Function at 0x1800c35a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xc0]
mov r12, r8
mov ebx, dword [rsp + 0xc0]
mov r8, rdx
mov r14, r9
mov rdx, rcx
lea r13d, [rbp - 0xd]
cmp ebp, r13d
jbe case.0x1800c3619.218
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x50]
lea eax, [rbp - 0xda]
lea r9, [0x180000000]
cmp eax, 0x29
ja case.0x1800c3619.229
movzx eax, byte [r9 + rax + 0xc39e0]
mov ecx, dword [r9 + rax*4 + 0xc39b0]
add rcx, r9
jmp rcx
mov rax, qword [r14]
cmp dword [rax], 0x7f2bb708
je case.0x1800c3619.229
mov eax, 0x7f2bb708
jmp 0x1800c366e
mov rdx, qword [r14]
mov ecx, dword [r12]
cmp rcx, qword [rdx + 0x20]
jb 0x1800c364f
mov eax, dword [r8]
dec eax
add eax, ecx
cmp rax, qword [rdx + 0x30]
jbe 0x1800c36d2
mov edi, 0x125
cmp edi, 0x125
je 0x1800c368a
cmp edi, 0xa71a
je 0x1800c3686
cmp edi, 0x14d0f
jne 0x1800c36bc
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
jmp 0x1800c36bc
mov rax, qword [r14]
lea r8, [rsp + 0xc0]
mov r9d, 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 0x48]
mov eax, dword [r12]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0xc0], 0x7f2bb72f
call fcn.180084320
add edi, 0xa5f5
cmp edi, 0x1f1df
jbe 0x1800c3654
mov r8, qword [rsp + 0xa8]
mov eax, dword [r8]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x40]
mov eax, dword [r12]
xor r9d, r9d
mov dword [rsp + 0x38], eax
mov edx, 0xa7
mov rax, qword [r14]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.180081620
mov ebx, eax
jmp case.0x1800c3619.229
cmp qword [0x1800fba78], rsi
jne case.0x1800c3619.229
mov qword [0x1800fba78], r15
jmp case.0x1800c3619.229
test rsi, rsi
jne 0x1800c3761
mov edi, 0x71
mov eax, edi
sub eax, 0x70
je 0x1800c39a5
cmp eax, 1
jne 0x1800c375a
xor r8d, r8d
lea rdx, [0x1800d9468]
lea rcx, str.WcmQueryProperty
call fcn.1800d0700
dec edi
cmp edi, 0x6f
ja 0x1800c3734
cmp qword [0x180103b40], rsi
jne case.0x1800c3619.229
mov qword [0x180103b40], r15
jmp case.0x1800c3619.229
mov rcx, r12
mov dword [rsp + 0x40], 0
call qword [r14 + 0x120]
xor edx, edx
lea rcx, [rsp + 0x48]
div dword [r14 + 0x60]
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], edx
mov rdx, r14
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x49]
call fcn.1800c1cc0
mov rbx, rax
jmp case.0x1800c3619.229
mov rsi, qword [0x1800fba18]
xor r15d, r15d
jmp case.0x1800c3619.229
mov edx, dword [rdx]
xor r8d, r8d
mov rax, qword [r14 + 0x130]
mov rcx, r14
add edx, dword [r12]
call qword [rax + 0x18]
test eax, eax
je 0x1800c380f
mov ecx, 0xb1
nop word [rax + rax]
mov eax, ecx
sub eax, 0xb0
je case.0x1800c3619.218
cmp eax, 1
jne 0x1800c3805
lea ebx, [rax - 2]
dec ecx
cmp ecx, 0xaf
ja 0x1800c37f0
xor ebx, ebx
jmp case.0x1800c3619.229
cmp dword [rdx], 0
jne 0x1800c3842
mov eax, 0xe2
cmp eax, 0xe2
je 0x1800c3834
cmp eax, 0x5bd0
je case.0x1800c3619.218
jmp 0x1800c3836
xor ebx, ebx
add eax, 0x5aee
cmp eax, 0xb5dc
jbe 0x1800c3820
cmp dword [r14 + 0x18], 0
jne 0x1800c3854
cmp dword [r14 + 0x1c], 0
je case.0x1800c3619.229
mov ecx, 0x4b
nop dword [rax]
mov eax, ecx
sub eax, 0x49
je case.0x1800c3619.218
sub eax, 1
je 0x1800c387f
cmp eax, 1
jne 0x1800c3884
mov dword [r14 + 0x38], 0xa
jmp 0x1800c3884
mov ebx, 0xffffffff
dec ecx
cmp ecx, 0x48
ja 0x1800c3860
jmp case.0x1800c3619.229
test rsi, rsi
je 0x1800c38f1
nop word [rax + rax]
mov r9d, 0x109
mov eax, r9d
sub eax, 0x108
je 0x1800c38dc
cmp eax, 1
jne 0x1800c38e0
mov r8, rsi
mov rax, r14
sub r8, r14
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800c38d3
inc rax
test ecx, ecx
jne 0x1800c38c0
test edx, edx
je 0x1800c38f1
mov r15, rsi
jmp 0x1800c38e0
mov rsi, qword [rsi + 0x30]
dec r9d
cmp r9d, 0x107
ja 0x1800c38a6
test rsi, rsi
jne 0x1800c38a0
mov ebp, 0x102
jmp case.0x1800c3619.229
cmp qword [0x1800fba18], rsi
jne 0x1800c394a
mov edi, 0x90
nop dword [rax]
cmp edi, 0x90
je 0x1800c3930
cmp edi, 0x121
jne 0x1800c393a
mov rax, qword [rsi + 0x30]
mov rcx, rsi
mov qword [0x1800fba18], rax
jmp 0x1800c3934
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add edi, 0x91
cmp edi, 0x1b2
jb 0x1800c3910
jmp case.0x1800c3619.229
mov edi, 9
nop
mov eax, edi
sub eax, 9
je 0x1800c3970
sub eax, 0x60
je 0x1800c3966
cmp eax, 0x60
jne 0x1800c397a
mov rcx, rsi
jmp 0x1800c3974
mov rax, qword [rsi + 0x30]
mov qword [r15 + 0x30], rax
jmp 0x1800c397a
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add edi, 0x60
cmp edi, 0x129
jb 0x1800c3950
dec ebp
cmp ebp, r13d
jbe case.0x1800c3619.218
mov rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
jmp 0x1800c35ef
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3