Function at 0x180021fe0
Capabilities:
Execute command

Disassembly:
mov r11, rsp
push rdi
push r15
sub rsp, 0x1f8
mov rax, qword [0x1800312f8]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
lea eax, [rdx - 0xd]
mov qword [rsp + 0x20], rcx
mov rdi, r8
mov r15, r9
mov r8, rcx
cmp edx, eax
jbe 0x1800222dc
mov qword [r11 + 8], rbx
lea r9, [0x18001a890]
mov ebx, dword [rsp + 0x20]
mov qword [r11 - 0x18], rbp
lea ebp, [rdx - 0xaf]
mov qword [r11 - 0x20], rsi
lea rdx, [0x180000000]
mov qword [r11 - 0x28], r12
xor esi, esi
movzx r12d, byte [rsp + 0x28]
mov qword [r11 - 0x30], r13
mov r13, qword [rsp + 0x20]
mov qword [r11 - 0x38], r14
mov r14d, 0xd
nop dword [rax + rax]
cmp ebp, 0xd
ja case.0x180022073.1
mov ecx, dword [rdx + rbp*4 + 0x222f8]
add rcx, rdx
jmp rcx
movzx eax, r12b
test r13, r13
mov ecx, esi
cmovne ecx, eax
movzx r12d, cl
jmp case.0x180022073.1
lea rcx, str.clear
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x18002228d
mov word [rsp + 0x182], si
jmp case.0x180022073.1
movzx esi, word [r8]
mov ebx, 0x8b
mov eax, ebx
sub eax, 0x8b
je 0x1800220cb
cmp eax, 0x3e
jne 0x1800220cf
mov rcx, qword [rdi + 0x10]
call fcn.180023e38
jmp 0x1800220cf
mov word [rdi + 8], si
add ebx, 0x37
cmp ebx, 0xf9
jb 0x1800220b2
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x148
call sub.VCRUNTIME140.dll_memset
xor esi, esi
mov ebx, esi
jmp 0x18002228d
lea rcx, [rdi + 0xa]
cmp rcx, r15
je case.0x180022073.1
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x18002210f
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
call fcn.1800206c0
jmp 0x18002228d
movups xmm0, xmmword [str.qvs:_tfc]
mov r8d, 1
mov dword [rsp + 0x1b8], 0x64
lea rdx, [0x180028504]
lea rcx, [rsp + 0x1a8]
movups xmmword [rsp + 0x1a8], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x2000610078
mov qword [rsp + 0x1bc], rax
mov eax, 0x6e
mov word [rsp + 0x180], ax
jmp 0x18002228d
lea rcx, [rsp + 0x30]
mov qword [rdi], r9
call qword [sym.imp.GDI32.dll_CreateColorSpaceA]
mov r13, rax
jmp 0x18002228d
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.SHLWAPI.dll_PathIsPrefixW]
jmp 0x18002228d
mov r8d, 1
mov word [rsp + 0x18c], si
lea rdx, [0x180028510]
lea rcx, [rsp + 0x18c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 1
mov word [rsp + 0x18e], si
lea rdx, [0x18002853e]
lea rcx, [rsp + 0x18e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18002228d
mov r8d, 2
lea rdx, [0x180028554]
lea rcx, [rsp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x3a
mov dword [rsp + 0x188], 0x5f005c
mov word [rsp + 0x186], ax
jmp 0x18002228d
mov ecx, ebx
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
test r12b, r12b
je 0x18002228d
mov rcx, r13
call qword [sym.imp.GDI32.dll_DeleteColorSpace]
jmp 0x18002228d
mov r8d, 3
lea rdx, [0x1800285be]
lea rcx, [rsp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rsp + 0x1a0], 0x30
mov r12b, 1
jmp 0x18002228d
mov r8d, 5
mov word [rsp + 0x190], si
lea rdx, [0x180028606]
lea rcx, [rsp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rsp + 0x20]
lea r9, [0x18001a890]
lea rdx, [0x180000000]
dec ebp
sub r14, 1
jne 0x180022060
mov r14, qword [rsp + 0x1d0]
mov r13, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x1e8]
mov rbp, qword [rsp + 0x1f0]
mov rbx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1800245e0
add rsp, 0x1f8
pop r15
pop rdi
ret