Function at 0x18001ac90
Capabilities:
Check for software breakpoints
Reference http user-agent string

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rax, qword [0x1800cd230]
xor rax, rsp
mov qword [rbp + 0x1f], rax
lea esi, [r8 + 0xaf0]
mov qword [rsp + 0x150], r12
mov dword [rsp + 0x30], r8d
mov r13d, r8d
mov qword [rsp + 0x48], rdx
mov r12, rdx
mov rbx, rcx
mov edi, r8d
cmp r8d, esi
jae 0x18001adbd
mov eax, 0x64
mov r14d, 0x6957
mov r13d, 0x7041
xor r12d, r12d
lea ecx, [rax + 0xb]
lea edx, [rax + 0x13]
lea r15d, [rax + 0xa]
lea r8d, [rax + 0xf]
lea r9d, [rax - 0x44]
lea r10d, [rax - 0x16]
lea r11d, [rax - 0x10]
cmp edi, 0x17b
ja 0x18001af0d
je 0x18001af04
cmp edi, 0xcc
ja 0x18001ae68
je 0x18001ae5c
cmp edi, 0x1d
je 0x18001ae36
cmp edi, 0x37
je 0x18001ae15
cmp edi, 0x62
jne 0x18001ada5
mov rdx, qword [rbx + 0x28]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov rdx, qword [rbx + 0x20]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov ecx, 0x6f
lea edx, [rcx + 8]
lea r8d, [rcx + 4]
lea r9d, [rcx - 0x4f]
lea r10d, [rcx - 0x21]
lea r11d, [rcx - 0x1b]
mov eax, 0x64
add edi, 0xaf
cmp edi, esi
jb 0x18001ad11
mov r12, qword [rsp + 0x48]
mov r13d, dword [rsp + 0x30]
lea eax, [r13 + 0xf]
cmp r13d, eax
jae 0x18001b227
mov r14, qword [rsp + 0x48]
lea edi, [r13 - 0x1d]
mov r15, qword [rsp + 0x48]
lea rdx, [0x180000000]
mov esi, 0xf
mov r9d, 0x4b62
mov r11d, 0x332e
mov r10d, 0x7469
lea r8d, [rsi + 0x56]
nop word [rax + rax]
cmp edi, 0x1e
ja case.0x18001ae13.10
mov ecx, dword [rdx + rdi*4 + 0x1be90]
add rcx, rdx
jmp rcx
mov r8d, 4
mov word [rbp - 1], r12w
lea rdx, [0x1800c03ce]
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18001ad88
mov r8d, 3
mov byte [rbp - 0x51], r12b
lea rdx, [0x1800c04b4]
lea rcx, [rbp - 0x51]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp - 0x4e], 0x69
jmp 0x18001ad88
mov dword [rbp - 0x4d], 0x2f616c6c
jmp 0x18001ada5
mov eax, edi
sub eax, 0xe6
je 0x18001aecc
sub eax, 0x2b
je 0x18001ae88
cmp eax, 0x4e
jne 0x18001ada0
and dword [rbx + 0xc], 0xfffffffe
jmp 0x18001ada0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov rdx, qword [rbx + 0x30]
jmp 0x18001ad78
mov r8d, 3
lea rdx, [0x1800c0590]
lea rcx, [rbp + 7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 5
mov word [rbp + 0xd], r12w
lea rdx, [0x1800c05dc]
lea rcx, [rbp - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18001ad88
mov byte [rbp - 0x49], r12b
jmp 0x18001ada5
cmp edi, 0x2d9
ja 0x18001afa3
je 0x18001af91
mov eax, edi
sub eax, 0x195
je 0x18001af71
sub eax, 0x2b
je 0x18001af55
cmp eax, 0x6a
jne 0x18001ada0
movzx eax, word [0x1800c0514]
mov word [rbp - 0x49], ax
movzx eax, byte [0x1800c0516]
mov byte [rbp - 0x47], al
mov byte [rbp - 0x46], r12b
mov word [rbp - 0x79], r14w
jmp 0x18001ada0
mov rdx, qword [rbx + 0x38]
xor r9d, r9d
mov r8d, 0x11b
xor ecx, ecx
call fcn.1800251e0
mov rdx, rbx
jmp 0x18001ad78
mov eax, dword [0x1800c0476]
mov dword [rbp - 0x21], eax
movzx eax, word [0x1800c047a]
mov word [rbp - 0x1d], ax
mov dword [rbp - 0x1b], 0x610065
jmp 0x18001ada0
mov word [rbp - 0x77], r15w
mov word [rbp - 0x76], ax
mov word [rbp - 0x75], cx
jmp 0x18001ada5
cmp edi, 0x388
je 0x18001b00f
cmp edi, 0x437
je 0x18001afd7
cmp edi, 0x4e6
jne 0x18001ada5
mov eax, dword [0x1800c03ff]
mov dword [rbp - 0x2f], eax
movzx eax, byte [0x1800c0403]
mov byte [rbp - 0x2b], al
jmp 0x18001ada0
mov r8d, 2
lea rdx, [0x1800be29c]
lea rcx, [rbp - 0x41]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 5
lea rdx, str.in64
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov word [rbp - 0x31], r13w
jmp 0x18001ad88
mov word [rbp - 0x74], dx
mov word [rbp - 0x73], r8w
mov word [rbp - 0x72], r9w
mov word [rbp - 0x71], r10w
mov word [rbp - 0x70], r11w
jmp 0x18001ada5
mov r8d, 5
mov byte [rbp - 0x39], 0
lea rdx, [0x1800c05f3]
lea rcx, [rbp - 0x39]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1800bab90]
lea rcx, [rbp - 0x59]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 3
lea rdx, [0x1800c0640]
lea rcx, [rbp - 0x59]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rcx, [rbp - 0x59]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001b080
movzx eax, word [0x1800bd50c]
mov word [rcx], ax
jmp 0x18001b1f7
mov r8d, 1
mov dword [rsp + 0x58], 0x4d54484b
lea rdx, [0x1800c0655]
mov byte [rbp - 0x7d], 0
lea rcx, [rbp - 0x7d]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001b1f7
