Function at 0x1800fc610
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x18017d2b8]
xor rax, rsp
mov qword [rbp - 0x50], rax
mov ebx, dword [rsp + 0x40]
lea r12d, [rcx + 0x549]
mov r15, r9
mov r13d, ecx
cmp ecx, r12d
jae 0x1800fc9cd
movsd xmm6, qword [0x180159918]
movsd xmm8, qword [0x18015d848]
movsd xmm9, qword [0x18015ac58]
movsd xmm7, qword [0x18015a468]
movsd xmm10, qword [0x18015ca00]
movsd xmm11, qword [0x18015ac48]
movsd xmm12, qword [0x18015a510]
movsd xmm13, qword [0x18015d6c0]
movsd xmm14, qword [0x18015d820]
movsd xmm15, qword [0x18015d6d8]
mov r14d, dword [rsp + 0x40]
lea rsi, str.Ganti_Fail
cmp r13d, 0x124
ja 0x1800fc9a7
je 0x1800fc99b
mov eax, r13d
sub eax, 0xb
je 0x1800fc918
sub eax, 0x7b
je 0x1800fc900
sub eax, 0x23
je 0x1800fc7a9
sub eax, 0x16
je 0x1800fc79f
cmp eax, 0x42
jne 0x1800fcced
movsd xmm0, qword [rsp + 0x78]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x48]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea r8, str.rpb21
lea rdx, str.eraLtpb
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x50]
movsd qword [rsp + 0x50], xmm6
movsd qword [rsp + 0x40], xmm8
movsd qword [rsp + 0x48], xmm0
call fcn.1800fe9c0
movsd xmm0, qword [rbp - 0x80]
lea r8, str.rpb22
movsd qword [rsp + 0x50], xmm9
jmp 0x1800fccb4
mov ebx, 0xffffffd2
jmp 0x1800fcced
cmp dword [0x18017d614], 0
jle 0x1800fc7de
movsxd rax, dword [r15]
mov ecx, 2
lea rdi, [rax + rax*8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, qword [rsi + rdi*8]
lea rdx, str._1_:_Create_room_failed_with__2_
mov r8d, dword [0x18017d630]
mov rcx, rax
call fcn.18010fd20
xor r14d, r14d
cmp dword [0x18017d630], r14d
jle 0x1800fc8d4
xor esi, esi
mov rdx, qword [0x18017d6a0]
lea r8, [0x18017d6a0]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__spawnv]
mov rcx, rax
mov rax, qword [0x18017d768]
mov dword [rsi + rax], ecx
cmp ecx, 0xffffffff
je 0x1800fccff
test ecx, ecx
jne 0x1800fc89d
mov edi, SHSetFolderPathA
nop dword [rax + rax]
mov eax, edi
sub eax, 0xe3
je 0x1800fc847
cmp eax, 0x17
jne 0x1800fc890
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x1800e6920]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
lea eax, [r14 + 1]
mov dword [0x18017d614], 0
mov dword [rsp + 0x48], eax
lea r8, [rsp + 0x40]
mov eax, dword [r15]
mov r9d, SHSetFolderPathA
mov dword [rsp + 0x40], eax
xor edx, edx
lea rax, [rsp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18010cd30
add edi, 0x17
cmp edi, 0x111
jb 0x1800fc830
jmp 0x1800fc8c0
cmp dword [0x18017d614], 0
jle 0x1800fc8c0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, [0x1801502ac]
call fcn.18010fd20
inc r14d
add rsi, 4
cmp r14d, dword [0x18017d630]
jl 0x1800fc7f0
cmp dword [0x18017d614], 0
jle 0x1800fcced
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.s_wqm_b32
call fcn.18010fd20
jmp 0x1800fcced
movsd xmm0, qword [rsp + 0x70]
lea r8, str.rpb13
movsd qword [rsp + 0x50], xmm7
jmp 0x1800fccb4
lea r9, [rsp + 0x60]
movsd qword [rsp + 0x50], xmm10
lea r8, [rsp + 0x50]
mov edx, 0xca
xor ecx, ecx
call fcn.18000f250
movsd xmm0, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea r8, str.rpb11
lea rdx, str.eraLtpb
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x48], xmm6
movsd qword [rsp + 0x50], xmm11
movsd qword [rsp + 0x40], xmm0
call fcn.1800fe9c0
movsd xmm0, qword [rsp + 0x68]
lea r8, str.rpb12
movsd qword [rsp + 0x50], xmm12
jmp 0x1800fccb4
mov r14d, dword [0x18017d630]
jmp 0x1800fcced
mov eax, r13d
sub eax, 0x13a
je 0x1800fc9cd
sub eax, 0x42
je 0x1800fcbb6
sub eax, 0x23
je 0x1800fca3b
sub eax, 0x7b
je 0x1800fca34
cmp eax, 0x7b
jne 0x1800fcced
mov eax, ebx
mov rcx, qword [rbp - 0x50]
xor rcx, rsp
call fcn.180110960
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor ebx, ebx
jmp 0x1800fcced
movsxd rsi, r14d
test r14d, r14d
je 0x1800fcb8a
xor r14d, r14d
nop word [rax + rax]
mov rax, qword [0x18017d768]
lea rcx, [rsp + 0x58]
xor r8d, r8d
movsxd rdx, dword [rax + rsi*4 - 4]
call qword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__cwait]
mov rdi, rax
cmp eax, 0xffffffff
jne 0x1800fcb0e
cmp dword [0x18017d630], r14d
je 0x1800fcb0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0xa
jne 0x1800fcab6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.PrintAssemblyOptions_help:
mov rax, qword [0x18017d768]
mov r8d, dword [rax + rsi*4 - 4]
call fcn.18010fd20
jmp 0x1800fcb0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x1800fcae9
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.llvm.x86.avx512.mask.pand.q.512
mov rax, qword [0x18017d768]
mov r8d, dword [rax + rsi*4 - 4]
call fcn.18010fd20
jmp 0x1800fcb0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x16
jne 0x1800fcb0e
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.342_28_352
call fcn.18010fd20
cmp byte [rsp + 0x58], r14b
je 0x1800fcb80
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.NONTYPE_ERROR
mov rcx, rax
call fcn.18010fd20
mov edi, dword [rsp + 0x58]
lea eax, [rdi - 1]
cmp ax, 0xff
jae 0x1800fcb56
and edi, 0x7f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.IV_ABSDIFSFRACT
jmp 0x1800fcb75
cmp dil, 0x7f
jne 0x1800fcb80
sar edi, 8
mov ecx, 2
movzx edi, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.VariantGetInt32Elem
mov r8d, edi
mov rcx, rax
call fcn.18010fd20
sub rsi, 1
jne 0x1800fca50
cmp dword [0x18017d614], 0
jle 0x1800fcced
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.done_n
call fcn.18010fd20
jmp 0x1800fcced
movsd xmm0, qword [rbp - 0x78]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea r8, str.rpb23
lea rdx, str.eraLtpb
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x48], xmm6
movsd qword [rsp + 0x50], xmm13
movsd qword [rsp + 0x40], xmm0
call fcn.1800fe9c0
movsd xmm0, qword [rbp - 0x70]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea r8, str.rpb31
lea rdx, str.eraLtpb
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x48], xmm6
movsd qword [rsp + 0x50], xmm14
movsd qword [rsp + 0x40], xmm0
call fcn.1800fe9c0
movsd xmm0, qword [rbp - 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea r8, str.rpb32
lea rdx, str.eraLtpb
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x48]
movsd qword [rsp + 0x48], xmm6
movsd qword [rsp + 0x50], xmm15
movsd qword [rsp + 0x40], xmm0
call fcn.1800fe9c0
movsd xmm0, qword [0x18015ac60]
lea r8, str.rpb33
movsd qword [rsp + 0x50], xmm0
movsd xmm0, qword [rbp - 0x60]
lea rax, [rsp + 0x50]
movsd qword [rsp + 0x48], xmm6
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rdx, str.eraLtpb
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], r15
movsd qword [rsp + 0x40], xmm0
call fcn.1800fe9c0
add r13d, 0x7b
cmp r13d, r12d
jae 0x1800fc9cd
jmp 0x1800fc6f8
lea rcx, str.application_x_msnmsgrp2p
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
xor r9d, r9d
mov dword [rsp + 0x20], SHUnicodeToAnsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800774b0
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3