425
mov dword [0x1800c5ec8], 0x15161718
mov dword [0x1800c5ecc], 0x11121314
mov dword [0x1800c5ed0], 0x4050607
mov dword [0x1800c5ed4], 0x10203
mov dword [0x1800c5ed8], 0x3383940
mov dword [0x1800c5edc], 0x10d4d8d
mov dword [0x1800c5ee0], 0x2829333
mov dword [0x1800c5ee4], 0x94989c
mov dword [0x1800c5ee8], 0x222324
mov dword [0x1800c5eec], 0x14585c6
mov dword [0x1800c5ef0], 0x1213141
mov dword [0x1800c5ef4], 0x181c44
mov dword [0x1800c5ef8], 0x2030405
mov dword [0x1800c5efc], 0x40
mov dword [0x1800c5f00], 1
mov dword [0x1800c5f04], 1
jmp case.default.0x18003283b
movsxd rax, dword [rdi]
mov r13d, 1
cmp eax, 5
ja case.default.0x18003283b
mov ecx, dword [rdx + rax*4 + 0x32b68]
add rcx, rdx
jmp rcx
mov r9, r10
lea rdx, [rbp - 0x38]
mov r8, r12
mov ecx, 0x30
call fcn.1800271f0
jmp case.0x18003283b.0
mov r9, r12
lea rcx, [rbp - 0x38]
mov r8, r10
mov edx, 0x88
call fcn.180048490
jmp case.0x18003283b.0
lea r8, [rbp - 0x38]
mov edx, 0x37
mov rcx, r10
call fcn.1800085f0
mov r13d, eax
mov rdx, rsi
mov ecx, 0x1c
mov r15d, 0x118
call fcn.180028580
mov edi, 0x51
mov eax, edi
sub eax, 0x51
je 0x180032932
sub eax, 0x4c
je 0x18003294d
cmp eax, 0xb0a
je 0x180032a28
jmp 0x18003294d
mov r8d, 0x81
lea rcx, [rbp - 0x38]
mov rdx, r10
call fcn.180032b80
jmp 0x18003287a
lea r8, [rbp - 0x38]
mov rdx, r10
mov ecx, 0x8f
call fcn.1800556d0
jmp 0x18003287a
lea r8, [0x1800c5e98]
mov edx, 0xeb
lea rcx, [rbp - 0x10]
call fcn.180062790
test eax, eax
jne 0x180032a28
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x1800a3b9b]
mov rcx, rax
lea rdx, str.mi_ISO_...
lea rax, str.CBuddyClientSend::RequestAddBuddy:_encryption_is_NULL_
mov qword [rsp + 0x20], rax
call fcn.1800a0de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rax, qword [r14]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x180032944
mov rcx, qword [r14 + 8]
call rdx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add edi, 0x5b2
cmp edi, 0x1116
jbe 0x180032895
jmp 0x180032a28
lea r8, [rbp - 0x10]
mov ecx, 0x27
lea rdx, [0x1800c5ed8]
call fcn.18009fa20
test eax, eax
je 0x180032abe
lea r8, [0x1800c5eb8]
mov edx, 0x11a
lea rcx, [rbp - 0x10]
call fcn.180027690
jmp 0x180032a28
mov r8, r12
mov edx, 0x7f
xor ecx, ecx
call fcn.180045810
mov r14, rax
mov qword [rbp - 0x48], rax
jmp 0x180032a28
mov r9, r14
xor edx, edx
xor ecx, ecx
mov r8d, 0xe9
call fcn.18004c0d0
mov r14, qword [rbp - 0x18]
mov rcx, rax
mov qword [rsp + 0x60], rax
mov edi, PathMakeUniqueName
mov rax, qword [rbp - 0x20]
mov esi, dword [rax]
movzx eax, byte [0x1800c56c1]
cmp edi, 0x2c
je 0x180032a06
cmp edi, 0x36
jne 0x180032a11
test al, al
je 0x180032a11
call qword [0x1800c56b8]
mov rcx, qword [rsp + 0x60]
xor al, al
mov byte [0x1800c56c1], al
jmp 0x180032a11
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], esi
add edi, 0x207c
cmp edi, 0x6174
jbe 0x1800329e3
mov r14, qword [rbp - 0x48]
mov rsi, qword [rsp + 0x60]
mov r10, qword [rsp + 0x50]
lea rdx, [0x180000000]
mov r8, qword [rsp + 0x48]
inc r15d
cmp r15d, dword [rsp + 0x58]
jae case.0x1800322b2.287
mov rdi, qword [rbp - 0x40]
jmp 0x180032290
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x1800a3b9b]
mov rcx, rax
lea rdx, str.covMatType
lea rax, str.reVTMD_is_disabled_due_to_its_non_free_licensing.
mov qword [rsp + 0x20], rax
call fcn.1800a0de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x1800a3b9b]
mov rcx, rax
lea rdx, str.Qi03Qip7Qi
lea rax, str.uint16___OVERLOADABLE___convert_uint_sat_rtz_ushort16__
mov qword [rsp + 0x20], rax
call fcn.1800a0de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x1800a3b9b]
mov rcx, rax
lea rdx, str.forcequant
lea rax, str.ATL.CComObject_CPsLookupFieldUsageChildMetadata_.Release
mov qword [rsp + 0x20], rax
call fcn.1800a0de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3