Function at 0x18000cd80
Capabilities:
Get common file path
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x180059178]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov qword [rsp + 0x70], r9
mov r15, r8
mov qword [rsp + 0x78], r8
mov eax, edx
mov dword [rsp + 0x60], edx
mov rdx, rcx
mov qword [rsp + 0x68], rcx
xor r12d, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
lea ebx, [rax + 0xc]
mov dword [rsp + 0x34], ebx
lea r10, [0x180000000]
lea r13d, [r12 + 0x2e]
movabs r8, 0x7ffffffffffffffe
mov rsi, qword [rsp + 0x78]
movzx r14d, byte [rsp + 0x30]
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x3c], r14d
cmp eax, ebx
jae 0x18000d19b
lea edi, [rax - 0xb3]
lea r13d, [r12 + 0x44]
lea r10d, [r12 + 0x6f]
lea r11d, [r12 + 0x72]
lea r8d, [r12 + 0x65]
cmp edi, 0x12
ja case.0x18000ce54.5
lea rcx, [0x180000000]
mov ecx, dword [rcx + rdi*4 + 0xdb44]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [r15 + 0x8c]
mov dword [rsp + 0x48], eax
jmp case.0x18000ce54.5
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15 + 0x21c], xmm0
movups xmmword [r15 + 0x22c], xmm0
movups xmmword [r15 + 0x23c], xmm0
mov qword [r15 + 0x24c], rax
cmp dword [r15 + 0x8c], eax
je 0x18000dac6
jmp case.0x18000ce54.5
mov eax, 0x76
mov word [rbp + 0x18], ax
mov eax, 0x69
mov word [rbp + 0x19], ax
mov eax, 0x2e6d
mov word [rbp + 0x1a], ax
jmp case.0x18000ce54.5
mov dword [rbp + 0x2d], 0x617461
mov eax, 0x7473
mov word [rbp + 0x30], ax
jmp case.0x18000ce54.5
mov eax, dword [rsp + 0x48]
add rax, r9
mov qword [rsp + 0x40], rax
mov edx, 0xb2
lea rcx, [rsp + 0x40]
call fcn.180032670
mov dword [rsi], eax
xor r9d, r9d
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, r13d
call fcn.180027b80
mov dword [rsi + 4], eax
mov qword [rsp + 0x20], r12
mov r9d, 0x2e
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
mov word [rsi + 8], ax
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov r8d, 0x65
lea r10d, [r8 + 0xa]
lea r11d, [r8 + 0xd]
jmp case.0x18000ce54.5
mov word [rbp + 0x22], r10w
mov dword [rbp + 0x23], 0x2e6572
mov word [rbp + 0x26], r11w
jmp case.0x18000ce54.5
mov ecx, dword [rsp + 0x48]
add ecx, 0x36
cmp rcx, qword [rdx]
jbe case.0x18000ce54.5
mov r12d, 0x70004
jmp 0x18000dac6
mov dword [rbp + 0x1c], 0x61746144
mov eax, 0x73
mov word [rbp + 0x20], ax
mov eax, 0x74
mov word [rbp + 0x21], ax
jmp case.0x18000ce54.5
mov word [rbp + 0x32], r10w
mov word [rbp + 0x33], r11w
mov word [rbp + 0x34], r8w
mov r14, qword [0x180057498]
lea rbx, [0x180057488]
cmp qword [0x1800574a0], 8
cmovae rbx, qword [0x180057488]
cmp r14, 8
jae 0x18000cfd1
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x28], xmm0
mov esi, 7
mov r15, qword [rbp - 0x28]
jmp 0x18000d010
mov rsi, r14
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x28]
call fcn.18001f320
mov r15, rax
mov qword [rbp - 0x28], rax
lea r8, [r14*2 + 2]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x18], r14
lea r13, [rbp - 0x28]
cmp rsi, 8
cmovae r13, r15
cmp r14, 8
jae 0x18000d039
movups xmm0, xmmword [r13]
mov qword [rbp + 0x10], 7
jmp 0x18000d07d
mov rbx, r14
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 8]
call fcn.18001f320
mov qword [rbp - 8], rax
lea r8, [r14*2 + 2]
mov rdx, r13
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x10], rbx
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp + 8], r14
mov rcx, qword [rbp - 0x30]
cmp rcx, 8
jb 0x18000d0c5
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d0c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000d1cb
call fcn.180045a08
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [rbp + 8]
movups xmmword [rbp - 0x38], xmm0
cmp rsi, 8
jb 0x18000d110
lea rdx, [rsi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x18000d108
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000da8b
mov rcx, r15
call fcn.180045a08
mov r14b, 1
mov dword [rsp + 0x3c], r14d
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x50]
mov ebx, dword [rsp + 0x34]
mov r15, qword [rsp + 0x78]
mov r8d, 0x65
lea r10d, [r8 + 0xa]
lea r11d, [r8 + 0xd]
lea r13d, [r8 - 0x21]
jmp case.0x18000ce54.5
mov word [rbp + 0x27], r8w
jmp case.0x18000ce54.5
lea rsi, [r15 + 0x21c]
mov qword [rsp + 0x50], rsi
jmp case.0x18000ce54.5
mov eax, 0x6e
mov word [rbp + 0x28], ax
mov dword [rbp + 0x29], 0x656d61
mov word [rbp + 0x2c], r13w
inc edi
lea eax, [rdi + 0xb3]
cmp eax, ebx
jb 0x18000ce33
mov eax, dword [rsp + 0x60]
movabs r8, 0x7ffffffffffffffe
lea r10, [0x180000000]
mov r13d, 0x2e
cmp eax, ebx
mov ebx, dword [rsp + 0x48]
jae case.0x18000d1c9.186
mov edi, 0x61
mov ecx, dword [rsp + 0x34]
nop
add eax, 0xffffff4d
cmp eax, 0xf
ja case.default.0x18000d1c9
mov ecx, dword [r10 + rax*4 + 0xdb90]
add rcx, r10
jmp rcx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rsp + 0x40]
movups xmm0, xmmword [rcx]
movups xmmword [rsi + 0x14], xmm0
add rcx, 0x10
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx]
mov qword [rsi + 0x24], rax
jmp case.0x18000d1c9.187
lea rdx, [rsp + 0x40]
mov ecx, 0x66
call fcn.180010b20
mov byte [rsi + 0x34], al
jmp case.0x18000d1c9.187
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
mov word [rsi + 0xa], ax
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
mov word [rsi + 0xc], ax
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
mov word [rsi + 0xe], ax
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
mov word [rsi + 0x10], ax
jmp case.0x18000d1c9.187
mov qword [rsp + 0x20], r12
mov r9d, r13d
lea r8, [rsp + 0x40]
xor edx, edx
xor ecx, ecx
call fcn.18002b910
mov word [rsi + 0x12], ax
jmp case.0x18000d1c9.187
mov rsi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
cmp rsi, rcx
jae 0x18000d2c4
lea rax, [rsi + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rcx, 8
cmovae rax, qword [rbp - 0x48]
mov dword [rax + rsi*2], 0x64
jmp 0x18000d39a
mov rax, r8
sub rax, rsi
cmp rax, 1
jb 0x18000db36
lea r13, [rsi + 1]
mov r14, qword [rbp - 0x30]
mov rdi, r13
or rdi, 7
cmp rdi, r8
jbe 0x18000d2ed
mov rdi, r8
jmp 0x18000d30e
mov rcx, r14
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp r14, rax
jbe 0x18000d303
mov rdi, r8
jmp 0x18000d30e
lea rax, [r14 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.18001f320
mov r15, rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rdi
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18000d380
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r15 + rsi], 0x64
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x18000d376
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18000da8b
mov rdi, rcx
mov rcx, rdi
call fcn.180045a08
jmp 0x18000d391
lea rdx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov dword [r15 + rsi], 0x64
mov edi, 0x61
mov qword [rbp - 0x48], r15
lea rcx, [rbp - 0x58]
call qword [sym.imp.SHELL32.dll_SHGetInstanceExplorer]
mov dword [rbp - 0x70], eax
mov dword [rsp + 0x70], r12d
mov r14, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
cmp r14, rsi
jae 0x18000d3eb
lea rcx, [r14 + 1]
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x48]
cmp rsi, 8
cmovae rcx, qword [rbp - 0x48]
mov dword [rcx + r14*2], 0x61
mov rsi, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x3c]
mov r13d, 0x2e
jmp case.0x18000d1c9.187
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x18000db36
lea r13, [r14 + 1]
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x18000d41a
mov rdi, rdx
jmp 0x18000d43b
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x18000d430
mov rdi, rdx
jmp 0x18000d43b
lea rax, [rsi + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.18001f320
mov r15, rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rdi
add r14, r14
mov r8, r14
mov rcx, rax
cmp rsi, 8
jb 0x18000d4c7
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r15 + r14], 0x61
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x18000d4a3
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18000da8b
mov rdi, rcx
mov rcx, rdi
call fcn.180045a08
mov qword [rbp - 0x48], r15
mov rsi, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x3c]
mov edi, 0x61
lea r13d, [rdi - 0x33]
jmp case.0x18000d1c9.187
lea rdx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov edi, 0x61
mov dword [r15 + r14], edi
mov qword [rbp - 0x48], r15
mov rsi, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x3c]
lea r13d, [rdi - 0x33]
jmp case.0x18000d1c9.187
lea rdx, [rsp + 0x40]
mov ecx, 0x66
call fcn.180010b20
mov byte [rsi + 0x35], al
mov ebx, r12d
mov dword [rsp + 0x48], ebx
jmp case.0x18000d1c9.187
mov rcx, qword [rsp + 0x40]
add rcx, 8
mov qword [rsp + 0x40], rcx
mov eax, dword [rcx]
mov dword [rsi + 0x2c], eax
movzx eax, word [rcx + 4]
mov word [rsi + 0x30], ax
lea rax, [rcx + 6]
mov qword [rsp + 0x40], rax
jmp case.0x18000d1c9.187
mov byte [rsp + 0x38], 1
mov r14, r12
mov qword [rsp + 0x68], r12
cmp qword [0x1800574b8], r12
jbe 0x18000d78e
nop dword [rax]
nop word [rax + rax]
mov eax, 0x129
mov dword [rsp + 0x5c], eax
nop dword [rax]
sub eax, 0x126
je 0x18000d5bf
sub eax, 1
je 0x18000d5ae
sub eax, 1
je 0x18000d593
cmp eax, 1
jne 0x18000d75f
mov byte [rsp + 0x30], al
jmp 0x18000d75f
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x7c], 0x36
mov dword [rbp - 0x74], 0x80
jmp 0x18000d75f
mov qword [rbp - 0x68], r12
mov dword [rbp - 0x80], r12d
mov dword [rbp - 0x78], r12d
jmp 0x18000d75f
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov esi, dword [rbp - 0x80]
mov r9d, esi
mov r13, qword [rbp - 0x68]
mov r8, r13
mov r15d, dword [rbp - 0x7c]
mov edx, r15d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov edi, eax
mov r9d, dword [rbp - 0x78]
xor r8d, r8d
mov edx, dword [rbp - 0x74]
mov rcx, qword [rbp - 0x28]
call sub.IMM32.dll_ImmGetCompositionStringA
test edi, edi
je 0x18000d606
mov byte [rsp + 0x30], 0
jmp 0x18000d620
cmp byte [rsp + 0x30], 0
je 0x18000d620
lea r9, [rbp + 0x40]
mov r8d, esi
mov rdx, r13
mov ecx, r15d
call qword [sym.imp.SHELL32.dll_SHSetFolderPathA]
lea rax, [0x1800574a8]
cmp qword [0x1800574c0], 0x10
cmovae rax, qword [0x1800574a8]
movsx ecx, byte [rax + r14]
mov word [rsp + 0x58], cx
mov r14, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
cmp r14, rsi
jae 0x18000d673
lea rax, [r14 + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rsi, 8
cmovae rax, qword [rbp - 0x48]
mov word [rax + r14*2], cx
mov word [rax + r14*2 + 2], r12w
jmp 0x18000d75a
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x18000db3c
lea r13, [r14 + 1]
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x18000d6a2
mov rdi, rdx
jmp 0x18000d6c3
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x18000d6b8
mov rdi, rdx
jmp 0x18000d6c3
lea rax, [rsi + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.18001f320
mov r15, rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rdi
add r14, r14
mov r8, r14
mov rcx, rax
cmp rsi, 8
jb 0x18000d73d
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsp + 0x58]
mov word [r15 + r14], ax
mov word [r15 + r14 + 2], r12w
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x18000d733
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18000da84
mov rdi, rcx
mov rcx, rdi
call fcn.180045a08
jmp 0x18000d756
lea rdx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsp + 0x58]
mov word [r15 + r14], ax
mov word [r15 + r14 + 2], r12w
mov qword [rbp - 0x48], r15
mov r14, qword [rsp + 0x68]
mov eax, dword [rsp + 0x5c]
dec eax
mov dword [rsp + 0x5c], eax
cmp eax, 0x125
ja 0x18000d570
inc r14
mov qword [rsp + 0x68], r14
cmp r14, qword [0x1800574b8]
jb 0x18000d560
mov edi, 0x61
mov dword [rsp + 0x5c], 0xf003f
mov rsi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
cmp rsi, rcx
jae 0x18000d7d1
lea rax, [rsi + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rcx, 8
cmovae rax, qword [rbp - 0x48]
mov r13d, 0x2e
mov dword [rax + rsi*2], r13d
mov rsi, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x3c]
jmp case.0x18000d1c9.187
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18000db36
lea r13, [rsi + 1]
mov r14, qword [rbp - 0x30]
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x18000d804
mov rdi, rdx
jmp 0x18000d825
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x18000d81a
mov rdi, rdx
jmp 0x18000d825
lea rax, [r14 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.18001f320
mov r15, rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rdi
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18000d8af
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r13d, 0x2e
mov dword [r15 + rsi], r13d
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x18000d88f
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18000da8b
mov rdi, rcx
mov rcx, rdi
call fcn.180045a08
mov qword [rbp - 0x48], r15
mov rsi, qword [rsp + 0x50]
mov r14d, dword [rsp + 0x3c]
mov edi, 0x61
jmp case.0x18000d1c9.187
lea rdx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov r13d, 0x2e
mov dword [r15 + rsi], r13d
jmp 0x18000d897
mov ecx, r12d
movzx eax, byte [rsp + 0x38]
cmp dword [rbp - 0x70], r12d
cmove ecx, eax
mov byte [rsp + 0x38], cl
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, dword [rsp + 0x5c]
lea rcx, [rbp + 0x18]
call qword [sym.imp.SHLWAPI.dll_SHRegCreateUSKeyA]
mov dword [rsp + 0x58], eax
mov r14, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
cmp r14, rsi
jae 0x18000d927
lea rcx, [r14 + 1]
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x48]
cmp rsi, 8
cmovae rcx, qword [rbp - 0x48]
mov dword [rcx + r14*2], 0x74
jmp 0x18000da03
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r14
cmp rax, 1
jb 0x18000db36
lea r13, [r14 + 1]
mov rdi, r13
or rdi, 7
cmp rdi, rdx
jbe 0x18000d956
mov rdi, rdx
jmp 0x18000d977
mov rcx, rsi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rsi, rax
jbe 0x18000d96c
mov rdi, rdx
jmp 0x18000d977
lea rax, [rsi + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.18001f320
mov r15, rax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], rdi
add r14, r14
mov r8, r14
mov rcx, rax
cmp rsi, 8
jb 0x18000d9e9
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r15 + r14], 0x74
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x18000d9df
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x18000da8b
mov rdi, rcx
mov rcx, rdi
call fcn.180045a08
jmp 0x18000d9fa
lea rdx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov dword [r15 + r14], 0x74
mov edi, 0x61
mov qword [rbp - 0x48], r15
mov r14d, dword [rsp + 0x3c]
movzx r14d, r14b
cmp dword [rsp + 0x58], 0
cmovne r14d, r12d
mov dword [rsp + 0x3c], r14d
cmp byte [rsp + 0x38], 0
je 0x18000da2b
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHELL32.dll_SHSetInstanceExplorer]
mov rsi, qword [rsp + 0x50]
mov r13d, 0x2e
jmp case.0x18000d1c9.187
lea rdx, [rsp + 0x40]
mov ecx, 0x66
call fcn.180010b20
mov byte [rsi + 0x32], al
lea rdx, [rsp + 0x40]
mov ecx, 0x66
call fcn.180010b20
mov byte [rsi + 0x33], al
mov ecx, dword [rsp + 0x34]
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
cmp eax, ecx
jae case.0x18000d1c9.186
movabs r8, 0x7ffffffffffffffe
lea r10, [0x180000000]
jmp 0x18000d1b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r14b, r14b
je 0x18000daa1
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
xor r9d, r9d
mov r8d, 0xfb
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.18003a890
mov byte [rsp + 0x48], al
mov r12d, dword [rsp + 0x48]
jmp 0x18000dac6
mov r12d, ebx
mov rcx, qword [rbp - 0x30]
cmp rcx, 8
jb 0x18000db09
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000db04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000db04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180045a08
mov eax, r12d
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1800461b0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180018020
nop
call fcn.180018020
int3