Function at 0x180059850
Capabilities:
Parse credit card information
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
movaps xmmword [rsp + 0x4b0], xmm6
mov rax, qword [0x1800e5c38]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r9, r8
mov qword [rsp + 0x60], r8
mov esi, edx
mov dword [rbp - 0x70], edx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
xor ecx, ecx
mov ebx, ecx
mov dword [rsp + 0x58], ecx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], cx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rcx
mov r12d, edx
mov dword [rsp + 0x50], edx
lea r13d, [rdx + 0x11e0]
mov dword [rsp + 0x68], r13d
lea rcx, [0x180000000]
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x80], eax
mov eax, dword [rsp + 0x54]
cmp edx, r13d
jae 0x18005a6da
movabs rdx, 0x7ffffffffffffffe
mov ebx, 0x56
movabs rsi, 0xffffffffffff
mov dword [rsp + 0x34], eax
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rcx
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x7c], eax
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x74], eax
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x31], al
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x78], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x30], al
mov r15d, 0x6a61
mov r14d, 0x42
movabs r10, 0xaaaaaaaaaaaaaaab
cmp r12d, 0x22b
ja 0x18005a242
je 0x18005a231
cmp r12d, 0xb4
ja 0x180059a5a
je 0x180059a2e
cmp r12d, 0x35
je 0x180059a21
cmp r12d, 0x70
jne 0x180059ad7
mov rax, qword [rdi]
cmp dword [rax], 0x7f2bb712
je 0x180059ad7
mov eax, 0x21
nop dword [rax + rax]
cmp eax, 0x21
je 0x180059a08
cmp eax, 0xf57
jne 0x180059a10
mov ebx, dword [rsp + 0x5c]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18005b260
mov rdx, qword [rbp - 0x28]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b24d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b24d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dword [rsp + 0x5c], 0x7f2bb712
add eax, 0xf36
cmp eax, 0x1e6c
jbe 0x1800599b0
jmp 0x180059ad7
mov r11b, 1
mov byte [rsp + 0x31], r11b
jmp 0x180059add
movsd xmm0, qword [str.BNDMOVMR64mr]
movsd qword [rbp + 0xf8], xmm0
movzx eax, word [0x1800d99b8]
mov word [rbp + 0x100], ax
xor eax, eax
mov word [rbp + 0x102], ax
jmp 0x180059ad7
cmp r12d, 0xff
ja 0x180059ceb
je 0x180059cb8
mov eax, r12d
sub eax, 0xc4
je 0x180059b1a
cmp eax, 0x14
jne 0x180059ad7
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb2
lea rcx, [rbp - 0x38]
call fcn.180087b90
test al, al
jne 0x180059ac4
mov ecx, 0x35
nop dword [rax]
mov eax, ecx
sub eax, 0x35
je 0x180059ab2
cmp eax, 1
je case.0x18005a769.56
jmp 0x180059abd
mov dword [rdi], 1
mov byte [rsp + 0x5c], 0
inc ecx
cmp ecx, 0x37
jb 0x180059aa0
xor eax, eax
mov dword [rdi], eax
mov r9, qword [rsp + 0x60]
movabs rdx, 0x7ffffffffffffffe
movzx r11d, byte [rsp + 0x31]
movzx r8d, byte [rsp + 0x30]
mov r14d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x48]
mov r10, qword [rsp + 0x40]
add r12d, 0x8f
mov dword [rsp + 0x50], r12d
cmp r12d, r13d
jb 0x180059947
mov ebx, dword [rsp + 0x58]
mov esi, dword [rbp - 0x70]
lea rcx, [0x180000000]
jmp 0x18005a71f
mov rdi, qword [0x1800e5958]
lea rbx, [0x1800e5948]
cmp qword [0x1800e5960], 8
cmovae rbx, qword [0x1800e5948]
cmp rdi, 8
jae 0x180059b51
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x38], xmm0
mov r14d, 7
mov r15, qword [rbp + 0x38]
jmp 0x180059b90
mov r14, rdi
or r14, 7
cmp r14, rdx
cmova r14, rdx
lea rdx, [r14 + 1]
lea rcx, [rbp + 0x38]
call fcn.1800682d0
mov r15, rax
mov qword [rbp + 0x38], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movabs rdx, 0x7ffffffffffffffe
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x48], rdi
lea rsi, [rbp + 0x38]
cmp r14, 8
cmovae rsi, r15
cmp rdi, 8
jae 0x180059bba
movups xmm6, xmmword [rsi]
mov qword [rbp + 0x80], 7
jmp 0x180059bf7
mov rbx, rdi
or rbx, 7
cmp rbx, rdx
cmova rbx, rdx
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x68]
call fcn.1800682d0
mov qword [rbp + 0x68], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x80], rbx
movups xmm6, xmmword [rbp + 0x68]
mov qword [rbp + 0x78], rdi
mov rcx, qword [rbp + 0x30]
cmp rcx, 8
jb 0x180059c3b
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180059c36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a6c5
call fcn.1800cfd58
movups xmmword [rbp + 0x18], xmm6
movups xmm0, xmmword [rbp + 0x78]
movups xmmword [rbp + 0x28], xmm0
cmp r14, 8
jb 0x180059c82
lea rdx, [r14*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x180059c7a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005a6d3
mov rcx, r15
call fcn.1800cfd58
mov r8b, 1
mov byte [rsp + 0x30], r8b
mov rdi, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
movzx r11d, byte [rsp + 0x31]
movabs rdx, 0x7ffffffffffffffe
mov ebx, 0x56
movabs rsi, 0xffffffffffff
jmp 0x180059ae3
xorps xmm0, xmm0
movups xmmword [r9], xmm0
movups xmmword [r9 + 0x10], xmm0
movups xmmword [r9 + 0x20], xmm0
mov rcx, qword [rdi]
movsxd rax, dword [rcx + 0xa4]
lea rdx, [rax + rax*2]
shl rdx, 4
add rdx, qword [rcx + 0xb0]
mov qword [rbp - 0x60], rdx
jmp 0x180059acd
cmp r12d, 0x19c
ja 0x18005a188
je 0x18005a17b
mov eax, r12d
sub eax, 0x10d
je 0x18005a16f
sub eax, 0x36
je 0x18005a160
sub eax, 0x10
je 0x180059de2
sub eax, 0x14
je 0x180059dbc
cmp eax, 0x27
jne 0x180059ad7
mov rdx, qword [rbp - 0x60]
test rdx, rdx
je 0x180059acd
xor esi, esi
mov r8d, 0x44
cmp r8d, 0x44
je 0x180059d81
cmp r8d, 0x50
je 0x180059d78
cmp r8d, 0x5c
je 0x180059d6f
cmp r8d, 0x68
jne 0x180059da3
mov eax, dword [rdx + 0xc]
sub eax, dword [rdx + 8]
lea eax, [rax + rax*2]
shl eax, 2
mov dword [r9 + 0x14], eax
jmp 0x180059da3
mov eax, dword [rdx + 0xc]
mov dword [r9 + 0xc], eax
jmp 0x180059da3
mov eax, dword [rdx + 8]
mov dword [r9 + 8], eax
jmp 0x180059da3
mov rcx, qword [rdx + 0x28]
test rcx, rcx
je 0x180059da0
sub rcx, qword [rdx]
mov rax, r10
mul rcx
shr rdx, 3
mov dword [r9], edx
mov rdx, qword [rbp - 0x60]
jmp 0x180059da3
mov dword [r9], esi
add r8d, 0xc
cmp r8d, 0x74
jb 0x180059d45
movabs rsi, 0xffffffffffff
jmp 0x180059acd
mov rax, qword [rbp - 0x38]
cmp rax, qword [rbp - 0x30]
je 0x180059dd8
cmp dword [rax + 8], 0
jne 0x180059dce
inc dword [rdi]
add rax, 0x20
cmp rax, qword [rbp - 0x30]
jne 0x180059dc6
mov byte [rsp + 0x5c], 1
jmp 0x180059ad7
mov dword [rbp - 0x78], 0xa
xor r14d, r14d
mov ebx, r14d
mov qword [rbp - 0x68], rbx
cmp qword [0x1800e5978], r14
jbe 0x18005a6bb
mov r15d, r14d
cmp r15d, 0xc3
ja case.0x180059e2e.1
mov eax, r15d
lea r8, [0x180000000]
movzx eax, byte [r8 + rax + 0x5b33c]
mov ecx, dword [r8 + rax*4 + 0x5b2f8]
add rcx, r8
jmp rcx
mov byte [rbp + 0xa8], 0
mov dword [rsp + 0x54], r14d
jmp case.0x180059e2e.1
mov qword [rsp + 0x78], r14
jmp case.0x180059e2e.1
mov word [rbp + 0xa4], 0
jmp case.0x180059e2e.1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x94], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa4], xmm1
movdqu xmmword [rbp + 0xb4], xmm0
mov qword [rbp + 0xc4], r14
mov dword [rbp + 0x90], 0xa
jmp case.0x180059e2e.1
mov dword [rbp + 0x98], 0x1e
mov dword [rbp + 0x9c], 0xa
jmp case.0x180059e2e.1
mov dword [rbp + 0x68], 0x28
mov dword [rbp + 0xa0], 0x190
jmp case.0x180059e2e.1
mov byte [rsp + 0x32], 1
mov byte [rsp + 0x38], 1
jmp case.0x180059e2e.1
cmp byte [rsp + 0x32], 0
je 0x180059ee6
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.GDI32.dll_DeleteObject]
movabs rdx, 0x7ffffffffffffffe
lea rax, [0x1800e5968]
cmp qword [0x1800e5980], 0x10
cmovae rax, qword [0x1800e5968]
movsx r13d, byte [rax + rbx]
mov rsi, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
cmp rsi, rcx
jae 0x180059f34
lea rax, [rsi + 1]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmp rcx, 8
cmovae rax, qword [rbp + 0x18]
mov word [rax + rsi*2], r13w
mov word [rax + rsi*2 + 2], r14w
jmp case.0x180059e2e.1
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18005b2dd
lea r12, [rsi + 1]
mov r14, qword [rbp + 0x30]
mov rbx, r12
or rbx, 7
cmp rbx, rdx
jbe 0x180059f5d
mov rbx, rdx
jmp 0x180059f7e
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x180059f73
mov rbx, rdx
jmp 0x180059f7e
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x18]
call fcn.1800682d0
mov rdi, rax
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18005a002
mov rbx, qword [rbp + 0x18]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], r13w
xor eax, eax
mov word [rdi + rsi + 2], ax
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x180059fea
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18005a6cc
mov rbx, rcx
mov rcx, rbx
call fcn.1800cfd58
mov qword [rbp + 0x18], rdi
mov rbx, qword [rbp - 0x68]
xor r14d, r14d
jmp case.0x180059e2e.1
lea rdx, [rbp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], r13w
xor r14d, r14d
mov word [rdi + rsi + 2], r14w
mov qword [rbp + 0x18], rdi
mov rbx, qword [rbp - 0x68]
jmp case.0x180059e2e.1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x60], eax
mov byte [rbp + 0xa6], al
jmp case.0x180059e2e.1
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, dword [rsp + 0x6c]
lea rdx, [rbp + 0x68]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.GDI32.dll_CreateDIBitmap]
mov qword [rbp - 0x50], rax
jmp case.0x180059e2e.1
mov byte [rbp + 0xa9], 0
jmp case.0x180059e2e.1
lea rcx, [rbp + 0x90]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov qword [rbp - 0x58], rax
mov edx, r14d
movzx ecx, byte [rsp + 0x38]
cmp qword [rbp - 0x50], 0
cmovne edx, ecx
mov byte [rsp + 0x38], dl
jmp case.0x180059e2e.1
mov dword [rbp + 0x94], 0x14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
jmp case.0x180059e2e.1
mov dword [rsp + 0x6c], r14d
mov byte [rbp + 0xa7], 1
jmp case.0x180059e2e.1
cmp byte [rsp + 0x38], 0
je 0x18005a0e8
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, r14d
movzx eax, byte [rsp + 0x32]
cmp qword [rbp - 0x58], 0
cmovne ecx, eax
mov byte [rsp + 0x32], cl
jmp case.0x180059e2e.1
mov word [rbp + 0xaa], 0x200
add r15d, 0xd
lea eax, [r15 + 0x7b]
cmp eax, 0x14b
movabs rdx, 0x7ffffffffffffffe
jb 0x180059e03
inc rbx
mov qword [rbp - 0x68], rbx
cmp rbx, qword [0x1800e5978]
jb 0x180059e00
mov r12d, dword [rsp + 0x50]
mov r13d, dword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
mov ebx, 0x56
movabs rsi, 0xffffffffffff
jmp 0x180059ad7
mov dword [rbp + 0x102], 0x56
jmp 0x180059ad7
mov rax, qword [rdi]
mov qword [r9 + 0x60], rax
jmp 0x180059ad7
mov rax, qword [rdi + 0x10]
mov qword [r9 + 0x68], rax
jmp 0x180059ad7
mov eax, r12d
sub eax, 0x1d2
je 0x18005a209
sub eax, 0x10
je 0x18005a1e3
sub eax, 0x14
je case.0x18005a769.56
movzx r8d, byte [rsp + 0x30]
mov r10, qword [rsp + 0x40]
movzx r11d, byte [rsp + 0x31]
mov r14d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x48]
cmp eax, 0x27
jne 0x180059af2
mov rax, qword [rdi]
mov ecx, dword [rax + 0xa4]
mov dword [r9 + 4], ecx
mov rax, qword [rdi]
mov ecx, dword [rax + 0xa8]
mov dword [r9 + 0x10], ecx
jmp 0x180059af2
mov r14d, 0x14
mov dword [rsp + 0x34], r14d
xor eax, eax
mov r15d, eax
mov qword [rsp + 0x48], rax
movzx r8d, byte [rsp + 0x30]
movzx r11d, byte [rsp + 0x31]
jmp 0x180059aed
mov eax, dword [str.MRrhyxdviTX_507AMhLn7uzf_5cwdO2NR47rtMNE5qdMf1ZD6Li8tr76g5fmu_vEtpOGRgjIG5]
mov dword [rbp + 0x104], eax
movzx eax, word [0x1800d99e4]
mov word [rbp + 0x108], ax
xor eax, eax
mov word [rbp + 0x10a], ax
jmp 0x180059ad7
mov rax, qword [rdi + 0x30]
mov qword [r9 + 0x58], rax
or dword [r9], 0x10
jmp 0x180059ad7
cmp r12d, 0x40e
ja 0x18005a4d5
je 0x18005a4c6
cmp r12d, 0x2f0
ja 0x18005a314
je 0x18005a2eb
mov eax, r12d
sub eax, 0x261
je 0x18005a2dc
sub eax, 0x10
je 0x18005a2ad
movzx r8d, byte [rsp + 0x30]
mov r10, qword [rsp + 0x40]
movzx r11d, byte [rsp + 0x31]
mov r14d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x48]
cmp eax, 0x3b
jne 0x180059af2
mov eax, 0xffffffff
mov qword [r9 + 0x18], rax
mov qword [r9 + 0x20], rsi
jmp 0x180059af2
movups xmm0, xmmword [str.total_frames___0]
movups xmmword [rbp + 0x168], xmm0
movups xmm1, xmmword [0x1800d9aa8]
movups xmmword [rbp + 0x178], xmm1
movzx eax, word [0x1800d9ab8]
mov word [rbp + 0x188], ax
jmp 0x180059ad7
mov dword [rbp + 0x10a], 0x72
jmp 0x180059ad7
mov r8d, 3
lea rdx, [0x1800d99d8]
lea rcx, [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0x124], 0x43
jmp 0x180059ac8
mov eax, r12d
sub eax, 0x300
je 0x18005a397
sub eax, 0x7f
je 0x18005a358
movzx r8d, byte [rsp + 0x30]
mov r10, qword [rsp + 0x40]
movzx r11d, byte [rsp + 0x31]
mov r14d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x48]
cmp eax, 0x10
jne 0x180059af2
mov dword [rbp - 0x7c], 0x28
xor eax, eax
mov dword [rbp - 0x74], eax
jmp 0x180059af2
mov eax, dword [0x1800d99cc]
mov dword [rbp + 0x126], eax
movzx eax, word [0x1800d99d0]
mov word [rbp + 0x12a], ax
lea rcx, [rbp + 0x120]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18005a380
mov eax, dword [0x1800d99d4]
mov dword [rcx], eax
jmp 0x180059ad7
mov rsi, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
cmp rsi, rcx
jae 0x18005a3cf
lea rax, [rsi + 1]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmp rcx, 8
cmovae rax, qword [rbp + 0x18]
mov dword [rax + rsi*2], 0x2e
movabs rsi, 0xffffffffffff
jmp 0x180059ad7
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18005b2e3
lea r15, [rsi + 1]
mov r14, qword [rbp + 0x30]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x18005a3f8
mov rbx, rdx
jmp 0x18005a419
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x18005a40e
mov rbx, rdx
jmp 0x18005a419
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x18]
call fcn.1800682d0
mov rdi, rax
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18005a4b4
mov rbx, qword [rbp + 0x18]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x18005a480
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18005a6d3
mov rbx, rcx
mov rcx, rbx
call fcn.1800cfd58
mov qword [rbp + 0x18], rdi
mov rdi, qword [rsp + 0x70]
mov r9, qword [rsp + 0x60]
movabs rdx, 0x7ffffffffffffffe
mov ebx, 0x56
movabs rsi, 0xffffffffffff
jmp 0x180059ad7
lea rdx, [rbp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
jmp 0x18005a488
mov dword [rbp + 0x12c], 0x6b
jmp 0x180059ad7
cmp r12d, 0x52c
ja 0x18005a64f
je 0x18005a640
mov eax, r12d
sub eax, 0x41e
je 0x18005a563
sub eax, 0x7f
je 0x18005a528
movzx r8d, byte [rsp + 0x30]
movzx r11d, byte [rsp + 0x31]
mov r14d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x48]
cmp eax, 0x10
jne 0x180059aed
xor eax, eax
mov r10d, eax
mov qword [rsp + 0x40], rax
mov dword [rbp - 0x40], eax
jmp 0x180059af2
movsd xmm0, qword [str.7zGen]
movsd qword [rbp + 0x12e], xmm0
mov eax, dword [0x1800d9a88]
mov dword [rbp + 0x136], eax
mov eax, dword [0x1800d9a8c]
mov dword [rbp + 0x138], eax
movzx eax, word [0x1800d9a90]
mov word [rbp + 0x13c], ax
jmp 0x180059ad7
mov dword [rbp - 0x80], 0x32
mov rsi, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
cmp rsi, rcx
jae 0x18005a5a2
lea rax, [rsi + 1]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmp rcx, 8
cmovae rax, qword [rbp + 0x18]
mov dword [rax + rsi*2], 0x64
movabs rsi, 0xffffffffffff
jmp 0x180059ad7
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18005b2e3
lea r15, [rsi + 1]
mov r14, qword [rbp + 0x30]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x18005a5cb
