Function at 0x1800398b0
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov rbx, qword [rbp + 0x398]
mov eax, edx
mov r11, qword [rbp - 0x60]
mov r12, r9
mov rdi, qword [rbp - 0x60]
mov r14, r8
mov dword [rbp - 0x20], edx
mov esi, eax
lea r10d, [rax - 0xd]
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x18], rbx
mov rdx, rcx
mov dword [rsp + 0x64], r10d
mov qword [rbp - 0x28], r11
mov qword [rbp - 0x78], rdi
cmp eax, r10d
jbe 0x18003a41a
movzx ecx, byte [rsp + 0x62]
movzx eax, byte [rsp + 0x62]
mov r15, qword [rbp - 0x60]
mov r13, qword [rbp - 0x60]
mov byte [rsp + 0x61], cl
mov rcx, qword [rbp - 0x60]
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x60], al
mov r9d, 0x46
lea eax, [rsi - 0x3e]
lea r8d, [r9 - 1]
cmp eax, 0x14
ja case.0x180039972.70
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x3ac68]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [r14 + 0x1a0]
mov ecx, dword [r14 + 0x1a4]
mov dword [rbp - 0x44], eax
mov dword [rbp - 0x68], ecx
jmp case.0x180039972.70
cmp qword [r14 + 0x18], 8
mov rcx, r14
jb 0x18003999a
mov rcx, qword [r14]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r11, rax
mov qword [rbp - 0x28], rax
jmp 0x18003a1af
mov eax, dword [r14 + 0x198]
mov dword [rbp - 0x48], eax
jmp case.0x180039972.70
mov r8d, 4
lea rdx, [0x18007d35c]
lea rcx, [rbp + 0x106]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea rcx, [rbp + 0x100]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180039a04
movzx eax, word [0x18007d360]
mov word [rcx], ax
movzx eax, byte [0x18007d362]
mov byte [rcx + 2], al
jmp 0x18003a1ab
mov dword [rbp - 0x10], 0
jmp case.0x180039972.70
mov eax, dword [r14 + 0x19c]
mov dword [rbp - 0x64], eax
jmp case.0x180039972.70
mov r8b, 1
mov byte [rsp + 0x60], r8b
jmp 0x18003a1ba
mov r8d, 2
lea rdx, [0x18007d364]
lea rcx, [rbp + 0x100]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003a1ab
movzx r8d, byte [rsp + 0x60]
mov dl, 1
mov byte [rsp + 0x61], dl
jmp 0x18003a1bf
movzx eax, word [0x18007d368]
lea rdx, [0x18007d36c]
mov word [rbp + 0x101], ax
lea rcx, [rbp + 0x103]
movzx eax, byte [0x18007d36a]
mov r8d, 4
mov byte [rbp + 0x103], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003a1ab
cmp r11, 0xffffffffffffffff
jne 0x180039f0c
mov edi, 0x11c
nop dword [rax + rax]
cmp edi, 0x5f7
ja 0x180039cfc
je 0x180039ce1
cmp edi, 0x351
ja 0x180039bf7
je 0x180039bc9
mov eax, edi
sub eax, 0x11c
je 0x180039bb2
sub eax, 0x71
je 0x180039ba5
sub eax, 0x71
je 0x180039b79
sub eax, 0x71
je 0x180039b44
cmp eax, 0x71
jne 0x180039eec
lea r8d, [rax - 0x70]
lea rdx, [0x18007b7d4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0xeb], 0x5f4349
jmp 0x180039ee2
mov eax, 0x54
lea rcx, [rbp + 0xe0]
mov word [rbp + 0xe8], ax
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180039b60
movzx eax, word [0x18007d39c]
mov word [rcx], ax
jmp 0x180039eec
mov eax, 0x52
mov word [rbp + 0xe5], ax
movzx eax, word [0x18007d390]
mov word [rbp + 0xe6], ax
movzx eax, byte [0x18007d392]
mov byte [rbp + 0xe8], al
jmp 0x180039eec
mov word [rbp + 0xe4], r8w
jmp 0x180039eec
mov dword [rbp + 0xe0], 0x465542
mov word [rbp + 0xe3], r9w
jmp 0x180039eec
movzx eax, word [0x18007d394]
mov word [rbp + 0xee], ax
movzx eax, word [0x18007d398]
mov word [rbp + 0xf0], ax
movzx eax, byte [0x18007d39a]
mov byte [rbp + 0xf2], al
jmp 0x180039eec
mov eax, edi
sub eax, 0x3c2
je 0x180039ca4
sub eax, 0x71
je 0x180039c93
sub eax, 0x71
je 0x180039c74
sub eax, 0x71
je 0x180039c49
cmp eax, 0x71
jne 0x180039eec
lea rcx, [rbp + 0xd0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180039c30
movzx eax, word [0x18007181c]
mov word [rcx], ax
jmp 0x180039eec
mov r8d, 5
lea rdx, str.nlyL
lea rcx, [rbp + 0xd4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x6f
mov word [rbp + 0xd8], ax
jmp 0x180039ee2
movzx eax, word [0x180071820]
mov word [rbp + 0xd2], ax
mov eax, 0x4f
mov word [rbp + 0xd3], ax
jmp 0x180039eec
mov eax, 0x73
mov word [rbp + 0xd1], ax
jmp 0x180039eec
lea rcx, [rbp + 0xe0]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180039cb0
movzx eax, byte [0x18007d3a8]
movsd xmm0, qword [str.X2_IDXEN]
movsd qword [rcx], xmm0
mov byte [rcx + 8], al
mov eax, 0x75
mov word [rbp + 0xd0], ax
jmp 0x180039eec
mov eax, 0x20
mov dword [rbp + 0xda], 0x3a6c61
mov word [rbp + 0xdd], ax
jmp 0x180039eec
cmp edi, 0x90e
ja 0x180039da6
je 0x180039d97
mov eax, edi
sub eax, 0x6d9
je 0x180039d8d
sub eax, 0x71
je 0x180039d85
sub eax, 0x71
je 0x180039d47
sub eax, 0x71
je 0x180039d3b
cmp eax, 0x71
jne 0x180039eec
mov dword [rbp - 4], 1
jmp 0x180039eec
mov dword [rbp - 0xc], 0x2000000
jmp 0x180039eec
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0x30], rax
mov eax, dword [0x18007d380]
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0xa0], eax
movzx eax, word [0x18007d384]
movups xmmword [rbp + 0x20], xmm0
mov word [rbp + 0xa4], ax
movups xmm0, xmmword [str.n_Unicode_predetermin]
movups xmmword [rbp + 0x90], xmm0
jmp 0x180039eec
xor r15d, r15d
jmp 0x180039eec
mov byte [rsp + 0x62], 1
jmp 0x180039eec
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
jmp 0x180039eec
mov eax, edi
sub eax, 0x97f
je 0x180039ed1
sub eax, 0x71
je 0x180039ec8
sub eax, 0x71
je 0x180039e33
sub eax, 0x71
je 0x180039dd4
cmp eax, 0x71
je case.0x18003a4da.6
jmp 0x180039eec
lea rax, [rbp]
xor edx, edx
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0xd0]
lea rax, [rbp + 8]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea r8, [rbp + 0xe0]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x40], rax
mov eax, dword [rbp - 8]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp - 0xc]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckAndAuditAlarmA]
mov byte [rbp - 0x60], 0
jmp 0x180039ee2
movzx eax, byte [rsp + 0x62]
xor ecx, ecx
test r15, r15
cmovne ecx, eax
mov byte [rsp + 0x62], cl
movzx eax, cl
test cl, cl
je 0x180039eec
mov ebx, 0x93
cmp ebx, 0x93
je 0x180039e9a
cmp ebx, 0x89d
je 0x180039e84
cmp ebx, 0x10a7
jne 0x180039eb8
test al, al
je 0x180039eb8
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180039eb3
test r13, r13
jne 0x180039eb8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov byte [rsp + 0x62], al
jmp 0x180039eb8
mov r8d, 0xf01ff
lea rdx, [rbp + 0x90]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r13, rax
movzx eax, byte [rsp + 0x62]
add ebx, 0x80a
cmp ebx, 0x181e
jbe 0x180039e54
jmp 0x180039ee2
mov dword [rbp - 8], 0
jmp 0x180039eec
mov r8d, dword [rbp - 4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r15, rax
mov r8d, 0x45
lea r9d, [r8 + 1]
add edi, 0x71
cmp edi, 0xbb4
jb 0x180039ad0
mov rbx, qword [rbp - 0x18]
mov rdi, qword [rbp - 0x78]
mov r10d, dword [rsp + 0x64]
mov r11, qword [rbp - 0x28]
movzx r8d, byte [rsp + 0x60]
xor r9d, r9d
movzx edx, byte [rsp + 0x61]
mov qword [rsp + 0x68], r9
jmp 0x18003a1c4
mov eax, dword [rbx]
dec eax
cmp eax, 7
ja case.default.0x180039f45
lea r9, [0x180000000]
cdqe
mov ecx, dword [r9 + rax*4 + 0x3acbc]
add rcx, r9
jmp rcx
mov ecx, dword [rbp - 0x48]
add ecx, 3
mov dword [rbp - 0x48], ecx
jmp 0x180039f55
mov ecx, dword [rbp - 0x48]
mov ebx, 0x6d
nop word [rax + rax]
mov eax, ebx
sub eax, 0x6a
je case.0x18003a1f7.0
sub eax, 1
je 0x180039fc2
sub eax, 1
je 0x180039fa0
cmp eax, 1
jne 0x18003a03e
cmp dword [r14 + 0x198], 0xffffffff
jne 0x18003a03e
lea rdx, str.vulcanRemoveMessageListener
mov rcx, r14
call fcn.1800250a0
jmp 0x18003a03a
mov r8d, dword [r12]
cmp r8d, 0xff
jbe 0x18003a03e
lea rdx, str.vmx_vigor_fields_ToolsInstallManager_
mov rcx, r14
call fcn.1800250a0
jmp 0x18003a03a
mov eax, dword [r12]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x30], eax
lea r8, [rsp + 0x70]
mov rax, qword [rbp + 0x390]
mov dword [rbp - 0x78], ecx
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x78], 0xffffffff
mov dword [rbp - 0x80], reloc.SHELL32.dll_ILFindLastID
mov eax, dword [rax]
mov dword [rbp - 0x40], eax
mov eax, dword [rdx]
lea rdx, [rsp + 0x78]
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x40]
mov dword [rsp + 0x38], ILFree
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x70], 0
call fcn.18003dc30
mov rdi, rax
mov qword [rbp - 0x78], rax
mov rdx, qword [rbp - 0x50]
mov ecx, dword [rbp - 0x48]
dec ebx
cmp ebx, 0x69
ja 0x180039f60
lea r9, [0x180000000]
mov edi, dword [rbp - 0x64]
add edi, 3
mov dword [rbp - 0x64], edi
jmp 0x18003a061
mov edi, dword [rbp - 0x64]
mov ebx, 6
cmp ebx, 6
ja case.default.0x18003a07c
mov eax, ebx
mov ecx, dword [r9 + rax*4 + 0x3acdc]
add rcx, r9
jmp rcx
cmp dword [r14 + 0x19c], 0xffffffff
jne case.default.0x18003a07c
lea rdx, str.Load_Store_Splits_Completed
mov rcx, r14
call fcn.1800250a0
jmp case.default.0x18003a07c
mov edx, dword [rbp - 0x58]
mov eax, dword [rbp - 0x70]
add eax, dword [rbp - 0x6c]
shl edx, 0x16
add eax, edx
mov dword [rbp - 0x58], edx
mov dword [r12], eax
jmp case.default.0x18003a07c
shr dword [rbp - 0x6c], 0xa
mov ecx, dword [r12]
and ecx, 0x3fc
mov dword [rbp - 0x70], ecx
jmp case.default.0x18003a07c
mov r8d, dword [r12]
cmp r8d, 0x3fff
jbe case.default.0x18003a07c
lea rdx, str.VSGLayoutObjectRelative.canMakeRelative
mov rcx, r14
call fcn.1800250a0
jmp case.default.0x18003a07c
mov edx, dword [r12]
and edx, 0x3c00
mov dword [rbp - 0x6c], edx
jmp case.default.0x18003a07c
shl dword [rbp - 0x70], 6
mov eax, dword [r12]
and eax, 3
mov dword [rbp - 0x58], eax
dec ebx
lea r9, [0x180000000]
lea eax, [rbx + 0x2e]
cmp eax, 0x2d
ja 0x18003a066
mov rdx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x78]
mov r8d, dword [rbp - 0x44]
add r8d, 3
mov dword [rbp - 0x44], r8d
jmp 0x18003a1dc
mov eax, dword [r12]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x80], eax
lea r8, [rbp - 0x38]
mov rax, qword [rbp + 0x390]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x40], 0xc0ff0f
mov dword [rbp - 0x78], edi
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
mov rax, qword [rbp - 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x70], eax
xor eax, eax
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x38], ILFree
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.18003dc30
mov rdi, rax
mov qword [rbp - 0x78], rax
mov rbx, qword [rbp - 0x18]
mov esi, 0x4e
mov r11, qword [rbp - 0x28]
mov r10d, dword [rsp + 0x64]
movzx r8d, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
mov r9, qword [rsp + 0x68]
dec esi
cmp esi, r10d
jbe 0x18003a439
mov rdx, qword [rbp - 0x50]
jmp 0x180039944
mov r8d, dword [rbp - 0x44]
mov ebx, 7
cmp ebx, 7
ja case.default.0x18003a1f7
mov eax, ebx
mov ecx, dword [r9 + rax*4 + 0x3acf8]
add rcx, r9
jmp rcx
shl dword [rbp - 0x70], 8
jmp case.default.0x18003a1f7
mov r8d, dword [r12]
cmp r8d, 0x3fff
jbe case.default.0x18003a1f7
lea rdx, str.S__updateGeometries_QHeaderView__MAEXXZ
mov rcx, r14
call fcn.1800250a0
jmp case.default.0x18003a1f7
shl dword [rbp - 0x6c], 0x18
mov ecx, dword [r12]
and ecx, 0x3f00
mov dword [rbp - 0x70], ecx
jmp case.default.0x18003a1f7
mov eax, dword [rbp - 0x70]
add eax, dword [rbp - 0x6c]
mov dword [r12], eax
jmp case.default.0x18003a1f7
movzx eax, byte [r12]
mov dword [rbp - 0x6c], eax
jmp case.default.0x18003a1f7
mov eax, dword [r12]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x80], eax
lea rcx, [rbp - 0x30]
mov rax, qword [rbp + 0x390]
mov dword [rbp - 0x78], r8d
lea r8, [rbp - 0x38]
mov dword [rbp - 0x40], 0xff3f0000
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
mov eax, dword [rdx]
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x70], eax
xor eax, eax
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x38], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x38], ILFree
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.18003dc30
mov rdi, rax
mov qword [rbp - 0x78], rax
jmp case.default.0x18003a1f7
cmp dword [r14 + 0x1a0], 0xffffffff
jne case.default.0x18003a1f7
lea rdx, str.Failed_to_get_RFData_offset
mov rcx, r14
call fcn.1800250a0
mov rdx, qword [rbp - 0x50]
lea r9, [0x180000000]
mov r8d, dword [rbp - 0x44]
dec ebx
lea eax, [rbx + 0x66]
cmp eax, 0x65
ja 0x18003a1e1
mov ecx, dword [rbp - 0x68]
add ecx, 3
mov dword [rbp - 0x68], ecx
jmp 0x18003a312
mov ecx, dword [rbp - 0x68]
mov ebx, 0x11b
nop word [rax + rax]
cmp ebx, 0x118
jbe case.default.0x180039f45
mov eax, ebx
sub eax, 0x119
je case.0x18003a1f7.0
sub eax, 1
je 0x18003a388
cmp eax, 1
jne 0x18003a405
cmp dword [r14 + 0x1a4], 0xffffffff
jne 0x18003a360
lea rdx, str._DEBUGGER__bailout_type__
mov rcx, r14
call fcn.1800250a0
mov r8d, dword [r12]
cmp r8d, 0xf
jbe 0x18003a405
lea rdx, str.Invalid_picture_dimensions:__d_x__d_
mov rcx, r14
call fcn.1800250a0
mov rdx, qword [rbp - 0x50]
dec ebx
mov ecx, dword [rbp - 0x68]
jmp 0x18003a320
shl dword [r12], 4
lea r9, [rbp - 0x78]
mov eax, dword [r12]
lea r8, [rbp - 0x38]
mov dword [rbp - 0x80], eax
mov rax, qword [rbp + 0x390]
mov dword [rbp - 0x78], ecx
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x40], SHTestTokenMembership
mov dword [rbp - 0x30], reloc.SHELL32.dll_ILFindLastID
mov eax, dword [rax]
mov dword [rsp + 0x78], eax
mov eax, dword [rdx]
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x70], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov dword [rsp + 0x38], ILFree
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x38], 0
call fcn.18003dc30
mov rdi, rax
mov qword [rbp - 0x78], rax
mov rdx, qword [rbp - 0x50]
dec ebx
mov ecx, dword [rbp - 0x68]
jmp 0x18003a320
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
movzx r8d, byte [rsp + 0x62]
movzx edx, byte [rsp + 0x62]
mov r9, qword [rbp - 0x60]
mov byte [rsp + 0x60], r8b
mov byte [rsp + 0x61], dl
mov qword [rsp + 0x68], r9
jmp 0x18003a43c
mov eax, dword [rbp - 0x20]
cmp eax, r10d
jbe case.0x18003a4da.6
mov r13, qword [rbp - 0x50]
movzx esi, byte [rsp + 0x62]
mov r14d, dword [rbp - 0x1c]
mov r15, qword [rbp - 0x60]
mov r12d, dword [rbp - 0x1c]
nop word [rax + rax]
add eax, 0xffffffc5
cmp eax, 0x17
ja case.0x18003a484.70
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x3ad18]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r8d, dword [rsp + 0x70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r9, rax
mov qword [rsp + 0x68], rax
jmp 0x18003ac0f
mov qword [rbp - 0x60], rdi
jmp case.0x18003a484.70
mov eax, dword [rbp - 0x64]
cmp eax, dword [rbp - 0x10]
je case.0x18003a484.70
xor edi, edi
mov dword [rbp - 0x58], edi
nop dword [rax]
cmp edi, 6
ja case.default.0x18003a4da
lea rdx, [0x180000000]
mov ecx, dword [rdx + rdi*4 + 0x3ad78]
add rcx, rdx
jmp rcx
lea r9, [rbp - 0x1c]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorSacl]
jmp case.default.0x18003a4da
mov r13, 0xffffffffffffffff
mov qword [rbx + 0x10], 0
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
mov qword [rbp - 0x50], r13
jb 0x18003a517
mov rax, qword [rbx]
mov byte [rax], 0
jmp case.default.0x18003a4da
mov byte [rsp + 0x62], 1
jmp case.default.0x18003a4da
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp + 0x20], xmm0
jmp case.default.0x18003a4da
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymInitialize]
test eax, eax
jne case.default.0x18003a4da
mov byte [rsp + 0x62], al
jmp case.default.0x18003a4da
cmp byte [rsp + 0x62], 0
je 0x18003aa11
mov edi, dword [rsp + 0x78]
mov ebx, 0xf9
cmp ebx, 0xc29
ja 0x18003a7cd
je 0x18003a7af
cmp ebx, 0x691
ja 0x18003a6bf
je 0x18003a6b0
cmp ebx, 0x3c5
ja 0x18003a628
je 0x18003a609
cmp ebx, 0xf9
je 0x18003a5fb
cmp ebx, 0x1ac
je 0x18003a5ea
cmp ebx, 0x25f
je 0x18003a5de
cmp ebx, 0x312
jne 0x18003a9f8
mov dword [rbp + 0x93], 0x535f4547
mov byte [rbp + 0x97], 0
jmp 0x18003a9f8
mov byte [rbp + 0x93], 0
jmp 0x18003a9f8
mov eax, 0x414d
mov word [rbp + 0x91], ax
jmp 0x18003a9f8
mov word [rbp + 0x90], 0x49
jmp 0x18003a9f8
mov r8d, 2
lea rdx, [0x18007d702]
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18003a9f8
cmp ebx, 0x478
je 0x18003a689
cmp ebx, 0x52b
je 0x18003a66a
cmp ebx, 0x5de
jne 0x18003a9f8
mov r8d, 1
mov byte [rbp + 0x9f], 0
lea rdx, [0x18007d827]
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18003a9f8
mov r8d, 3
lea rdx, [0x18007d5fb]
lea rcx, [rbp + 0x9c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003a9f8
movzx eax, word [0x18007d66e]
mov word [rbp + 0x99], ax
movzx eax, byte [0x18007d670]
mov byte [rbp + 0x9b], al
mov byte [rbp + 0x9c], 0
jmp 0x18003a9f8
mov dword [rbp + 0xa0], 0x42323135
jmp 0x18003a9f8
cmp ebx, 0x95d
ja 0x18003a742
je 0x18003a71d
cmp ebx, 0x744
je 0x18003a711
cmp ebx, 0x7f7
je 0x18003a705
cmp ebx, 0x8aa
jne 0x18003a9f8
movzx eax, word [0x18007d59a]
mov word [rbp + 0xa5], ax
movzx eax, byte [0x18007d59c]
mov byte [rbp + 0xa7], al
jmp 0x18003a9f8
mov byte [rbp + 0xa4], 0x59
jmp 0x18003a9f8
mov byte [rbp + 0xa4], 0
jmp 0x18003a9f8
mov eax, dword [0x18007d5be]
mov dword [rbp + 0xb0], eax
movzx eax, byte [0x18007d5c2]
mov byte [rbp + 0xb4], al
mov byte [rbp + 0xa8], 0
jmp 0x18003a9f8
cmp ebx, 0xa10
je 0x18003a7a3
cmp ebx, 0xac3
je 0x18003a784
cmp ebx, 0xb76
jne 0x18003a9f8
mov r8d, 1
mov byte [rbp + 0xb6], 0
lea rdx, [0x18007d613]
lea rcx, [rbp + 0xb6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003a9f8
mov r8d, 1
lea rdx, [0x18007d80c]
lea rcx, [rbp + 0xb5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003a9f8
mov byte [rbp + 0xb5], 0
jmp 0x18003a9f8
mov eax, dword [0x18007d4e0]
mov dword [rbp + 0xb7], eax
movzx eax, byte [0x18007d4e4]
mov byte [rbp + 0xbb], al
jmp 0x18003a9f8
cmp ebx, 0x1274
ja 0x18003a915
je 0x18003a90d
cmp ebx, 0xfa8
ja 0x18003a89d
je 0x18003a891
cmp ebx, 0xcdc
je 0x18003a86b
cmp ebx, 0xd8f
je 0x18003a845
cmp ebx, 0xe42
je 0x18003a826
cmp ebx, 0xef5
jne 0x18003a9f8
mov eax, 0x746e
mov word [rbp + 0xc3], ax
jmp 0x18003a9f8
mov r8d, 5
lea rdx, [0x18007d6f0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18003a9f8
mov r8d, 1
lea rdx, [0x18007d681]
lea rcx, [rbp + 0xbd]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0xbe], 0
jmp 0x18003a9f8
mov r8d, 1
mov byte [rbp + 0xbc], 0
lea rdx, [0x18007d5d5]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18003a9f8
mov byte [rbp + 0xc5], 0
jmp 0x18003a9f8
cmp ebx, 0x105b
je 0x18003a8d3
cmp ebx, 0x110e
je 0x18003a8c7
cmp ebx, 0x11c1
jne 0x18003a9f8
mov word [rbp + 0xc9], 0x67
jmp 0x18003a9f8
mov byte [rbp + 0xc9], 0
jmp 0x18003a9f8
mov r8d, 1
lea rdx, [0x18007d6a6]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18007d6c7]
mov word [rbp + 0xc6], ax
movzx eax, byte [0x18007d6c9]
mov byte [rbp + 0xc8], al
jmp 0x18003a9f8
mov sil, 1
jmp 0x18003a9f8
cmp ebx, 0x15f3
ja 0x18003a988
je 0x18003a95e
cmp ebx, 0x1327
je 0x18003a94b
cmp ebx, 0x148d
je 0x18003a943
cmp ebx, 0x1540
jne 0x18003a9f8
xor r14d, r14d
jmp 0x18003a9f8
xor r15d, r15d
jmp 0x18003a9f8
mov qword [rbp - 0x38], 0
mov r12d, 0x36
jmp 0x18003a9f8
mov rcx, qword [rbp - 0x38]
lea rax, [rbp + 0x110]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov r8, r15
mov dword [rbp - 0x80], 0xa
mov edx, r12d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
jmp 0x18003a9f8
cmp ebx, 0x16a6
je 0x18003a9d6
cmp ebx, 0x1759
je 0x18003a9c6
cmp ebx, 0x180c
jne 0x18003a9f8
test sil, sil
je 0x18003a9bb
lea r9, [rbp + 0x110]
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.SHELL32.dll_SHSetFolderPathW]
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18003a9f8
xor ecx, ecx
movzx eax, sil
test edi, edi
cmove ecx, eax
movzx esi, cl
jmp 0x18003a9f8
mov eax, dword [rbp - 0x80]
lea r9, [rbp + 0x40]
lea r8, [rbp + 0xb0]
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0x90]
mov rcx, r13
call qword [sym.imp.dbghelp.dll_SymGetFileLineOffsets64]
add ebx, 0xb3
cmp ebx, 0x18bf
jb 0x18003a572
mov dword [rsp + 0x78], edi
mov edi, dword [rbp - 0x58]
mov byte [rbp - 0x60], 0
mov rbx, qword [rbp - 0x18]
inc edi
mov dword [rbp - 0x58], edi
lea eax, [rdi + 0x8c]
cmp eax, 0x93
jb 0x18003a4c0
mov rdi, qword [rbp - 0x78]
jmp 0x18003ac0a
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003ac0a
test dl, dl
je 0x18003aa7b
mov rcx, qword [rbp]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.dbghelp.dll_SymEnumerateModules64]
mov rcx, qword [rbp]
mov dword [rbp - 0x68], eax
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov r9, qword [rsp + 0x68]
movzx r8d, byte [rsp + 0x60]
mov r10d, dword [rsp + 0x64]
movzx edx, byte [rsp + 0x61]
test r8b, r8b
je case.0x18003a484.70
mov r13, qword [rbp - 0x40]
mov edi, 0xc3
nop dword [rax]
mov eax, edi
sub eax, 0xc2
je 0x18003aad5
cmp eax, 1
jne 0x18003ab2d
mov r8d, 0xf01ff
lea rdx, [rbp + 0x100]
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov r13, rax
test rax, rax
jne 0x18003ab27
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor r8b, r8b
mov byte [rsp + 0x60], r8b
jmp 0x18003ab2d
test r8b, r8b
je 0x18003ab2d
mov ebx, reloc.SHELL32.dll_SHSetInstanceExplorer
nop
mov eax, ebx
sub eax, 0xaf
je 0x18003ab0f
cmp eax, 1
jne 0x18003ab18
xor r9d, r9d
lea rax, [rbp + 0xc]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, r13
lea edx, [r9 + 2]
call qword [sym.imp.ADVAPI32.dll_QueryServiceObjectSecurity]
mov rcx, r13
jmp 0x18003ab12
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r9, qword [rsp + 0x68]
dec ebx
cmp ebx, 0xae
ja 0x18003aae0
movzx r8d, byte [rsp + 0x60]
mov r9, qword [rsp + 0x68]
dec edi
cmp edi, 0xc1
ja 0x18003aa90
mov rdi, qword [rbp - 0x78]
mov qword [rbp - 0x40], r13
mov r13, qword [rbp - 0x50]
jmp 0x18003ac15
mov ecx, 0x36
mov eax, ecx
sub eax, 0x36
je 0x18003ab68
cmp eax, 1
je case.0x18003a4da.6
jmp 0x18003ab6c
mov byte [rbp - 0x60], 1
inc ecx
cmp ecx, 0x38
jb 0x18003ab56
mov qword [rbp], 0xffffffffffffffff
jmp case.0x18003a484.70
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x18003ab8d
mov rdx, qword [rbx]
mov r8d, dword [rbp - 0x64]
lea r9, [rbp - 0x10]
mov rcx, r11
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18003ac0a
xor ecx, ecx
movzx eax, dl
cmp dword [rbp - 0x68], ecx
cmovne ecx, eax
movzx edx, cl
mov byte [rsp + 0x61], cl
jmp case.0x18003a484.70
mov rcx, qword [rbp]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x70], 1
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 0x68], eax
jmp 0x18003ac0a
xor ecx, ecx
movzx eax, r8b
test r9, r9
cmovne ecx, eax
movzx r8d, cl
mov byte [rsp + 0x60], cl
jmp case.0x18003a484.70
xor edx, edx
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rbx
mov dword [rbp - 0x64], eax
call fcn.18005f3a0
mov r9, qword [rsp + 0x68]
movzx r8d, byte [rsp + 0x60]
mov r10d, dword [rsp + 0x64]
movzx edx, byte [rsp + 0x61]
mov eax, dword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
dec eax
mov r11, qword [rbp - 0x28]
mov dword [rbp - 0x20], eax
cmp eax, r10d
ja 0x18003a460
mov rax, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.18006fee0
mov rbx, qword [rsp + 0x478]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret