Function at 0x1800dd240
Capabilities:
Check for software breakpoints
Create pipe
Create thread
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x180135928]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov rdi, r9
mov qword [rbp - 0x40], r9
mov rbx, r8
mov qword [rbp - 0x78], rbx
mov r12d, edx
mov dword [rsp + 0x50], edx
mov qword [rbp - 0x80], rcx
movdqa xmm0, xmmword [0x18011dd00]
movdqa xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
movdqa xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
xor ecx, ecx
mov qword [rbp + 0x78], rcx
mov word [rbp + 0x80], cx
movdqu xmmword [rbp + 0x92], xmm0
mov byte [rbp + 0x82], cl
mov qword [rbp + 0x48], rcx
mov word [rbp + 0x50], cx
movdqu xmmword [rbp + 0x62], xmm0
mov byte [rbp + 0x52], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
movdqa xmmword [rbp], xmm0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rcx
mov qword [rbp + 0xc0], rcx
mov ecx, 0x30
call fcn.1801060c0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xb8], rax
xor r8d, r8d
mov qword [rbp + 0xc8], r8
xorps xmm2, xmm2
movsd qword [rbp + 0xd0], xmm2
mov qword [rbp + 0xd8], r8
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xe8], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r8
mov qword [rbp + 0x128], 0xffffffffffffffff
mov dword [rbp + 0x130], r8d
xor eax, eax
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rax
movdqa xmm0, xmmword [0x18011dd00]
movdqa xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], al
mov word [rbp + 0x1a0], r8w
mov dword [rbp + 0x1a4], r8d
mov qword [rbp + 0x1a8], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1b0], xmm0
movsd qword [rbp + 0x1c0], xmm2
mov byte [rbp + 0x1c8], al
mov qword [rbp + 0x1cc], r8
mov esi, r12d
imul r13d, r12d, 0xe2d
lea r10d, [r8 + 0x71]
mov r14d, dword [rsp + 0x60]
mov rax, qword [rbp - 0x50]
cmp r12d, r13d
ja 0x1800dd994
lea rdx, [0x180105c60]
mov r12, qword [rbp + 0x40]
mov qword [rbp - 0x58], rax
mov r9d, dword [rsp + 0x60]
mov dword [rsp + 0x60], r9d
mov r15d, dword [rbp - 0x70]
mov ebx, dword [rbp - 0x70]
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x68], rax
lea rcx, [0x180105c50]
cmp esi, 0x44d2
ja 0x1800dd820
je 0x1800dd7f2
cmp esi, 0x11a
ja 0x1800dd726
je 0x1800dd6c0
cmp esi, 0x11
je 0x1800dd587
cmp esi, 0x2e
je 0x1800dd560
cmp esi, 0x66
je 0x1800dd4f1
cmp esi, 0xf8
jne 0x1800dd539
mov r8d, 2
lea rdx, [0x180113040]
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x65
mov word [rbp + 0x2b9], ax
jmp 0x1800dd52f
mov qword [rbp - 0x50], rcx
mov qword [rbp + 0x290], rdx
mov r9d, 0x78
lea r8, [rbp + 0x290]
lea rdx, [rbp - 0x50]
xor ecx, ecx
call fcn.1800bd820
mov qword [rbp - 0x58], rax
mov dword [rsp + 0x68], 0
mov edx, 0x9e
lea rcx, [rsp + 0x68]
call fcn.1800b09c0
xor r8d, r8d
lea rdx, [0x180105c60]
imul eax, dword [rsp + 0x50], 0xbf
add esi, eax
cmp esi, r13d
ja 0x1800dd9aa
mov rdi, qword [rbp - 0x40]
mov r9d, dword [rsp + 0x60]
mov r10d, 0x71
jmp 0x1800dd47f
mov rcx, qword [rbp - 0x80]
movzx edi, byte [rcx + 6]
inc edi
mov dword [rsp + 0x60], edi
mov edx, dword [rcx + 0x1c]
add edx, edi
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rcx, qword [rbp - 0x80]
mov qword [rcx + 0x20], rax
jmp 0x1800dd52f
mov dword [rsp + 0x48], 0x3a
mov dword [rsp + 0x68], r8d
lea r9, [rsp + 0x68]
mov r8d, 0x43
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.18009b4d0
mov r12, rax
test rax, rax
jne 0x1800dd52f
mov edi, 0x32
nop
cmp edi, 0x32
je 0x1800dd66c
cmp edi, 0x1a2c
je 0x1800dd65e
cmp edi, 0x3426
jne 0x1800dd6a9
xor r14d, r14d
lea rcx, [rbp + 0x128]
call fcn.180008f60
mov rbx, qword [rbp + 0x110]
test rbx, rbx
je 0x1800de538
mov rdi, qword [rbp + reloc.SHLWAPI.dll_SHRegGetIntW]
cmp rbx, rdi
je 0x1800dd628
nop dword [rax]
mov rcx, rbx
call fcn.1800af780
add rbx, 0x20
cmp rbx, rdi
jne 0x1800dd610
mov rbx, qword [rbp + 0x110]
mov r8, qword [rbp + 0x120]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x110]
call fcn.1800bb680
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
xor esi, esi
mov qword [rbp + 0x120], rsi
jmp 0x1800de53a
mov rax, qword [rbp - 0x40]
xor ecx, ecx
mov dword [rax], ecx
mov qword [rbp - 0x78], rcx
jmp 0x1800dd6a9
mov dword [rsp + 0x68], 1
lea rax, str.SECURITY_SERVICE_ID_BASE_RID
mov qword [rsp + 0x20], rax
mov r9d, 0x24
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x68]
call fcn.180023820
xor r9d, r9d
lea r8d, [r9 + 0x44]
mov rdx, qword [rbp - 0x80]
xor ecx, ecx
call fcn.18009fdb0
add edi, 0x19fa
cmp edi, 0x4dee
jbe 0x1800dd5c0
jmp 0x1800dd52f
cmp dword [rdi], 2
jl 0x1800dd6e6
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax]
lea ecx, [r9 + 0x36]
call fcn.1800d00c0
xor r8d, r8d
test eax, eax
jne 0x1800dd532
mov edi, 0x6b
nop dword [rax + rax]
mov eax, edi
sub eax, 0x6b
je 0x1800dd702
cmp eax, 1
je case.0x1800de100.260
jmp 0x1800dd71a
xor r9d, r9d
lea r8d, [r9 + 0x44]
mov rdx, qword [rbp - 0x80]
xor ecx, ecx
call fcn.18009fdb0
xor r8d, r8d
mov r14d, r8d
inc edi
cmp edi, 0x6d
jb 0x1800dd6f0
jmp 0x1800dd532
cmp esi, 0xcc0
je 0x1800dd7d5
cmp esi, 0x196f
je case.0x1800de100.260
cmp esi, 0x2280
jne 0x1800dd539
mov r15d, 1
mov rdx, qword [rbp - 0x80]
cmp dword [rdx + 0x1c], r15d
jbe 0x1800dd7cb
nop word [rax + rax]
mov edi, 7
cmp edi, 7
je 0x1800dd77c
cmp edi, 0xc4
jne 0x1800dd7af
mov rax, qword [rbp - 0x40]
cmp ebx, dword [rax]
jg 0x1800dd7c8
jmp 0x1800dd7af
movzx eax, byte [rdx + 6]
mov dword [rsp + 0x48], eax
lea eax, [r15 + 1]
mov dword [rsp + 0x68], eax
mov r9, qword [rdx + 0x20]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov ecx, r10d
call fcn.180055f50
mov rbx, rax
mov rdx, qword [rbp - 0x80]
mov r10d, 0x71
add edi, 0xbd
cmp edi, 0x181
jb 0x1800dd765
add r15d, dword [rsp + 0x60]
cmp r15d, dword [rdx + 0x1c]
jb 0x1800dd760
xor r8d, r8d
mov esi, 0x2280
jmp 0x1800dd532
mov r9, qword [rbp - 0x80]
xor edx, edx
lea r8d, [rdx + 0x62]
mov rcx, r12
call fcn.1800d1a30
xor r8d, r8d
mov r14d, r8d
jmp 0x1800dd532
mov rdx, qword [rbp - 0x80]
mov r8d, dword [rdx + 0x1c]
cmp r15d, r8d
jae 0x1800dd52f
mov ecx, r15d
mov rdx, qword [rdx + 0x20]
add rdx, rcx
sub r8d, r15d
movsxd rcx, r9d
add rcx, rdx
call sub.VCRUNTIME140.dll_memmove
jmp 0x1800dd52f
cmp esi, 0xd380
ja 0x1800dd8e9
je 0x1800dd8d5
cmp esi, 0x4c80
je 0x1800dd539
cmp esi, 0x6724
je 0x1800dd8bb
cmp esi, 0x8976
je 0x1800dd879
cmp esi, 0xba00
jne 0x1800dd539
mov r8d, 3
lea rdx, [0x180113044]
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800dd52f
mov eax, dword [rdi]
mov dword [rsp + 0x58], eax
mov rcx, qword [rbp - 0x80]
movzx eax, byte [rcx + 6]
mov dword [rsp + 0x68], eax
lea eax, [r15 + 1]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x2b
mov r8, qword [rcx + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.1800e4330
jmp 0x1800dd52f
mov edx, r15d
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 0x20]
mov rax, qword [rbp - 0x78]
movzx eax, byte [rax]
mov byte [rdx + rcx], al
jmp 0x1800dd532
mov rax, qword [rbp - 0x78]
mov rax, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rbp - 0x68], rcx
jmp 0x1800dd539
cmp esi, 0xe4b4
je 0x1800dd93a
cmp esi, 0x17308
je 0x1800dd90f
cmp esi, 0x17ce8
jne 0x1800dd539
mov dword [rsp + 0x68], r8d
jmp 0x1800dd520
mov r8d, 3
lea rdx, [0x180113014]
lea rcx, [rbp + 0x2b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x6f
mov word [rbp + 0x2c0], ax
jmp 0x1800dd52f
mov dword [rsp + 0x68], 0xffffffff
mov edx, 0x9e
lea rcx, [rsp + 0x68]
call fcn.1800b09c0
mov edx, 0xcb
xor r8d, r8d
nop dword [rax]
mov eax, r8d
lea rcx, [rbp + 0x2d0]
nop word [rax + rax]
cmp edx, 0xcb
jne 0x1800dd97a
mov dword [rcx], eax
inc eax
add rcx, 4
cmp eax, 0x41
jb 0x1800dd970
inc edx
cmp edx, 0xcd
jb 0x1800dd960
jmp 0x1800dd532
mov r8, qword [rbp - 0x50]
mov qword [rbp - 0x58], r8
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x60], edx
mov qword [rbp - 0x68], rax
jmp 0x1800dd9bb
mov rbx, qword [rbp - 0x78]
mov edx, dword [rsp + 0x60]
mov r8, qword [rbp - 0x58]
mov r12d, dword [rsp + 0x50]
mov r15d, r12d
mov dword [rsp + 0x58], r12d
lea eax, [r12 + 0x13]
lea rcx, [0x180000000]
movzx r9d, byte [rsp + 0x54]
mov edi, dword [rsp + 0x60]
mov r10, qword [rbp - 0x60]
mov esi, dword [rsp + 0x60]
mov r11d, dword [rsp + 0x60]
mov byte [rsp + 0x40], r9b
mov qword [rsp + 0x70], r10
mov dword [rsp + 0x48], r11d
cmp r12d, eax
jae 0x1800de06f
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x40]
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x68], eax
mov ecx, dword [rsp + 0x50]
nop dword [rax]
nop word [rax + rax]
lea eax, [r15 - 0x2e]
cmp eax, 0xf1
ja case.default.0x1800dda4a
lea r9, [0x180000000]
movzx eax, byte [r9 + rax + 0xde77c]
mov ecx, dword [r9 + rax*4 + 0xde72c]
add rcx, r9
jmp rcx
mov eax, 0x1bb
mov word [rsp + 0x58], ax
mov r9d, 0x90
lea r8, [0x1801358b8]
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.18003da40
jmp 0x1800de03a
mov r9d, 0x34
xor r8d, r8d
xor edx, edx
lea rcx, [0x180135838]
call fcn.180024d20
test al, al
jne 0x1800ddd3a
xor r8d, r8d
mov r15d, r8d
jmp 0x1800ddaa3
xor r8d, r8d
cmp r15d, 0x10
ja case.default.0x1800ddac1
mov eax, r15d
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xde870]
add rcx, rdx
jmp rcx
mov eax, 0x71
mov word [rbp + 0x2a0], ax
mov eax, 0x75
mov word [rbp + 0x2a1], ax
jmp case.default.0x1800ddac1
mov dword [rbp + 0x2a2], 0x2e6369
jmp case.default.0x1800ddac1
cmp r12, 0xffffffffffffffff
jne case.default.0x1800ddac1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x78], 0
jmp case.default.0x1800ddac1
mov qword [rbp - 0x30], r8
lea r13, [rbp + 0x2a0]
jmp case.default.0x1800ddac1
mov r12, 0xffffffffffffffff
lea rax, str..pipe1numAccountsChanged__
mov qword [rbp - 0x60], rax
jmp case.default.0x1800ddac1
lea r9, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
test eax, eax
je case.default.0x1800ddac1
mov byte [rsp + 0x54], 0
jmp case.default.0x1800ddac1
mov dword [rbp + 0x2ab], 0x6f6e2e
jmp case.default.0x1800ddac1
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], 0x200
mov dword [rsp + 0x20], 0x200
mov edx, 3
mov r9d, 0xff
lea r8d, [rdx + 3]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov r12, rax
cmp byte [rsp + 0x54], 0
je case.default.0x1800ddac1
mov ebx, 0xad
nop word [rax + rax]
cmp ebx, 0xad
je 0x1800ddbff
cmp ebx, 0x4394
je 0x1800ddbf0
cmp ebx, 0x867b
je 0x1800ddbe0
cmp ebx, 0xc962
jne 0x1800ddc07
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1800ddc07
call sub.RPCRT4.dll_MesHandleFree
jmp 0x1800ddc07
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800ddc07
call sub.RPCRT4.dll_MesHandleFree
jmp 0x1800ddc07
lea r8, [rbp - 0x28]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
jmp 0x1800ddc07
mov qword [rbp - 0x28], 0
add ebx, 0x42e7
cmp ebx, 0x10b9c
jbe 0x1800ddbb0
jmp case.default.0x1800ddac1
mov dword [rbp + 0x2ae], 0x75735f
mov eax, 0x7070
mov word [rbp + 0x2b1], ax
jmp case.default.0x1800ddac1
mov eax, 0x79
mov word [rbp + 0x2a7], ax
mov eax, 0x70
mov word [rbp + 0x2a8], ax
jmp case.default.0x1800ddac1
mov eax, 0x63
mov word [rbp + 0x2a5], ax
mov eax, 0x72
mov word [rbp + 0x2a6], ax
jmp case.default.0x1800ddac1
cmp byte [rsp + 0x78], 0
je 0x1800ddcd3
mov ebx, 0x10
xor r14d, r14d
nop
cmp ebx, 0x10
je 0x1800ddc95
cmp ebx, 0x24
jne 0x1800ddccb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800ddccb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
mov qword [rsp + 0x30], r14
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x200
lea r9, [rbp + 0x2d0]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
add ebx, 0x14
cmp ebx, 0x38
jb 0x1800ddc80
mov r14d, 1
jmp case.default.0x1800ddac1
mov eax, 0x74
mov word [rbp + 0x2a9], ax
mov eax, 0x6f
mov word [rbp + 0x2aa], ax
jmp case.default.0x1800ddac1
mov byte [rsp + 0x78], 1
mov byte [rsp + 0x54], 1
jmp case.default.0x1800ddac1
mov eax, 0x74
mov word [rbp + 0x2b5], ax
jmp case.default.0x1800ddac1
mov eax, 0x726f
mov word [rbp + 0x2b3], ax
nop dword [rax + rax]
inc r15d
lea eax, [r15 + 0x86]
cmp eax, 0x97
jb 0x1800ddaa0
mov r15d, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x1800de03a
mov r8d, 1
lea rdx, [0x18010cbd0]
lea rcx, [rbp + 0x200]
call fcn.1800b2340
jmp 0x1800de03a
mov eax, 0x1bb
mov word [rsp + 0x58], ax
mov r9d, 0x5c
lea r8, [0x180135898]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x78]
call fcn.1800aede0
jmp 0x1800de03a
mov r9b, 1
mov byte [rsp + 0x40], r9b
mov ecx, dword [rsp + 0x50]
jmp 0x1800de049
xor r9d, r9d
mov edx, 0xa1
xor ecx, ecx
call fcn.1800587a0
jmp 0x1800de03a
mov eax, 0x1bb
mov word [rbp + 0x240], ax
jmp case.0x1800dda4a.47
cmp edi, 1
jge case.0x1800dda4a.47
mov ebx, 0x53
nop dword [rax]
mov eax, ebx
sub eax, 0x53
je 0x1800dddfc
sub eax, 1
je 0x1800dddf7
cmp eax, 1
je case.0x1800de100.260
jmp 0x1800dde15
xor r14d, r14d
jmp 0x1800dde15
mov r9, qword [rbp - 0x80]
mov r8d, 0x78
mov rdx, r10
xor ecx, ecx
call fcn.1800c9c10
mov r10, qword [rsp + 0x70]
inc ebx
cmp ebx, 0x56
jb 0x1800ddde0
jmp case.0x1800dda4a.47
lea rax, [rbp + 0x2b8]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800dde30
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x1e0]
call fcn.1800b2340
jmp 0x1800de03a
mov rax, qword [rbp - 0x80]
add dword [rax + 0x1c], edx
jmp case.0x1800dda4a.47
mov r9, qword [rbp - 0x80]
xor r8d, r8d
mov edx, 0xcb
xor ecx, ecx
call fcn.1800c77c0
mov r10, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne case.0x1800dda4a.47
mov ebx, 0x8e
cmp ebx, 0x8e
je 0x1800dde9d
cmp ebx, 0x238
je 0x1800dd5e1
jmp 0x1800ddeaf
xor r9d, r9d
lea r8d, [r9 + 0x44]
mov rdx, qword [rbp - 0x80]
xor ecx, ecx
call fcn.18009fdb0
add ebx, 0x1aa
cmp ebx, 0x354
jbe 0x1800dde87
jmp 0x1800de03a
mov rdx, qword [rbp - 0x68]
test esi, esi
js 0x1800dded3
cmp esi, dword [rdx + 0x2c]
jle case.0x1800dda4a.47
mov esi, dword [rdx + 0x2c]
dec esi
jmp case.0x1800dda4a.47
lea rcx, [rbp + 0x2b8]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800ddee7
mov eax, dword [0x180113068]
mov dword [rcx], eax
jmp case.0x1800dda4a.47
xor eax, eax
mov dword [rsp + 0x68], eax
xor r8d, r8d
mov rdx, qword [rbx + 8]
lea ecx, [rax + 1]
call fcn.1800b9f00
mov rsi, rax
jmp 0x1800de03a
mov r11d, 0x32595559
mov dword [rsp + 0x48], r11d
mov ecx, dword [rsp + 0x50]
movzx r9d, byte [rsp + 0x40]
jmp 0x1800de04e
mov ecx, dword [rsp + 0x50]
movzx r9d, byte [rsp + 0x40]
mov r11d, dword [rsp + 0x48]
test esi, esi
jns 0x1800de04e
mov rax, qword [rbp - 0x68]
add esi, dword [rax + 0x2c]
jmp 0x1800de04e
mov rdx, qword [rbp - 0x68]
mov edi, dword [rdx + 0x2c]
sub edi, esi
mov rcx, qword [rbp - 0x40]
cmp dword [rcx], 2
jle case.0x1800dda4a.47
mov ebx, 0xe9
mov eax, ebx
sub eax, 0xe8
je 0x1800ddfb0
cmp eax, 1
jne 0x1800ddffe
xor r8d, r8d
mov rax, qword [rbp - 0x78]
mov rdx, qword [rax + 0x10]
lea ecx, [r8 + 1]
call fcn.1800b9f00
mov rdi, rax
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
test eax, eax
jns 0x1800ddffe
mov eax, dword [rdx + 0x2c]
sub eax, esi
add edi, eax
jmp 0x1800ddffe
test edi, edi
js 0x1800ddfbc
lea eax, [rsi + rdi]
cmp eax, dword [rdx + 0x2c]
jl 0x1800ddfc1
mov edi, dword [rdx + 0x2c]
sub edi, esi
cmp dword [rcx], 3
jle 0x1800ddffe
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x54]
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 0x18]
call fcn.18006ea70
test eax, eax
je 0x1800ddff6
mov edx, 0x6e
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax + 0x18]
call fcn.1800d2700
mov dword [rsp + 0x68], eax
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
dec ebx
cmp ebx, 0xe7
ja 0x1800ddf72
jmp 0x1800de03a
xor r9d, r9d
lea r8, [rbp + 0x220]
xor edx, edx
lea ecx, [rdx + 0x58]
call fcn.1800d6d50
lea r8, [rbp + 0x1e0]
mov edx, GetAcceptLanguagesA
lea rcx, [rbp + 0x250]
call fcn.180024b60
mov r10, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x50]
movzx r9d, byte [rsp + 0x40]
mov r11d, dword [rsp + 0x48]
inc r15d
mov dword [rsp + 0x58], r15d
lea eax, [rcx + 0x13]
cmp r15d, eax
jae 0x1800de079
mov rbx, qword [rbp - 0x78]
mov edx, dword [rsp + 0x60]
mov r8, qword [rbp - 0x58]
jmp 0x1800dda20
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x68], edx
jmp 0x1800de089
mov edx, dword [rsp + 0x68]
mov r12d, dword [rsp + 0x50]
lea rcx, [0x180000000]
lea ebx, [r12 + 0x1b5]
mov dword [rsp + 0x58], ebx
cmp r12d, ebx
jae case.0x1800de100.260
mov r8d, 0x46
mov ebx, dword [rbp - 0x70]
mov r13, qword [rbp + 0x40]
mov r12, qword [rbp + 0x40]
mov eax, dword [rsp + 0x58]
lea r15, [0x180010ba0]
cmp dword [rsp + 0x50], 0x20c
ja 0x1800de515
mov eax, dword [rsp + 0x50]
cmp eax, 0x20c
je case.0x1800de100.260
add eax, 0xffffff08
cmp eax, 0xfd
ja case.0x1800de100.266
movzx eax, byte [rcx + rax + 0xde900]
mov ecx, dword [rcx + rax*4 + 0xde8b4]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rax, [rbp - 0x20]
mov qword [rbp - 0x40], rax
mov eax, dword [0x1801358e0]
mov dword [rbp - 0x38], eax
mov eax, dword [0x1801358e4]
mov dword [rbp - 0x34], eax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x30], xmm0
jmp case.0x1800de100.266
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x30]
lea r8, [0x1800732d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x30], rax
jmp 0x1800de4fb
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x20]
xor edx, edx
mov ecx, 0x123
call fcn.18007e410
lea rax, [rbp + 0x78]
mov qword [rbp - 0x60], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x1800de192
lea rax, [rbp + 0x78]
mov qword [rdx], rax
add qword [rbp - 0x18], 8
jmp 0x1800de4fb
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.180006ff0
jmp 0x1800de4fb
mov r15d, 0xdb
mov eax, r15d
sub eax, 0xd9
je 0x1800de1f7
sub eax, 1
je 0x1800de1ed
cmp eax, 1
jne 0x1800de1f9
cmp edi, eax
jl 0x1800de20b
mov dword [rsp + 0x60], edx
mov r9d, 0xf9
mov r8, r12
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.1800ad0c0
mov rbx, rax
jmp 0x1800de1f9
test ebx, ebx
jne 0x1800de20b
mov r13, qword [r13 + 0x48]
jmp 0x1800de1f9
dec edi
