Function at 0x18001ece0
Capabilities:
Create thread
Query or enumerate registry value
Query service status
Reference sql statements

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rbx, r9
mov rdi, r8
mov rsi, rdx
xor ecx, ecx
mov qword [rbp + 0xf0], rcx
mov word [rbp + 0xf8], cx
movdqa xmm0, xmmword [0x180057ad0]
movdqu xmmword [rbp + 0x10a], xmm0
mov byte [rbp + 0xfa], cl
mov qword [rbp + 0xa8], rcx
mov word [rbp + 0xb0], cx
movdqu xmmword [rbp + 0xc2], xmm0
mov byte [rbp + 0xb2], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x160], rcx
mov qword [rbp + 0x168], rcx
mov qword [rbp + 0x170], rcx
mov ecx, 0x30
call fcn.18003ae38
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x168], rax
xor r11d, r11d
mov qword [rbp + 0x178], r11
xorps xmm2, xmm2
movsd qword [rbp + 0x180], xmm2
mov qword [rbp + 0x188], r11
mov dword [rbp + 0x190], 1
mov qword [rbp + 0x198], r11
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1b0], xmm1
movdqa xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], r11
mov qword [rbp + 0x1d8], 0xffffffffffffffff
mov dword [rbp + 0x1e0], r11d
xor eax, eax
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm0
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm0
mov qword [rbp + 0x228], rax
movdqa xmm0, xmmword [0x180057ad0]
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], al
mov word [rbp + 0x250], r11w
mov dword [rbp + 0x254], r11d
mov qword [rbp + 0x258], r11
xorps xmm0, xmm0
movaps xmmword [rbp + 0x260], xmm0
movsd qword [rbp + 0x270], xmm2
mov byte [rbp + 0x278], al
mov qword [rbp + 0x27c], r11
mov r15d, dword [rbp + 0x5c0]
mov r14d, r15d
imul eax, r15d, 0x690
mov dword [rsp + 0x40], eax
cmp r15d, eax
ja 0x18001f59b
lea ecx, [r11 + 0x20]
mov edx, 0x3236
lea r9d, [r11 + 0x23]
lea r10d, [r11 + 0x36]
mov r8d, 0x454e
movzx r12d, byte [rsp + 0x31]
mov r13, qword [rsp + 0x78]
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
cmp r14d, 0xa880
ja 0x18001efa7
je 0x18001ef8b
cmp r14d, 0x3880
ja 0x18001ef50
je 0x18001ef3f
mov eax, r14d
sub eax, 0x80
je 0x18001ef2d
sub eax, 0x47
je 0x18001ef20
cmp eax, 0x5b
jne 0x18001f586
mov eax, dword [rdi]
mov dword [rbx], eax
mov rax, qword [rbp + 0x5a0]
mov eax, dword [rax]
mov dword [rbx + 4], eax
mov eax, dword [rsi]
mov dword [rbx + 8], eax
jmp 0x18001f586
movzx eax, byte [rbx + 3]
mov byte [rsp + 0x38], al
jmp 0x18001f586
mov dword [rsp + 0x60], 0x4b4a43
mov word [rsp + 0x63], cx
jmp 0x18001f586
mov word [rsp + 0x64], r9w
mov word [rsp + 0x65], r10w
jmp 0x18001f586
cmp r14d, 0x57d7
je 0x18001ef7e
cmp r14d, 0x7080
je 0x18001ef74
cmp r14d, 0x8002
je 0x18001fc20
jmp 0x18001f586
mov word [rsp + 0x66], dx
jmp 0x18001f586
movzx eax, byte [rbx + 2]
mov byte [rsp + 0x39], al
jmp 0x18001f586
mov word [rsp + 0x68], cx
mov dword [rsp + 0x69], 0x20544145
mov eax, 0x4f
mov word [rsp + 0x6d], ax
jmp 0x18001f586
cmp r14d, 0x11880
ja 0x18001f07c
je 0x18001f05a
cmp r14d, 0xaee7
je 0x18001f04c
cmp r14d, 0xe080
je 0x18001f03c
cmp r14d, 0x105f7
jne 0x18001f586
movzx eax, byte [rbx]
mov byte [rsp + 0x3b], al
lea rdx, [rbp + 0x148]
mov edi, r11d
lea rsi, [rsp + 0x38]
test edi, edi
je 0x18001f012
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdx + rax], 0
jne 0x18001f000
add rdx, rax
mov byte [rdx], 0x2e
inc rdx
movzx ecx, byte [rsi]
mov r8d, 0xa
call fcn.18004004c
mov rdx, rax
inc edi
inc rsi
cmp edi, 4
jb 0x18001eff3
mov rsi, qword [rbp + 0x5a8]
xor r11d, r11d
jmp 0x18001f2aa
mov word [rsp + 0x6e], r8w
mov byte [rsp + 0x70], 0
jmp 0x18001f586
mov eax, dword [rbx]
shr eax, 8
mov byte [rsp + 0x3a], al
jmp 0x18001f586
mov eax, 0x6e
mov word [rbp - 0x80], ax
mov eax, dword [str.fcOpE]
mov dword [rbp - 0x7f], eax
movzx eax, word [0x180054ef8]
mov word [rbp - 0x7b], ax
jmp 0x18001f586
cmp r14d, 0x15080
je 0x18001f571
cmp r14d, 0x15d07
je 0x18001f53d
cmp r14d, 0x18880
jne 0x18001f586
movzx eax, word [0x180054b44]
mov word [rbp - 0x78], ax
movzx eax, byte [0x180054b46]
mov byte [rbp - 0x76], al
lea r8, [0x180067198]
xor edx, edx
mov ecx, 0xed
call fcn.180037e10
test al, al
jne 0x18001f569
mov edi, 0x107
nop dword [rax + rax]
cmp edi, 0x6d1
ja 0x18001f323
je 0x18001f2f6
cmp edi, 0x3b3
ja 0x18001f1f0
je 0x18001f1d0
cmp edi, 0x25d
ja 0x18001f176
je 0x18001f16a
mov eax, edi
sub eax, 0x107
je 0x18001f15d
sub eax, 0x72
je 0x18001f13b
xor r11d, r11d
cmp eax, 0x72
jne 0x18001f29b
movabs rax, 0x6f005f004c
mov qword [rbp + 0x74], rax
jmp 0x18001f29b
mov r8d, 1
lea rdx, [0x180054cb4]
lea rcx, [rbp + 0x70]
call fcn.18003f900
mov dword [rbp + 0x72], 0x47
jmp 0x18001f298
xor r11d, r11d
mov word [rbp + 0x70], r11w
jmp 0x18001f29b
mov dword [rbp + 0x7a], 0x73
jmp 0x18001f298
mov eax, edi
sub eax, 0x2cf
je 0x18001f1b6
cmp eax, 0x72
jne 0x18001f298
lea rcx, [rbp + 0x70]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18001f190
movsd xmm0, qword [str.able]
movsd qword [rcx], xmm0
movzx eax, word [0x180054cb0]
mov word [rcx + 8], ax
jmp 0x18001f298
mov dword [rbp + 0x7c], 0x77
movabs rax, 0x6e0045006d
mov qword [rbp + 0x7e], rax
jmp 0x18001f298
movabs rax, 0x6f006c0046
mov qword [rbp + 0x8c], rax
mov dword [rbp + 0x92], 0x61
jmp 0x18001f298
cmp edi, 0x57b
ja 0x18001f2ce
je 0x18001f26c
mov eax, edi
sub eax, 0x425
je 0x18001f245
sub eax, 0x72
je 0x18001f21f
xor r11d, r11d
cmp eax, 0x72
jne 0x18001f29b
mov word [rbp + 0x40], r11w
jmp 0x18001f29b
mov r8d, 1
lea rdx, [0x180053ddc]
lea rcx, [rbp + 0x70]
call fcn.18003f900
movabs rax, 0x650074006e0049
mov qword [rbp + 0x38], rax
jmp 0x18001f298
mov dword [rbp + 0x94], 0x74
mov dword [rbp + 0x96], 0x4d
movabs rax, 0x650064006f
mov qword [rbp + 0x98], rax
jmp 0x18001f298
mov r8d, 3
lea rdx, [0x180054cdc]
lea rcx, [rbp + 0x38]
call fcn.18003f900
mov r8d, 2
lea rdx, [0x180054d32]
lea rcx, [rbp + 0x46]
call fcn.18003f948
xor r11d, r11d
add edi, 0x72
cmp edi, 0xc9b
jb 0x18001f0e0
mov rdi, qword [rbp + 0x5b0]
mov ecx, 0x20
mov edx, 0x3236
mov r8d, 0x454e
lea r9d, [rcx + 3]
lea r10d, [rcx + 0x16]
jmp 0x18001f586
mov eax, edi
sub eax, 0x5ed
je 0x18001f2ed
xor r11d, r11d
cmp eax, 0x72
jne 0x18001f29b
mov dword [rbp + 0x4c], 0x200064
mov word [rbp + 0x50], r11w
jmp 0x18001f29b
mov dword [rbp + 0x4a], 0x65
jmp 0x18001f298
movabs rax, 0x75007100650073
mov qword [rbp + 0x50], rax
xor eax, eax
mov word [rbp + 0x58], ax
lea r8d, [rax + 2]
lea rdx, [0x180054eba]
lea rcx, [rbp + 0x38]
call fcn.18003f900
jmp 0x18001f298
cmp edi, 0x9ef
ja 0x18001f46b
je 0x18001f43c
cmp edi, 0x899
ja 0x18001f3e7
je 0x18001f3bf
mov eax, edi
sub eax, 0x743
je 0x18001f393
sub eax, 0x72
je 0x18001f36c
xor r11d, r11d
cmp eax, 0x72
jne 0x18001f29b
mov dword [rbp + 0x350], 0x6a
jmp 0x18001f29b
xor eax, eax
mov word [rbp + 0x6a], ax
lea r8d, [rax + 1]
lea rdx, [0x180054d9e]
lea rcx, [rbp + 0x6a]
call fcn.18003f948
xor r11d, r11d
mov word [rbp + 0x6c], r11w
jmp 0x18001f29b
mov r8d, 4
lea rdx, [0x180054b80]
lea rcx, [rbp + 0x38]
call fcn.18003f900
mov r8d, 3
lea rdx, [0x180054c76]
lea rcx, [rbp + 0x64]
jmp 0x18001f293
mov r8d, 5
lea rdx, str.uma_:
lea rcx, [rbp + 0x350]
call fcn.18003f900
mov dword [rbp + 0x35c], 0x5c
jmp 0x18001f298
mov eax, edi
sub eax, 0x90b
je 0x18001f40b
xor r11d, r11d
cmp eax, 0x72
jne 0x18001f29b
mov r12b, 1
mov r13, 0xffffffff80000001
jmp 0x18001f29b
mov dword [rbp + 0x35e], 0x69
movabs rax, 0x650076007a
mov qword [rbp + 0x360], rax
movabs rax, 0x6f00640069
mov qword [rbp + 0x366], rax
jmp 0x18001f298
movups xmm0, xmmword [str.INT_NVVM_MIN_ULL]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [0x180054e50]
movups xmmword [rbp + 0x130], xmm1
movzx eax, word [0x180054e60]
mov word [rbp + 0x140], ax
jmp 0x18001f298
mov eax, edi
sub eax, 0xa61
je 0x18001f530
sub eax, 0x72
je 0x18001f4e4
sub eax, 0x72
je 0x18001f4af
sub eax, 0x72
je 0x18001f495
cmp eax, 0x72
je 0x18001fc1b
jmp 0x18001f298
lea rcx, [rbp + 0x350]
call qword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
mov dword [rsp + 0x58], 1
jmp 0x18001f298
xor eax, eax
mov ecx, eax
movzx eax, r12b
test r15, r15
cmovne ecx, eax
movzx r12d, cl
test cl, cl
je 0x18001f4ce
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x120]
call qword [sym.imp.SHLWAPI.dll_StrPBrkW]
jmp 0x18001f298
movups xmm0, xmmword [str.loader_cant_be_NULL]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [0x180054ed0]
movups xmmword [rbp - 0x60], xmm1
movsd xmm0, qword [0x180054ee0]
movsd qword [rbp - 0x50], xmm0
movzx eax, word [0x180054ee8]
mov word [rbp - 0x48], ax
mov r9d, dword [rsp + 0x34]
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x70]
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov r15, rax
jmp 0x18001f298
xor r11d, r11d
mov dword [rsp + 0x34], r11d
jmp 0x18001f29b
lea rax, [rbp + 0x148]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001f550
lea rdx, [rbp + 0x148]
mov rcx, rdi
call fcn.1800171c0
xor r11d, r11d
jmp 0x18001f2b1
movzx eax, word [0x180054eec]
mov word [rbp - 0x7a], ax
movzx eax, byte [0x180054eee]
mov byte [rbp - 0x78], al
imul eax, dword [rbp + 0x5c0], 0x70
add r14d, eax
cmp r14d, dword [rsp + 0x40]
jbe 0x18001eed0
mov ebx, dword [rbp + 0x5c0]
lea edx, [rbx + 0xf]
mov dword [rsp + 0x34], edx
cmp ebx, edx
jae 0x18001fc1b
lea edx, [rbx - 0x80]
mov dword [rsp + 0x38], edx
mov r13d, dword [rsp + 0x48]
movzx r15d, byte [rsp + 0x31]
movzx r14d, byte [rsp + 0x31]
mov r12d, dword [rsp + 0x48]
mov esi, dword [rsp + 0x48]
mov edi, dword [rsp + 0x48]
mov eax, dword [rsp + 0x34]
mov r9d, 0x1bb
lea r10, [0x180005fb0]
lea r8, [0x180000000]
cmp edx, 0xe
ja case.default.0x18001f601
mov ecx, dword [r8 + rdx*4 + 0x1fec8]
add rcx, r8
jmp rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.180040388
jmp 0x18001fbf4
cmp qword [rsp + 0x78], 0
jne 0x18001f876
mov ebx, 0x11d
nop word [rax + rax]
cmp ebx, 0x4b9
ja 0x18001f75b
je 0x18001f712
cmp ebx, 0x2eb
ja 0x18001f6e8
je 0x18001f6c2
cmp ebx, 0x11d
je 0x18001f6a6
cmp ebx, 0x1b7
je 0x18001f688
cmp ebx, 0x251
jne 0x18001f858
mov eax, dword [0x180054f52]
mov dword [rbp - 0x68], eax
movzx eax, byte [0x180054f56]
mov byte [rbp - 0x64], al
mov byte [rbp - 0x63], 0
jmp 0x18001f858
movzx eax, word [0x180054f1a]
mov word [rbp - 0x6b], ax
movzx eax, byte [0x180054f1c]
mov byte [rbp - 0x69], al
mov byte [rbp - 0x68], 0
jmp 0x18001f858
mov eax, dword [str.VFNMSUB213PDZ256mb]
mov dword [rbp - 0x70], eax
movzx eax, byte [0x180054f34]
mov byte [rbp - 0x6c], al
mov byte [rbp - 0x6b], 0
jmp 0x18001f858
mov dword [rbp - 0x63], 0x33313276
mov byte [rbp - 0x5f], 0
mov r8d, 3
lea rdx, [0x180054f0c]
lea rcx, [rbp - 0x5f]
call fcn.18003fd90
jmp 0x18001f858
cmp ebx, 0x385
je 0x18001f707
cmp ebx, 0x41f
jne 0x18001f858
mov word [rbp - 0x5b], 0x7a
jmp 0x18001f858
mov word [rbp - 0x5c], 0x6b
jmp 0x18001f858
mov r15b, 1
movzx r14d, r15b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2d0], xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
mov qword [rbp + 0x340], rax
jmp 0x18001f858
cmp ebx, 0x721
ja 0x18001f83a
je 0x18001f7e8
cmp ebx, 0x553
je 0x18001f7c8
cmp ebx, 0x5ed
je 0x18001f79b
cmp ebx, 0x687
jne 0x18001f858
mov ecx, r11d
movzx eax, r15b
test r13d, r13d
cmove ecx, eax
movzx r15d, cl
jmp 0x18001f858
lea rcx, [rbp + 0x120]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDW]
mov r12d, eax
lea r8, [rbp + 0x2d0]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartTraceA]
mov r13d, eax
jmp 0x18001f858
movups xmm0, xmmword [str.opacity__s]
movups xmmword [rbp + 0x120], xmm0
movsd xmm1, qword [0x180054f70]
movsd qword [rbp + 0x130], xmm1
jmp 0x18001f858
mov ecx, r11d
movzx eax, r14b
test r12d, r12d
cmovne ecx, eax
movzx r14d, cl
test r15b, r15b
je 0x18001f828
lea r8, [rbp + 0x2d0]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryTraceA]
lea r8, [rbp + 0x2d0]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StopTraceA]
test r14b, r14b
je 0x18001f858
xor edx, edx
mov ecx, r12d
call qword [sym.imp.WINMM.dll_mciGetYieldProc]
jmp 0x18001f858
cmp ebx, 0x7bb
je 0x18001f850
cmp ebx, 0x855
je 0x18001fc1b
jmp 0x18001f858
mov dword [rsp + 0x58], 1
add ebx, 0x9a
cmp ebx, 0x8ef
mov r11d, 0
jb 0x18001f630
mov ebx, dword [rbp + 0x5c0]
lea r9, [rbp + 0x30]
lea r8, [rbp - 0x40]
mov edx, esi
lea rcx, [rsp + 0x60]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov edi, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001fbf4
cmp byte [rsp + 0x31], 0
je 0x18001f91a
mov ebx, 0xca
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xca
je 0x18001f8fc
sub eax, 1
je 0x18001f8e8
sub eax, 1
je 0x18001f8d8
cmp eax, 1
jne 0x18001f900
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x18001f900
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001f900
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x18001f900
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001f900
lea r8, [rbp + 0x28]
mov edx, esi
lea rcx, [rsp + 0x60]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov edi, eax
jmp 0x18001f900
mov qword [rbp + 0x28], r11
inc ebx
cmp ebx, 0xce
mov r11d, 0
jb 0x18001f8b0
mov edx, dword [rsp + 0x38]
mov ebx, dword [rbp + 0x5c0]
cmp byte [rsp + 0x30], 0
je 0x18001fbf8
mov r8d, 0xf01ff
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
test rax, rax
jne 0x18001f960
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [rsp + 0x30], bl
mov ebx, dword [rbp + 0x5c0]
jmp 0x18001fbf4
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rbp + 0x2a0]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx ebx, byte [rsp + 0x30]
mov byte [rsp + 0x30], bl
mov ebx, dword [rbp + 0x5c0]
jmp 0x18001fbf4
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x20]
je 0x18001f9d6
lea rcx, [rbp + 0xf0]
mov qword [rax], rcx
add qword [rbp - 0x28], 8
jmp 0x18001fbfb
lea r8, [rsp + 0x40]
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180001170
jmp 0x18001fbf4
lea r9, [rbp - 0x30]
mov r8d, 0xb2
lea rdx, [0x180067190]
lea rcx, [rbp + 0x160]
call fcn.1800374d0
jmp 0x18001fbf4
xor r8d, r8d
mov edx, 0x106
lea rcx, [rbp + 0x160]
call fcn.1800227a0
xor r11d, r11d
mov ecx, r11d
movzx eax, byte [rsp + 0x30]
cmp qword [rsp + 0x50], rcx
cmovne ecx, eax
mov byte [rsp + 0x30], cl
mov edx, dword [rsp + 0x38]
jmp 0x18001fbfb
mov qword [rsp + 0x50], r10
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea ecx, [r9 + 0x74]
call fcn.180003b40
mov r8d, dword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x50], rax
xor r11d, r11d
mov edx, r11d
movzx ecx, byte [rsp + 0x31]
test edi, edi
cmove edx, ecx
mov byte [rsp + 0x31], dl
mov edx, dword [rsp + 0x38]
jmp 0x18001fbfb
lea rax, [rsp + 0x60]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18001faa0
xor r8d, r8d
mov edx, 0x114
lea rcx, [rbp - 0x30]
call fcn.180027520
jmp 0x18001fbf4
mov dword [rbp - 0x40], r11d
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x28]
cmp rax, qword [rbp - 0x20]
je 0x18001f9d6
lea rcx, [rbp + 0xa8]
mov qword [rax], rcx
add qword [rbp - 0x28], 8
jmp 0x18001fbfb
mov eax, dword [0x180067240]
mov dword [rsp + 0x40], eax
xor r9d, r9d
mov r8d, 0x10b
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180038750
lea rax, [rbp - 0x30]
mov qword [rbp + 0xe0], rax
mov eax, dword [0x180067240]
mov dword [rbp + 0xe8], eax
mov eax, dword [0x180067244]
mov dword [rbp + 0xec], eax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x290], xmm0
jmp 0x18001fbf4
mov dword [rsp + 0x48], 1
jmp 0x18001fbfb
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x31], 1
mov word [rsp + 0x40], r9w
mov r9d, 0xb6
lea r8, [rbp + 0xf0]
lea rdx, [rsp + 0x40]
lea rcx, [0x1800671f8]
call fcn.1800146a0
jmp 0x18001fbf4
mov qword [rsp + 0x50], r11
mov word [rsp + 0x40], r9w
lea r9, [rbp + 0xa8]
lea r8, [rsp + 0x40]
mov edx, 0x69
lea rcx, [0x180067218]
call fcn.180010d90
jmp 0x18001fbf4
mov qword [rbp + 0x30], r11
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2a0], xmm0
movups xmmword [rbp + 0x2b0], xmm0
mov dword [rbp + 0x2c0], eax
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], r11d
lea r9, [rbp + 0x290]
lea r8, [0x18000ecd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
mov edx, dword [rsp + 0x38]
xor r11d, r11d
mov eax, dword [rsp + 0x34]
inc ebx
mov dword [rbp + 0x5c0], ebx
inc edx
mov dword [rsp + 0x38], edx
cmp ebx, eax
jae 0x18001fc1b
jmp 0x18001f5d9
mov dword [rsp + 0x58], r11d
mov rbx, qword [rsp + 0x58]
lea rcx, [rbp + 0x1d8]
call fcn.1800031b0
mov rdi, qword [rbp + 0x1c0]
test rdi, rdi
je 0x18001fcae
mov rsi, qword [rbp + 0x1c8]
cmp rdi, rsi
je 0x18001fc5c
mov rcx, rdi
call fcn.1800153e0
add rdi, 0x20
cmp rdi, rsi
jne 0x18001fc44
mov rdi, qword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1d0]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001fc8f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001feb3
mov rcx, rdi
call fcn.18003ae74
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1c0], xmm0
xor r14d, r14d
mov qword [rbp + 0x1d0], r14
jmp 0x18001fcb1
xor r14d, r14d
mov rcx, qword [rbp + 0x1a8]
test rcx, rcx
je 0x18001fd07
mov rdx, qword [rbp + 0x1b8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fcf0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001feb3
call fcn.18003ae74
mov qword [rbp + 0x1a8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1b0], xmm0
lea rcx, [rbp + 0x168]
call fcn.1800030f0
nop
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x18001fda8
mov rsi, qword [rbp - 0x10]
cmp rdi, rsi
je 0x18001fd45
nop word [rax + rax]
mov rcx, rdi
call fcn.180002a00
add rdi, 0x28
cmp rdi, rsi
jne 0x18001fd30
mov rdi, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001fd94
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001feb9
mov rcx, rdi
call fcn.18003ae74
mov qword [rbp - 0x18], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x18001fdfa
mov rax, qword [rbp - 0x20]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fde9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001feb9
call fcn.18003ae74
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r14
mov rdx, qword [rbp + 0xca]
cmp rdx, 0x10
jb 0x18001fe3b
inc rdx
mov rcx, qword [rbp + 0xb2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fe36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001febf
call fcn.18003ae74
movdqa xmm0, xmmword [0x180057ad0]
movdqu xmmword [rbp + 0xc2], xmm0
mov byte [rbp + 0xb2], 0
mov rdx, qword [rbp + 0x112]
cmp rdx, 0x10
jb 0x18001fe8f
inc rdx
mov rcx, qword [rbp + 0xfa]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001fe8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001fead
call fcn.18003ae74
mov rax, rbx
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x660
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18003f694
nop
call fcn.18003f694
nop
call fcn.18003f694
nop
call fcn.18003f694
int3