Function at 0x1800713b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0xb0], rax
imul eax, r9d, 0x3c9
mov r13, rdx
mov qword [rbp - 0x50], rdx
mov r15d, r9d
mov qword [rbp - 0x70], r8
mov rdx, rcx
mov qword [rbp - 0x68], rcx
mov ebx, r9d
mov dword [rbp - 0x78], eax
cmp r9d, eax
ja 0x18007171c
mov esi, dword [rsp + 0x68]
mov edi, dword [rsp + 0x60]
mov r14, qword [rbp - 0x60]
mov r13d, dword [rsp + 0x68]
mov r12, qword [rbp - 0x50]
cmp ebx, 0x3df6
ja 0x180071574
je 0x18007155b
cmp ebx, 0x135
ja 0x180071507
je 0x1800714ee
mov eax, ebx
sub eax, 3
je 0x1800714df
sub eax, 0x97
je 0x180071498
sub eax, 2
je 0x180071484
cmp eax, 0x69
jne 0x180071709
movzx eax, word [0x1800e3008]
mov word [rbp + 0x98], ax
movzx eax, byte [0x1800e300a]
mov byte [rbp + 0x9a], al
jmp 0x180071709
mov ecx, dword [r8]
mov r13d, 1
and ecx, 7
shl r13d, cl
jmp 0x180071709
mov rax, qword [0x1800fb2e0]
lea r9, [rbp - 0x60]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x78]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x78], 8
xor edx, edx
mov qword [rsp + 0x20], rax
mov r8d, 0xad
call fcn.18006c670
mov r8, qword [rbp - 0x70]
mov esi, eax
mov rdx, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
jmp 0x180071709
mov r12d, dword [r8]
shr r12, 3
add r12, rdx
jmp 0x180071709
movzx eax, byte [r12]
mov ecx, eax
and ecx, r13d
or al, r13b
mov dword [rbp - 0x80], ecx
mov byte [r12], al
jmp 0x180071709
cmp ebx, 0x1ce
je 0x18007154f
cmp ebx, 0x267
je 0x1800719d5
cmp ebx, 0x1f48
je 0x18007153b
cmp ebx, 0x3504
jne 0x180071709
mov byte [rbp + 0x9b], 0
jmp 0x180071709
test esi, esi
je 0x180071709
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [rbp - 0x80]
mov dword [rsp + 0x6c], eax
jmp 0x180071709
lea rcx, str.le_valutanotatie
call fcn.1800d0700
mov r8, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
jmp 0x180071709
cmp ebx, 0x9d02
ja 0x1800716a9
je 0x18007169d
cmp ebx, 0x5ca4
je 0x180071667
cmp ebx, 0x6903
je 0x18007165b
cmp ebx, 0x7b52
je 0x1800715e4
cmp ebx, 0x9a00
jne 0x180071709
lea rcx, [0x1800e0ce8]
call fcn.1800d0700
lea r9, [rsp + 0x70]
mov qword [rsp + 0x70], r14
xor r8d, r8d
mov edx, 0x103
xor ecx, ecx
call fcn.18009ab50
mov r8, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
jmp 0x180071709
test edi, edi
je 0x180071709
nop dword [rax]
mov r9d, 0x9f
mov qword [rsp + 0x70], r14
lea r8, [rbp]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.180017ee0
mov edi, dword [rsp + 0x60]
mov esi, eax
cmp eax, 0x7f2bb742
jne 0x180071642
mov rax, qword [0x1800fb4b8]
lea rdx, [rsp + 0x78]
mov r8d, 0xc1
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x78], edi
call fcn.180021710
jmp 0x18007164a
test eax, eax
jne 0x180071543
test edi, edi
jne 0x1800715f0
mov r8, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
jmp 0x180071709
mov byte [rbp + 0x9b], 0x74
jmp 0x180071709
mov r9d, 0x9f
mov qword [rsp + 0x70], r14
lea r8, [rbp]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.180017ee0
mov esi, eax
test eax, eax
jne 0x180071543
mov edi, dword [rsp + 0x60]
mov r8, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
jmp 0x180071709
mov dword [rbp + 0x9c], 0x6e456369
jmp 0x180071709
cmp ebx, 0xd101
je 0x180071702
cmp ebx, 0x10500
je 0x1800716de
cmp ebx, 0x138ff
je 0x1800716d2
cmp ebx, 0x16cfe
jne 0x180071709
mov byte [rbp + 0xa9], 0
jmp 0x180071709
mov dword [rbp + 0xa5], 0x74654d64
jmp 0x180071709
mov r8d, 5
lea rdx, [0x1800e3033]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
jmp 0x180071709
mov byte [rbp + 0xa0], 0
imul eax, r15d, 0x33
add ebx, eax
cmp ebx, dword [rbp - 0x78]
jbe 0x180071420
mov r13, qword [rbp - 0x50]
lea edi, [r15 + 0x120]
cmp r15d, edi
jae 0x1800719d5
movzx ebx, byte [rsp + 0x60]
lea r8, [0x180000000]
mov r14d, dword [rsp + 0x68]
mov esi, dword [rsp + 0x68]
mov r12, qword [rbp - 0x70]
nop word [rax + rax]
cmp r15d, 0x205
ja 0x1800719b0
je 0x180071953
lea eax, [r15 - 0x105]
cmp eax, 0xf0
ja case.0x180071789.276
movzx eax, byte [r8 + rax + 0x71a44]
mov ecx, dword [r8 + rax*4 + 0x71a04]
add rcx, r8
jmp rcx
mov word [rbp + 0x92], 0x72
jmp case.0x180071789.276
mov r8d, 3
mov byte [rbp + 0x8c], 0
lea rdx, [0x1800e30b9]
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea r8, [0x180000000]
jmp case.0x180071789.276
lea rax, [rsp + 0x68]
xor ecx, ecx
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x80]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea r8, [rbp + 0x98]
lea rax, [rbp - 0x44]
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x58]
mov dword [rsp + 0x38], r14d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckAndAuditAlarmA]
lea r8, [0x180000000]
test eax, eax
jne case.0x180071789.276
xor bl, bl
jmp case.0x180071789.276
movzx eax, word [0x1800e30c4]
mov word [rbp + 0x89], ax
movzx eax, byte [0x1800e30c6]
mov byte [rbp + 0x8b], al
jmp case.0x180071789.276
mov qword [rbp - 0x58], 0
jmp case.0x180071789.276
mov dword [rbp + 0xa9], 0x6c696661
mov byte [rbp + 0xad], 0
jmp case.0x180071789.276
mov r8d, 5
lea rdx, [0x1800e30ff]
lea rcx, [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea r8, [0x180000000]
mov byte [rbp + 0x85], 0
jmp case.0x180071789.276
mov bl, 1
jmp case.0x180071789.276
mov word [rbp + 0x88], 0x6f
jmp case.0x180071789.276
movzx eax, word [0x1800e3132]
mov word [rbp + 0x8f], ax
movzx eax, byte [0x1800e3134]
mov byte [rbp + 0x91], al
mov byte [rbp + 0x92], 0
jmp case.0x180071789.276
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x20], rax
movups xmmword [rbp - 0x30], xmm0
jmp case.0x180071789.276
xor r14d, r14d
lea rcx, [rbp - 0x78]
lea r8d, [r14 + 0x1b]
call fcn.1800278e0
test al, al
je 0x1800719d0
lea r8, [0x180000000]
jmp case.0x180071789.276
mov word [rbp + 0xad], 0x65
jmp case.0x180071789.276
movzx eax, word [0x1800e3193]
mov word [rbp + 0x85], ax
movzx eax, byte [0x1800e3195]
mov byte [rbp + 0x87], al
mov byte [rbp + 0x88], 0
jmp case.0x180071789.276
xorps xmm0, xmm0
mov esi, 0x2000000
movups xmmword [rbp - 0x18], xmm0
jmp case.0x180071789.276
test bl, bl
je 0x180071968
mov r8d, dword [rsp + 0x68]
lea rdx, [rbp - 0x58]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ObjectDeleteAuditAlarmA]
movzx eax, word [r13]
xor r9d, r9d
mov word [rsp + 0x60], ax
xor r8d, r8d
mov eax, dword [rbp - 0x78]
xor edx, edx
mov dword [rbp - 0x80], eax
mov rcx, r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xd7
call fcn.1800a0640
mov byte [rsp + 0x6c], al
lea r8, [0x180000000]
jmp case.0x180071789.276
cmp r15d, 0x215
je 0x1800719d5
add r15d, 0x10
cmp r15d, edi
jae 0x1800719d5
mov rdx, qword [rbp - 0x68]
jmp 0x180071750
mov byte [rsp + 0x6c], r14b
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800d1090
mov rbx, qword [rsp + 0x218]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret