Function at 0x18004a310
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18007cd08]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea esi, [rcx - 0xb]
mov r15, rdx
cmp ecx, esi
jbe 0x18004a53b
mov rbx, qword [rbp - 0x30]
lea edi, [rcx - 0xa9]
mov r12, qword [rbp - 0x30]
lea rdx, [0x180000000]
mov r13, qword [rbp - 0x30]
xor r14d, r14d
lea r8d, [r14 + 0x32]
lea r9d, [r14 + 0x5f]
lea r10d, [r14 + 0x2e]
lea r11d, [r14 + 0x6c]
nop word [rax + rax]
cmp edi, 0x24
ja case.0x18004a39b.11
movzx eax, byte [rdx + rdi + 0x4a640]
mov ecx, dword [rdx + rax*4 + 0x4a610]
add rcx, rdx
jmp rcx
mov dword [r15 + 8], r14d
jmp case.0x18004a39b.11
mov edx, 3
mov word [rbp - 0x14], r14w
mov r8d, 0x8b
lea rcx, [rbp - 0x28]
call fcn.1800417d0
xor r8d, r8d
mov rcx, r15
mov r14, rax
lea edx, [r8 + 0x2c]
call fcn.180058510
test al, al
je 0x18004a53b
mov rcx, qword [r15]
call r14
xor r14d, r14d
mov qword [r15], 0xffffffffffffffff
jmp 0x18004a512
mov rbx, r15
jmp case.0x18004a39b.11
mov r9d, 0xef
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180042520
mov r12, rax
mov qword [rbp - 0x38], r14
mov edx, 0x23
mov qword [rbp - 0x40], 1
lea rax, [rbp - 0x38]
mov r9, r12
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x22]
call fcn.180062560
jmp 0x18004a512
lea r8, [rbp - 0x48]
mov byte [rbp - 0x48], 1
mov rdx, r12
mov ecx, 0x91
call fcn.18006b1e0
mov r12, rax
jmp 0x18004a512
mov dword [rbp - 0x28], 0x730077
mov dword [rbp - 0x24], 0x5f0032
mov dword [rbp - 0x20], 0x320033
jmp case.0x18004a39b.11
mov word [rbp - 0x1c], r10w
mov dword [rbp - 0x1a], 0x6c0064
mov word [rbp - 0x16], r11w
jmp case.0x18004a39b.11
mov r8, r13
xor edx, edx
mov ecx, 0xa9
call fcn.18004c030
jmp 0x18004a512
mov edx, 0x23
mov qword [rbp - 0x40], 2
lea rax, [rbp - 0x38]
mov r9, r12
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x21]
call fcn.180062560
mov edx, 0x23
mov qword [rbp - 0x40], 3
lea rax, [rbp - 0x38]
mov r9, r12
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x20]
call fcn.180062560
mov r8, qword [rbp - 0x38]
test r8, r8
je 0x18004a56b
cmp qword [r8 + 8], 2
jne 0x18004a56b
mov r9, r12
mov qword [rbp - 0x30], 1
mov edx, 0x7f
lea rcx, [rbp - 0x30]
call fcn.180062810
mov r13, rax
mov r8d, 0x32
lea rdx, [0x180000000]
lea r9d, [r8 + 0x2d]
lea r10d, [r8 - 4]
lea r11d, [r8 + 0x3a]
dec edi
lea ecx, [rdi + 0xa9]
cmp ecx, esi
ja 0x18004a380
mov eax, dword [rbp - 0x50]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18006edc0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.PKIX_PL_LdapClient_ResumeRequest
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor r8d, r8d
lea r9, [rbp - 0x50]
xor ecx, ecx
lea edx, [r8 + 9]
call fcn.180062810
test al, al
jne 0x18004a5ac
mov byte [rbp - 0x50], al
jmp 0x18004a53b
cmp dword [rbp - 0x50], 2
jb 0x18004a5b8
mov byte [rbp - 0x50], 1
jmp 0x18004a53b
mov r9d, 0x62
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800420e0
cmp eax, 3
setae byte [rbp - 0x50]
jmp 0x18004a53b
imul ecx, dword [rbx + 0xc], 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbx + 8]
lea rcx, [rbp - 0x40]
mov r9, qword [rbx]
xor r8d, r8d
mov dword [rbp - 0x40], eax
mov qword [rsp + 0x20], r14
lea edx, [r8 + 0x6f]
call fcn.180060e30
jmp case.0x18004a39b.9