mov rbx, rdx
jmp 0x18005a5ec
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x18005a5e1
mov rbx, rdx
jmp 0x18005a5ec
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x18]
call fcn.1800682d0
mov rdi, rax
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18005a62b
mov rbx, qword [rbp + 0x18]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x64
jmp 0x18005a453
lea rdx, [rbp + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x64
jmp 0x18005a488
mov dword [rbp + 0x13c], 0x61
jmp 0x180059ad7
cmp r12d, 0x5bb
je 0x18005a6a2
cmp r12d, 0x64a
je 0x18005a683
cmp r12d, 0x6d9
jne 0x180059ad7
mov word [rbp + 0xe0], r14w
mov word [rbp + 0xe1], r15w
jmp 0x180059ad7
mov r8d, 1
lea rdx, [0x1800d9abc]
lea rcx, [rbp + 0x120]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180059ac8
mov dword [rbp + 0x13e], 0x74
mov dword [rbp + 0x140], 0x6f
jmp 0x180059ad7
mov ebx, 0x56
jmp 0x180059ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r14d, dword [rsp + 0x54]
mov dword [rsp + 0x34], r14d
mov r15, qword [rsp + 0x78]
mov qword [rsp + 0x48], r15
mov dword [rbp - 0x7c], eax
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x74], eax
movzx r11d, byte [rsp + 0x32]
mov byte [rsp + 0x31], r11b
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x78], eax
mov r10, qword [rsp + 0x78]
mov qword [rsp + 0x40], r10
movzx r8d, byte [rsp + 0x32]
mov byte [rsp + 0x30], r8b
lea eax, [rsi - 0x1f]
mov dword [rbp - 0x68], eax
cmp esi, eax
jbe case.0x18005a769.56
mov r13d, dword [rbp - 0x68]
movzx edx, byte [rsp + 0x32]
mov dword [rsp + 0x50], edx
mov r12d, dword [rbp - 0x68]
mov qword [rbp - 0x60], r12
lea eax, [rsi - 0x2c]
cmp eax, 0x88
ja case.0x18005a769.74
movzx eax, byte [rcx + rax + 0x5b47c]
mov ecx, dword [rcx + rax*4 + 0x5b400]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov dword [rbp - 0x3c], 2
jmp case.0x18005a769.74
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0x168]
call qword [sym.imp.SHLWAPI.dll_StrCSpnIW]
jmp 0x18005b200
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x190]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0xf8]
mov rcx, qword [rbp - 8]
call qword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
mov dword [rbp - 0x50], eax
jmp 0x18005b200
mov byte [rsp + 0x5c], 0
jmp case.0x18005a769.74
cmp qword [rdi + 0x10], 0x35
jb case.0x18005a769.74
mov r15d, 0x127
nop word [rax + rax]
cmp r15d, 0x299
ja 0x18005aa74
je 0x18005aa51
cmp r15d, 0x1e0
ja 0x18005a8c8
je 0x18005a8a8
mov eax, r15d
sub eax, 0x127
je 0x18005a897
sub eax, 0x25
je 0x18005a886
sub eax, 0x25
je 0x18005a867
sub eax, 0x25
je 0x18005a84a
cmp eax, 0x25
jne 0x18005af07
mov eax, dword [str._u64]
mov dword [rbp + 0xd7], eax
movzx eax, byte [0x1800d9acc]
mov byte [rbp + 0xdb], al
jmp 0x18005af07
mov eax, 0x5f
mov word [rbp + 0xd5], ax
mov eax, 0x6e
mov word [rbp + 0xd6], ax
jmp 0x18005af07
movzx eax, word [0x1800d9ac4]
mov word [rbp + 0xd2], ax
mov eax, 0x71
mov word [rbp + 0xd4], ax
jmp 0x18005af07
mov eax, 0x63
mov word [rbp + 0xd1], ax
jmp 0x18005af07
mov eax, 0x76
mov word [rbp + 0xd0], ax
jmp 0x18005af07
movzx eax, word [0x1800d9ac0]
mov word [rbp + 0xdb], ax
movzx eax, byte [0x1800d9ac2]
mov byte [rbp + 0xdd], al
jmp 0x18005af07
mov eax, r15d
sub eax, 0x205
je 0x18005aa46
sub eax, 0x25
je 0x18005a941
sub eax, 0x25
je 0x18005a913
cmp eax, 0x25
jne 0x18005af07
lea rax, [rbp + 0xd0]
mov r12, 0xffffffffffffffff
nop word [rax + rax]
inc r12
cmp byte [rax + r12], 0
jne 0x18005a900
mov qword [rbp - 0x60], r12
jmp 0x18005af07
movsd xmm0, qword [str.r_alla_webbl]
movsd qword [rbp + 0x110], xmm0
mov eax, dword [0x1800d9ae0]
mov dword [rbp + 0x118], eax
movzx eax, byte [0x1800d9ae4]
mov byte [rbp + 0x11c], al
jmp 0x18005af07
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov esi, 0xb
cmp qword [rdi + 0x10], rsi
cmovb rsi, qword [rdi + 0x10]
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18005a968
mov r14, qword [rdi]
cmp rsi, 0xf
ja 0x18005a997
mov qword [rbp + 0x48], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rbp + 0x38]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x38], 0
or dword [rsp + 0x58], 4
lea rcx, [0x1800e59a8]
jmp 0x18005abb8
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18005b2ef
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18005a9bb
mov rdi, rax
jmp 0x18005a9c8
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18005aa01
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005b2e9
mov rcx, rax
call fcn.1800cfd1c
test rax, rax
je 0x18005b23d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18005aa12
test rcx, rcx
je 0x18005aa0d
call fcn.1800cfd1c
jmp 0x18005aa0f
xor eax, eax
mov rbx, rax
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp + 0x38], rbx
mov rdi, qword [rsp + 0x70]
or dword [rsp + 0x58], 4
lea rcx, [0x1800e59a8]
jmp 0x18005abb8
mov dl, 1
mov byte [rsp + 0x32], dl
jmp 0x18005af03
lea rax, [rbp + 0x110]
mov r13, 0xffffffffffffffff
nop
inc r13
cmp byte [rax + r13], 0
jne 0x18005aa60
xor eax, eax
mov dword [rbp - 0x48], eax
jmp 0x18005af07
cmp r15d, 0x352
ja 0x18005adc6
je 0x18005ada2
mov eax, r15d
sub eax, 0x2be
je 0x18005ac42
sub eax, 0x25
je 0x18005ac37
sub eax, 0x25
je 0x18005ac0d
cmp eax, 0x25
jne 0x18005af07
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rax, qword [rdi + 0x10]
cmp rax, 0x11
jb 0x18005b2d7
add rax, 0xffffffffffffffef
mov esi, 0x24
cmp rax, rsi
cmovb rsi, rax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18005aae7
mov rax, qword [rdi]
lea r14, [rax + 0x11]
cmp rsi, 0xf
ja 0x18005ab0e
mov qword [rbp + 0x48], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rbp + 0x38]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x38], 0
jmp 0x18005abac
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18005b2ef
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18005ab32
mov rdi, rax
jmp 0x18005ab3f
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18005ab78
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005b2e9
mov rcx, rax
call fcn.1800cfd1c
test rax, rax
je 0x18005b23d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18005ab89
test rcx, rcx
je 0x18005ab84
call fcn.1800cfd1c
jmp 0x18005ab86
xor eax, eax
mov rbx, rax
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp + 0x38], rbx
mov rdi, qword [rsp + 0x70]
or dword [rsp + 0x58], 2
lea rcx, [0x1800e5988]
lea rdx, [rbp + 0x38]
call fcn.18004ac80
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x18005aee9
inc rdx
mov rcx, qword [rbp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x18005abfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b23d
call fcn.1800cfd58
mov edx, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x58]
jmp 0x18005af07
xor eax, eax
mov qword [rbp + 8], rax
lea r9, [rbp - 0x18]
lea r8, [rbp - 0x48]
mov edx, r12d
lea rcx, [rbp + 0xd0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x6c], eax
mov edx, dword [rsp + 0x50]
jmp 0x18005af07
xor eax, eax
mov qword [rbp - 0x18], rax
jmp 0x18005af07
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rax, qword [rdi + 0x10]
cmp rax, 0xb
jb 0x18005b2d7
add rax, 0xfffffffffffffff5
mov esi, 6
cmp rax, rsi
cmovb rsi, rax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18005ac79
mov rax, qword [rdi]
lea r14, [rax + 0xb]
cmp rsi, 0xf
ja 0x18005aca0
mov qword [rbp + 0x48], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rbp + 0x38]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rsi + 0x38], 0
jmp 0x18005ad42
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x18005b2ef
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x18005acc4
mov rdi, rax
jmp 0x18005acd1
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x18005ad0a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005b2e9
mov rcx, rax
call fcn.1800cfd1c
test rax, rax
je 0x18005b23d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18005ad1b
test rcx, rcx
je 0x18005ad16
call fcn.1800cfd1c
jmp 0x18005ad18
xor eax, eax
mov rbx, rax
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov qword [rbp + 0x38], rbx
mov rdi, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x58]
or ebx, 1
mov dword [rsp + 0x58], ebx
lea rdx, [rbp + 0x38]
lea rcx, [0x1800e59c8]
call fcn.18004ac80
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x18005ad94
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ad8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005b23d
call fcn.1800cfd58
xor eax, eax
mov dword [rbp - 0x44], eax
mov edx, dword [rsp + 0x50]
jmp 0x18005af07
lea r9, [rbp + 8]
lea r8, [rbp - 0x44]
mov edx, r13d
lea rcx, [rbp + 0x110]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x68], eax
mov edx, dword [rsp + 0x50]
jmp 0x18005af07
mov eax, r15d
sub eax, 0x377
je 0x18005aef3
sub eax, 0x25
je 0x18005ae6e
sub eax, 0x25
je 0x18005adf0
cmp eax, 0x25
je case.0x18005a769.56
jmp 0x18005af07
cmp byte [rsp + 0x32], 0
je 0x18005ae60
mov ebx, 0x84
xor r12d, r12d
nop
mov eax, ebx
sub eax, 0x84
je 0x18005ae4a
sub eax, 1
je 0x18005ae23
cmp eax, 1
jne 0x18005ae4e
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x18005ae4e
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18005ae4e
lea r8, [rbp - 0x20]
mov edx, r13d
lea rcx, [rbp + 0x110]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rsp + 0x68], eax
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x18005ae4e
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18005ae4e
mov qword [rbp - 0x20], r12
inc ebx
cmp ebx, 0x87
jb 0x18005ae00
mov r12, qword [rbp - 0x60]
mov edx, dword [rsp + 0x50]
mov byte [rsp + 0x5c], 1
mov ebx, dword [rsp + 0x58]
jmp 0x18005af07
xor r8d, r8d
mov ecx, r8d
movzx eax, byte [rsp + 0x32]
cmp dword [rsp + 0x68], r8d
cmove ecx, eax
mov byte [rsp + 0x32], cl
test dl, dl
je 0x18005aeed
mov ebx, 0x31
nop
mov eax, ebx
sub eax, 0x31
je 0x18005aede
sub eax, 1
je 0x18005aeb4
cmp eax, 1
jne 0x18005aee2
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x18005aee2
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
jmp 0x18005aee2
lea r8, [rbp - 0x10]
mov edx, r12d
lea rcx, [rbp + 0xd0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rsp + 0x6c], eax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x18005aeaf
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
jmp 0x18005aee2
mov qword [rbp - 0x10], r8
inc ebx
cmp ebx, 0x34
jb 0x18005ae90
mov edx, dword [rsp + 0x50]
mov ebx, dword [rsp + 0x58]
jmp 0x18005af07
movzx edx, dl
cmp dword [rsp + 0x6c], 0
mov eax, 0
cmovne edx, eax
mov dword [rsp + 0x50], edx
add r15d, 0x25
cmp r15d, 0x40b
jb 0x18005a7e0
mov esi, dword [rbp - 0x70]
mov r14d, dword [rsp + 0x34]
mov r15, qword [rsp + 0x48]
jmp 0x18005b204
mov eax, 0x20
mov word [rbp + 0xe5], ax
jmp case.0x18005a769.74
mov edx, 0x61
lea rcx, [rbp + 0x18]
call fcn.1800b8b30
movups xmm0, xmmword [str._historystatus]
movups xmmword [rbp + 0x148], xmm0
movsd xmm1, qword [0x1800d9af8]
movsd qword [rbp + 0x158], xmm1
mov eax, dword [0x1800d9b00]
mov dword [rbp + 0x160], eax
movzx eax, word [0x1800d9b04]
mov word [rbp + 0x164], ax
jmp 0x18005b200
xor eax, eax
mov dword [rsp + 0x54], eax
jmp case.0x18005a769.74
mov ebx, 0x5c
mov eax, ebx
sub eax, 0x5c
je 0x18005afa8
cmp eax, 0x7a
je case.0x18005a769.56
jmp 0x18005afbd
lea r8, [rbp + 0x18]
mov edx, SHStripMneumonicA
mov rcx, rdi
call fcn.1800c45d0
mov byte [rsp + 0x5c], al
add ebx, 0x7a
cmp ebx, 0x150
jb 0x18005af96
mov r9d, dword [rbp - 0x80]
mov r8d, dword [rbp - 0x7c]
mov edx, r14d
mov ecx, dword [rbp - 0x78]
call qword [sym.imp.GDI32.dll_CreateRectRgn]
mov qword [rbp], rax
jmp 0x18005b200
mov eax, 0x65
mov word [rbp + 0xea], ax
mov eax, 0x6b
mov word [rbp + 0xeb], ax
jmp case.0x18005a769.74
mov eax, 0x7320
mov word [rbp + 0xe8], ax
jmp case.0x18005a769.74
mov eax, 0x6174
mov word [rbp + 0xe3], ax
jmp case.0x18005a769.74
mov eax, 0x70
mov word [rbp + 0xe6], ax
jmp case.0x18005a769.74
mov qword [rbp - 8], 0xffffffff80000001
mov dword [rbp - 0x58], 0x10
jmp case.0x18005a769.74
mov eax, 0x72
mov word [rbp + 0xee], ax
mov eax, 0x75
mov word [rbp + 0xef], ax
jmp case.0x18005a769.74
mov eax, 0x74
mov word [rbp + 0xec], ax
mov eax, 0x6f
mov word [rbp + 0xed], ax
jmp case.0x18005a769.74
cmp byte [rsp + 0x38], 0
je 0x18005b0b1
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x190]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0xf8]
mov rcx, qword [rbp - 8]
call qword [sym.imp.SHLWAPI.dll_SHRegSetPathW]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0xe0]
mov edx, dword [rbp - 0x3c]
mov ecx, dword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_AssocQueryKeyA]
jmp 0x18005b200
xor eax, eax
mov ecx, eax
movzx eax, r11b
cmp qword [rbp], rcx
cmovne ecx, eax
movzx r11d, cl
mov byte [rsp + 0x31], cl
jmp case.0x18005a769.74
test r11b, r11b
je case.0x18005a769.74
mov ebx, 0x36
mov r12, qword [rbp]
mov edx, 0xffffffff
mov eax, ebx
sub eax, 0x35
je 0x18005b122
cmp eax, 1
jne 0x18005b135
mov rdx, r10
mov rcx, r12
call qword [sym.imp.GDI32.dll_EqualRgn]
jmp 0x18005b12b
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteObject]
mov edx, 0xffffffff
mov r10, qword [rsp + 0x40]
add ebx, edx
cmp ebx, 0x34
ja 0x18005b108
mov r12, qword [rbp - 0x60]
jmp 0x18005b200
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x38]
cmp dword [rbp - 0x50], ecx
cmove ecx, eax
mov byte [rsp + 0x38], cl
jmp case.0x18005a769.74
mov dword [r9 + 0x28], 0x8000
mov dword [r9 + 0x2c], 0x7fff
jmp case.0x18005a769.74
mov eax, 0x6f
mov word [rbp + 0xe7], ax
jmp case.0x18005a769.74
mov eax, 0x4a
nop dword [rax + rax]
cmp eax, 0x4a
je 0x18005b244
add eax, 0x3374
cmp eax, 0x3374
jbe 0x18005b190
lea r9, [rbp - 0x40]
xor r8d, r8d
mov edx, dword [rbp - 0x74]
mov rcx, r15
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0x78], rax
jmp 0x18005b200
xor eax, eax
mov ecx, eax
movzx eax, r8b
cmp qword [rsp + 0x78], rcx
cmovne ecx, eax
movzx r8d, cl
mov byte [rsp + 0x30], cl
jmp case.0x18005a769.74
mov byte [rsp + 0x38], 1
jmp case.0x18005a769.74
mov edx, 0x74
lea rcx, [rbp + 0x18]
call fcn.1800b8b30
jmp 0x18005b200
test r8b, r8b
je case.0x18005a769.74
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Unlock]
mov edx, dword [rsp + 0x50]
movzx r11d, byte [rsp + 0x31]
movzx r8d, byte [rsp + 0x30]
mov eax, 0xffffffff
add esi, eax
mov dword [rbp - 0x70], esi
cmp esi, dword [rbp - 0x68]
jbe case.0x18005a769.56
mov r9, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x58]
mov r10, qword [rsp + 0x40]
lea rcx, [0x180000000]
jmp 0x18005a742
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor eax, eax
mov ebx, eax
jmp 0x1800599c0
call fcn.1800cfd58
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
xor eax, eax
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp + 0x30]
cmp rcx, 8
jb 0x18005b2a3
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b29e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b29e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cfd58
mov eax, ebx
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1800d0500
mov rbx, qword [rsp + 0x508]
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800661e0
nop
call fcn.1800661a0
int3
call fcn.1800661a0
int3
call fcn.180066060
int3
call fcn.1800661a0
int3