mov byte [rbp - 0x28], 0
jmp case.0x18001ae13.10
mov word [rbp - 0x2a], r9w
jmp case.0x18001ae13.10
xor eax, eax
mov qword [rbx], rax
jmp case.0x18001ae13.10
movzx eax, word [0x1800c066c]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1800c066e]
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], 0
jmp case.0x18001ae13.10
movsd xmm0, qword [0x1800c068a]
movzx eax, word [0x1800c0692]
movsd qword [rbp - 0x17], xmm0
mov word [rbp - 0xf], ax
mov dword [rbp - 0xd], 0x6c006c
jmp case.0x18001ae13.10
mov dword [rsp + 0x48], 0x373335
mov dword [rsp + 0x4b], 0x36332e
jmp case.0x18001ae13.10
mov word [rbp - 0x28], r10w
mov byte [rbp - 0x26], 0
jmp case.0x18001ae13.10
mov eax, 0x38
mov word [rbp - 0x54], r8w
mov word [rbp - 0x69], ax
mov dword [rbp - 0x68], 0x302e33
mov dword [rbp - 0x61], 0x33303134
mov byte [rbp - 0x5d], 0
jmp case.0x18001ae13.10
mov dword [rsp + 0x50], 0x6b696c
mov word [rsp + 0x53], r8w
mov byte [rbp - 0x7c], 0
jmp case.0x18001ae13.10
mov r8d, 2
mov word [rsp + 0x3f], 0x61
lea rdx, [0x1800c06a7]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rsp + 0x34], 0x35
jmp 0x18001b1f7
xor eax, eax
lea rcx, [rbp - 1]
xor r8d, r8d
mov word [rbp - 9], ax
mov edx, 0xef
lea r9d, [rax + 0x30]
call fcn.180042280
mov r9d, 8
lea rcx, [rbp - 0x21]
xor r8d, r8d
mov edx, 0xef
mov r14, rax
call fcn.180042280
mov r15, rax
jmp 0x18001b1f7
xor eax, eax
mov qword [r12], rax
jmp case.0x18001ae13.10
mov rcx, qword [rbx]
call r15
mov rcx, qword [r12]
call r14
lea rdx, [0x180000000]
mov r8d, 0x65
mov r9d, 0x4b62
mov r10d, 0x7469
mov r11d, 0x332e
inc edi
sub rsi, 1
jne 0x18001ae00
mov r13d, dword [rsp + 0x30]
mov r12, qword [rsp + 0x150]
lea r14d, [r13 + 0x348]
cmp r13d, r14d
jae 0x18001be71
mov r15d, 0x3739
nop word [rax + rax]
cmp r13d, 0x1a5
ja 0x18001b830
je 0x18001b69c
cmp r13d, 0xc5
ja 0x18001b3f0
je 0x18001b354
mov eax, r13d
sub eax, 0x1d
je 0x18001b332
sub eax, 0x38
je 0x18001b321
cmp eax, 0x38
jne 0x18001be64
lea rax, [rbp - 0x51]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x18001b2a0
lea rdx, [rbp - 0x51]
mov rcx, rbx
call fcn.1800293c0
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b2df
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b2d7
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001b2f1
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b819
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b316
mov rax, qword [rbx]
mov word [rcx + rax], 0x28
jmp 0x18001be64
mov word [rsp + 0x38], 0x3633
mov byte [rsp + 0x3a], 0
jmp 0x18001be64
mov r8d, 3
mov byte [rsp + 0x35], 0
lea rdx, [0x1800c06e3]
lea rcx, [rsp + 0x35]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18001be64
lea rax, [rbp - 0x79]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001b360
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001b3a9
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b390
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x79]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
jmp 0x18001b3c0
lea r9, [rbp - 0x79]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b4fd
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b3e5
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001be64
mov eax, r13d
sub eax, 0xfd
je 0x18001b638
sub eax, 0x38
je 0x18001b514
cmp eax, 0x38
jne 0x18001be64
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b439
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b431
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001b44b
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x18001b492
lea rax, [rcx + 3]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b473
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8d, 3
mov rcx, rdi
lea rdx, [0x1800c06d0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 3], 0
jmp 0x18001b4b1
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800c06d0]
mov rcx, rbx
lea edx, [r8 + 3]
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b4da
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b4d2
mov rax, qword [rbx]
mov word [rax + rcx], 0x29
jmp 0x18001b4ec
xor r8d, r8d
mov r9b, 0x29
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jb 0x18001b3d1
mov r9b, 0x20
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
jmp 0x18001be64
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b53d
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b535
mov rax, qword [rbx]
mov word [rax + rcx], 0x3b
jmp 0x18001b54f
xor r8d, r8d
mov r9b, 0x3b
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b578
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b570
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001b58a
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rbp - 0x41]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001b595
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001b5de
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b5c5
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x41]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x18001b5f5
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b621
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b616
mov rax, qword [rbx]
mov word [rax + rcx], 0x3b
jmp 0x18001be64
mov r9b, 0x3b
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
jmp 0x18001be64
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x18001b682
lea rax, [rcx + 3]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b660
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8d, 3
mov rcx, rdi
lea rdx, [0x1800c06e8]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 3], 0
jmp 0x18001be64
mov qword [rsp + 0x20], 3
lea r9, [0x1800c06e8]
mov edx, 3
jmp 0x18001be59
lea rax, [rbp - 0x31]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001b6a7
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001b6f0
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b6d7
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x31]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
jmp 0x18001b707
lea r9, [rbp - 0x31]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b730
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b728
mov rax, qword [rbx]
mov word [rax + rcx], 0x2f
jmp 0x18001b742
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rsp + 0x48]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001b750
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001b79a
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b780
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
jmp 0x18001b7b2
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b7db
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b7d3
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001b7ed
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b819
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b80e
mov rax, qword [rbx]
mov word [rax + rcx], 0x28
jmp 0x18001be64
mov r9b, 0x28
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
jmp 0x18001be64
cmp r13d, reloc.SHELL32.dll_SHChangeNotification_Unlock
ja 0x18001bc6b
je 0x18001bb2a
mov eax, r13d
sub eax, 0x1dd
je 0x18001bac7
sub eax, 0x38
je 0x18001b9e6
cmp eax, 0x38
jne 0x18001be64
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b88c
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b884
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001b89e
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rbp - 0x39]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001b8b0
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001b8f9
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b8e0
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x39]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x18001b910
lea r9, [rbp - 0x39]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b939
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b931
mov rax, qword [rbx]
mov word [rax + rcx], 0x29
jmp 0x18001b94b
xor r8d, r8d
mov r9b, 0x29
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001b974
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b96c
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001b986
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rbp - 0x59]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001b991
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001b9dd
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001b9c1
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x59]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rdi], 0
jmp 0x18001be64
lea r9, [rbp - 0x59]
jmp 0x18001be51
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001ba0f
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001ba07
mov rax, qword [rbx]
mov word [rax + rcx], 0x2c
jmp 0x18001ba21
xor r8d, r8d
mov r9b, 0x2c
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001ba4a
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001ba42
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001ba5c
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rsp + 0x50]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001ba70
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001babd
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001baa0
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
jmp 0x18001be64
lea r9, [rsp + 0x50]
jmp 0x18001be51
lea rax, [rsp + 0x58]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001bad3
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001bb20
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bb03
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x58]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rdi], 0
jmp 0x18001be64
lea r9, [rsp + 0x58]
jmp 0x18001be51
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001bb53
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bb4b
mov rax, qword [rbx]
mov word [rax + rcx], 0x2f
jmp 0x18001bb65
xor r8d, r8d
mov r9b, 0x2f
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rbp - 0x69]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001bb70
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001bbb9
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bba0
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x69]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
jmp 0x18001bbd0
lea r9, [rbp - 0x69]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001bbf9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bbf1
mov rax, qword [rbx]
mov word [rax + rcx], 0x2e
jmp 0x18001bc0b
xor r8d, r8d
mov r9b, 0x2e
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rbp - 0x61]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001bc16
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001bc62
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bc46
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rbp - 0x61]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rdi], 0
jmp 0x18001be64
lea r9, [rbp - 0x61]
jmp 0x18001be51
mov eax, r13d
sub eax, reloc.SHELL32.dll_CDefFolderMenu_Create2
je 0x18001bd2d
sub eax, 0x38
je 0x18001bcea
cmp eax, 0x38
jne 0x18001be64
lea rax, [rsp + 0x34]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001bc93
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001bce0
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bcc3
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x18001be64
lea r9, [rsp + 0x34]
jmp 0x18001be51
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001bd16
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bd0b
mov rax, qword [rbx]
mov word [rax + rcx], 0x2f
jmp 0x18001be64
mov r9b, 0x2f
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
jmp 0x18001be64
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001bd56
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bd4e
mov rax, qword [rbx]
mov word [rax + rcx], 0x2e
jmp 0x18001bd68
xor r8d, r8d
mov r9b, 0x2e
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x18001bd9c
lea rax, [rcx + 2]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bd90
mov rax, qword [rbx]
mov word [rax + rcx], r15w
mov byte [rax + rcx + 2], 0
jmp 0x18001bdbb
xor r8d, r8d
mov qword [rsp + 0x20], 2
lea r9, [0x1800c06cc]
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.180005890
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18001bde4
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001bddc
mov rax, qword [rbx]
mov word [rax + rcx], 0x20
jmp 0x18001bdf6
xor r8d, r8d
mov r9b, 0x20
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.180005730
lea rax, [rsp + 0x3c]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001be02
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18001be4c
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18001be32
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
lea rdx, [rsp + 0x3c]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rdi], 0
jmp 0x18001be64
lea r9, [rsp + 0x3c]
mov rdx, rsi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rbx
call fcn.180005890
add r13d, 0x38
cmp r13d, r14d
jb 0x18001b250
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1800a7b10
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret