Function at 0x18000f700
Capabilities:
Create mailslot
Encode data using base64
Get disk information
Get hostname

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4a8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
movaps xmmword [rax - 0xa8], xmm11
mov rax, qword [0x180079880]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov r14, r9
mov qword [rbp - 0x48], r9
mov r12, r8
mov qword [rbp - 0x68], r8
mov r15, rdx
mov qword [rbp - 0x70], rdx
mov rdx, rcx
mov qword [rbp - 0x80], rcx
mov r10, qword [rbp + 0x428]
mov qword [rsp + 0x78], r10
mov rax, qword [rbp + 0x410]
mov qword [rbp - 0x50], rax
mov r13, qword [rbp + 0x418]
mov qword [rbp - 0x58], r13
mov rcx, qword [rbp + 0x430]
mov qword [rbp - 0x78], rcx
mov edi, dword [rbp + 0x420]
mov eax, edi
mov dword [rsp + 0x70], eax
lea r8d, [rdi + 0x393]
mov dword [rsp + 0x60], r8d
cmp edi, r8d
jae 0x18000ff66
movsd xmm6, qword [0x180072b48]
movsd xmm7, qword [0x180072b98]
movsd xmm11, qword [0x180072af8]
movsd xmm10, qword [0x180072c10]
movss xmm8, dword [rbp - 0x58]
movss xmm9, dword [rbp - 0x58]
movzx esi, word [rsp + 0x58]
mov r11d, 0x1f4
mov r9d, 0x5c
lea edi, [r9 + 0xd]
lea ebx, [rdi - 0x46]
cmp eax, 0x19e
ja 0x18000fb1c
je 0x18000fab1
add eax, 0xffffff7a
cmp eax, 0xf4
ja case.0x18000f83f.135
lea r10, [0x180000000]
movzx eax, byte [r10 + rax + 0x10a24]
mov ecx, dword [r10 + rax*4 + 0x109f4]
add rcx, r10
jmp rcx
mov eax, 0x20
mov word [rbp + 0x7b], ax
mov eax, 0x46
mov word [rbp + 0x7c], ax
movzx eax, word [0x18007046c]
mov word [rbp + 0x7d], ax
movzx eax, byte [0x18007046e]
mov byte [rbp + 0x7f], al
jmp case.0x18000f83f.135
movss xmm8, dword [0x180072c0c]
movss xmm9, dword [0x180072b1c]
jmp case.0x18000f83f.135
mov byte [rsp + 0x40], 1
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0xed
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180027790
mov r8d, dword [rsp + 0x60]
jmp 0x18000ff3e
mov byte [rsp + 0x40], 0
movzx eax, byte [0x180079011]
mov byte [rsp + 0x50], al
movzx eax, byte [0x180079010]
mov byte [rsp + 0x48], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
mov edx, 0xce
xor ecx, ecx
call fcn.180026890
mov byte [rsp + 0x48], 0
movzx eax, byte [0x180079013]
mov byte [rsp + 0x40], al
movzx eax, byte [0x180079012]
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, 0xce
xor ecx, ecx
call fcn.180026890
mov byte [rsp + 0x48], 0x38
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0xed
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180027790
mov byte [rsp + 0x48], 8
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x48]
jmp 0x18000f89a
mov word [rbp + 0x78], bx
mov word [rbp + 0x79], di
mov eax, 0x66
mov word [rbp + 0x7a], ax
jmp case.0x18000f83f.135
lea rax, [rbp + 0x78]
dec rax
nop
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x18000f990
movsd xmm0, qword [str.ED_WEIG]
movsd qword [rax], xmm0
mov r8d, 2
lea rdx, [0x180070478]
lea rcx, [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x18007047c]
mov dword [rbp + 0x90], eax
movzx eax, word [0x180070480]
mov word [rbp + 0x94], ax
mov r8d, dword [rsp + 0x60]
jmp 0x18000ff3e
xor eax, eax
mov word [rbp + 0xc4], ax
jmp case.0x18000f83f.135
xor eax, eax
mov dword [rsp + 0x64], eax
jmp case.0x18000f83f.135
mov byte [rsp + 0x58], 1
lea rbx, [0x180079010]
mov edi, 0xb
nop word [rax + rax]
mov byte [rsp + 0x40], 0
movzx eax, byte [rbx + 1]
mov byte [rsp + 0x48], al
movzx eax, byte [rbx]
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov edx, 0xe3
lea rcx, [rsp + 0x58]
call fcn.18002a3d0
lea rbx, [rbx + 2]
sub rdi, 1
jne 0x18000fa10
mov r8d, dword [rsp + 0x60]
jmp 0x18000ff3e
mov eax, dword [0x180070484]
mov dword [rbp + 0x94], eax
movsd xmm0, qword [str.r120]
movsd qword [rbp + 0x98], xmm0
movzx eax, word [0x180070498]
mov word [rbp + 0xa0], ax
mov dword [rbp + 0xc0], r9d
mov word [rbp + 0xc2], r9w
jmp case.0x18000f83f.135
movzx eax, word [rdx]
cmp ax, r11w
cmovg ax, r11w
add ax, 0xa
mov word [rdx], ax
jmp case.0x18000f83f.135
mov byte [rsp + 0x58], 6
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0xed
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180027790
mov byte [rsp + 0x58], 0x14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0xed
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180027790
mov byte [rsp + 0x58], 0xc
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x58]
jmp 0x18000f89a
sub eax, 0x1a8
je 0x18000fe19
sub eax, 0x3d
je 0x18000fb3e
cmp eax, 0x3d
jne case.0x18000f83f.135
mov eax, dword [rsp + 0x64]
jmp 0x180010907
movsx eax, si
cdq
idiv dword [r10 + 0x20]
mov ebx, eax
cmp dword [r10 + 0x38], 0
je 0x18000fd73
mov edi, 0xcf
nop dword [rax + rax]
mov eax, edi
sub eax, 0xcf
je 0x18000fd3a
sub eax, 1
je 0x18000fd30
sub eax, 1
je 0x18000fbee
cmp eax, 1
jne 0x18000fd5b
cmp dword [r10 + 0x3c], 0
jne 0x18000fd5b
lea edx, [rax + 0x7c]
mov rcx, qword [r10 + 0x70]
call fcn.180026650
cdq
and edx, 0x3f
add eax, edx
sar eax, 6
mov r10, qword [rsp + 0x78]
sub eax, dword [r10 + 0x18]
jne 0x18000fbbb
xor r9d, r9d
mov dword [r10 + 0x38], r9d
jmp 0x18000fd57
test eax, eax
jle 0x18000fd57
mov dword [rsp + 0x68], eax
mov r9d, 0x78
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [r10 + 0x70]
call fcn.1800249b0
mov r10, qword [rsp + 0x78]
xor r9d, r9d
mov dword [r10 + 0x38], r9d
jmp 0x18000fd57
cmp dword [r10 + 0x3c], 0
je 0x18000fd5b
mov r8d, 0xa
xor r15d, r15d
cmp r8d, 0xa
je 0x18000fcfc
cmp r8d, 0x794
je 0x18000fc7b
cmp r8d, 0xf1e
jne 0x18000fd16
movsx ecx, word [r10 + 0x2e]
movsx eax, bx
imul ecx, eax
cmp ecx, 0x32
jle 0x18000fd16
movsx eax, word [r10 + 0x30]
imul eax, dword [r10 + 0x20]
lea ecx, [rax + rax*2]
cmp ecx, 0x9b0
jge 0x18000fc69
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [r10 + 0x18], edx
mov dword [r10 + 0x3c], r15d
jmp 0x18000fd16
mov edx, 0x3e
mov dword [r10 + 0x18], edx
mov dword [r10 + 0x3c], r15d
jmp 0x18000fd16
movsx ecx, word [r10 + 0x30]
movsx eax, word [r10 + 0x2c]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
maxsd xmm0, xmm7
comisd xmm0, xmm1
jbe 0x18000fcbd
add dword [r10 + 0x28], ecx
movzx eax, word [r10 + 0x26]
inc ax
mov word [r10 + 0x26], ax
jmp 0x18000fcc5
mov word [r10 + 0x26], r15w
mov eax, r15d
movsx ecx, ax
movsx eax, bx
imul eax, ecx
cmp eax, 6
jl 0x18000fd16
mov eax, dword [r10 + 0x28]
imul eax, dword [r10 + 0x20]
lea eax, [rax + rax*2]
shl eax, 3
shl ecx, 8
cdq
idiv ecx
mov ecx, 0x3e
cmp eax, ecx
cmovl ecx, eax
mov dword [r10 + 0x18], ecx
mov dword [r10 + 0x3c], r15d
jmp 0x18000fd16
inc word [r10 + 0x2e]
cmp word [r10 + 0x26], r15w
jne 0x18000fd16
movzx eax, word [r10 + 0x30]
mov word [r10 + 0x2c], ax
mov dword [r10 + 0x28], r15d
add r8d, 0x78a
cmp r8d, 0x169e
jbe 0x18000fc02
mov r15, qword [rbp - 0x70]
jmp 0x18000fd57
cmp r12, rcx
je 0x18000fd5b
mov rdx, r12
jmp 0x18000fd45
cmp r13, r15
je 0x18000fd5b
mov rdx, r13
mov rcx, r15
movsx r8, word [r14]
shl r8, 2
call sub.VCRUNTIME140.dll_memcpy
mov r10, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x78]
inc edi
cmp edi, 0xd3
jb 0x18000fb60
mov r8d, dword [rsp + 0x60]
jmp 0x18000ff3e
xor edx, edx
lea r8d, [rdx + 0x67]
mov rcx, qword [r10 + 0x70]
call fcn.180026160
test eax, eax
je 0x18000fd99
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x44]
mov rcx, qword [rsp + 0x78]
call fcn.180010b70
xor r9d, r9d
movzx ebx, r9w
cmp r9w, si
jge 0x18000f8ae
mov rdi, qword [rbp - 0x78]
mov r14, qword [rsp + 0x78]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 + 0x1c]
mov dword [rsp + 0x68], eax
mov r10, qword [r14 + 0x70]
movzx eax, bx
lea rcx, [rax + rax*4]
shl rcx, 6
lea rax, [rdi + rcx]
lea r9, [r15 + rcx]
lea r8, [r12 + rcx]
lea rdx, [rcx + r13]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x49
lea rcx, [rsp + 0x68]
call fcn.180024be0
inc bx
cmp bx, si
jl 0x18000fdc0
mov r14, qword [rbp - 0x48]
mov r8d, dword [rsp + 0x60]
jmp 0x18000ff3e
movzx eax, word [rdx]
mov word [r10 + 0x30], ax
cmp word [r10 + 0x14], 1
jne 0x18000ff27
mov eax, dword [r10 + 0x50]
cmp eax, 0x19
jge 0x18000fe41
inc eax
mov dword [r10 + 0x50], eax
jmp 0x18000ff27
mov edi, 0x35
mov r12, qword [rbp - 0x50]
xor r13d, r13d
nop dword [rax]
mov eax, edi
sub eax, 0x35
je 0x18000fe89
cmp eax, 0x57
jne 0x18000ff07
movss xmm0, dword [r10 + 0x5c]
comiss xmm8, xmm0
jbe 0x18000fe77
movss dword [r10 + 0x5c], xmm8
jmp 0x18000ff07
comiss xmm0, xmm9
jbe 0x18000ff07
movss dword [r10 + 0x5c], xmm9
jmp 0x18000ff07
mov eax, dword [r12]
mov dword [rsp + 0x68], eax
lea rbx, [r10 + 0x5c]
mov r9, rbx
mov r8, qword [r10 + 0x48]
lea rdx, [rsp + 0x68]
mov ecx, 0x7d
call fcn.180024550
mov dword [rsp + 0x64], eax
mov r10, qword [rsp + 0x78]
cmp eax, 0xffffffff
jne 0x18000fec9
mov dword [rbx], r13d
mov dword [r10 + 0x68], 0x2f12
xorps xmm1, xmm1
jmp 0x18000fecf
movss xmm1, dword [r10 + 0x5c]
movsx eax, word [r14]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [r10 + 0x10]
divss xmm1, xmm0
movss dword [rbx], xmm1
cvtps2pd xmm0, xmm1
comisd xmm11, xmm0
jbe 0x18000feff
comisd xmm0, xmm10
jbe 0x18000feff
mov dword [r10 + 0x54], r13d
jmp 0x18000ff07
mov dword [r10 + 0x54], 1
add edi, 0x57
cmp edi, 0xe3
jb 0x18000fe50
mov r15, qword [rbp - 0x70]
mov r12, qword [rbp - 0x68]
mov r13, qword [rbp - 0x58]
mov r8d, dword [rsp + 0x60]
movsx ecx, word [r14]
mov eax, 0x66666667
imul ecx
mov esi, edx
sar esi, 5
mov eax, esi
shr eax, 0x1f
add esi, eax
mov rdx, qword [rbp - 0x80]
mov eax, dword [rsp + 0x70]
add eax, 0x3d
mov dword [rsp + 0x70], eax
cmp eax, r8d
jae 0x18000ff60
mov rcx, qword [rbp - 0x78]
mov r10, qword [rsp + 0x78]
jmp 0x18000f7f0
mov edi, dword [rbp + 0x420]
mov ebx, edi
mov dword [rbp - 0x5c], ebx
imul eax, edi, 0x372
mov dword [rbp - 0x58], eax
cmp edi, eax
ja 0x180010903
movabs rdx, 0x69004c0020
mov r14d, 0x32
movzx ecx, word [rsp + 0x58]
mov dword [rsp + 0x58], ecx
movzx esi, byte [rsp + 0x58]
mov dword [rsp + 0x70], esi
movzx r13d, byte [rsp + 0x58]
mov r12, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x48]
lea rax, str.libeay32
cmp ebx, 0xe75c
ja 0x180010223
je 0x180010205
cmp ebx, 0x6374
ja 0x180010135
je 0x1800100f7
cmp ebx, 0x86
je 0x1800100a8
cmp ebx, 0x2180
je 0x180010061
cmp ebx, 0x427a
jne 0x180010972
movsd xmm0, qword [str.nterp]
movsd qword [rbp + 0xec], xmm0
mov eax, dword [0x1800704c0]
mov dword [rbp + 0xf4], eax
mov dword [rbp + 0xf6], 0x72
lea rcx, [rbp + 0xc0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180010030
mov eax, dword [0x1800704c4]
mov dword [rcx], eax
mov eax, dword [0x1800704c8]
mov dword [rbp + 0xfa], eax
movzx eax, word [0x1800704cc]
mov word [rbp + 0xfe], ax
jmp 0x18001096e
mov r8d, 8
lea rdx, str.slotRe
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x1800705d0]
mov dword [rbp + 0xde], eax
movsd xmm0, qword [str.Hat_E]
movsd qword [rbp + 0xe2], xmm0
mov eax, dword [0x1800705e0]
mov dword [rbp + 0xea], eax
jmp 0x180010964
mov eax, dword [0x1800705e4]
mov dword [rbp + 0xc4], eax
mov eax, dword [0x1800705ec]
mov dword [rbp + 0xc8], eax
movzx eax, word [0x1800705f0]
mov word [rbp + 0xcc], ax
mov r8d, 1
lea rdx, [0x1800704c4]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rbp + 0xce], 0x6c
jmp 0x180010964
mov qword [rbp + 0xfe], rdx
mov dword [rbp + 0x104], 0x6e
lea rcx, [rbp + 0xc0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180010113
mov eax, dword [0x1800705f4]
mov dword [rcx], eax
movzx eax, word [0x1800705f8]
mov word [rcx + 4], ax
jmp 0x18001096e
cmp ebx, 0x846e
je 0x180010191
cmp ebx, 0xa568
je 0x180010168
cmp ebx, 0xc662
jne 0x180010972
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rbp + 0x50], xmm0
movsd xmm1, qword [rbp + 0x20]
movsd qword [rbp + 0x60], xmm1
jmp 0x180010972
mov r8d, 2
lea rdx, [0x180070532]
lea rcx, [rbp + 0xb2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0xb6], 0x32
jmp 0x180010964
lea rcx, [rbp + 0xc0]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800101a0
mov eax, dword [0x1800705fc]
mov dword [rcx], eax
movzx eax, word [0x180070600]
mov word [rcx + 4], ax
mov r8d, 2
lea rdx, [0x180070604]
lea rcx, [rbp + 0x10e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movsd xmm0, qword [0x1800706c2]
movsd qword [rbp + 0xa8], xmm0
movzx eax, word [0x1800706ca]
mov word [rbp + 0xb0], ax
xor r9d, r9d
mov word [rbp + 0xb2], r9w
jmp 0x180010964
mov byte [rsp + 0x40], 1
mov ecx, pe_nt_image_headers64
mov dword [rsp + 0x58], ecx
lea rax, [rbp + 0x90]
mov qword [rbp + 0x50], rax
jmp 0x180010972
cmp ebx, 0x16b44
ja 0x1800108f3
je 0x1800108dd
cmp ebx, 0x10856
je 0x1800108b4
cmp ebx, 0x12950
je 0x18001028f
cmp ebx, 0x14a4a
jne 0x180010972
movsx eax, cx
mov dword [rbp - 0x38], eax
cmp rdi, 0xffffffffffffffff
jne 0x18001026f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x40], 0
lea r9, [rbp - 0x28]
mov r8d, 0x104
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameA]
jmp 0x180010964
xor r9d, r9d
xor edx, edx
mov r8d, 0xffffffff
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov qword [rbp - 0x48], rax
xor r15d, r15d
mov dword [rbp - 0x60], r15d
lea r14, [rbp + 0x50]
mov qword [rbp - 0x70], r14
jmp 0x1800102c3
xor r15d, r15d
mov qword [rbp], r15
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r15w
mov edi, 0xb1
mov dword [rsp + 0x60], edi
mov ebx, r15d
mov dword [rsp + 0x64], ebx
jmp 0x1800102f3
xor r15d, r15d
cmp ebx, 5
ja case.default.0x180010310
mov eax, ebx
lea r8, [0x180000000]
mov edx, dword [r8 + rax*4 + 0x10b1c]
add rdx, r8
jmp rdx
test sil, sil
je case.default.0x180010310
xor edx, edx
mov r8d, 0x80
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov qword [rbp - 0x68], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp case.default.0x180010310
mov rdx, qword [r14]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180010350
lea rcx, [rbp - 0x10]
call fcn.18003dda0
mov rsi, qword [rbp]
mov r14, qword [rbp + 8]
cmp rsi, r14
jae 0x180010392
lea rax, [rsi + 1]
mov qword [rbp], rax
lea rax, [rbp - 0x10]
cmp r14, 8
cmovae rax, qword [rbp - 0x10]
mov dword [rax + rsi*2], 0x2e
jmp 0x18001046f
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x1800109ee
lea r15, [rsi + 1]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x1800103c1
mov rbx, rdx
jmp 0x1800103e2
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x1800103d7
mov rbx, rdx
jmp 0x1800103e2
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x10]
call fcn.18003dca0
mov rdi, rax
mov qword [rbp], r15
mov qword [rbp + 8], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x180010453
mov rbx, qword [rbp - 0x10]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x180010449
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800109e0
mov rbx, rcx
mov rcx, rbx
call fcn.1800504dc
jmp 0x180010463
lea rdx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
mov qword [rbp - 0x10], rdi
mov edi, dword [rsp + 0x60]
mov ebx, dword [rsp + 0x64]
mov r8d, 3
lea rdx, [0x1800703f8]
lea rcx, [rbp - 0x10]
call fcn.18003dda0
mov esi, dword [rsp + 0x70]
mov r14, qword [rbp - 0x70]
jmp case.default.0x180010310
cmp qword [rbp - 0x18], 0
jne case.default.0x180010310
mov ebx, 0xb
cmp ebx, 0xb
ja case.default.0x1800104b8
mov eax, ebx
mov ecx, dword [r8 + rax*4 + 0x10b34]
add rcx, r8
jmp rcx
mov byte [rbp + 0x6f], 0x45
jmp case.default.0x1800104b8
mov r13b, 1
mov byte [rsp + 0x50], r13b
mov dword [rbp - 0x3c], 0x182aa
mov dword [rbp - 0x40], r15d
jmp case.default.0x1800104b8
mov word [rbp + 0x24], r15w
mov dword [rbp + 0x68], 0x4954414c
jmp case.default.0x1800104b8
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], pe_nt_image_headers64
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x20], r15
cmp rax, 0
jne 0x180010522
mov byte [rsp + 0x50], al
lea r8, [0x180000000]
jmp case.default.0x1800104b8
movsd xmm0, qword [str.LOCFHAsmNH]
movsd qword [rbp + 0x10], xmm0
movzx eax, word [0x180070578]
mov word [rbp + 0x18], ax
movabs rax, 0x4e006d00730041
mov qword [rbp + 0x1a], rax
mov word [rbp + 0x22], r15w
jmp case.default.0x1800104b8
mov eax, 0x4f
mov word [rbp + 0x22], ax
jmp case.default.0x1800104b8
mov byte [rbp + 0x71], 0
mov r8d, 1
lea rdx, [0x180070592]
lea rcx, [rbp + 0x71]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x72], 0
lea r8, [0x180000000]
jmp case.default.0x1800104b8
mov byte [rbp + 0x70], 0x45
jmp case.default.0x1800104b8
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], pe_nt_image_headers64
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r12, rax
cmp byte [rsp + 0x50], 0
je 0x1800105e7
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_SetupComm]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
jne 0x180010522
xor r13b, r13b
lea r8, [0x180000000]
jmp case.default.0x1800104b8
test r13b, r13b
je case.default.0x1800104b8
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
mov r8d, dword [rbp - 0x40]
mov edx, dword [rbp - 0x3c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_BackupSeek]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x180000000]
jmp case.default.0x1800104b8
movzx eax, word [0x18007059c]
mov word [rbp + 0x6c], ax
movzx eax, byte [0x18007059e]
mov byte [rbp + 0x6e], al
mov byte [rbp + 0x6f], 0
dec ebx
lea eax, [rbx + 0x118]
cmp eax, 0x117
ja 0x1800104a2
mov ebx, dword [rsp + 0x64]
mov edi, dword [rsp + 0x60]
jmp case.default.0x180010310
mov rax, qword [rsp + 0x78]
mov rdi, qword [rax + 0x10]
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x180010688
mov rbx, qword [rax]
cmp rdi, 8
jae 0x1800106a1
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x10], xmm0
mov r14d, 7
mov r15, qword [rbp + 0x10]
jmp 0x1800106e0
mov r14, rdi
or r14, 7
movabs rax, 0x7ffffffffffffffe
cmp r14, rax
cmova r14, rax
lea rdx, [r14 + 1]
lea rcx, [rbp + 0x10]
call fcn.18003dca0
mov r15, rax
mov qword [rbp + 0x10], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x20], rdi
lea rsi, [rbp + 0x10]
cmp r14, 8
cmovae rsi, r15
cmp rdi, 8
jae 0x180010707
movups xmm6, xmmword [rsi]
mov qword [rbp + 0x48], 7
jmp 0x18001074b
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.18003dca0
mov qword [rbp + 0x30], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x48], rbx
movups xmm6, xmmword [rbp + 0x30]
mov qword [rbp + 0x40], rdi
mov rax, qword [rbp + 8]
cmp rax, 8
jb 0x18001078f
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001078a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800109d9
call fcn.1800504dc
movups xmmword [rbp - 0x10], xmm6
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp], xmm0
cmp r14, 8
jb 0x1800107d6
lea rdx, [r14*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1800107ce
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800109e0
mov rcx, r15
call fcn.1800504dc
mov sil, 1
mov ebx, dword [rsp + 0x64]
mov edi, dword [rsp + 0x60]
mov r14, qword [rbp - 0x70]
jmp 0x18001082d
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp case.default.0x180010310
mov edx, 0x104
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x18], rax
movzx esi, sil
cmp qword [rbp - 0x68], 0
cmove esi, r15d
mov dword [rsp + 0x70], esi
inc edi
mov dword [rsp + 0x60], edi
inc ebx
mov dword [rsp + 0x64], ebx
cmp edi, 0xb7
jb 0x1800102f0
mov rax, qword [rbp + 8]
cmp rax, 8
jb 0x180010889
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180010884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800109e7
call fcn.1800504dc
mov eax, dword [rbp - 0x60]
inc eax
mov dword [rbp - 0x60], eax
add r14, 8
mov qword [rbp - 0x70], r14
cmp eax, 3
jb 0x1800102c0
mov ebx, dword [rbp - 0x5c]
mov rdi, qword [rbp - 0x48]
mov r14d, 0x32
jmp 0x180010964
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0xa8]
mov qword [rbp + 0x60], rdx
movabs rdx, 0x69004c0020
jmp 0x180010972
cmp byte [rsp + 0x40], 0
je 0x180010972
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180010964
cmp ebx, 0x18c3e
je 0x18001094c
cmp ebx, 0x1ad38
jne 0x180010972
mov eax, dword [rsp + 0x68]
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.180050c90
lea r11, [rsp + 0x4a8]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
mov byte [rsp + 0x68], 1
movabs rdx, 0x69004c0020
mov ecx, dword [rsp + 0x58]
imul eax, dword [rbp + 0x420], 0x3f
add ebx, eax
mov dword [rbp - 0x5c], ebx
cmp ebx, dword [rbp - 0x58]
ja 0x180010903
jmp 0x18000ffac
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180010903
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800109cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800109cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800504dc
jmp 0x180010903
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.18003dbc0
int3