dec r15d
cmp r15d, 0xd8
mov edx, dword [rsp + 0x68]
ja 0x1800de1b6
jmp case.0x1800de100.256
mov dword [rsp + 0x50], 0x15f
jmp 0x1800de4fb
lea rax, [rbp + 0x48]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp - 0x10]
je 0x1800de238
lea rcx, [rbp + 0x48]
mov qword [rax], rcx
add qword [rbp - 0x18], 8
jmp 0x1800de249
lea r8, [rbp - 0x60]
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.180006ff0
mov eax, dword [0x1801358e0]
mov dword [rsp + 0x60], eax
xor r9d, r9d
lea r8d, [r9 + 0x77]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.1800e8cf0
jmp 0x1800de4fb
lea r9, [0x180135830]
mov r8d, 0x35
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xb0]
call fcn.18005d220
mov r9d, 0x109
lea r8, [rbp + 0xb0]
xor edx, edx
xor ecx, ecx
call fcn.18003cb10
jmp 0x1800de4fb
mov rax, qword [rbp - 0x68]
mov r13, qword [rax + 0x10]
nop dword [rax]
mov ecx, 0x10f
mov eax, ecx
sub eax, 0x10f
je 0x1800de2d2
sub eax, 1
je 0x1800de2cc
cmp eax, 1
jne 0x1800de2d7
dec esi
jmp 0x1800de2d7
mov r13, qword [r13 + 0x48]
jmp 0x1800de2d7
cmp esi, 1
jl case.0x1800de100.252
inc ecx
cmp ecx, 0x112
jb 0x1800de2b5
jmp 0x1800de2b0
mov dword [rsp + 0x50], 0x131
jmp case.0x1800de100.266
lea rcx, [rbp + 0x40]
call qword [sym.imp.GDI32.dll_CreatePalette]
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x70], 0x40000
jmp 0x1800de4fb
mov qword [rbp - 0x60], r15
lea r9, [rbp - 0x60]
xor edx, edx
xor ecx, ecx
mov r8d, SHRegGetIntW
call fcn.1800d1a30
jmp 0x1800de4fb
xor r14d, r14d
jmp case.0x1800de100.266
mov rax, qword [rbp - 0x30]
test rax, rax
jne 0x1800de48c
mov r15d, 0xda
cmp r15d, 0x1de
ja 0x1800de45c
je case.0x1800de37f.221
lea eax, [r15 - 0xda]
cmp eax, 0xea
ja case.0x1800de37f.221
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0xdea28]
mov ecx, dword [rdx + rax*4 + 0xdea00]
add rcx, rdx
jmp rcx
mov r8d, 1
lea rdx, [0x18011306c]
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rsp + 0x54], 1
mov r8d, 0x46
jmp case.0x1800de37f.221
mov dword [rbp - 0x78], 0
jmp case.0x1800de37f.221
mov r8d, 4
lea rdx, [0x180113070]
lea rcx, [rbp + 0x290]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0x293], 0x2d4445
mov r8d, 0x46
jmp case.0x1800de37f.221
mov word [rbp + 0x296], r8w
movzx eax, word [0x180113074]
mov word [rbp + 0x297], ax
movzx eax, byte [0x180113076]
mov byte [rbp + 0x299], al
jmp case.0x1800de37f.221
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x50]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov r8d, 0x46
test eax, eax
je case.0x1800de37f.221
mov byte [rsp + 0x54], 0
jmp case.0x1800de37f.221
cmp byte [rsp + 0x54], 0
je case.0x1800de37f.221
mov rcx, qword [rbp - 0x28]
call sub.RPCRT4.dll_MesHandleFree
mov r8d, 0x46
jmp case.0x1800de37f.221
lea rax, [rbp + 0x290]
mov qword [rbp - 0x50], rax
jmp case.0x1800de37f.221
mov qword [rbp - 0x28], 0
jmp case.0x1800de37f.221
mov eax, r15d
sub eax, 0x1f8
je 0x1800de471
cmp eax, 0x1a
je case.0x1800de100.260
jmp case.0x1800de37f.221
mov r14d, 1
add r15d, 0x1a
cmp r15d, 0x22c
jb 0x1800de341
mov rax, qword [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800de4fb
mov r12, qword [r10 + 8]
jmp case.0x1800de100.266
xor ecx, ecx
movzx eax, r9b
cmp qword [rbp - 0x58], rcx
cmovne ecx, eax
movzx r9d, cl
mov byte [rsp + 0x40], cl
jmp case.0x1800de100.266
mov r8d, dword [rbp - 0x70]
xor edx, edx
mov ecx, r11d
call qword [sym.imp.WINMM.dll_mmioInstallIOProcW]
movzx r9d, byte [rsp + 0x40]
test r9b, r9b
je 0x1800de501
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1800de4fb
mov qword [rbp + 0x40], 0
jmp case.0x1800de100.266
mov r9, qword [rbp - 0x80]
mov r8d, 0x78
mov rdx, r10
xor ecx, ecx
call fcn.1800c9c10
xor r14d, r14d
movzx r9d, byte [rsp + 0x40]
mov r10, qword [rsp + 0x70]
mov r8d, 0x46
mov r11d, dword [rsp + 0x48]
mov eax, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
add edx, 0x17
mov dword [rsp + 0x50], edx
cmp edx, eax
jae case.0x1800de100.260
mov edx, dword [rsp + 0x68]
lea rcx, [0x180000000]
jmp 0x1800de0b3
xor esi, esi
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x1800de572
mov r8, qword [rbp + 0x108]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0xf8]
call fcn.1800bb5e0
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
lea rcx, [rbp + 0xb8]
call fcn.180008e90
nop
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x1800de610
mov rdi, qword [rbp]
cmp rbx, rdi
je 0x1800de5aa
mov rcx, rbx
call fcn.1800087a0
add rbx, 0x28
cmp rbx, rdi
jne 0x1800de595
mov rbx, qword [rbp - 8]
mov rcx, qword [rbp + 8]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800de5fc
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800de5fc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1801060fc
mov qword [rbp - 8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x1800de639
mov r8, qword [rbp - 0x10]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x20]
call fcn.1800bb590
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov rdx, qword [rbp + 0x6a]
cmp rdx, 0x10
jb 0x1800de677
inc rdx
mov rcx, qword [rbp + 0x52]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800de672
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800de672
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801060fc
movdqa xmm0, xmmword [0x18011dd00]
movdqu xmmword [rbp + 0x62], xmm0
mov byte [rbp + 0x52], 0
mov rdx, qword [rbp + 0x9a]
cmp rdx, 0x10
jb 0x1800de6cc
inc rdx
mov rcx, qword [rbp + 0x82]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800de6c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800de6c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801060fc
movdqa xmm0, xmmword [0x18011dd00]
movdqu xmmword [rbp + 0x92], xmm0
mov byte [rbp + 0x82], 0
lea rcx, [rbp + 0x250]
call fcn.180008b00
nop
lea rcx, [rbp + 0x1e0]
call fcn.180008bb0
mov eax, r14d
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.180106610
mov rbx, qword [rsp + 0x628]
add rsp, 0x5e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret