Function at 0x18000c7a0
Capabilities:
Check mutex on windows
Hide thread from debugger
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x658]
sub rsp, 0x758
mov rax, qword [0x180093630]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov r15, qword [r8 + 8]
xor edi, edi
mov dword [rbp - 0x2c], edi
mov r14, rdx
mov qword [rbp - 0x38], rdi
mov dword [rbp - 0x74], edi
mov dword [rbp - 0x70], edi
mov dword [rbp - 0x6c], edi
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x70], rdi
mov dword [rbp - 0x78], edi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x80], r15
mov qword [rbp + 0x18], r8
mov qword [rsp + 0x68], rdx
mov qword [rbp + 0x68], rcx
mov qword [rsp + 0x60], 0x218
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001ec22
mov rbx, qword [0x180096348]
mov rsi, rdi
test rbx, rbx
je 0x18000c862
nop dword [rax]
mov rcx, qword [rbx + 0x190]
mov rdx, r15
call qword [sym.imp.KERNELBASE.dll_lstrcmpiW]
test eax, eax
je 0x18000c851
mov rsi, rbx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18000c830
jmp 0x18000c862
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001ec4a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x1708
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x18001ec6f
add rax, 0x430
mov qword [rsp + 0x7a8], r12
mov qword [rbp - 0x58], rax
add rax, 0x430
mov qword [rbp - 0x40], rax
add rax, 0x218
mov qword [rbp - 0x10], rax
add rax, 0x218
mov qword [rbp + 8], rax
mov qword [rsp + 0x750], r13
mov r13d, 0x430
mov dword [rsp + 0x58], edi
lea r12, [rax + 0x648]
mov qword [rbp - 0x20], rdi
xor eax, eax
mov dword [rbp - 0x28], 0x3e8
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
mov eax, dword [0x180094ff8]
mov dword [rbp - 0x5c], eax
mov dword [rbp - 0x60], eax
lea rax, [r14 - 1]
mov dword [rbp + 0x38], edi
mov qword [rbp + 0x40], rdi
cmp rax, 0xfffffffffffffffd
ja 0x18001f1a8
lea rdx, [0x180070200]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x18001ecaf
mov dword [rbp - 8], 0x440
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [r13 + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18001eca4
lea rax, [rbp - 8]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x38]
mov r8d, 2
mov dword [rsp + 0x20], 0x440
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, 0x80000000
mov r14d, eax
add eax, ecx
test ecx, eax
je 0x18000d7d2
mov eax, dword [rdi + 4]
mov r13d, dword [rdi + 8]
mov dword [rsp + 0x58], eax
test r14d, r14d
js 0x18000c9ac
mov rcx, qword [rbp + 0x10]
lea rdx, [rdi + 0xc]
mov r8d, r13d
call sub.msvcrt.dll_memcpy
mov r13d, dword [rdi + 8]
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov ecx, r14d
call fcn.18000dc0c
mov edi, eax
test eax, eax
jne 0x18001f1af
mov rcx, qword [rbp + 0x10]
lea r12d, [r13 + 8]
mov eax, 0xfffffff8
lea r14d, [rdi + 8]
and r12, rax
mov eax, dword [rsp + 0x58]
lea r13, [r12 + rcx]
mov qword [rbp - 0x58], r13
cmp eax, 2
jne 0x18000d802
mov r8d, 0x218
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, eax
dec eax
cmp eax, 0x217
ja 0x18001ecba
lea r14d, [rcx*2 + 9]
mov eax, 0xfffffff8
mov rcx, qword [0x180093040]
and r14, rax
lea r12, [r14 + 0x218]
mov qword [rsp + 0x60], r12
add r13, r14
mov qword [rbp - 0x40], r13
test edi, edi
jne 0x18001edf8
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
xor r14d, r14d
mov dword [rsp + 0x50], 0x218
mov dword [rsp + 0x30], r14d
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800701f4]
mov qword [rsp + 0x20], r13
call fcn.18000d9e0
mov edi, eax
test eax, eax
jne 0x18001ed28
cmp byte [r13], r14b
je 0x18001ed28
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001ed02
mov eax, dword [rsp + 0x50]
mov ecx, 0xfffffff8
lea r14d, [rax + 8]
mov byte [rax + r13], 0
and r14, rcx
add r12, r14
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], r12
mov r12, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.Open_Timeout
lea rax, [rbp - 0x60]
mov dword [rsp + 0x58], 0
mov rcx, r12
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call fcn.18000d9e0
mov edi, eax
test eax, eax
je 0x18000d925
mov eax, dword [0x180094ff8]
mov dword [rbp - 0x60], eax
xor eax, eax
mov edi, eax
add r13, r14
mov r14d, 8
mov qword [rbp + 8], r13
test edi, edi
jne 0x18000cb9d
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x218
mov qword [rsp + 0x28], rax
lea rdx, [0x1800701d0]
mov rcx, r12
mov qword [rsp + 0x20], r13
call fcn.18000d9e0
mov edi, eax
test eax, eax
jne 0x18001ee5a
cmp byte [r13], al
je 0x18001ee5a
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001ee34
mov r14d, dword [rsp + 0x50]
mov eax, 0xfffffff8
add r14d, 8
and r14, rax
lea r12, [r14 + r13]
mov r13d, 8
mov qword [rbp - 0x10], r12
test edi, edi
jne 0x18001f499
add qword [rsp + 0x60], r14
lea rax, [rsp + 0x50]
mov r14, qword [rsp + 0x68]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x30], edi
lea rdx, str.Query
mov qword [rsp + 0x28], rax
mov rcx, r14
mov dword [rsp + 0x50], 0x218
mov qword [rsp + 0x20], r12
call fcn.18000d9e0
mov edi, eax
test eax, eax
je 0x18001ef30
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rdx, [0x1800701c0]
mov qword [rsp + 0x20], r12
mov rcx, r14
mov dword [rsp + 0x50], 0x218
call fcn.18000d9e0
mov edi, eax
test eax, eax
jne 0x18001ef62
mov r13d, dword [rsp + 0x50]
mov eax, 0xfffffff8
add r13d, 8
and r13, rax
add qword [rsp + 0x60], r13
cmp byte [r12], 0
je 0x18001ef62
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001ef3c
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp - 0x5c]
mov dword [rsp + 0x50], 4
xor edi, edi
mov qword [rsp + 0x20], rax
lea rdx, str.Collect_Timeout
mov dword [rsp + 0x58], edi
mov rcx, r14
call fcn.18000d9e0
test eax, eax
je 0x18000d937
mov eax, dword [0x180094ff8]
mov dword [rbp - 0x5c], eax
lea rdx, str.First_Counter
mov dword [rbp - 0x50], 0
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x48], rdi
mov r12d, edi
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x18001f04d
mov dword [rbp - 4], 0x14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xc]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18001f042
lea rax, [rbp - 4]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x50]
mov r8d, 2
mov dword [rsp + 0x20], 0x14
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, 0x80000000
mov r14d, eax
add eax, ecx
test ecx, eax
je 0x18000d796
mov r12d, dword [rdi + 4]
test r14d, r14d
js 0x18000cd5d
mov r8d, dword [rdi + 8]
lea rdx, [rdi + 0xc]
lea rcx, [rbp - 0x70]
call sub.msvcrt.dll_memcpy
xor eax, eax
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
xor edi, edi
mov ecx, r14d
call fcn.18000dc0c
test eax, eax
jne 0x18000d7e4
cmp r12d, 4
jne 0x18000d7e4
lea rdx, str.Last_Counter
mov dword [rbp + 0x48], 0
lea rcx, [rbp + 0x48]
mov qword [rbp + 0x50], rdi
mov r12d, edi
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x18001f063
mov dword [rbp], 0x14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xc]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18001f058
mov rcx, qword [rsp + 0x68]
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x48]
mov r9, rdi
mov dword [rsp + 0x20], 0x14
mov r8d, 2
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, 0x80000000
mov r14d, eax
add eax, ecx
test ecx, eax
je 0x18000d7a8
mov r12d, dword [rdi + 4]
test r14d, r14d
js 0x18000ce43
mov r8d, dword [rdi + 8]
lea rdx, [rdi + 0xc]
lea rcx, [rbp - 0x6c]
call sub.msvcrt.dll_memcpy
xor eax, eax
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
xor edi, edi
mov ecx, r14d
call fcn.18000dc0c
test eax, eax
jne 0x18000d7ec
cmp r12d, 4
jne 0x18000d7ec
mov rdi, qword [rbp - 0x10]
lea rdx, str.Object_List
xor eax, eax
lea rcx, [rbp + 0x58]
add rdi, r13
mov dword [rbp + 0x58], eax
mov qword [rsp + 0x70], rdi
mov r14d, eax
mov qword [rbp + 0x60], rax
call qword [sym.imp.ntdll.dll_RtlCreateUnicodeString]
test al, al
je 0x18001f07f
mov dword [rbp + 4], 0x440
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x440
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18001f06e
mov rcx, qword [rsp + 0x68]
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x58]
mov r9, rdi
mov dword [rsp + 0x20], 0x440
mov r8d, 2
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ecx, 0x80000000
mov r12d, eax
add eax, ecx
test ecx, eax
je 0x18000d7ba
mov r14d, dword [rdi + 4]
mov r13d, dword [rdi + 8]
test r12d, r12d
js 0x18000cf45
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18000cf45
mov r8d, r13d
lea rdx, [rdi + 0xc]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov r13d, dword [rdi + 8]
xor eax, eax
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov rdi, qword [rsp + 0x70]
mov ecx, r12d
call fcn.18000dc0c
test eax, eax
jne 0x18000d7f4
lea r12d, [r13 + 8]
mov eax, 0xfffffff8
and r12, rax
mov qword [rsp + 0x58], r12
cmp r14d, 1
jne 0x18001f090
mov rcx, qword [rsp + 0x70]
xor r13d, r13d
mov edi, r13d
mov r14, rcx
movzx eax, word [rcx]
test ax, ax
je 0x18000d027
mov r15d, r13d
mov r12d, 0x20
cmp ax, r12w
je 0x18000d205
test rdi, rdi
cmove rdi, r14
movzx eax, word [r14 + 2]
add r14, 2
test ax, ax
jne 0x18000cfb2
mov r12, qword [rsp + 0x58]
mov dword [rsp + 0x78], r15d
mov r15, qword [rbp - 0x80]
test rdi, rdi
je 0x18000d027
mov r13d, dword [rsp + 0x78]
cmp r13d, 0x40
jae 0x18001f0fa
cmp rdi, r14
je 0x18001f0fa
test ax, ax
jne 0x18001f0fa
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov dword [rbp + r13*4 + 0x80], eax
inc r13d
mov dword [rsp + 0x78], r13d
xor r13d, r13d
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 1
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.Keep_Library_Resident
lea rax, [rbp - 0x30]
mov dword [rsp + 0x58], r13d
add r12, rdi
mov qword [rsp + 0x20], rax
mov edi, 4
mov dword [rbp - 0x30], r13d
mov rcx, r14
mov dword [rsp + 0x50], edi
call fcn.18000d9e0
test eax, eax
je 0x18001f18c
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp - 0x28]
mov dword [rsp + 0x50], edi
lea rdx, str.Error_Count_Limit
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.18000d9e0
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp + 0x70]
mov dword [rsp + 0x58], r13d
lea rdx, str.Library_Validation_Code
mov qword [rsp + 0x20], rax
mov rcx, r14
mov dword [rsp + 0x50], 0x10
call fcn.18000d9e0
test eax, eax
je 0x18001f1ef
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001f20a
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
xor eax, eax
mov dword [rsp + 0x30], 1
mov qword [rbp - 0x20], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x28], rax
lea rdx, str.Successful_File_Date
lea rax, [rbp - 0x20]
mov dword [rsp + 0x50], 8
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.18000d9e0
test eax, eax
je 0x18001f232
mov qword [rbp - 0x20], 0xffffffffffffffff
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
jne 0x18001f24d
lea rax, [rbp - 0x80]
mov r8, r15
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov edx, 0x218
mov rcx, r12
call fcn.18000dc50
mov r10d, eax
mov r14d, 0x7ffffffe
test eax, eax
js 0x18000d253
mov rdx, qword [rbp - 0x80]
mov r10d, r13d
lea rax, [rdx - 1]
cmp rax, r14
ja 0x18001f272
test r10d, r10d
js 0x18001f28c
mov rcx, qword [rbp - 0x68]
mov r10d, r13d
test rdx, rdx
je 0x18001f27d
mov r8, r14
lea r9, str.Linkage
sub r8, rdx
sub r9, rcx
nop dword [rax]
lea rax, [rdx + r8]
test rax, rax
je 0x18000d246
movzx eax, word [rcx + r9]
test ax, ax
je 0x18000d246
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x18000d1e0
jmp 0x18001f27d
test rdi, rdi
je 0x18000cfc3
cmp r15d, 0x40
jae 0x18000cfc3
xor edx, edx
mov word [r14], r13w
mov rcx, rdi
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov word [r14], r12w
mov rdi, r13
mov ecx, eax
mov eax, r15d
inc r15d
mov dword [rbp + rax*4 + 0x80], ecx
jmp 0x18000cfc3
test rdx, rdx
je 0x18001f27d
mov word [rcx], r13w
movzx eax, r10w
mov rcx, r13
mov qword [rbp - 0x18], rcx
test r10d, r10d
js 0x18000d286
mov rcx, qword [rbp + 0x68]
lea rax, [rbp - 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x18]
test eax, eax
je 0x18000d834
mov r12, r13
mov qword [rsp + 0x70], r13
test rbx, rbx
jne 0x18000d530
mov rdi, qword [rbp - 0x40]
mov rax, qword [rbp + 0x18]
mov ecx, 0xfffffff8
mov rbx, qword [rsp + 0x60]
movzx eax, word [rax + 2]
add eax, 7
and rax, rcx
add rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x38], rax
mov rsi, rax
test rax, rax
je 0x18001f46b
lea rcx, [rax + 0x218]
mov r8, rdi
mov qword [rax + 0x18], rcx
lea rdx, [rbx - 0x218]
lea rax, [rbp - 0x80]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.18000dd30
test eax, eax
js 0x18001f34b
mov eax, dword [rbp - 0x60]
lea r9, [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rbp - 0x10]
mov dword [rsi + 0x44], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea rcx, [rdx + 8]
and rcx, 0xfffffffffffffff8
sub rdx, rcx
mov qword [rsi + 0x38], rcx
add rdx, qword [rbp - 0x80]
call fcn.18000dd30
test eax, eax
js 0x18001f34b
mov eax, dword [rbp - 0x5c]
lea r9, [rsp + 0x60]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rbp + 8]
mov dword [rsi + 0x40], eax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea rcx, [rdx + 8]
and rcx, 0xfffffffffffffff8
sub rdx, rcx
mov qword [rsi + 0x50], rcx
add rdx, qword [rbp - 0x80]
call fcn.18000dd30
test eax, eax
js 0x18001f34b
mov rdx, qword [rsp + 0x60]
lea rax, [rbp - 0x80]
mov r8, qword [rbp - 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rcx, [rdx + 8]
and rcx, 0xfffffffffffffff8
sub rdx, rcx
mov qword [rsi + 0x68], rcx
add rdx, qword [rbp - 0x80]
shr rdx, 1
call fcn.18000dc50
test eax, eax
js 0x18001f34b
mov rcx, qword [rsp + 0x60]
mov rax, qword [rbp - 0x80]
lea rsi, [rcx + 0x17]
and rsi, 0xfffffffffffffff8
lea rdi, [rax + rax]
sub rdi, rsi
add rdi, rcx
test r12, r12
jne 0x18000d947
xor ebx, ebx
mov rax, qword [rbp - 0x38]
lea r9, [rsp + 0x60]
shr rdi, 1
mov r8, r15
mov rdx, rdi
mov qword [rsp + 0x70], r12
mov rcx, rsi
mov qword [rax + 0x190], rsi
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
call fcn.18000dc50
test eax, eax
js 0x18001f347
cmp dword [rbp - 0x2c], 0
mov eax, dword [rbp - 0x74]
jne 0x18001f35b
mov rsi, qword [rbp - 0x38]
mov r13, qword [rsp + 0x68]
mov dword [rsi + 0x184], eax
mov qword [rsi + 0x70], r13
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rsi + 0x1a0], xmm0
mov rax, qword [rbp - 0x20]
mov qword [rsi + 0x1b0], rax
mov dword [rsi + 0x188], 1
mov eax, dword [rbp - 0x70]
mov dword [rsi + 0x17c], eax
mov eax, dword [rbp - 0x6c]
mov dword [rsi + 0x180], eax
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x18000d49a
mov r8d, eax
mov dword [rsi + 0x78], eax
shl r8, 2
lea rcx, [rsi + 0x7c]
lea rdx, [rbp + 0x80]
call sub.msvcrt.dll_memcpy
lea rax, [rbp - 0x80]
mov qword [rsi + 0x198], rbx
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r8, r15
lea rcx, [rbp + 0x1c0]
mov edx, 0x218
call fcn.18000dc50
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x68]
test eax, eax
js 0x18001f3c2
lea rax, [rbx - 1]
cmp rax, r14
ja 0x18001f3ad
xor eax, eax
lea r9, str._Perf_Library_Lock_PID_
sub r14, rbx
mov r10d, eax
mov r8d, eax
sub r9, rdi
mov rcx, rbx
mov rdx, rdi
nop word [rax + rax]
lea rax, [rcx + r14]
test rax, rax
je 0x18000d629
movzx eax, word [r9 + rdx]
test ax, ax
je 0x18000d629
mov word [rdx], ax
inc r8
add rdx, 2
sub rcx, 1
jne 0x18000d500
jmp 0x18001f363
mov eax, dword [rbp - 0x70]
cmp dword [rbx + 0x17c], eax
jne 0x18001f304
mov eax, dword [rbp - 0x6c]
cmp dword [rbx + 0x180], eax
jne 0x18001f304
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNELBASE.dll_lstrcmpiW]
mov rdi, qword [rbp - 0x40]
test eax, eax
jne 0x18001f308
mov rcx, qword [rbx + 0x18]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001f308
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001f308
mov rdx, qword [rbp + 8]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18001f308
mov rsi, rbx
mov word [rbx + 0x214], ax
xor r14d, r14d
mov r8, qword [0x1800968e8]
test r8, r8
jne 0x18001f426
mov r13, qword [rsp + 0x750]
test r12, r12
jne 0x18000d990
mov r12, qword [rsp + 0x7a8]
test rsi, rsi
je 0x18000d5f2
lea rax, [rsi + 0x1f0]
mov qword [rax + 8], rax
mov qword [rax], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x10]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rsi
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.180017170
add rsp, 0x758
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rcx, rcx
je 0x18001f363
xor r14d, r14d
mov rcx, rbx
sub rcx, r8
mov word [rdx], r14w
lea rdx, [rdi + r8*2]
test r10d, r10d
js 0x18001f375
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r9d, 0x10
lea rdx, [rbp + 0x180]
mov ecx, eax
lea r8d, [r9 + 0x10]
call qword [sym.imp.msvcrt.dll__ultow_s]
lea r8, [rbp + 0x180]
mov rdx, rbx
mov rcx, rdi
call fcn.18000e694
test eax, eax
js 0x18001f3ca
mov qword [rbp - 0x58], r14
mov edi, r14d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThread]
lea r9, [rbp - 0x58]
mov r8b, 1
mov rcx, rax
mov edx, 4
call qword [sym.imp.ntdll.dll_NtOpenThreadToken]
test eax, eax
js 0x18001f3d7
mov r9d, 8
mov qword [rbp + 0x18], r14
lea r8, [rbp + 0x18]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
test eax, eax
js 0x18001f3e8
mov ebx, 1
mov eax, dword [0x180096398]
test eax, eax
je 0x18000d9b9
mov dword [rbp + 0x30], r14d
mov dword [rbp + 0x20], eax
lea rax, [0x180096660]
lea r8, [rbp + 0x1c0]
mov qword [rbp + 0x28], rax
xor edx, edx
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 8], rax
test ebx, ebx
je 0x18000d73f
mov r9d, 8
lea r8, [rbp - 0x58]
mov rcx, 0xfffffffffffffffe
lea edx, [r9 - 3]
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
test eax, eax
js 0x18001f403
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18000d74e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 8], 0
mov eax, dword [rbp - 0x28]
mov dword [rsi + 0x1e8], eax
mov byte [rsi + 0x214], 1
je 0x18000d776
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x18001f40f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp qword [rsi + 8], 0
je 0x18001f417
test edi, edi
je 0x18000d5b6
jmp 0x18001f4a1
cmp r14d, 0x80000005
je 0x18000cd3e
jmp 0x18000cd5d
cmp r14d, 0x80000005
je 0x18000ce24
jmp 0x18000ce43
cmp r12d, 0x80000005
je 0x18000cf16
mov r13d, 0x430
jmp 0x18000cf45
cmp r14d, 0x80000005
je 0x18000c985
jmp 0x18000c9ac
mov dword [rbp - 0x70], edi
jmp 0x18000cd97
mov dword [rbp - 0x6c], edi
jmp 0x18000ce7d
mov r12d, 8
xor r13d, r13d
jmp 0x18000d02c
cmp eax, 1
jne 0x18001ecc1
mov rdx, rcx
mov r8, r12
mov rcx, r13
mov r14, r12
call sub.msvcrt.dll_memcpy
mov rcx, qword [0x180093040]
add r12, 0x218
mov qword [rsp + 0x60], r12
jmp 0x18000ca46
test rcx, rcx
je 0x18000d28e
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rdx, str.Export
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x58], r13d
call fcn.18000d9e0
test eax, eax
je 0x18000d87e
cmp eax, 0xea
jne 0x18001f2a2
mov eax, dword [rsp + 0x58]
cmp eax, 1
jne 0x18000d99d
mov r12d, dword [rsp + 0x50]
lea rcx, [r12 + 2]
call fcn.18000618c
mov qword [rsp + 0x70], rax
test rax, rax
je 0x18001f2cc
mov r12, qword [rsp + 0x70]
lea rax, [rsp + 0x50]
mov rcx, qword [rbp - 0x18]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x30], 1
lea rdx, str.Export
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x58], r13d
call fcn.18000d9e0
mov edi, eax
test eax, eax
jne 0x18001f2b3
mov eax, dword [rsp + 0x58]
cmp eax, 1
jne 0x18000d9ab
mov r13d, dword [rsp + 0x50]
mov ecx, 0xfffffff8
inc r13d
lea eax, [r13 + 7]
and rax, rcx
add qword [rsp + 0x60], rax
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test edi, edi
je 0x18000d296
jmp 0x18001f499
cmp dword [rsp + 0x58], 4
jne 0x18000cb1a
xor eax, eax
jmp 0x18000cb27
cmp dword [rsp + 0x58], 4
je 0x18000ccb3
jmp 0x18000ccaa
mov rax, qword [rbp - 0x38]
mov rdx, r12
mov r8d, r13d
mov rcx, rsi
mov ebx, r13d
mov qword [rax + 0x20], rsi
call sub.msvcrt.dll_memcpy
shr rbx, 1
mov rcx, r12
lea rsi, [rsi + rbx*2]
add rsi, 7
and rsi, 0xfffffffffffffff8
call fcn.18000940c
xor ebx, ebx
lea eax, [r13 + 7]
mov ecx, 0xfffffff8
mov r12d, ebx
and rax, rcx
sub rdi, rax
jmp 0x18000d3ef
mov rcx, r12
call fcn.18000940c
jmp 0x18000d5d7
cmp eax, 7
je 0x18000d88b
jmp 0x18001f2a2
cmp eax, 7
je 0x18000d8f5
jmp 0x18001f2b3
mov ecx, edi
call fcn.1800049a4
mov dword [rbp + 0x30], r14d
test eax, eax
je 0x18001f3f0
mov eax, dword [0x180096398]
jmp 0x18000d6f3
cmp byte [rcx + 0x19], 4
jb 0x18000c81d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0xa
mov r9, r15
call fcn.18004721c
nop
jmp 0x18000c81d
cmp byte [rcx + 0x19], 4
jb 0x18000c862
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0xb
call fcn.180047170
nop
jmp 0x18000c862
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001ec9d
cmp byte [rcx + 0x19], 2
jb 0x18001ec9d
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0xc
mov r9d, 0x1708
call fcn.180047190
xor eax, eax
jmp 0x18000d60a
mov r14d, 0xc0000017
jmp 0x18000c9c0
mov r14d, 0xc0000017
jmp 0x18000c9ca
mov edi, 0x482
jmp 0x18001ecf1
mov edi, 0x482
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001ecf8
cmp byte [rcx + 0x19], 2
jb 0x18001ecf8
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0xd
mov r9d, edi
call fcn.180047190
mov rcx, qword [0x180093040]
mov r12, qword [rsp + 0x60]
jmp 0x18000ca46
cmp byte [rcx + 0x19], 4
jb 0x18000caaf
mov rcx, qword [rcx + 0x10]
mov edx, 0x10
mov r9, r13
mov qword [rsp + 0x20], r15
call fcn.18004ba6c
nop
jmp 0x18000caaf
test r15, r15
je 0x18001ed5e
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001ed89
cmp byte [rcx + 0x19], 2
jb 0x18001ed89
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0xe
mov dword [rsp + 0x20], eax
mov r9, r15
call fcn.18004b680
jmp 0x18001ed89
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001ed89
cmp byte [rcx + 0x19], 2
jb 0x18001ed89
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0xf
mov r9d, eax
call fcn.180047190
lea r8, [0x1800965e8]
mov dword [rbp - 0x78], 1
xor edx, edx
mov ecx, 0xc0000bbb
call fcn.18004b234
test eax, eax
je 0x18001ee1c
mov rcx, qword [0x180096360]
lea rax, str.Open
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r15
test rcx, rcx
je 0x18001ee1c
mov qword [rsp + 0x40], r14
lea rax, [rbp - 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, 2
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], ax
mov r9d, 0xc0000bbb
mov qword [rsp + 0x20], r14
lea edx, [r8 + 1]
call sym.ADVAPI32.dll_ReportEventW
jmp 0x18001ee1c
test byte [rcx + 0x1c], 4
je 0x18001ee1c
cmp byte [rcx + 0x19], 2
jb 0x18001ee1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x11
mov r9, r15
call fcn.18004721c
mov r14d, 8
test edi, edi
je 0x18000cac4
mov r12, qword [rsp + 0x68]
jmp 0x18000d930
cmp byte [rcx + 0x19], 4
jb 0x18000cb8c
mov rcx, qword [rcx + 0x10]
mov edx, 0x14
mov r9, r13
mov qword [rsp + 0x20], r15
call fcn.18004ba6c
nop
jmp 0x18000cb8c
test r15, r15
je 0x18001ee90
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001eebb
cmp byte [rcx + 0x19], 2
jb 0x18001eebb
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x12
mov dword [rsp + 0x20], eax
mov r9, r15
call fcn.18004b680
jmp 0x18001eebb
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001eebb
cmp byte [rcx + 0x19], 2
jb 0x18001eebb
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x13
mov r9d, eax
call fcn.180047190
lea r8, [0x1800965e8]
xor edx, edx
mov ecx, 0xc0000bbb
call fcn.18004b234
test eax, eax
je 0x18001ef24
mov rcx, qword [0x180096360]
lea rax, str.Close
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r15
test rcx, rcx
je 0x18001ef24
xor r9d, r9d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], r9
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov eax, 2
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r9
lea edx, [r8 + 1]
mov r9d, 0xc0000bbb
call sym.ADVAPI32.dll_ReportEventW
mov dword [rbp - 0x78], 1
jmp 0x18000cb9d
mov dword [rbp - 0x2c], 1
jmp 0x18000cc33
cmp byte [rcx + 0x19], 4
jb 0x18000cc65
mov rcx, qword [rcx + 0x10]
mov edx, 0x17
mov r9, r12
mov qword [rsp + 0x20], r15
call fcn.18004ba6c
nop
jmp 0x18000cc65
test r15, r15
je 0x18001ef98
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001efc3
cmp byte [rcx + 0x19], 2
jb 0x18001efc3
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x15
mov dword [rsp + 0x20], edi
mov r9, r15
call fcn.18004b680
jmp 0x18001efc3
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001efc3
cmp byte [rcx + 0x19], 2
jb 0x18001efc3
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x16
mov r9d, edi
call fcn.180047190
lea r8, [0x1800965e8]
mov dword [rbp - 0x78], 1
xor edx, edx
mov ecx, 0xc0000bbb
call fcn.18004b234
test eax, eax
je 0x18001f033
mov rcx, qword [0x180096360]
lea rax, str.Collect
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r15
test rcx, rcx
je 0x18001f033
xor r9d, r9d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], r9
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov eax, 2
mov dword [rsp + 0x30], r9d
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], r9
lea edx, [r8 + 1]
mov r9d, 0xc0000bbb
call sym.ADVAPI32.dll_ReportEventW
test edi, edi
je 0x18000cc65
xor edi, edi
jmp 0x18000ccb3
mov r14d, 0xc0000017
jmp 0x18000cd71
mov r14d, 0xc0000017
jmp 0x18000cd7d
mov r14d, 0xc0000017
jmp 0x18000ce57
mov r14d, 0xc0000017
jmp 0x18000ce63
mov r12d, 0xc0000017
mov r13d, 0x430
jmp 0x18000cf59
mov r12d, 0xc0000017
mov r13d, 0x430
jmp 0x18000cf68
cmp r14d, 7
jne 0x18000d024
xor eax, eax
mov r13d, eax
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x70]
cmp word [rax], r13w
je 0x18001f0fa
cmp r13d, 0x40
jae 0x18001f0fa
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xa]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov ecx, eax
mov eax, r13d
inc r13d
mov dword [rsp + 0x78], r13d
mov dword [rbp + rax*4 + 0x80], ecx
or rax, 0xffffffffffffffff
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18001f0db
lea rdi, [rdi + rax*2]
add rdi, 2
cmp word [rdi], 0
jne 0x18001f0ae
jmp 0x18000d024
cmp word [rdi], 0
je 0x18000d024
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001f12c
cmp byte [rcx + 0x19], 2
jb 0x18001f12c
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x18
call fcn.180047170
lea r8, [0x1800965e8]
xor edx, edx
mov ecx, 0xc0000bba
call fcn.18004b234
test eax, eax
je 0x18000d024
mov rcx, qword [0x180096360]
test rcx, rcx
je 0x18000d024
xor r13d, r13d
xor r8d, r8d
mov qword [rsp + 0x40], r13
mov r9d, 0xc0000bba
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
lea edx, [r8 + 1]
mov word [rsp + 0x28], r13w
mov qword [rsp + 0x20], r13
call sym.ADVAPI32.dll_ReportEventW
nop
jmp 0x18000d027
cmp dword [rsp + 0x58], edi
jne 0x18000d07d
mov eax, dword [rbp - 0x74]
cmp dword [rbp - 0x30], 1
cmove eax, edi
mov dword [rbp - 0x74], eax
jmp 0x18000d07d
mov edi, 6
jmp 0x18001f1b4
mov r14, qword [rsp + 0x68]
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001f1df
cmp byte [rcx + 0x19], 2
jb 0x18001f1df
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x19
mov r9, r15
call fcn.18004721c
test edi, edi
jne 0x18001f499
xor r13d, r13d
jmp 0x18000d0b0
cmp dword [rsp + 0x58], 3
jne 0x18000d0f4
cmp dword [rsp + 0x50], 0x10
je 0x18000d10f
jmp 0x18000d0f4
cmp byte [rcx + 0x19], 4
jb 0x18000d105
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x1a
mov r9, r15
call fcn.18004721c
nop
jmp 0x18000d105
cmp dword [rsp + 0x58], 3
jne 0x18000d159
cmp dword [rsp + 0x50], 8
je 0x18000d172
jmp 0x18000d159
cmp byte [rcx + 0x19], 4
jb 0x18000d172
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x1b
call fcn.180047170
nop
jmp 0x18000d172
mov r10d, 0x80070057
jmp 0x18000d1b4
sub rcx, 2
mov r10d, 0x8007007a
jmp 0x18000d24f
test rdx, rdx
je 0x18000d253
mov rax, qword [rbp - 0x68]
mov word [rax], r13w
jmp 0x18000d253
xor eax, eax
mov qword [rsp + 0x70], rax
mov edi, eax
mov r12, rax
jmp 0x18000d90e
mov rcx, r12
call fcn.18000940c
xor eax, eax
mov qword [rsp + 0x70], r13
mov edi, eax
mov r12, r13
jmp 0x18000d90e
mov edi, 0xe
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001f2ab
cmp byte [rcx + 0x19], 2
jb 0x18001f2ab
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xe]
mov r9d, r12d
lea r8, [0x180071e60]
call fcn.180047190
mov r12, qword [rsp + 0x70]
jmp 0x18000d90e
mov rdi, qword [rbp - 0x40]
mov rax, qword [rbx]
test rsi, rsi
je 0x18001f315
mov qword [rsi], rax
jmp 0x18001f31c
mov qword [0x180096348], rax
mov edx, 1
mov rcx, rbx
call fcn.18004c964
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
dec dword [0x180096344]
mov rcx, rbx
call fcn.18000940c
nop
jmp 0x18000d2a3
mov rsi, qword [rbp - 0x38]
mov r13, qword [rsp + 0x68]
xor r14d, r14d
movzx edi, ax
jmp 0x18000d789
or eax, 1
jmp 0x18000d433
sub rdx, 2
mov r10d, 0x8007007a
dec r8
jmp 0x18000d632
lea rax, [rbx + rbx]
shr rax, 1
je 0x18001f388
mov rdx, rdi
mov word [rdi], r14w
mov rcx, rax
mov r8d, 0x80000000
lea eax, [r10 + r8]
test r8d, eax
jne 0x18000d64c
cmp r10d, 0x8007007a
jne 0x18000d652
jmp 0x18000d64c
xor r14d, r14d
test rbx, rbx
je 0x18000d652
mov word [rdi], r14w
jmp 0x18000d652
xor r14d, r14d
jmp 0x18000d652
mov word [rbp + 0x180], r14w
jmp 0x18000d68b
mov ecx, eax
mov ebx, r14d
call fcn.18000dc0c
mov edi, eax
jmp 0x18000d6e1
mov ebx, r14d
jmp 0x18000d6e1
mov dword [rbp + 0x20], 0x5c
lea rax, [0x18007d400]
jmp 0x18000d6fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
jmp 0x18000d73f
mov edi, r14d
jmp 0x18000d77e
test edi, edi
jne 0x18001f4a1
mov edi, 0xe
jmp 0x18001f4a1
mov eax, dword [r8]
cmp eax, dword [r8 + 4]
jae 0x18001f45b
inc eax
mov edx, 0x20
mov dword [r8], eax
mov ecx, eax
shl rcx, 7
add rcx, r8
mov r8, qword [rsi + 0x190]
mov qword [rsi + 0x1b8], rcx
call fcn.18000e694
nop
jmp 0x18000d5c6
inc dword [r8 + 8]
mov qword [rsi + 0x1b8], r14
jmp 0x18000d5c6
mov edi, 0xe
mov rcx, qword [0x180093040]
test byte [rcx + 0x1c], 4
je 0x18001f499
cmp byte [rcx + 0x19], 2
jb 0x18001f499
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0xf]
mov r9d, ebx
lea r8, [0x180071e60]
call fcn.180047190
mov r13, qword [rsp + 0x68]
xor r14d, r14d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [0x180093040]
mov ebx, dword [rbp - 0x78]
test byte [rcx + 0x1c], 4
je 0x18001f4db
cmp byte [rcx + 0x19], 2
jb 0x18001f4db
mov rcx, qword [rcx + 0x10]
lea r8, [0x180071e60]
mov edx, 0x1e
mov dword [rsp + 0x20], ebx
mov r9, r15
call fcn.18004b680
test ebx, ebx
je 0x18001f4f0
mov r8d, 1
mov rdx, r15
mov rcx, r13
call fcn.18004a704
mov rsi, qword [rbp - 0x38]
test rsi, rsi
je 0x18001f504
mov rcx, rsi
call fcn.18000940c
mov rsi, r14
mov r12, qword [rsp + 0x70]
jmp 0x18000d5c6