Function at 0x18000d320
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x1800ca088]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov qword [rsp + 0x40], rdx
lea eax, [rcx + 0x3f]
xor edx, edx
mov dword [rsp + 0x28], ecx
lea r15, [0x180000000]
mov r14d, ecx
lea r9d, [rdx + 0x64]
cmp ecx, eax
jae 0x18000d643
mov r14, qword [rsp + 0x40]
lea edi, [rcx - 0x39]
lea esi, [rdx + 0x15]
movabs rbx, 0x320033006c
lea r12d, [rdx + 0x4e]
mov r13d, 0x6570
nop dword [rax + rax]
cmp edi, 0x72
ja case.0x18000d3bd.21
movzx eax, byte [r15 + rdi + 0xdc80]
mov ecx, dword [r15 + rax*4 + 0xdc28]
add rcx, r15
jmp rcx
movzx eax, word [0x1800b092a]
mov word [rbp + 0x17], ax
movzx eax, byte [0x1800b092c]
mov byte [rbp + 0x19], al
mov byte [rbp + 0x1a], 0
jmp case.0x18000d3bd.21
movzx eax, word [0x1800b093c]
mov word [rbp + 0x22], ax
movzx eax, byte [0x1800b093e]
mov byte [rbp + 0x24], al
jmp case.0x18000d3bd.21
mov eax, dword [str.ad32]
mov dword [rbp + 0x24], eax
movzx eax, byte [0x1800b0944]
mov byte [rbp + 0x28], al
jmp case.0x18000d3bd.21
mov dword [rbp + 0x13], 0x7268546e
jmp case.0x18000d3bd.21
cmp qword [r14 + 0x20], 0x10
lea rax, [r14 + 8]
mov qword [rax + 0x10], rdx
jb 0x18000d42d
mov rax, qword [rax]
mov byte [rax], 0
jmp case.0x18000d3bd.21
lea rdx, [0x1800b0948]
lea rcx, [rbp + 0x29]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edx, edx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
lea rdx, [0x1800b094c]
mov byte [rbp + 0x20], 0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
mov r8d, 1
mov byte [rbp + 0x10], 0
lea rdx, [0x1800b0957]
lea rcx, [rbp + 0x10]
call fcn.180089030
xor edx, edx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
mov word [rbp + 0x28], r12w
jmp case.0x18000d3bd.21
mov qword [rbp - 0x80], rdx
lea rcx, [r14 + 0x28]
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x18], rdx
lea rdx, [rsp + 0x70]
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
mov qword [rbp - 8], 0xffffffffffffffff
call fcn.1800740c0
lea rcx, [r14 + 0x48]
lea rdx, [rbp - 0x70]
call fcn.1800740c0
mov rax, qword [rbp - 0x50]
lea rcx, [r14 + 0x70]
lea rdx, [rbp - 0x48]
mov qword [r14 + 0x68], rax
call fcn.1800740c0
lea rcx, [r14 + 0x90]
lea rdx, [rbp - 0x28]
call fcn.1800740c0
mov rax, qword [rbp - 8]
lea rcx, [rsp + 0x70]
mov qword [r14 + 0xb0], rax
call fcn.18000dd50
xor edx, edx
movabs rbx, 0x320033006c
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
mov word [rbp + 0x90], dx
lea rcx, [rbp + 0x90]
lea rdx, [0x1800b096c]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
mov word [rbp + 0x11], r13w
jmp case.0x18000d3bd.21
mov byte [rbp + 0x17], 0
jmp case.0x18000d3bd.21
mov rcx, qword [r14 + 0xb8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
lea rax, [rbp + 0x90]
mov dword [rbp + 0xa2], r9d
sub rax, 2
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x18000d5c0
mov ecx, dword [0x1800b0974]
mov dword [rax], ecx
jmp case.0x18000d3bd.21
mov dword [rbp + 0xa6], 0x6c
jmp case.0x18000d3bd.21
mov rcx, qword [r14 + 0xb8]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
mov word [rbp + 0xb0], dx
jmp case.0x18000d3bd.21
mov dword [r14], edx
jmp case.0x18000d3bd.21
lea rdx, [0x1800b0978]
lea rcx, [rbp + 0x92]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
mov qword [rbp + 0x9a], rbx
lea r9d, [rdx + 0x64]
jmp case.0x18000d3bd.21
mov dword [rbp + 0xa0], 0x2e
add edi, 3
sub rsi, 1
jne 0x18000d3a0
mov r14d, dword [rsp + 0x28]
lea eax, [r14 - 0x14]
mov r8d, 0x72
cmp r14d, eax
jbe 0x18000d82b
lea ebx, [r14 - 0x26]
movabs rsi, 0x6e00720065006b
lea edi, [r8 - 0x5e]
lea r12d, [r8 - 0x2f]
nop dword [rax]
cmp ebx, 0x13
ja case.default.0x18000d684
mov ecx, dword [r15 + rbx*4 + 0xdcf4]
add rcx, r15
jmp rcx
mov word [rbp + 0x88], dx
jmp case.default.0x18000d684
mov dword [rbp + 6], 0x69463233
jmp case.default.0x18000d684
mov r8d, 3
lea rdx, [0x1800b09ce]
lea rcx, [rbp + 3]
call fcn.180088b50
mov r8d, 0x72
jmp case.default.0x18000d684
mov byte [rbp + 0xd], 0
mov qword [rbp + 0x70], rsi
jmp case.default.0x18000d684
mov dword [rbp + 0x84], 0x6c006c
jmp case.default.0x18000d684
mov eax, dword [0x1800b09e4]
mov dword [rbp + 0xc2], r9d
mov dword [rbp + 0xc4], eax
movzx eax, word [0x1800b09e8]
mov word [rbp + 0xc8], ax
jmp case.default.0x18000d684
mov eax, dword [0x1800b0aee]
mov dword [rbp + 0x78], eax
movzx eax, word [0x1800b0af2]
mov word [rbp + 0x7c], ax
jmp case.default.0x18000d684
lea rdx, str.kernel32.
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, 0x72
jmp case.default.0x18000d684
lea rdx, [0x1800b0b0c]
lea rcx, [rbp + 0x32]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, 0x72
jmp case.default.0x18000d684
mov r8d, 1
lea rdx, [0x1800b0b11]
lea rcx, [rbp + 0xa]
call fcn.180088b50
mov r8d, 0x72
jmp case.default.0x18000d684
mov byte [rbp + 0xb], 0
jmp case.default.0x18000d684
movzx eax, word [0x1800b0b32]
mov word [rbp], ax
movzx eax, byte [0x1800b0b34]
mov byte [rbp + 2], al
mov byte [rbp + 3], 0
jmp case.default.0x18000d684
mov word [rbp + 0x7e], dx
jmp case.default.0x18000d684
mov byte [rbp + 0xa], 0
jmp case.default.0x18000d684
mov word [rbp + 0x30], r12w
jmp case.default.0x18000d684
mov eax, dword [0x1800b0b44]
mov dword [rbp + 0x7e], eax
movzx eax, word [0x1800b0b48]
mov word [rbp + 0x82], ax
mov word [rbp + 0x84], dx
jmp case.default.0x18000d684
mov r8d, 1
lea rdx, [0x1800b0b81]
lea rcx, [rbp + 0xc]
call fcn.180088b50
mov r8d, 0x72
jmp case.default.0x18000d684
mov r8d, 2
lea rdx, [0x1800b0bd0]
lea rcx, [rbp + 0x33]
call fcn.180088b50
mov r8d, 0x72
jmp case.default.0x18000d684
mov word [rbp + 0x31], r8w
jmp case.default.0x18000d684
mov word [rbp + 0xb], 0x73
mov edx, 0
dec ebx
lea r9d, [rdx + 0x64]
sub rdi, 1
jne 0x18000d670
lea ebx, [r14 + 0x398]
mov dword [rsp + 0x20], ebx
cmp r14d, ebx
movzx ebx, byte [rsp + 0x24]
jae 0x18000dbf2
movzx r15d, byte [rsp + 0x24]
mov edi, 0x6f
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x20]
lea ecx, [rdi - 0x1b]
lea edx, [rdi - 0x3c]
lea r11d, [rdi - 7]
lea r9d, [rdi + 5]
lea r10d, [rdi - 0xa]
lea r8d, [rdi - 1]
nop dword [rax + rax]
cmp r14d, 0x205
ja 0x18000d9da
je 0x18000d9ca
cmp r14d, 0x11f
ja 0x18000d96e
je 0x18000d954
mov eax, r14d
sub eax, 0x39
je 0x18000d945
sub eax, 0x2e
je 0x18000d93c
sub eax, 0x2e
je 0x18000d91e
sub eax, 0x2e
je 0x18000d8ed
cmp eax, 0x2e
jne 0x18000dbdc
movzx eax, word [0x1800b0bdc]
mov word [rbp + 0x45], r11w
mov word [rbp + 0x46], ax
movzx eax, byte [0x1800b0bde]
mov byte [rbp + 0x48], al
jmp 0x18000dbdc
mov r8d, 7
lea rdx, str.help32
lea rcx, [rbp + 0x3a]
call fcn.180088b50
mov r8d, 6
lea rdx, str.Snaps
lea rcx, [rbp + 0x40]
call fcn.180088b50
jmp 0x18000dbc1
movzx eax, word [0x1800b0bd8]
mov word [rbp + 0x37], di
mov word [rbp + 0x38], ax
movzx eax, byte [0x1800b0bda]
mov byte [rbp + 0x3a], al
jmp 0x18000dbdc
mov word [rbp + 0x36], cx
jmp 0x18000dbdc
mov word [rbp + 0x34], r9w
mov word [rbp + 0x35], r10w
jmp 0x18000dbdc
mov edi, 0x72
mov dword [rbp + 0x50], 0x65006b
mov word [rbp + 0x54], di
mov edi, 0x6f
jmp 0x18000dbe0
mov eax, r14d
sub eax, 0x14d
je 0x18000d9b9
sub eax, 0x2e
je 0x18000d9a9
sub eax, 0x2e
je 0x18000d99b
cmp eax, 0x2e
mov eax, dword [rsp + 0x20]
jne 0x18000dbe0
mov dword [rbp + 0x64], 0x6c006c
jmp 0x18000dbe0
mov eax, 0x64
mov word [rbp + 0x62], ax
jmp 0x18000dbdc
mov word [rbp + 0x5c], dx
mov dword [rbp + 0x5e], 0x2e0032
jmp 0x18000dbdc
mov word [rbp + 0x56], r8w
mov dword [rbp + 0x58], 0x6c0065
jmp 0x18000dbdc
xor ecx, ecx
mov word [rbp + 0x68], cx
mov ecx, 0x54
jmp 0x18000dbe0
cmp r14d, 0x2eb
ja 0x18000dae4
je 0x18000daba
mov eax, r14d
sub eax, 0x233
je 0x18000da83
sub eax, 0x2e
je 0x18000da67
sub eax, 0x2e
je 0x18000da46
cmp eax, 0x2e
jne 0x18000dbdc
cmp rsi, 0xffffffffffffffff
jne 0x18000dbdc
mov ecx, 0x95
nop dword [rax]
mov eax, ecx
sub eax, 0x95
je 0x18000da34
cmp eax, 0x2c
je 0x18000dbf2
jmp 0x18000da36
xor bl, bl
add ecx, 0x2c
cmp ecx, 0xed
jb 0x18000da20
jmp 0x18000dbd7
lea r8, [rbp + 0x30]
mov ecx, 0x45
lea rdx, [rbp + 0x50]
call fcn.18003ae90
xor edx, edx
lea ecx, [rdx + 4]
call rax
mov rsi, rax
jmp 0x18000dbc1
lea r8, [rbp]
mov ecx, 0x45
lea rdx, [rbp + 0x70]
call fcn.18003ae90
mov qword [rsp + 0x48], rax
jmp 0x18000dbc1
lea r8, [rbp + 0x20]
mov ecx, 0x45
lea rdx, [rbp + 0x90]
call fcn.18003ae90
lea r8, [rbp + 0x10]
mov ecx, 0x45
lea rdx, [rbp + 0xb0]
mov r13, rax
call fcn.18003ae90
mov qword [rsp + 0x38], rax
jmp 0x18000dbc1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x1c
mov rcx, rsi
call qword [rsp + 0x48]
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov dword [rsp + 0x2c], eax
jmp 0x18000dbc1
mov eax, r14d
sub eax, 0x319
je 0x18000db86
sub eax, 0x2e
je 0x18000db1c
sub eax, 0x2e
je 0x18000db0a
cmp eax, 0x2e
je 0x18000dbf2
jmp 0x18000dbdc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ebx, r15b
jmp 0x18000dbc1
mov r12, qword [rsp + 0x38]
mov r15b, 1
mov r14, qword [rsp + 0x40]
nop dword [rax]
mov eax, dword [r14]
cmp dword [rsp + 0x5c], eax
jne 0x18000db6b
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1fffff
call r12
mov rdi, rax
test rax, rax
je 0x18000db6b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
mov rcx, rdi
setne al
and r15b, al
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call r13
test eax, eax
jne 0x18000db30
mov r14d, dword [rsp + 0x28]
mov r12d, dword [rsp + 0x2c]
jmp 0x18000dbbc
cmp dword [rsp + 0x30], 0
jne 0x18000dbdc
mov edi, 0x8d
mov eax, edi
sub eax, 0x8d
je 0x18000dba2
cmp eax, 1
je 0x18000dbf2
jmp 0x18000dbb2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 0x12
sete bl
inc edi
cmp edi, 0x8f
jb 0x18000db92
mov edi, 0x6f
mov r11d, 0x68
lea r10d, [r11 - 3]
lea r9d, [r11 + 0xc]
lea r8d, [r11 + 6]
lea edx, [r11 - 0x35]
mov ecx, 0x54
mov eax, dword [rsp + 0x20]
add r14d, 0x2e
mov dword [rsp + 0x28], r14d
cmp r14d, eax
jb 0x18000d880
movzx eax, bl
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1800803f0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret