Function at 0x18001ecb0
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x18001ecb0
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1788]
mov eax, 0x1888
call fcn.18014fd1d
sub rsp, rax
mov rbx, rcx
call fcn.180005f06
lea rax, [0x180167398]
lea rcx, [rbx + 0x130]
mov qword [rbx + 0x128], rax
call fcn.180001fbe
lea rax, [0x1801673d8]
mov qword [rbx], rax
lea rcx, [rbx + 0x158]
lea rax, [0x1801673e8]
mov qword [rbx + 0x128], rax
lea rax, [0x180167400]
mov qword [rbx + 0x130], rax
xor eax, eax
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0xe70], xmm0
movsd qword [rbp + 0x1570], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xe60], xmm1
movaps xmmword [rbp + 0x1560], xmm1
mov dword [rbx + 0x138], eax
mov dword [rbx + 0x13c], 0xfa0
movaps xmm0, xmmword [rbp + 0xe60]
movups xmmword [rbx + 0x140], xmm0
movsd xmm1, qword [rbp + 0xe70]
movsd qword [rbx + 0x150], xmm1
call fcn.180005beb
lea rcx, [rbx + 0x190]
call fcn.180005beb
xor ecx, ecx
mov dword [rbx + 0x1dc], ecx
lea rcx, [rbx + 0x1c8]
call fcn.180002d29
lea rcx, [rbx + 0x1e0]
call fcn.180005beb
lea rcx, [rbx + 0x218]
call fcn.180005beb
lea rdi, [rbx + 0x250]
xor eax, eax
mov qword [rdi], rax
mov edx, 0x200
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], 0xff
mov rcx, qword [rdi]
call fcn.180005df3
mov qword [rdi], rax
xor ecx, ecx
mov dword [rdi + 8], ecx
mov rax, qword [rdi]
mov word [rax], cx
xor eax, eax
mov qword [rbx + 0x260], rcx
lea rcx, [rbx + 0x268]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0xe90], xmm0
movsd qword [rbp + 0x1450], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xe80], xmm1
movaps xmmword [rbp + 0x1440], xmm1
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], 0xfa0
movaps xmm0, xmmword [rbp + 0xe80]
movups xmmword [rcx + 0x18], xmm0
movsd xmm1, qword [rbp + 0xe90]
movsd qword [rcx + 0x28], xmm1
mov dword [rcx + 0x34], eax
call fcn.180003936
xor eax, eax
lea rcx, [rbx + 0x2a0]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movsd xmm0, qword [rbp - 0x58]
movaps xmmword [rbp + 0xea0], xmm1
movsd qword [rbp + 0xeb0], xmm0
movaps xmmword [rbp + 0x1460], xmm1
movsd qword [rbp + 0x1470], xmm0
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], 0xfa0
movaps xmm0, xmmword [rbp + 0xea0]
movups xmmword [rcx + 0x18], xmm0
movsd xmm1, qword [rbp + 0xeb0]
movsd qword [rcx + 0x28], xmm1
mov dword [rcx + 0x34], eax
call fcn.180005254
xor eax, eax
lea rcx, [rbx + 0x2d8]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0xed0], xmm0
movsd qword [rbp + 0x1490], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xec0], xmm1
movaps xmmword [rbp + 0x1480], xmm1
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], 0xfa0
movaps xmm0, xmmword [rbp + 0xec0]
movups xmmword [rcx + 0x18], xmm0
movsd xmm1, qword [rbp + 0xed0]
movsd qword [rcx + 0x28], xmm1
mov dword [rcx + 0x34], eax
call fcn.1800061b3
lea rcx, [rbx + 0x310]
mov edx, 8
call fcn.180006087
xor eax, eax
lea rcx, [rbx + 0x360]
mov qword [rbx + 0x318], rax
mov qword [rbx + 0x320], rax
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0xef0], xmm0
movsd qword [rbp + 0x14b0], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xee0], xmm1
movaps xmmword [rbp + 0x14a0], xmm1
mov dword [rbx + 0x328], eax
mov dword [rbx + 0x32c], 0xfa0
movaps xmm0, xmmword [rbp + 0xee0]
movups xmmword [rbx + 0x330], xmm0
movsd xmm1, qword [rbp + 0xef0]
movsd qword [rbx + 0x340], xmm1
mov qword [rbx + 0x348], rax
mov qword [rbx + 0x350], rax
mov qword [rbx + 0x358], rax
call fcn.180001433
lea r15, [rbx + 0x390]
xor eax, eax
mov rcx, r15
mov dword [r15 + 0x14], eax
call fcn.1800022ca
xor eax, eax
lea rsi, [rbx + 0x3a8]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0x14d0], xmm0
movsd qword [rbp + 0xf10], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xf00], xmm1
movaps xmmword [rbp + 0x14c0], xmm1
mov dword [rsi], eax
mov dword [rsi + 4], 0xfa0
movaps xmm0, xmmword [rbp + 0xf00]
movups xmmword [rsi + 8], xmm0
lea rcx, [rbx + 0x3e0]
movsd xmm1, qword [rbp + 0xf10]
movsd qword [rsi + 0x18], xmm1
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rax
call fcn.180005beb
xor eax, eax
lea rcx, [rbx + 0x428]
mov qword [rbx + 0x418], rax
mov qword [rbx + 0x420], rax
lea edx, [rax + 8]
call fcn.180006087
lea rcx, [rbx + 0x438]
xor r13d, r13d
mov dword [rcx + 0x14], r13d
call fcn.18000381e
lea ecx, [r13 + 0x58]
call fcn.180001267
mov r12, rax
test rax, rax
je 0x18001f120
lea ecx, [r13 + 0x10]
call fcn.180001267
test rax, rax
je 0x18001f0b9
mov rcx, rax
call fcn.180002108
jmp 0x18001f0bc
mov rax, r13
test rax, rax
lea rdi, [rax + 8]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
cmove rdi, r13
call fcn.180001267
test rax, rax
je 0x18001f0de
mov rcx, rax
call fcn.180002108
mov rdx, rdi
lea rcx, [rbp + 0x1258]
mov r14, rax
call fcn.180001b77
mov rdx, r14
lea rcx, [rbp + 0x1260]
mov rdi, rax
call fcn.18000447b
mov rdx, rax
mov dword [rsp + 0x20], 0x3e8
mov r9d, 0x400
mov r8, rdi
mov rcx, r12
call fcn.18000519b
jmp 0x18001f123
mov rax, r13
lea r14, [rbx + 0x450]
mov rdx, rax
mov rcx, r14
call fcn.180004246
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.180001267
test rax, rax
je 0x18001f14e
mov rcx, rax
call fcn.180002108
jmp 0x18001f151
mov rax, r13
test rax, rax
lea rdx, [rax + 8]
lea rcx, [rbx + 0x458]
cmove rdx, r13
call fcn.180001b77
lea rdi, [rbx + 0x460]
xor eax, eax
mov qword [rdi], rax
mov edx, 0x200
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], 0xff
mov rcx, qword [rdi]
call fcn.180005df3
mov qword [rdi], rax
xor ecx, ecx
mov dword [rdi + 8], ecx
mov edx, 0x200
mov rax, qword [rdi]
lea rdi, [rbx + 0x470]
mov word [rax], cx
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], 0xff
mov rcx, qword [rdi]
call fcn.180005df3
mov qword [rdi], rax
xor ecx, ecx
mov dword [rdi + 8], ecx
mov edx, 0x200
mov rax, qword [rdi]
lea rdi, [rbx + 0x480]
mov word [rax], cx
xor eax, eax
mov qword [rdi], rax
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], 0xff
mov rcx, qword [rdi]
call fcn.180005df3
xor ecx, ecx
mov qword [rdi], rax
mov dword [rdi + 8], ecx
xor edx, edx
mov rax, qword [rdi]
mov word [rax], cx
lea rcx, [rbx + 0x490]
call fcn.18000444e
lea rcx, [rbx + 0x4a0]
xor edx, edx
call fcn.18000444e
lea rcx, [rbx + 0x4b0]
xor edx, edx
call fcn.18000444e
lea rcx, [rbx + 0x4c0]
xor edx, edx
call fcn.18000444e
lea rcx, [rbx + 0x4d0]
xor edx, edx
call fcn.18000444e
lea rcx, [rbx + 0x4e0]
xor edx, edx
call fcn.18000444e
xor eax, eax
lea rcx, [rbx + 0x4f8]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0xf30], xmm0
movsd qword [rbp + 0x14f0], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xf20], xmm1
movaps xmmword [rbp + 0x14e0], xmm1
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], 0xfa0
movaps xmm0, xmmword [rbp + 0xf20]
movups xmmword [rcx + 0x18], xmm0
movsd xmm1, qword [rbp + 0xf30]
movsd qword [rcx + 0x28], xmm1
mov dword [rcx + 0x34], eax
call fcn.180004ef3
xor eax, eax
lea rcx, [rbx + 0x530]
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0xf50], xmm0
movsd qword [rbp + 0x1510], xmm0
mov dword [rbp - 0x60], eax
movups xmm1, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0xf40], xmm1
movaps xmmword [rbp + 0x1500], xmm1
mov dword [rcx + 0x10], eax
mov dword [rcx + 0x14], 0xfa0
movaps xmm0, xmmword [rbp + 0xf40]
movups xmmword [rcx + 0x18], xmm0
movsd xmm1, qword [rbp + 0xf50]
movsd qword [rcx + 0x28], xmm1
mov dword [rcx + 0x34], eax
call fcn.180001c2b
lea rcx, [rbx + 0x5f8]
lea r9, [0x180003b4d]
lea r8, str.LdrLoadDll
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x658]
lea r9, [0x1800034a4]
lea r8, str.LdrUnloadDll
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x6b8]
lea r9, [0x180002432]
lea r8, str.NtWaitForSingleObject
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x718]
lea r9, [0x180001235]
lea r8, str.NtWaitForMultipleObjects
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x778]
lea r9, [0x180001429]
lea r8, str.NtSetSecurityObject
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x7d8]
lea r9, [0x180004b01]
lea r8, str.NtMapViewOfSection
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x838]
lea r9, [0x18000107d]
lea r8, str.NtUnmapViewOfSection
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x898]
lea r9, [0x180002180]
lea r8, str.NtUnmapViewOfSectionEx
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x8f8]
lea r9, [0x18000344f]
lea r8, str.CreateProcessW
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x958]
lea r9, [0x180001ef1]
lea r8, str.CreateProcessA
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x9b8]
lea r9, [0x1800049da]
lea r8, str.CreateProcessAsUserA
lea rdx, str.advapi32.dll
call fcn.180004f16
lea rcx, [rbx + 0xa18]
lea r9, [0x180005533]
lea r8, str.CreateProcessAsUserW
lea rdx, str.advapi32.dll
call fcn.180004f16
lea rcx, [rbx + 0xa78]
lea r9, [0x180002cca]
lea r8, str.CreateProcessWithLogonW
lea rdx, str.advapi32.dll
call fcn.180004f16
lea rcx, [rbx + 0xad8]
lea r9, [0x1800048b3]
lea r8, str.CreateProcessWithTokenW
lea rdx, str.advapi32.dll
call fcn.180004f16
lea rcx, [rbx + 0xb38]
lea r9, [0x180002013]
lea r8, str.WaitForDebugEvent
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xb98]
lea r9, [0x180004a48]
lea r8, str.WaitForDebugEventEx
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xbf8]
lea r9, [0x180005a24]
lea r8, str.DebugActiveProcess
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xc58]
lea r9, [0x1800030e4]
lea r8, str.HeapReAlloc
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xcb8]
lea r9, [0x180001145]
lea r8, str.GlobalFree
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xd18]
lea r9, [0x180001e15]
lea r8, str.LocalFree
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xd78]
lea r9, [0x180002423]
lea r8, str.GlobalAlloc
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xdd8]
lea r9, [0x180001d84]
lea r8, str.LocalAlloc
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xe38]
lea r9, [0x180001db1]
lea r8, str.GlobalReAlloc
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xe98]
lea r9, [0x18000281a]
lea r8, str.LocalReAlloc
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xef8]
lea r9, [0x180005759]
lea r8, str.FormatMessageA
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xf58]
lea r9, [0x180001ec4]
lea r8, str.FormatMessageW
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0xfb8]
lea r9, [0x180003edb]
lea r8, str.CloseHandle
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1018]
lea r9, [0x1800029dc]
lea r8, str.LoadIconA
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1078]
lea r9, [0x180002c89]
lea r8, str.LoadIconW
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x10d8]
lea r9, [0x180004b6a]
lea r8, str.LoadImageA
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1138]
lea r9, [0x1800024fa]
lea r8, str.LoadImageW
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1198]
lea r9, [0x180005e7f]
lea r8, str.CoTaskMemAlloc
lea rdx, str.ole32.dll
call fcn.180004f16
lea rcx, [rbx + 0x11f8]
lea r9, [0x18000241e]
lea r8, str.CoTaskMemRealloc
lea rdx, str.ole32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1258]
lea r9, [0x1800023ab]
lea r8, str.CoTaskMemFree
lea rdx, str.ole32.dll
call fcn.180004f16
lea rcx, [rbx + 0x12b8]
lea r9, [0x1800059f2]
lea r8, str.StringFromIID
lea rdx, str.ole32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1318]
lea r9, [0x180002946]
lea r8, str.StringFromCLSID
lea rdx, str.ole32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1378]
lea r9, [0x1800054b6]
lea r8, str.SysReAllocString
lea rdx, str.oleaut32.dll
call fcn.180004f16
lea rcx, [rbx + 0x13d8]
lea r9, [0x180005ac4]
lea r8, str.SysReAllocStringLen
lea rdx, str.oleaut32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1438]
lea r9, [0x1800043e0]
lea r8, str.BSTR_UserFree
lea rdx, str.oleaut32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1498]
lea r9, [0x180003486]
lea r8, str.BSTR_UserFree64
lea rdx, str.oleaut32.dll
call fcn.180004f16
lea rcx, [rbx + 0x14f8]
lea r9, [0x18000516e]
lea r8, str.RtlInitializeCriticalSection
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x1558]
lea r9, [0x1800061a9]
lea r8, str.VariantClear
lea rdx, str.oleaut32.dll
call fcn.180004f16
lea rcx, [rbx + 0x15b8]
lea r9, [0x180006140]
lea r8, str.SafeArrayDestroy
lea rdx, str.oleaut32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1618]
lea r9, [0x180005277]
lea r8, str.SetTimer
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1678]
lea r9, [0x1800026da]
lea r8, str.SetCoalescableTimer
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x16d8]
lea r9, [0x18000622b]
lea r8, str.KillTimer
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1738]
lea r9, [0x1800016b3]
lea r8, str.GetDC
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1798]
lea r9, [0x1800028b0]
lea r8, str.GetDCEx
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x17f8]
lea r9, [0x1800029f5]
lea r8, str.HeapAlloc
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1858]
lea r9, [0x18000243c]
lea r8, str.CloseEnhMetaFile
lea rdx, str.gdi32.dll
call fcn.180004f16
lea rcx, [rbx + 0x18b8]
lea r9, [0x18000425f]
lea r8, str.CloseMetaFile
lea rdx, str.gdi32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1918]
lea r9, [0x180001992]
lea r8, str.CreatePipe
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1978]
lea r9, [0x18000249b]
lea r8, str.RtlFreeHeap
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x19d8]
lea r9, [0x180002996]
lea r8, str.HeapCreate
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1a38]
lea r9, [0x1800016ae]
lea r8, str.HeapDestroy
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1a98]
lea r9, [0x18000110e]
lea r8, str.GetIconInfo
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1af8]
lea r9, [0x1800030da]
lea r8, str.GetIconInfoExW
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1b58]
lea r9, [0x1800039f9]
lea r8, str.GetIconInfoExA
lea rdx, str.user32.dll
call fcn.180004f16
lea rcx, [rbx + 0x1bb8]
lea r9, [0x180003337]
lea r8, str.RegisterApplicationRestart
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1c18]
lea r9, [0x180004bf1]
lea r8, str.CreateInterface
lea rdx, [0x180167988]
call fcn.180004f16
lea rcx, [rbx + 0x1c78]
lea r9, [0x18000259a]
lea r8, str.CLRCreateInstance
lea rdx, [0x180167988]
call fcn.180004f16
lea rcx, [rbx + 0x1cd8]
lea r9, [0x180001be0]
lea r8, str.CreateDebuggingInterfaceFromVersion
lea rdx, [0x180167988]
call fcn.180004f16
lea rcx, [rbx + 0x1d38]
lea r9, [0x1800029b9]
lea r8, str.NtWaitForDebugEvent
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x1d98]
lea r9, [0x180002865]
lea r8, str.NtDuplicateObject
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x1df8]
lea r9, [0x180005f01]
lea r8, str.DuplicateHandle
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1e60]
call fcn.18000495d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rbx + 0x1e58], rax
call fcn.180001267
test rax, rax
je 0x18001fba8
mov rcx, rax
call fcn.180002108
lea rdi, [rax + 8]
test rax, rax
mov eax, 0
cmove rdi, rax
lea ecx, [rax + 0x10]
call fcn.180001267
test rax, rax
je 0x18001fbcd
mov rcx, rax
call fcn.180002108
mov edx, dword [0x1802496b8]
lea rcx, [rbx + 0x1e68]
mov r8, rax
mov r9, rdi
mov rax, qword [rbx + 0x1e60]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x1e58]
mov qword [rsp + 0x20], rax
call fcn.18000147e
lea rcx, [rbx + 0x1ec0]
lea r9, [0x180002126]
lea r8, str.RtlInstallFunctionTableCallback
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x1f20]
lea r9, [0x180003e13]
lea r8, str.RtlDeleteFunctionTable
lea rdx, [0x180167420]
call fcn.180004f16
lea rcx, [rbx + 0x1f80]
lea r9, [0x180001eec]
lea r8, str.DeleteTimerQueueTimer
lea rdx, [0x180167508]
call fcn.180004f16
lea rcx, [rbx + 0x1fe0]
mov edx, 8
call fcn.180006087
lea rcx, str.ntdll.dll
call qword [0x180259278]
mov rcx, rax
lea rdx, str.NtClose
call qword [0x180259280]
lea rcx, [rbx + 0x1ff0]
mov edx, 8
mov qword [rbx + 0x1fe8], rax
call fcn.180006087
lea rcx, str.ntdll.dll
call qword [0x180259278]
mov rcx, rax
lea rdx, str.NtCreateFile
call qword [0x180259280]
xor edx, edx
lea rcx, [rbp + 0x17e0]
mov qword [rbx + 0x1ff8], rax
call fcn.180006285
lea rcx, [rbx + 0x568]
mov qword [0x180249060], rbx
lea rdx, str.File
call qword [0x180249098]
lea rcx, [rbx + 0x578]
lea rdx, str.Event
call qword [0x180249098]
lea rcx, [rbx + 0x588]
lea rdx, str.Section
call qword [0x180249098]
lea rcx, [rbx + 0x598]
lea rdx, str.Mutant
call qword [0x180249098]
lea rcx, [rbx + 0x5a8]
lea rdx, str.Thread
call qword [0x180249098]
lea rcx, [rbx + 0x5b8]
lea rdx, [0x180167b20]
call qword [0x180249098]
lea rcx, [rbx + 0x5c8]
lea rdx, str.Semaphore
call qword [0x180249098]
lea rcx, [rbx + 0x5d8]
lea rdx, [0x180167b50]
call qword [0x180249098]
lea rcx, [rbx + 0x5e8]
lea rdx, str.Timer
call qword [0x180249098]
mov edx, 1
mov rcx, rbx
call fcn.180002e46
xor edx, edx
mov dword [rbx + 0x430], eax
lea rcx, [rbp - 0x50]
call fcn.18000444e
lea rdx, [rbp - 0x50]
mov rcx, qword [0x180249290]
call fcn.180003dfa
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x4b8]
call fcn.1800026a8
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.180005c45
mov rcx, qword [rbp + 0x4b8]
test rcx, rcx
je 0x18001fe00
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x4b8], rax
mov qword [rbp + 0x4c0], rax
jmp 0x18001fe02
xor eax, eax
mov ecx, dword [rbp - 0x48]
mov r13d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop word [rax + rax]
lea rax, [rax + 2]
lea r13d, [r13 + 1]
cmp dx, word [rax]
jne 0x18001fe20
lea edi, [rcx + r13]
lea rcx, [rbp + 0xb8]
call fcn.18000444e
test edi, edi
je 0x18001febc
cmp edi, dword [rbp + 0xc4]
jae 0x18001fe52
mov r12, qword [rbp + 0xb8]
jmp 0x18001fe7d
mov rcx, qword [rbp + 0xb8]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0xc4], eax
add rdx, rdx
call fcn.180005df3
mov r12, rax
mov qword [rbp + 0xb8], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r12 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp + 0xc0], edi
lea rdi, [rcx + rcx]
mov rcx, r12
mov r8, rdi
call fcn.180004e58
lea r8d, [r13 + 1]
add r8, r8
lea rcx, [rdi + r12]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x18001fec3
mov r12, qword [rbp + 0xb8]
xor eax, eax
xor ecx, ecx
test r12, r12
jne 0x18001fef2
mov edx, 0x200
mov dword [rbp + 0xf4], 0xff
call fcn.180005df3
xor ecx, ecx
mov qword [rbp + 0x17d8], rax
mov edi, ecx
mov word [rax], cx
xor eax, eax
jmp 0x18001ff4a
mov edi, eax
mov rax, r12
cmp cx, word [r12]
je 0x18001ff0b
nop
inc edi
lea rax, [rax + 2]
cmp cx, word [rax]
jne 0x18001ff00
lea edx, [rdi + 0x100]
add rdx, rdx
call fcn.180005df3
lea r8d, [rdi + 1]
mov qword [rbp + 0x17d8], rax
add r8, r8
mov rcx, rax
mov rdx, r12
call fcn.180004e58
mov rcx, r12
call fcn.180003427
xor eax, eax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
mov r13d, eax
xor ecx, ecx
lea rax, str.DeleakerDbgInfoProvider32.exe
nop word [rax + rax]
lea rax, [rax + 2]
lea r13d, [r13 + 1]
cmp cx, word [rax]
jne 0x18001ff60
xor edx, edx
lea rcx, [rbp + 0xc8]
lea r12d, [rdi + r13]
call fcn.18000444e
test r12d, r12d
je 0x180020018
cmp r12d, dword [rbp + 0xd4]
jae 0x18001ffa5
mov dword [rbp + 0xd0], r12d
lea eax, [rdi + r13]
mov r12, qword [rbp + 0xc8]
jmp 0x18001ffde
mov rcx, qword [rbp + 0xc8]
lea eax, [r12 + 0xff]
lea edx, [r12 + 0x100]
mov dword [rbp + 0xd4], eax
add rdx, rdx
call fcn.180005df3
mov r12, rax
mov qword [rbp + 0xc8], rax
lea eax, [rdi + r13]
mov dword [rbp + 0xd0], eax
mov rdx, qword [rbp + 0x17d8]
mov ecx, eax
xor eax, eax
mov word [r12 + rcx*2], ax
mov ecx, edi
lea rdi, [rcx + rcx]
mov rcx, r12
mov r8, rdi
call fcn.180004e58
lea r8d, [r13 + 1]
add r8, r8
lea rcx, [rdi + r12]
lea rdx, str.DeleakerDbgInfoProvider32.exe
call fcn.180004e58
jmp 0x18002001f
mov r12, qword [rbp + 0xc8]
xor eax, eax
xor ecx, ecx
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
test r12, r12
jne 0x18002004f
mov edx, 0x200
mov dword [rbp - 0x34], 0xff
call fcn.180005df3
xor ecx, ecx
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], ecx
mov word [rax], cx
jmp 0x1800200b3
mov edi, eax
mov rax, r12
cmp cx, word [r12]
je 0x18002006b
nop dword [rax + rax]
inc edi
lea rax, [rax + 2]
cmp cx, word [rax]
jne 0x180020060
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp - 0x34], eax
add rdx, rdx
call fcn.180005df3
lea r8d, [rdi + 1]
mov qword [rbp - 0x40], rax
add r8, r8
mov dword [rbp - 0x38], edi
mov rdx, r12
mov rcx, rax
call fcn.180004e58
mov rcx, r12
call fcn.180003427
xor eax, eax
mov qword [rbp + 0xc8], rax
mov qword [rbp + 0xd0], rax
lea r12, [rbx + 0x470]
mov rcx, r12
lea rdx, [rbp - 0x40]
call fcn.180005c45
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1800200de
call fcn.180003427
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x17d8]
test rax, rax
je 0x1800200f2
mov rcx, rax
call fcn.180003427
mov ecx, dword [rbp - 0x48]
xor eax, eax
mov r13d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop dword [rax]
lea rax, [rax + 2]
lea r13d, [r13 + 1]
cmp dx, word [rax]
jne 0x180020110
lea edi, [rcx + r13]
lea rcx, [rbp - 0x30]
call fcn.18000444e
test edi, edi
je 0x180020197
cmp edi, dword [rbp - 0x24]
jae 0x180020139
mov rax, qword [rbp - 0x30]
jmp 0x180020158
mov rcx, qword [rbp - 0x30]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp - 0x24], eax
add rdx, rdx
call fcn.180005df3
mov qword [rbp - 0x30], rax
mov ecx, dword [rbp + 0x17d8]
xor edx, edx
mov word [rax + rdi*2], dx
mov rdx, qword [rbp - 0x50]
mov dword [rbp - 0x28], edi
lea rdi, [rcx + rcx]
mov rcx, rax
mov r8, rdi
call fcn.180004e58
lea r8d, [r13 + 1]
mov r13, qword [rbp - 0x30]
add r8, r8
lea rdx, [0x180167bb8]
lea rcx, [rdi + r13]
call fcn.180004e58
jmp 0x18002019b
mov r13, qword [rbp - 0x30]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xf8]
call fcn.1800046ab
test r13, r13
je 0x1800201c4
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
jmp 0x1800201c6
xor eax, eax
mov ecx, dword [rbp + 0x100]
mov r13d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerDbgInfoProvider64.exe
xor edx, edx
nop
lea rax, [rax + 2]
lea r13d, [r13 + 1]
cmp dx, word [rax]
jne 0x1800201e0
lea edi, [rcx + r13]
lea rcx, [rbp - 0x20]
call fcn.18000444e
test edi, edi
je 0x18002026a
cmp edi, dword [rbp - 0x14]
jae 0x180020209
mov rax, qword [rbp - 0x20]
jmp 0x180020228
mov rcx, qword [rbp - 0x20]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp - 0x14], eax
add rdx, rdx
call fcn.180005df3
mov qword [rbp - 0x20], rax
mov ecx, dword [rbp + 0x17d8]
xor edx, edx
mov word [rax + rdi*2], dx
mov rdx, qword [rbp + 0xf8]
mov dword [rbp - 0x18], edi
lea rdi, [rcx + rcx]
mov rcx, rax
mov r8, rdi
call fcn.180004e58
lea r8d, [r13 + 1]
mov r13, qword [rbp - 0x20]
add r8, r8
lea rdx, str.DeleakerDbgInfoProvider64.exe
lea rcx, [rdi + r13]
call fcn.180004e58
jmp 0x18002026e
mov r13, qword [rbp - 0x20]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x3f0]
call fcn.1800046ab
test r13, r13
je 0x180020295
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rdi, [rbx + 0x480]
mov rcx, rdi
lea rdx, [rbp + 0x3f0]
call fcn.180005c45
mov rcx, qword [rbp + 0x3f0]
test rcx, rcx
je 0x1800202cc
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x3f0], rax
mov qword [rbp + 0x3f8], rax
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x1800202ed
call fcn.180003427
xor eax, eax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
cmp dword [0x1802496a0], 0
lea rcx, [rbx + 0x460]
cmovne r12, rdi
mov rdx, r12
call fcn.180005c45
mov ecx, dword [rbp - 0x48]
lea rax, [0x180167bb8]
xor edx, edx
mov dword [rbp + 0x17d8], ecx
mov r13d, edx
nop dword [rax]
lea rax, [rax + 2]
lea r13d, [r13 + 1]
cmp dx, word [rax]
jne 0x180020320
lea edi, [rcx + r13]
lea rcx, [rbp]
call fcn.18000444e
test edi, edi
je 0x1800203a7
cmp edi, dword [rbp + 0xc]
jae 0x180020349
mov r12, qword [rbp]
jmp 0x18002036b
mov rcx, qword [rbp]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0xc], eax
add rdx, rdx
call fcn.180005df3
mov r12, rax
mov qword [rbp], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r12 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp + 8], edi
lea rdi, [rcx + rcx]
mov rcx, r12
mov r8, rdi
call fcn.180004e58
lea r8d, [r13 + 1]
add r8, r8
lea rcx, [rdi + r12]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x1800203ab
mov r12, qword [rbp]
lea rdx, [rbp]
lea rcx, [rbp + 0x108]
call fcn.1800046ab
test r12, r12
je 0x1800203d4
mov rcx, r12
call fcn.180003427
xor eax, eax
mov qword [rbp], rax
mov qword [rbp + 8], rax
jmp 0x1800203d6
xor eax, eax
mov ecx, dword [rbp + 0x110]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerAsyncSymbolsLoader32.exe
xor edx, edx
nop
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x1800203f0
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x10]
call fcn.18000444e
test edi, edi
je 0x18002047d
cmp edi, dword [rbp + 0x1c]
jae 0x18002041a
mov r13, qword [rbp + 0x10]
jmp 0x18002043c
mov rcx, qword [rbp + 0x10]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x1c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x10], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp + 0x108]
mov dword [rbp + 0x18], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, str.DeleakerAsyncSymbolsLoader32.exe
call fcn.180004e58
jmp 0x180020481
mov r13, qword [rbp + 0x10]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x400]
call fcn.1800046ab
test r13, r13
je 0x1800204a8
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
lea rdx, [rbp + 0x400]
lea rcx, [rbx + 0x490]
call fcn.180005c45
mov rcx, qword [rbp + 0x400]
test rcx, rcx
je 0x1800204dc
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], rax
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1800204ff
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
jmp 0x180020501
xor eax, eax
mov ecx, dword [rbp - 0x48]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop word [rax + rax]
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020520
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x20]
call fcn.18000444e
test edi, edi
je 0x1800205aa
cmp edi, dword [rbp + 0x2c]
jae 0x18002054a
mov r13, qword [rbp + 0x20]
jmp 0x18002056c
mov rcx, qword [rbp + 0x20]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x2c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x20], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp + 0x28], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x1800205ae
mov r13, qword [rbp + 0x20]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x118]
call fcn.1800046ab
test r13, r13
je 0x1800205d7
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
jmp 0x1800205d9
xor eax, eax
mov ecx, dword [rbp + 0x120]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerAsyncSymbolsLoader64.exe
xor edx, edx
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x1800205f1
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x30]
call fcn.18000444e
test edi, edi
je 0x18002067e
cmp edi, dword [rbp + 0x3c]
jae 0x18002061b
mov r13, qword [rbp + 0x30]
jmp 0x18002063d
mov rcx, qword [rbp + 0x30]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x3c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x30], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp + 0x118]
mov dword [rbp + 0x38], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, str.DeleakerAsyncSymbolsLoader64.exe
call fcn.180004e58
jmp 0x180020682
mov r13, qword [rbp + 0x30]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x410]
call fcn.1800046ab
test r13, r13
je 0x1800206a9
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x410]
lea rcx, [rbx + 0x4a0]
call fcn.180005c45
mov rcx, qword [rbp + 0x410]
test rcx, rcx
je 0x1800206dd
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x418], rax
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x180020700
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
jmp 0x180020702
xor eax, eax
mov ecx, dword [rbp - 0x48]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop word [rax + rax]
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020720
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x40]
call fcn.18000444e
test edi, edi
je 0x1800207aa
cmp edi, dword [rbp + 0x4c]
jae 0x18002074a
mov r13, qword [rbp + 0x40]
jmp 0x18002076c
mov rcx, qword [rbp + 0x40]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x4c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x40], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp + 0x48], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x1800207ae
mov r13, qword [rbp + 0x40]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x128]
call fcn.1800046ab
test r13, r13
je 0x1800207d7
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
jmp 0x1800207d9
xor eax, eax
mov ecx, dword [rbp + 0x130]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerDebugger32.exe
xor edx, edx
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x1800207f1
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x50]
call fcn.18000444e
test edi, edi
je 0x18002087e
cmp edi, dword [rbp + 0x5c]
jae 0x18002081b
mov r13, qword [rbp + 0x50]
jmp 0x18002083d
mov rcx, qword [rbp + 0x50]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x5c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x50], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp + 0x128]
mov dword [rbp + 0x58], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, str.DeleakerDebugger32.exe
call fcn.180004e58
jmp 0x180020882
mov r13, qword [rbp + 0x50]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x420]
call fcn.1800046ab
test r13, r13
je 0x1800208a9
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
lea rdx, [rbp + 0x420]
lea rcx, [rbx + 0x4b0]
call fcn.180005c45
mov rcx, qword [rbp + 0x420]
test rcx, rcx
je 0x1800208dd
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x420], rax
mov qword [rbp + 0x428], rax
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x180020900
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
jmp 0x180020902
xor eax, eax
mov ecx, dword [rbp - 0x48]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop word [rax + rax]
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020920
lea edi, [r12 + rcx]
lea rcx, [rbp - 0x10]
call fcn.18000444e
test edi, edi
je 0x1800209aa
cmp edi, dword [rbp - 4]
jae 0x18002094a
mov r13, qword [rbp - 0x10]
jmp 0x18002096c
mov rcx, qword [rbp - 0x10]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp - 4], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp - 0x10], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp - 8], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x1800209ae
mov r13, qword [rbp - 0x10]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x138]
call fcn.1800046ab
test r13, r13
je 0x1800209d7
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
jmp 0x1800209d9
xor eax, eax
mov ecx, dword [rbp + 0x140]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerDebugger64.exe
xor edx, edx
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x1800209f1
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x60]
call fcn.18000444e
test edi, edi
je 0x180020a7e
cmp edi, dword [rbp + 0x6c]
jae 0x180020a1b
mov r13, qword [rbp + 0x60]
jmp 0x180020a3d
mov rcx, qword [rbp + 0x60]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x6c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x60], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp + 0x138]
mov dword [rbp + 0x68], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, str.DeleakerDebugger64.exe
call fcn.180004e58
jmp 0x180020a82
mov r13, qword [rbp + 0x60]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x430]
call fcn.1800046ab
test r13, r13
je 0x180020aa9
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x430]
lea rcx, [rbx + 0x4c0]
call fcn.180005c45
mov rcx, qword [rbp + 0x430]
test rcx, rcx
je 0x180020add
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x430], rax
mov qword [rbp + 0x438], rax
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x180020b00
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], rax
jmp 0x180020b02
xor eax, eax
mov ecx, dword [rbp - 0x48]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop word [rax + rax]
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020b20
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x70]
call fcn.18000444e
test edi, edi
je 0x180020baa
cmp edi, dword [rbp + 0x7c]
jae 0x180020b4a
mov r13, qword [rbp + 0x70]
jmp 0x180020b6c
mov rcx, qword [rbp + 0x70]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x7c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x70], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp + 0x78], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x180020bae
mov r13, qword [rbp + 0x70]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x158]
call fcn.1800046ab
test r13, r13
je 0x180020bd7
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
jmp 0x180020bd9
xor eax, eax
mov ecx, dword [rbp + 0x160]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerCacheDwarfSymbols32.exe
xor edx, edx
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020bf1
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x80]
call fcn.18000444e
test edi, edi
je 0x180020c97
cmp edi, dword [rbp + 0x8c]
jae 0x180020c28
mov r13, qword [rbp + 0x80]
jmp 0x180020c53
mov rcx, qword [rbp + 0x80]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x8c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x80], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp + 0x158]
mov dword [rbp + 0x88], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, str.DeleakerCacheDwarfSymbols32.exe
call fcn.180004e58
jmp 0x180020c9e
mov r13, qword [rbp + 0x80]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x440]
call fcn.1800046ab
test r13, r13
je 0x180020cce
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x440]
lea rcx, [rbx + 0x4d0]
call fcn.180005c45
mov rcx, qword [rbp + 0x440]
test rcx, rcx
je 0x180020d02
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x448], rax
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x180020d25
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], rax
jmp 0x180020d27
xor eax, eax
mov ecx, dword [rbp - 0x48]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, [0x180167bb8]
xor edx, edx
nop dword [rax]
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020d40
lea edi, [r12 + rcx]
lea rcx, [rbp + 0x90]
call fcn.18000444e
test edi, edi
je 0x180020ddf
cmp edi, dword [rbp + 0x9c]
jae 0x180020d73
mov r13, qword [rbp + 0x90]
jmp 0x180020d9e
mov rcx, qword [rbp + 0x90]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0x9c], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0x90], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp - 0x50]
mov dword [rbp + 0x98], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, [0x180167bb8]
call fcn.180004e58
jmp 0x180020de6
mov r13, qword [rbp + 0x90]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x148]
call fcn.1800046ab
test r13, r13
je 0x180020e18
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
jmp 0x180020e1a
xor eax, eax
mov ecx, dword [rbp + 0x150]
mov r12d, eax
mov dword [rbp + 0x17d8], ecx
lea rax, str.DeleakerCacheDwarfSymbols64.exe
xor edx, edx
lea rax, [rax + 2]
lea r12d, [r12 + 1]
cmp dx, word [rax]
jne 0x180020e32
lea edi, [r12 + rcx]
lea rcx, [rbp + 0xa0]
call fcn.18000444e
test edi, edi
je 0x180020ed8
cmp edi, dword [rbp + 0xac]
jae 0x180020e69
mov r13, qword [rbp + 0xa0]
jmp 0x180020e94
mov rcx, qword [rbp + 0xa0]
lea eax, [rdi + 0xff]
lea edx, [rdi + 0x100]
mov dword [rbp + 0xac], eax
add rdx, rdx
call fcn.180005df3
mov r13, rax
mov qword [rbp + 0xa0], rax
mov ecx, dword [rbp + 0x17d8]
xor eax, eax
mov word [r13 + rdi*2], ax
mov rdx, qword [rbp + 0x148]
mov dword [rbp + 0xa8], edi
lea rdi, [rcx + rcx]
mov rcx, r13
mov r8, rdi
call fcn.180004e58
lea r8d, [r12 + 1]
add r8, r8
lea rcx, [rdi + r13]
lea rdx, str.DeleakerCacheDwarfSymbols64.exe
call fcn.180004e58
jmp 0x180020edf
mov r13, qword [rbp + 0xa0]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x450]
call fcn.1800046ab
test r13, r13
je 0x180020f0f
mov rcx, r13
call fcn.180003427
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0x450]
lea rcx, [rbx + 0x4e0]
call fcn.180005c45
mov rcx, qword [rbp + 0x450]
test rcx, rcx
je 0x180020f43
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x458], rax
mov rcx, qword [rbp + 0x148]
test rcx, rcx
je 0x180020f64
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], rax
xor edx, edx
lea rcx, [rbp + 0x470]
call fcn.18000444e
lea rdx, [rbp + 0x470]
xor ecx, ecx
call fcn.180003dfa
mov rdx, qword [rbp + 0x470]
lea rcx, [rbp + 0x488]
call fcn.180003bcf
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.180005c45
mov rcx, qword [rbp + 0x488]
test rcx, rcx
je 0x180020fc3
call fcn.180003427
xor eax, eax
mov qword [rbp + 0x488], rax
mov qword [rbp + 0x490], rax
mov rcx, qword [rbp + 0x470]
lea rdx, str.bds.exe
call qword [0x1802592b0]
test eax, eax
jne 0x18002102e
mov byte [rbx + 0x4f0], 1
cmp dword [0x1802492d4], eax
je 0x180021035
cmp dword [0x1802492d8], 2
jb 0x180021035
lea edx, [rax + 2]
lea rcx, [rbp + 0x13a8]
call fcn.1800047e1
mov rcx, rax
lea rdx, str.DeleakerSDK::CDeleakerCore::CDeleakerCore
call fcn.180002621
mov rcx, rax
lea rdx, str.This_is_bds.exe_process___forceUseProcessHelper_is_set_to_true_r_n
call fcn.180001faa
lea rcx, [rbp + 0x13a8]
call fcn.18000561e
jmp 0x180021035
mov byte [rbx + 0x4f0], 0
mov rcx, qword [0x180249470]
xor eax, eax
mov dword [rbp - 0x68], eax
mov dword [rbp - 0x64], eax
mov qword [rbp - 0x58], rax
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0x1530], xmm0
movsd qword [rbp + 0x1550], xmm0
mov dword [rbp - 0x60], eax
movups xmm2, xmmword [rbp - 0x68]
mov dword [rbp + 0xe08], eax
movsd qword [rbp + 0xe20], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1520], xmm2
movaps xmmword [rbp + 0x1540], xmm2
movdqu xmmword [rbp + 0xe28], xmm0
mov dword [rbp + 0xe0c], 0xfa0
movups xmmword [rbp + 0xe10], xmm2
mov qword [rbp + 0xe38], rax
mov rax, qword [rcx]
call qword [rax + 0xc8]
lea r8, [rbp + 0xe08]
mov rcx, rbx
mov rdx, rax
call fcn.180004b83
lea rdx, [rbp + 0xe08]
lea rcx, [rbp + 0x498]
call fcn.1800024e1
cmp byte [rbp + 0x4a0], 0
mov rdi, qword [rbp + 0xe28]
je 0x180021120
mov rcx, qword [rbp + 0x498]
sub dword [rcx + 0x10], 1
jne 0x180021120
xor eax, eax
mov dword [rcx + 0x10], eax
xchg dword [rcx + 8], eax
mov rcx, qword [rbp + 0x498]
mov eax, dword [rcx + 0xc]
test eax, eax
jle 0x180021120
lock dec dword [rcx + 0xc]
xor r8d, r8d
mov rcx, qword [rbp + 0x498]
lea edx, [r8 + 1]
mov rcx, qword [rcx + 0x18]
call qword [0x180259180]
test rdi, rdi
je 0x1800211df
xor r14d, r14d
nop dword [rax]
lea rdx, [rbp + 0xe08]
lea rcx, [rbp + 0x4a8]
call fcn.1800024e1
lea r12, [rdi]
mov rdi, qword [rdi + 8]
cmp byte [rbp + 0x4b0], r14b
je 0x180021194
mov rcx, qword [rbp + 0x4a8]
sub dword [rcx + 0x10], 1
jne 0x180021194
mov dword [rcx + 0x10], r14d
mov eax, r14d
xchg dword [rcx + 8], eax
mov rcx, qword [rbp + 0x4a8]
mov eax, dword [rcx + 0xc]
test eax, eax
jle 0x180021194
lock dec dword [rcx + 0xc]
xor r8d, r8d
mov rcx, qword [rbp + 0x4a8]
lea edx, [r8 + 1]
mov rcx, qword [rcx + 0x18]
call qword [0x180259180]
lea r9, [r12 + 0x10]
mov dword [rsp + 0x20], r14d
lea r8, [r12 + 0x10]
lea rdx, [rbp + 0xb0]
lea rcx, [rbx + 0x1c8]
call fcn.180002103
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x1800211cf
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov qword [rbp + 0xb0], r14
test rdi, rdi
jne 0x180021130
lea r14, [rbx + 0x450]
cmp dword [rbx + 0x1dc], 0
je 0x1800213aa
mov rax, qword gs:[0x30]
xor r15d, r15d
mov rcx, qword [rax + 0x60]
lea r14, [r15 - 1]
mov rax, qword [rcx + 0x18]
mov r13, qword [rax + 0x10]
mov qword [rbp + 0xb0], r13
mov rdi, r13
mov qword [rbp + 0x17d8], r13
nop dword [rax]
lea r12, [rdi + 0x58]
test r12, r12
je 0x18002a74f
cmp qword [r12 + 8], r15
je 0x18002a74f
movzx eax, word [r12]
cmp r15w, ax
je 0x18002a74f
lea rdi, [rax + 1]
mov eax, 2
mul rdi
cmovo rax, r14
mov rcx, rax
call fcn.1800030d5
lea rdx, [rdi + rdi]
mov rcx, rax
mov r13, rax
call fcn.180006087
movzx r8d, word [r12]
mov rcx, r13
mov rdx, qword [r12 + 8]
call fcn.180004e58
test r13, r13
jne 0x1800212a9
mov edx, 0x200
mov dword [rbp - 0x74], 0xff
xor ecx, ecx
call fcn.180005df3
mov r12, rax
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], r15d
mov word [rax], r15w
jmp 0x180021301
mov edi, r15d
mov rax, r13
cmp r15w, word [r13]
je 0x1800212cc
nop word [rax + rax]
inc edi
lea rax, [rax + 2]
cmp r15w, word [rax]
jne 0x1800212c0
lea eax, [rdi + 0xff]
xor ecx, ecx
lea edx, [rdi + 0x100]
mov dword [rbp - 0x74], eax
add rdx, rdx
call fcn.180005df3
lea r8d, [rdi + 1]
mov qword [rbp - 0x80], rax
add r8, r8
mov dword [rbp - 0x78], edi
mov rdx, r13
mov rcx, rax
mov r12, rax
call fcn.180004e58
mov rcx, r13
call fcn.180003427
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xd8]
call fcn.1800046ab
test r12, r12
je 0x18002132e
mov rcx, r12
call fcn.180003427
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
mov r13, qword [rbp + 0xb0]
mov rdi, qword [rbp + 0x17d8]
lea rdx, [rbp + 0xd8]
lea rcx, [rbx + 0x1c8]
call fcn.18000209a
mov rcx, qword [rbp + 0xd8]
mov r12d, eax
test rcx, rcx
je 0x180021371
call fcn.180003427
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], r15
test r12d, r12d
je 0x180021382
mov rdx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.1800056f0
mov rdi, qword [rdi]
mov qword [rbp + 0x17d8], rdi
cmp qword [rdi], r13
jne 0x180021220
lea rsi, [rbx + 0x3a8]
lea r14, [rbx + 0x450]
lea r15, [rbx + 0x390]
cmp dword [0x1802492a4], 0
jne 0x18002a79b
call fcn.180004d95
cmp dword [0x1802496a4], 0
jne 0x18002a79b
cmp dword [rbx + 0x430], 0
je 0x1800213de
lea rcx, [rbx + 0x360]
call fcn.180005f83
lea rax, [rbx + 0x5f8]
xor r12d, r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov dword [rsp + 0x20], r12d
lea rdx, [rbp + 0xcc0]
mov rcx, r15
call fcn.180001221
mov rcx, qword [rbp + 0xcc0]
test rcx, rcx
je 0x18002141a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x658]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xcc8]
call fcn.180001221
mov rcx, qword [rbp + 0xcc8]
test rcx, rcx
je 0x180021453
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x6b8]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xcd0]
call fcn.180001221
mov rcx, qword [rbp + 0xcd0]
test rcx, rcx
je 0x18002148c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x718]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xcd8]
call fcn.180001221
mov rcx, qword [rbp + 0xcd8]
test rcx, rcx
je 0x1800214c5
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x778]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xce0]
call fcn.180001221
mov rcx, qword [rbp + 0xce0]
test rcx, rcx
je 0x1800214fe
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x7d8]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xce8]
call fcn.180001221
mov rcx, qword [rbp + 0xce8]
test rcx, rcx
je 0x180021537
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x838]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xcf0]
call fcn.180001221
mov rcx, qword [rbp + 0xcf0]
test rcx, rcx
je 0x180021570
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x898]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xcf8]
call fcn.180001221
mov rcx, qword [rbp + 0xcf8]
test rcx, rcx
je 0x1800215a9
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x14f8]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd00]
call fcn.180001221
mov rcx, qword [rbp + 0xd00]
test rcx, rcx
je 0x1800215e2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r13, [rbx + 0x1d38]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], r13
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd08]
call fcn.180001221
mov rcx, qword [rbp + 0xd08]
test rcx, rcx
je 0x18002161b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1d98]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd10]
call fcn.180001221
mov rcx, qword [rbp + 0xd10]
test rcx, rcx
je 0x180021654
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1df8]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd18]
call fcn.180001221
mov rcx, qword [rbp + 0xd18]
test rcx, rcx
je 0x18002168d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x8f8]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd20]
call fcn.180001221
mov rcx, qword [rbp + 0xd20]
test rcx, rcx
je 0x1800216c6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x958]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd28]
call fcn.180001221
mov rcx, qword [rbp + 0xd28]
test rcx, rcx
je 0x1800216ff
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rbx + 0xb38]
mov dword [rsp + 0x20], r12d
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], rdi
lea r8, [rbp - 0x80]
mov rcx, r15
lea rdx, [rbp + 0xd30]
call fcn.180001221
mov rcx, qword [rbp + 0xd30]
test rcx, rcx
je 0x180021738
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
xor eax, eax
lea r12, [rbx + 0xb98]
lea r9, [rbp - 0x80]
mov qword [rbp - 0x80], r12
lea r8, [rbp - 0x80]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0xd38]
mov rcx, r15
call fcn.180001221
mov rcx, qword [rbp + 0xd38]
test rcx, rcx
je 0x180021772
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xbf8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd40]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd40]
test rcx, rcx
je 0x1800217ac
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xc58]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd48]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd48]
test rcx, rcx
je 0x1800217e6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xcb8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd50]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd50]
test rcx, rcx
je 0x180021820
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xd18]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd58]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd58]
test rcx, rcx
je 0x18002185a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xd78]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd60]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd60]
test rcx, rcx
je 0x180021894
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xdd8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd68]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd68]
test rcx, rcx
je 0x1800218ce
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xe38]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd70]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd70]
test rcx, rcx
je 0x180021908
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xe98]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd78]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd78]
test rcx, rcx
je 0x180021942
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xef8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd80]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd80]
test rcx, rcx
je 0x18002197c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xf58]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd88]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd88]
test rcx, rcx
je 0x1800219b6
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xfb8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd90]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd90]
test rcx, rcx
je 0x1800219f0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1018]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xd98]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xd98]
test rcx, rcx
je 0x180021a2a
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1078]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xda0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xda0]
test rcx, rcx
je 0x180021a64
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x10d8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xda8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xda8]
test rcx, rcx
je 0x180021a9e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1138]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdb0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdb0]
test rcx, rcx
je 0x180021ad8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1198]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdb8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdb8]
test rcx, rcx
je 0x180021b12
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x11f8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdc0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdc0]
test rcx, rcx
je 0x180021b4c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1258]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdc8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdc8]
test rcx, rcx
je 0x180021b86
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x12b8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdd0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdd0]
test rcx, rcx
je 0x180021bc0
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1318]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdd8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdd8]
test rcx, rcx
je 0x180021bfa
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1378]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xde0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xde0]
test rcx, rcx
je 0x180021c34
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x13d8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xde8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xde8]
test rcx, rcx
je 0x180021c6e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1558]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdf0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdf0]
test rcx, rcx
je 0x180021ca8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1438]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xdf8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xdf8]
test rcx, rcx
je 0x180021ce2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1498]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0xe00]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0xe00]
test rcx, rcx
je 0x180021d1c
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x15b8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4c8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4c8]
test rcx, rcx
je 0x180021d56
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1618]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4d0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4d0]
test rcx, rcx
je 0x180021d90
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1678]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4d8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4d8]
test rcx, rcx
je 0x180021dca
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x16d8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4e0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4e0]
test rcx, rcx
je 0x180021e04
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1738]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4e8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4e8]
test rcx, rcx
je 0x180021e3e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x1798]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4f0]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4f0]
test rcx, rcx
je 0x180021e78
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0x9b8]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x4f8]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x4f8]
test rcx, rcx
je 0x180021eb2
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rax, [rbx + 0xa18]
mov rcx, r15
mov qword [rbp - 0x80], rax
lea r9, [rbp - 0x80]
xor eax, eax
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x500]
mov dword [rsp + 0x20], eax
call fcn.180001221
mov rcx, qword [rbp + 0x500]
test rcx, rcx
je 0x180021eec
mov edx, 0x200
mov qword [rbp + 0xd8], r15
xor ecx, ecx
mov dword [rbp + 0xe0], r15d
mov dword [rbp + 0xe4], 0xff
call fcn.180005df3
mov r8d, 2
mov qword [rbp + 0xd8], rax
lea rdx, [0x180158d60]
mov dword [rbp + 0xe0], r15d
mov rcx, rax
call fcn.180004e58
jmp 0x18002133c
xor r14d, r14d
lea r13, [rbx + 0x1d38]
lea r12, [rbx + 0xb98]
lea rdi, [rbx + 0xb38]
cmp dword [0x1802492d4], 0
je 0x18002a7f1
cmp dword [0x1802492d8], 2
jb 0x18002a7f1
mov edx, 2
lea rcx, [rbp + 0x13b8]
call fcn.1800047e1
mov rcx, rax
lea rdx, str.All_the_hooks_are_setup_r_n
call fcn.180002621
lea rcx, [rbp + 0x13b8]
call fcn.18000561e
mov rcx, qword [0x180249478]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov edx, dword [0x1802492a4]
mov rcx, rbx
call fcn.180002842
mov ecx, dword [0x1802492a4]
lea eax, [rcx - 1]
cmp eax, 1
ja 0x18002aace
lea rax, [rbx + 0x8f8]
mov rcx, r15
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.1800042d2
lea rax, [rbx + 0x958]
mov rcx, r15
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.1800042d2
xor edx, edx
lea rcx, [rbp + 0x460]
call fcn.18000444e
lea rdx, [rbp + 0x460]
xor ecx, ecx
call fcn.180003dfa
mov rdx, qword [rbp + 0x460]
lea rcx, [rbp + 0x13c8]
call fcn.180003bcf
mov rdx, rax
lea rcx, [rbp + 0x460]
call fcn.180005c45
lea rcx, [rbp + 0x13c8]
call fcn.18000534e
mov rdx, qword [rbp + 0x460]
lea rcx, [0x180169490]
call qword [0x1802592b0]
test eax, eax
jne 0x18002a8ef
cmp dword [0x1802492d4], eax
je 0x18002a8e9
cmp dword [0x1802492d8], 2
jb 0x18002a8e9
lea edx, [rax + 2]
lea rcx, [rbp + 0x13d8]
call fcn.1800047e1
mov rcx, rax
lea rdx, str.:_this_is_cdb.exe__going_to_hook_NtWaitForDebugEvent_instead_of_WaitForDebugEvent_and_WaitForDebugEventEx_r_n
call fcn.180002621
lea rcx, [rbp + 0x13d8]
call fcn.18000561e
mov qword [rbp - 0x70], r13
jmp 0x18002a903
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rdi
mov rcx, r15
call fcn.1800042d2
mov qword [rbp - 0x70], r12
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.1800042d2
lea rax, [rbx + 0xbf8]
mov rcx, r15
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.1800042d2
cmp dword [0x1802492a8], 1
jne 0x18002a974
lea rax, [rbx + 0x1c18]
mov rcx, r15
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.1800042d2
lea rax, [rbx + 0x1c78]
mov rcx, r15
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.1800042d2
lea rax, [rbx + 0x1cd8]
mov rcx, r15
lea rdx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
call fcn.1800042d2
mov edx, 0x100
lea rcx, [rbp + 0xe40]
call fcn.180005d9e
mov rcx, qword [0x180249470]
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov rdi, qword [rbp + 0xe40]
lea rdx, str.m_hEvent__SuspendThreadsOfDebuggedProcesses
mov ecx, eax
mov r8, rdi
call fcn.180004fb1
xor r8d, r8d
lea rcx, [0x180249688]
mov r9, rdi
lea edx, [r8 + 1]
call qword [0x180259100]
mov rdx, rax
lea rcx, [rbx + 0x318]
call fcn.180001e92
mov rcx, qword [rbx + 0x318]
test rcx, rcx
jne 0x18002aa05
mov r8, rdi
xor edx, edx
mov ecx, 0x100000
call qword [0x180259158]
mov rdx, rax
lea rcx, [rbx + 0x318]
call fcn.180001e92
mov rcx, qword [rbx + 0x318]
call fcn.1800022d9
mov rcx, qword [0x180249470]
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov r8, rdi
lea rdx, str.m_hEvent__ResumeThreadsOfDebuggedProcesses
mov ecx, eax
call fcn.180004fb1
xor r8d, r8d
lea rcx, [0x180249688]
mov r9, rdi
lea edx, [r8 + 1]
call qword [0x180259100]
mov rdx, rax
lea rcx, [rbx + 0x320]
call fcn.180001e92
mov rcx, qword [rbx + 0x320]
test rcx, rcx
jne 0x18002aa83
mov r8, rdi
xor edx, edx
mov ecx, 0x100000
call qword [0x180259158]
mov rdx, rax
lea rcx, [rbx + 0x320]
call fcn.180001e92
mov rcx, qword [rbx + 0x320]
call fcn.1800022d9
lea rax, [rbp + 0x17e8]
xor r14d, r14d
mov qword [rsp + 0x28], rax
lea r8, [0x180001834]
mov r9, rbx
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [0x180259120]
lea rcx, [rbp + 0xe40]
call fcn.180005fce
lea rcx, [rbp + 0x460]
call fcn.18000534e
mov ecx, dword [0x1802492a4]
cmp ecx, 1
jne 0x18002aba2
mov rcx, rbx
call fcn.180001d52
mov rcx, rbx
call fcn.180002cd9
mov rcx, qword [0x180249470]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantTimeToSystemTime]
mov rdx, rax
lea rcx, [rbp + 0xe50]
call fcn.18000444e
lea rdx, [rbp + 0xe50]
lea rcx, [rbx + 0x250]
call fcn.180005c45
lea rcx, [rbp + 0xe50]
call fcn.18000534e
lea rdx, [0x180167bb8]
lea rcx, [rbx + 0x250]
call fcn.1800035df
call qword [0x1802591a0]
mov r8d, eax
lea rdx, str._.8x.lock
lea rcx, [rbp + 0x1580]
call qword [0x1802597b0]
lea rdx, [rbp + 0x1580]
lea rcx, [rbx + 0x250]
call fcn.1800035df
mov rcx, qword [rbx + 0x250]
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0xc0000000
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 1]
call qword [0x1802591c8]
mov rdx, rax
lea rcx, [rbx + 0x260]
call fcn.180001e92
lea rcx, [rbx + 0x428]
call fcn.180004c0a
mov rcx, r15
call fcn.180006334
mov qword [rbp - 0x80], rax
test rax, rax
je 0x18002abdb
nop
lea rdx, [rbp - 0x80]
mov rcx, r15
call fcn.18000530d
mov rcx, qword [rax]
call fcn.1800017df
cmp qword [rbp - 0x80], 0
jne 0x18002abc0
mov rcx, rsi
call fcn.1800012b2
mov qword [rbp - 0x80], rax
test rax, rax
je 0x18002ac0c
nop dword [rax]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.180003265
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp qword [rbp - 0x80], 0
jne 0x18002abf0
cmp dword [0x1802494ac], 0
je 0x18002acbe
cmp dword [0x1802495a8], 0
je 0x18002ac84
xor ecx, ecx
call qword [0x180259278]
lea r9, [rbp + 0x17d0]
mov edx, 0x108
mov r8d, 4
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
mov rcx, rdi
call qword [0x180259248]
test eax, eax
je 0x18002ac84
mov eax, dword [0x1802495a8]
lea r9, [rbp + 0x17d0]
mov dword [rdi + 0xf8], eax
mov edx, 0x108
mov eax, dword [0x1802495ac]
mov rcx, rdi
mov dword [rdi + 0xfc], eax
mov r8d, dword [rbp + 0x17d0]
call qword [0x180259248]
call fcn.18003aa80
cmp dword [0x1802495b0], 0
je 0x18002acbe
xor ecx, ecx
call qword [0x180259278]
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x28]
test edx, edx
je 0x18002acb5
lea rcx, [rax + rdx]
call rcx
mov ecx, eax
call qword [0x180259220]
int3
xor ecx, ecx
call qword [0x180259220]
int3
lea rcx, [rbp + 0xe08]
call fcn.180004ba1
lea rcx, [rbp + 0x470]
call fcn.18000534e
lea rcx, [rbp - 0x50]
call fcn.18000534e
lea rcx, [rbp + 0x17e0]
call fcn.1800015c3
mov rax, rbx
add rsp, 0x1888
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret