Function at 0x1800ecfa0
Capabilities:
Access the windows event log
Create service
Create thread
Delete service
Enumerate services

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1120]
mov eax, 0x1220
call fcn.1800fe7c0
sub rsp, rax
mov rax, qword [0x1801094f8]
xor rax, rsp
mov qword [rbp + 0x1110], rax
mov qword [rbp + 0xb8], rdx
mov dword [rsp + 0x74], ecx
movdqa xmm0, xmmword [0x180105260]
movdqa xmmword [rbp + 0x2f0], xmm0
mov byte [rbp + 0x2e0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x300], 0
movdqa xmmword [rbp + 0x330], xmm0
mov byte [rbp + 0x320], 0
movdqa xmmword [rbp + 0x360], xmm0
mov byte [rbp + 0x350], 0
movdqa xmmword [rbp + 0x380], xmm0
mov byte [rbp + 0x370], 0
xor ecx, ecx
mov qword [rbp + 0x160], rcx
mov word [rbp + 0x168], cx
movdqu xmmword [rbp + 0x17a], xmm0
mov byte [rbp + 0x16a], cl
mov qword [rbp + 0x130], rcx
mov word [rbp + 0x138], cx
movdqu xmmword [rbp + 0x14a], xmm0
mov byte [rbp + 0x13a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rcx
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x1b0], rcx
mov qword [rbp + 0x1b8], rcx
mov qword [rbp + 0x1c0], rcx
mov ecx, 0x30
call fcn.1800fe2e0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x1b8], rax
xor r8d, r8d
mov qword [rbp + 0x1c8], r8
xorps xmm2, xmm2
movsd qword [rbp + 0x1d0], xmm2
mov qword [rbp + 0x1d8], r8
mov r12d, 1
mov dword [rbp + 0x1e0], r12d
mov qword [rbp + 0x1e8], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
movdqa xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], r8
mov qword [rbp + 0x228], 0xffffffffffffffff
mov dword [rbp + 0x230], r8d
xor eax, eax
movups xmmword [rbp + 0x238], xmm0
movups xmmword [rbp + 0x248], xmm0
movups xmmword [rbp + 0x258], xmm0
movups xmmword [rbp + 0x268], xmm0
mov qword [rbp + 0x278], rax
movdqa xmm0, xmmword [0x180105260]
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], al
mov word [rbp + 0x2a0], r8w
mov dword [rbp + 0x2a4], r8d
mov qword [rbp + 0x2a8], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x2b0], xmm0
movsd qword [rbp + 0x2c0], xmm2
mov byte [rbp + 0x2c8], al
mov qword [rbp + 0x2cc], r8
mov edx, dword [rsp + 0x74]
mov ebx, edx
lea edi, [rdx + 0xf87]
cmp edx, edi
jae 0x1800ed271
lea edx, [rax + 0x6d]
lea esi, [rax + 0x6c]
mov eax, 0x6170
movabs rcx, 0x64002e0032
lea r9d, [r8 + 0x73]
lea r15d, [r8 + 0x6f]
lea r10d, [r8 + 0x68]
mov r13d, 0x7265
mov r8d, 0x7562
lea r14d, [r12 + 0x52]
mov r11d, 0x3366
nop word [rax + rax]
cmp ebx, 0x3c4
ja 0x1800ed4b4
je 0x1800ed4a0
cmp ebx, 0x1e7
ja 0x1800ed3fc
je 0x1800ed3e8
cmp ebx, 0xd5
ja 0x1800ed361
je 0x1800ed30c
mov eax, ebx
sub eax, 0xa
je 0x1800ed2e7
sub eax, 0x2c
je 0x1800ed2d6
cmp eax, 0x73
jne 0x1800ed25b
mov eax, 0x79
mov word [rbp + 0x803], ax
mov eax, 0x6170
add ebx, 0x9f
cmp ebx, edi
jb 0x1800ed200
mov edx, dword [rsp + 0x74]
xor r8d, r8d
lea eax, [rdx + 0x1a]
mov dword [rbp - 8], eax
cmp edx, eax
jae case.0x1800ed2d4.26
mov edi, 0x1bb
movzx r15d, byte [rsp + 0x70]
movzx esi, byte [rsp + 0x7c]
movzx ebx, byte [rsp + 0x70]
mov dword [rbp - 0x70], ebx
movzx r14d, byte [rsp + 0x70]
mov r13, qword [rbp + 0x18]
mov r11d, 0x6b73
mov r10d, 0x36
lea r9, [0x180000000]
lea eax, [rdx - 0xa]
cmp eax, 0x34
ja case.0x1800ed2d4.36
movzx eax, byte [r9 + rax + 0xeeb44]
mov ecx, dword [r9 + rax*4 + 0xeead8]
add rcx, r9
jmp rcx
mov eax, 0x41
mov word [rbp + 0x820], ax
jmp 0x1800ed25b
mov word [rbp + 0x800], r9w
mov eax, 0x61
mov word [rbp + 0x801], ax
mov eax, 0x69
mov word [rbp + 0x802], ax
jmp 0x1800ed25b
mov r8d, 3
lea rdx, [0x180103370]
lea rcx, [rbp + 0x821]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0x823], 0x4c414f
mov word [rbp + 0x826], 0x4c
movabs rcx, 0x64002e0032
mov edx, 0x6d
mov r8d, 0x7562
lea r9d, [rdx + 6]
lea r10d, [rdx - 5]
mov r11d, 0x3366
jmp 0x1800ed25b
mov eax, ebx
sub eax, 0x148
je 0x1800ed3bd
cmp eax, 0x2c
jne 0x1800ed25b
mov eax, 0x41
mov word [rbp + 0x827], ax
lea r8d, [rax - 0x3f]
lea rdx, [0x180103368]
lea rcx, [rbp + 0x820]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8, r12
lea rdx, [0x18010336c]
lea rcx, [rbp + 0x820]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x850], 0x4e736e64
jmp 0x1800ed339
mov word [rbp + 0x804], r15w
mov word [rbp + 0x805], r10w
mov eax, 0x61
mov word [rbp + 0x806], ax
mov dword [rbp + 0x807], 0x632e6b63
jmp 0x1800ed25b
mov word [rbp + 0x80b], r15w
mov word [rbp + 0x80c], dx
jmp 0x1800ed260
mov eax, ebx
sub eax, 0x213
je 0x1800ed473
sub eax, 0x73
je 0x1800ed462
sub eax, 0x2c
je 0x1800ed44e
sub eax, 0x73
je 0x1800ed43d
cmp eax, 0x2c
jne 0x1800ed25b
movzx eax, word [0x1801033c5]
mov word [rbp + 0x85a], ax
movzx eax, byte [0x1801033c7]
mov byte [rbp + 0x85c], al
jmp 0x1800ed25b
mov eax, 0x5f
mov word [rbp + 0x831], ax
jmp 0x1800ed25b
mov word [rbp + 0x858], r13w
mov byte [rbp + 0x85a], 0
jmp 0x1800ed25b
mov eax, 0x5f
mov word [rbp + 0x830], ax
jmp 0x1800ed25b
mov byte [rbp + 0x854], 0
mov r8d, 4
lea rdx, [0x18010335c]
lea rcx, [rbp + 0x854]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x858], 0
jmp 0x1800ed339
mov dword [rbp + 0x832], 0x697562
mov esi, 0x6c
jmp 0x1800ed260
cmp ebx, 0x5cd
ja 0x1800ed603
je 0x1800ed5c0
cmp ebx, 0x502
ja 0x1800ed561
je 0x1800ed54b
mov eax, ebx
sub eax, 0x3f0
je 0x1800ed51f
sub eax, 0x73
je 0x1800ed4fd
cmp eax, 0x2c
mov eax, 0x6170
jne 0x1800ed260
mov word [rbp + 0x7f3], r14w
jmp 0x1800ed260
mov word [rbp + 0x835], si
mov dword [rbp + 0x836], 0x6e6974
mov eax, 0x695f
mov word [rbp + 0x839], ax
jmp 0x1800ed25b
mov byte [rbp + 0x85d], 0
mov eax, 0x57
mov word [rbp + 0x7f0], ax
mov word [rbp + 0x7f1], r14w
mov eax, 0x41
mov word [rbp + 0x7f2], ax
jmp 0x1800ed25b
mov dword [rbp + 0x83b], 0x5f323361
mov word [rbp + 0x83f], ax
jmp 0x1800ed260
mov eax, ebx
sub eax, 0x52e
je 0x1800ed5a3
cmp eax, 0x73
jne 0x1800ed25b
mov eax, 0x64
mov word [rbp + 0x841], ax
mov word [rbp + 0x842], ax
mov eax, 0x71
mov word [rbp + 0x843], ax
mov eax, 0x32
mov word [rbp + 0x844], ax
jmp 0x1800ed25b
mov eax, 0x74
mov word [rbp + 0x7f4], ax
mov eax, 0x61
mov word [rbp + 0x7f5], ax
jmp 0x1800ed25b
mov r15d, 0x72
mov word [rbp + 0x7f6], r15w
mov r15d, 0x74
mov word [rbp + 0x7f7], r15w
mov r15d, 0x75
mov word [rbp + 0x7f8], r15w
mov r15d, 0x70
mov word [rbp + 0x7f9], r15w
mov r15d, 0x6f
jmp 0x1800ed260
cmp ebx, 0x66c
je 0x1800ed6d4
cmp ebx, 0x70b
je 0x1800ed6ac
cmp ebx, 0x7aa
je 0x1800ed68d
cmp ebx, 0x849
je 0x1800ed666
cmp ebx, 0x8e8
jne 0x1800ed260
mov r9d, 0x74
mov word [rbp + 0x819], r9w
mov r9d, 0x5f
mov word [rbp + 0x81a], r9w
mov word [rbp + 0x81b], r11w
mov r9d, 0x73
jmp 0x1800ed260
mov r10d, 0x5f
mov word [rbp + 0x817], r10w
mov r10d, 0x67
mov word [rbp + 0x818], r10w
mov r10d, 0x68
jmp 0x1800ed260
mov dword [rbp + 0x810], 0x6d635f76
mov dword [rbp + 0x814], 0x787370
mov r13d, 0x7265
jmp 0x1800ed260
movsd xmm0, qword [str.s2_3]
movsd qword [rbp + 0x8fa], xmm0
mov qword [rbp + 0x902], rcx
mov dword [rbp + 0x908], esi
mov dword [rbp + 0x90a], esi
jmp 0x1800ed25b
mov dword [rbp + 0x8f8], 0x77
jmp 0x1800ed260
mov byte [rbp + 0x84c], 0
jmp case.0x1800ed2d4.36
mov eax, 0x32
mov word [rbp + 0x81d], ax
jmp case.0x1800ed2d4.36
mov eax, dword [0x1801094b0]
mov dword [rbp - 0x78], eax
mov r8d, 0x31
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x20]
call fcn.1800e9e10
mov dword [rbp - 0x14], r12d
jmp 0x1800edcc2
lea r8, [rbp + 0x8f8]
lea rdx, [rbp + 0x7f0]
mov ecx, 0x7a
call fcn.1800fafd0
mov qword [rbp + 0xa8], rax
mov dword [rbp - 0x40], 0x400
lea rdx, [rbp + 0x850]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov qword [rbp - 0x68], rax
jmp 0x1800edcc2
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithSidW]
xor r8d, r8d
mov dword [rbp - 0x80], r8d
mov edx, dword [rsp + 0x74]
jmp case.0x1800ed2d4.36
mov qword [rbp + 0x90], 0xffffffffffffffff
xor edi, edi
mov dword [rbp + 0x98], edi
mov ebx, 0x4c
lea esi, [rdi + 0x57]
lea r12d, [rdi + 0x41]
mov eax, ebx
sub eax, 0x48
je 0x1800ed806
sub eax, 4
je 0x1800ed7be
sub eax, 1
je 0x1800ed80c
cmp eax, 1
je 0x1800ed813
jmp 0x1800ed80c
lea r9, [rbp + 0x90]
mov r8d, esi
xor edx, edx
xor ecx, ecx
call fcn.1800f8e30
test al, al
je 0x1800ed813
lea r9, [rbp + 0x2e0]
lea r8, [rbp + 0x350]
lea rdx, [rbp + 0x90]
mov ecx, r12d
call fcn.1800fc410
xor edx, edx
lea r8d, [rdx + 0x33]
lea rcx, [rbp + 0x90]
call fcn.1800e71c0
jmp 0x1800ed80c
mov dword [rbp + 0x2e0], edi
inc ebx
cmp ebx, 0x50
jb 0x1800ed7a6
mov edi, 0x1bb
mov word [rbp - 0x78], di
lea r9, [0x180109468]
lea r8, [rbp + 0x160]
mov edx, 0xad
lea rcx, [rbp - 0x78]
call fcn.1800f9e70
movzx esi, byte [rsp + 0x7c]
mov r12d, 1
jmp 0x1800edcc2
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
mov word [rbp - 0x78], di
lea r9, [rbp - 0x78]
lea r8, [0x180109488]
mov edx, 0x87
lea rcx, [rbp + 0x130]
call fcn.1800f7920
xor edx, edx
lea r8d, [rdx + 0x1a]
lea rcx, [rbp + 0x20]
call fcn.1800f4b80
jmp 0x1800edcc2
mov byte [rsp + 0x78], 1
mov byte [rsp + 0x70], 1
mov qword [rbp + 0x10], r8
jmp case.0x1800ed2d4.36
mov word [rbp + 0x340], di
mov qword [rbp + 8], r8
xor r8d, r8d
lea rdx, [rbp + 0x320]
lea ecx, [r8 + 0x29]
call fcn.1800ef7c0
jmp 0x1800edcc2
lea rdx, [0x180109408]
mov ecx, r10d
call fcn.1800ecfa0
test al, al
jne 0x1800edc81
xor edi, edi
mov ebx, edi
nop
cmp ebx, 0x12
ja case.default.0x1800ed8fc
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xeeb7c]
add rcx, rdx
jmp rcx
mov dword [rbp + 0x860], 0x64
jmp case.default.0x1800ed8fc
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, [rbp + 0x8c0]
lea rdx, [rbp + 0x860]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rbp + 0x70], rax
jmp case.default.0x1800ed8fc
xorps xmm0, xmm0
movups xmmword [rbp + 0x888], xmm0
movups xmmword [rbp + 0x898], xmm0
movups xmmword [rbp + 0x8a8], xmm0
mov dword [rbp + 0x888], 0x30
jmp case.default.0x1800ed8fc
mov dword [rbp - 0x50], 3
jmp case.default.0x1800ed8fc
lea rcx, [rbp + 0x8c0]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800ed9b0
movsd xmm0, qword [0x1801033f0]
movsd qword [rcx], xmm0
mov eax, dword [0x1801033f8]
mov dword [rcx + 8], eax
movzx eax, word [0x1801033fc]
mov word [rcx + 0xc], ax
movabs rax, 0x4500740078
mov qword [rbp + 0x8f0], rax
mov r15b, 1
jmp case.default.0x1800ed8fc
lea rax, [rbp + 0x860]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x1800eda00
movsd xmm0, qword [0x180103400]
movsd qword [rax], xmm0
jmp case.default.0x1800ed8fc
mov dword [rbp + 0x87a], 0x20
mov eax, dword [0x180103408]
mov dword [rbp + 0x87c], eax
mov eax, 0x72
mov dword [rbp + 0x880], eax
mov word [rbp + 0x8c0], di
jmp case.default.0x1800ed8fc
mov eax, 0x69
mov dword [rbp + 0x8e0], eax
mov r8, r12
lea rdx, [0x180102310]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x1800ed8fc
lea rax, [rbp + 0x8c0]
sub rax, 2
nop word [rax + rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x1800eda80
movsd xmm0, qword [0x180103418]
movsd qword [rax], xmm0
jmp case.default.0x1800ed8fc
mov byte [rsp + 0x79], 1
mov qword [rbp + 0xa0], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x70], rdi
jmp case.default.0x1800ed8fc
lea r9, [rbp - 0x60]
mov r8d, dword [rbp - 0x4c]
lea rdx, [rbp + 0x888]
lea rcx, [rbp + 0xf0]
call sub.ADVAPI32.dll_LsaOpenPolicy
mov ecx, edi
movzx eax, byte [rsp + 0x79]
mov rdi, qword [rbp + 0x70]
test rdi, rdi
cmovne ecx, eax
mov byte [rsp + 0x79], cl
movzx r15d, r15b
cmp qword [rbp - 0x60], 0
mov eax, 0
cmove r15d, eax
cmp cl, al
je 0x1800edb36
lea rax, [rbp - 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor edi, edi
jmp case.default.0x1800ed8fc
mov r8d, 2
lea rdx, [0x180103420]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x1800ed8fc
mov dword [rbp - 0x4c], edi
mov dword [rbp - 0x48], edi
jmp case.default.0x1800ed8fc
mov r8d, 2
lea rdx, [0x180103410]
lea rcx, [rbp + 0x868]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.default.0x1800ed8fc
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x44], edi
mov qword [rbp + 0x18], rdi
jmp case.default.0x1800ed8fc
mov eax, dword [0x180103428]
mov dword [rbp + 0x86a], eax
movabs rax, 0x2000650064
mov qword [rbp + 0x86e], rax
mov dword [rbp + 0x874], 0x7b
lea rcx, [rbp + 0x860]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800edbd0
mov eax, dword [0x180103430]
mov dword [rcx], eax
movzx eax, word [0x180103434]
mov word [rcx + 4], ax
jmp case.default.0x1800ed8fc
lea rcx, [rbp + 0x8c0]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x1800edc00
mov eax, dword [0x180103438]
mov dword [rcx], eax
movzx eax, word [0x18010343c]
mov word [rcx + 4], ax
jmp case.default.0x1800ed8fc
movsd xmm0, qword [str.CA19Ke]
movsd qword [rbp + 0x8c6], xmm0
mov eax, dword [0x180103448]
mov dword [rbp + 0x8ce], eax
mov eax, 0x79
mov dword [rbp + 0x8d2], eax
lea r8d, [rax - 0x77]
lea rdx, [0x180103450]
lea rcx, [rbp + 0x8d4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x74
mov dword [rbp + 0x8d6], eax
inc ebx
lea eax, [rbx + 0xc7]
cmp eax, 0xda
jb 0x1800ed8e0
mov edi, 0x1bb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov sil, 1
mov byte [rsp + 0x7c], sil
lea rax, [rbp + 0x800]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800edca5
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x2e0]
call fcn.1800fbcc0
mov edx, dword [rsp + 0x74]
xor r8d, r8d
inc edx
mov dword [rsp + 0x74], edx
cmp edx, dword [rbp - 8]
jae case.0x1800ed2d4.26
mov ebx, dword [rbp - 0x70]
jmp 0x1800ed2a1
lea r9, [0x180109400]
lea r8, [rbp + 0x20]
mov edx, 0x2f
lea rcx, [rbp + 0x1b0]
call fcn.1800f7920
mov edx, 0x29
lea rcx, [rbp + 0x1b0]
call fcn.1800e82b0
test sil, sil
je 0x1800edcc2
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x910]
lea rdx, [rbp + 0x830]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameA]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800edcc2
mov eax, 0x35
mov word [rbp + 0x845], ax
mov word [rbp + 0x846], r10w
jmp case.0x1800ed2d4.36
cmp byte [rsp + 0x78], 0
je 0x1800edd89
lea r9, [rbp - 0x40]
lea r8, [rbp + 0xd10]
lea rdx, [rbp + 0x820]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetServiceDisplayNameA]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [rsp + 0x74]
mov edi, 0x1bb
cmp byte [rsp + 0x70], 0
je 0x1800edcc6
lea rdx, [rbp + 0x810]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenBackupEventLogA]
mov qword [rbp - 0x68], rax
test rax, rax
jne 0x1800eddbc
xor cl, cl
mov byte [rsp + 0x70], cl
mov edi, 0x1bb
jmp 0x1800edcc2
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov edi, 0x1bb
jmp 0x1800edcc2
mov dword [rbp - 0x30], r12d
mov rdi, qword [rbp - 0x68]
test rdi, rdi
je 0x1800eddeb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor edi, edi
mov qword [rbp - 0x68], rdi
mov ecx, 0x202
lea rdx, [rbp + 0x650]
call qword [rbp + 0xa8]
test eax, eax
je 0x1800eddb2
mov ebx, edi
cmp ebx, 0xc
ja case.default.0x1800ede1f
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0xeebc8]
add rcx, rdx
jmp rcx
mov qword [rbp], rdi
jmp case.default.0x1800ede1f
mov dword [rbp + 0x8bc], 0x54
jmp case.default.0x1800ede1f
lea r8, [rbp]
mov edx, dword [rbp - 0x3c]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rbp - 0x38], eax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x410], xmm0
movups xmmword [rbp + 0x420], xmm0
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x440], xmm0
movups xmmword [rbp + 0x450], xmm0
movups xmmword [rbp + 0x460], xmm0
movups xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0x480], rax
jmp case.default.0x1800ede1f
mov eax, 0x74
mov dword [rbp + 0x8a0], eax
lea rax, [rbp + 0x888]
sub rax, 2
nop dword [rax + rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x1800edeb0
movsd xmm0, qword [0x180103458]
movsd qword [rax], xmm0
mov r8, r12
lea rdx, [0x180102310]
lea rcx, [rbp + 0x888]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, r12
lea rdx, [0x180103414]
lea rcx, [rbp + 0x888]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x1800ede1f
cmp byte [rsp + 0x7a], 0
je 0x1800edf14
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, edi
movzx eax, byte [rsp + 0x7b]
cmp dword [rbp - 0x34], 0
cmove ecx, eax
mov byte [rsp + 0x7b], cl
cmp cl, 0
je 0x1800edf5b
lea r8, [rbp + 0x410]
lea rdx, [rbp + 0x888]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_UpdateTraceW]
lea r8, [rbp + 0x390]
lea rdx, [rbp + 0x888]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_StopTraceW]
mov byte [rbp - 0x80], 0
jmp case.default.0x1800ede1f
mov byte [rsp + 0x7a], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0xb0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x390], xmm0
movups xmmword [rbp + 0x3a0], xmm0
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3c0], xmm0
movups xmmword [rbp + 0x3d0], xmm0
movups xmmword [rbp + 0x3e0], xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], rax
mov dword [rbp - 0x3c], 0x20008
jmp case.default.0x1800ede1f
mov eax, dword [0x180103460]
mov dword [rbp + 0x8ac], eax
mov eax, dword [0x180103468]
mov dword [rbp + 0x8b0], eax
movzx eax, word [0x18010346c]
mov word [rbp + 0x8b4], ax
jmp case.default.0x1800ede1f
mov eax, 0x5f
mov dword [rbp + 0x8b4], eax
mov eax, dword [0x180103470]
mov dword [rbp + 0x8b6], eax
mov dword [rbp + 0x8ba], 0x49
jmp case.default.0x1800ede1f
mov ecx, edi
movzx eax, byte [rsp + 0x7a]
cmp dword [rbp - 0x38], 0
cmovne ecx, eax
mov byte [rsp + 0x7a], cl
jmp case.default.0x1800ede1f
mov byte [rsp + 0x7b], 1
jmp case.default.0x1800ede1f
movsd xmm0, qword [str.Phx.Cx]
movsd qword [rbp + 0x888], xmm0
mov eax, dword [0x180103480]
mov dword [rbp + 0x890], eax
movabs rax, 0x4c00490078
mov qword [rbp + 0x894], rax
mov r8d, 3
lea rdx, [0x180103488]
lea rcx, [rbp + 0x89a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x6e
mov dword [rbp + 0x89e], eax
jmp case.default.0x1800ede1f
lea r8, [rbp + 0x390]
lea rdx, [rbp + 0x888]
lea rcx, [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_StartTraceW]
mov dword [rbp - 0x34], eax
inc ebx
lea ecx, [rbx + 0x111]
cmp ecx, 0x11e
jb 0x1800ede03
mov edi, 0x1bb
jmp 0x1800edcc2
mov qword [rbp - 0x68], r8
jmp case.0x1800ed2d4.36
mov r8d, dword [rbp - 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x810]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_BackupEventLogA]
mov dword [rbp - 0xc], eax
mov r8d, 0x17
mov rdx, qword [rbp + 0xb8]
xor ecx, ecx
call fcn.1800f06f0
test al, al
jne 0x1800edcc2
mov edi, 0x7b
nop dword [rax + rax]
cmp edi, 0x13b
ja 0x1800ee1d5
je 0x1800ee18f
mov eax, edi
sub eax, 0x7b
je 0x1800ee175
sub eax, 0x40
je 0x1800ee155
cmp eax, 0x40
jne 0x1800ee251
xor eax, eax
mov qword [rbp - 0x58], rax
lea r8, [rbp - 0x58]
mov edx, dword [rbp - 0x2c]
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rbp - 0x28], eax
jmp 0x1800ee251
mov dword [rbp - 0x2c], 0x20008
xor edx, edx
mov r8d, 0x1c0
lea rcx, [rbp + 0x490]
call sub.VCRUNTIME140.dll_memset
jmp 0x1800ee251
mov r14b, 1
movzx ebx, r14b
mov dword [rbp - 0x70], ebx
mov qword [rbp + 0xc0], 0xffffffffffffffff
jmp 0x1800ee251
lea rcx, [rbp + 0x490]
call qword [sym.imp.ADVAPI32.dll_OpenTraceA]
mov qword [rbp + 0xc8], rax
xor r8d, r8d
mov edx, r8d
movzx ecx, r14b
cmp dword [rbp - 0x28], r8d
cmovne edx, ecx
movzx r14d, dl
lea rcx, [rax + 1]
movabs rax, 0xfffffffeffffffff
test rax, rcx
movzx ebx, bl
cmove ebx, r8d
mov dword [rbp - 0x70], ebx
jmp 0x1800ee254
mov eax, edi
sub eax, 0x17b
je 0x1800ee205
sub eax, 0x40
je 0x1800ee1ee
cmp eax, 0x40
je case.0x1800ed2d4.26
jmp 0x1800ee251
test bl, bl
je 0x1800ee1ff
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_CloseTrace]
mov byte [rbp - 0x80], 0
jmp 0x1800ee251
test r14b, r14b
je 0x1800ee251
mov ebx, 9
nop
mov eax, ebx
sub eax, 8
je 0x1800ee238
cmp eax, 1
jne 0x1800ee247
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp qword [rbp - 0x58], 0xffffffffffffffff
jne 0x1800ee247
xor r14b, r14b
jmp 0x1800ee247
test r14b, r14b
je 0x1800ee247
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec ebx
cmp ebx, 7
ja 0x1800ee210
mov ebx, dword [rbp - 0x70]
xor r8d, r8d
add edi, 0x40
cmp edi, 0x23b
jb 0x1800ee110
mov edx, dword [rsp + 0x74]
mov edi, 0x1bb
jmp case.0x1800ed2d4.36
mov r8, r12
lea rdx, [0x180103490]
lea rcx, [rbp + 0x300]
jmp 0x1800edcbd
xor eax, eax
mov qword [rbp + 0x190], rax
mov dword [rbp + 0x198], eax
mov ecx, r8d
movzx eax, sil
cmp qword [rbp + 8], 0
cmovne ecx, eax
movzx esi, cl
mov byte [rsp + 0x7c], cl
jmp case.0x1800ed2d4.36
lea rax, [rbp + 0x20]
mov qword [rbp + 0xe0], rax
mov eax, dword [0x1801094b0]
mov dword [rbp + 0xe8], eax
mov eax, dword [0x1801094b4]
mov dword [rbp + 0xec], eax
movaps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x100], xmm0
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
lea r9, [rbp + 0x100]
lea r8, [0x1800f64a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x80], rax
cmp rax, rdi
jne 0x1800eddb2
mov ebx, 0x84
nop dword [rax + rax]
cmp ebx, 0x66c
ja 0x1800ee535
je 0x1800ee522
cmp ebx, 0x324
ja 0x1800ee464
je 0x1800ee417
cmp ebx, 0x84
je 0x1800ee408
cmp ebx, 0x12c
je 0x1800ee3e9
cmp ebx, 0x1d4
je 0x1800ee3ca
cmp ebx, 0x27c
jne 0x1800ee6bb
mov r8d, 2
lea rdx, [0x1801034dc]
lea rcx, [rbp + 0x860]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 4
lea rdx, [0x18010350e]
lea rcx, [rbp + 0x872]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rbp + 0x87a], di
mov eax, dword [0x18010351c]
mov dword [rbp + 0x8c0], eax
movzx eax, word [0x180103520]
mov word [rbp + 0x8c4], ax
jmp 0x1800ee6bb
mov r8d, 2
lea rdx, [0x1801034a4]
lea rcx, [rbp + 0x860]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800ee6bb
mov r8d, 4
lea rdx, [0x18010355a]
lea rcx, [rbp + 0x860]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800ee6bb
mov dword [rbp + 0x860], 0x56
jmp 0x1800ee6bb
mov eax, 0x67
mov dword [rbp + 0x8c4], eax
lea rcx, [rbp + 0x8c0]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1800ee430
movsd xmm0, qword [str.NoFor]
movsd qword [rcx], xmm0
mov eax, dword [0x180103570]
mov dword [rcx + 8], eax
movabs rax, 0x4300650063
mov qword [rbp + 0x8d0], rax
jmp 0x1800ee6bb
cmp ebx, 0x3cc
je 0x1800ee4e7
cmp ebx, 0x474
je 0x1800ee4c8
cmp ebx, 0x51c
je 0x1800ee4ac
cmp ebx, 0x5c4
jne 0x1800ee6bb
mov r8d, 2
lea rdx, [0x1801022f8]
lea rcx, [rbp + 0x8e2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov byte [rsp + 0x7d], 1
jmp 0x1800ee6bb
mov r8, r12
lea rdx, [0x180103574]
lea rcx, [rbp + 0x8c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800ee6bb
mov eax, dword [0x180103524]
mov dword [rbp + 0x8dc], eax
movzx eax, word [0x180103528]
mov word [rbp + 0x8e0], ax
jmp 0x1800ee6bb
lea rcx, [rbp + 0x8c0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x1800ee4f2
mov eax, dword [0x18010352c]
mov dword [rcx], eax
mov eax, dword [0x180103530]
mov dword [rbp + 0x8d8], eax
movzx eax, word [0x180103534]
mov word [rbp + 0x8dc], ax
jmp 0x1800ee6bb
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0xd0], rdi
jmp 0x1800ee6bb
cmp ebx, 0x9b4
ja 0x1800ee5c1
je 0x1800ee5b9
cmp ebx, 0x714
je 0x1800ee5a2
cmp ebx, 0x7bc
je 0x1800ee59a
cmp ebx, 0x864
je 0x1800ee586
cmp ebx, 0x90c
jne 0x1800ee6bb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x888], xmm0
movups xmmword [rbp + 0x898], xmm0
mov qword [rbp + 0x8a8], rax
jmp 0x1800ee6bb
xor eax, eax
mov qword [rbp + 0x1a0], rax
mov dword [rbp + 0x1a8], eax
jmp 0x1800ee6bb
mov dword [rbp - 0x20], edi
jmp 0x1800ee6bb
mov eax, 8
mov word [rbp + 0x8a], ax
mov r13, rdi
mov dword [rbp - 0x1c], edi
jmp 0x1800ee6bb
mov dword [rbp - 0x24], edi
jmp 0x1800ee6bb
cmp ebx, 0xa5c
je 0x1800ee661
cmp ebx, 0xb04
je 0x1800ee625
cmp ebx, 0xbac
je 0x1800ee5ee
cmp ebx, 0xc54
je case.0x1800ed2d4.26
jmp 0x1800ee6bb
cmp byte [rsp + 0x7d], dil
je 0x1800ee61c
lea r8, [rbp + 0x888]
mov edx, 4
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 0x80], r12d
jmp 0x1800ee6bb
mov eax, dword [rbp - 0x18]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x24]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x1a0]
mov r8d, dword [rbp - 0x20]
mov edx, dword [rbp - 0x1c]
lea rcx, [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_AddAuditAccessAce]
mov ecx, edi
movzx eax, byte [rsp + 0x7d]
test r13, r13
cmovne ecx, eax
mov byte [rsp + 0x7d], cl
jmp 0x1800ee6bb
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, [rbp + 0x8c0]
lea rdx, [rbp + 0x860]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov r13, rax
mov dword [rbp - 0x18], edi
add ebx, 0xa8
cmp ebx, 0xcfc
jb 0x1800ee320
mov edi, 0x1bb
jmp 0x1800edcc2
mov r8d, dword [rbp - 0x14]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x1800e9fa0]
mov qword [rbp - 0x78], rax
xor r8d, r8d
lea rdx, [rbp - 0x78]
mov ecx, 0xd5
call fcn.1800ec750
jmp 0x1800edcc2
mov dword [rbp - 0x10], 0x400
lea rax, [rbp + 0x160]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x28]
cmp rax, qword [rbp + 0x30]
je 0x1800ee74b
lea rcx, [rbp + 0x160]
mov qword [rax], rcx
mov rdx, qword [rbp + 0x28]
add rdx, 8
mov qword [rbp + 0x28], rdx
jmp 0x1800ee760
lea r8, [rbp - 0x78]
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x20]
call fcn.1800e47a0
mov rdx, qword [rbp + 0x28]
lea rax, [rbp + 0x130]
mov qword [rbp - 0x78], rax
cmp rdx, qword [rbp + 0x30]
je 0x1800ee785
lea rax, [rbp + 0x130]
mov qword [rdx], rax
add qword [rbp + 0x28], 8
jmp 0x1800edcc2
lea r8, [rbp - 0x78]
lea rcx, [rbp + 0x20]
call fcn.1800e47a0
jmp 0x1800edcc2
mov dword [rbp + 0x847], 0x616d5f
jmp case.0x1800ed2d4.36
mov word [rbp + 0x84a], r11w
jmp case.0x1800ed2d4.36
mov ecx, r8d
movzx eax, byte [rsp + 0x78]
cmp qword [rbp + 0x10], 0
cmovne ecx, eax
movzx eax, cl
mov byte [rsp + 0x78], cl
cmp dword [rbp - 0xc], 0
jne case.0x1800ed2d4.36
xor cl, cl
mov byte [rsp + 0x70], cl
mov byte [rsp + 0x78], al
jmp case.0x1800ed2d4.36
test r15b, r15b
je 0x1800ee823
lea r8, [rbp + 0x18]
mov edx, 2
mov rcx, qword [rbp - 0x60]
call sub.ADVAPI32.dll_LsaQueryDomainInformationPolicy
mov rcx, qword [rbp - 0x60]
call sub.ADVAPI32.dll_LsaClose
jmp 0x1800ee823
mov qword [rsp + 0x20], r8
mov r9d, 0xca
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800e9a40
mov byte [rbp - 0x80], al
mov r12d, dword [rbp - 0x80]
lea rcx, [rbp + 0x228]
call fcn.1800e6820
mov rbx, qword [rbp + 0x210]
test rbx, rbx
je 0x1800ee8ac
mov rdi, qword [rbp + 0x218]
cmp rbx, rdi
je 0x1800ee85f
mov rcx, rbx
call fcn.1800fb770
add rbx, 0x20
cmp rbx, rdi
jne 0x1800ee847
mov rbx, qword [rbp + 0x210]
mov rdx, qword [rbp + 0x220]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800ee88e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800ee8e9
mov rcx, rbx
call fcn.1800fe31c
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x210], xmm0
xor esi, esi
mov qword [rbp + 0x220], rsi
jmp 0x1800ee8ae
xor esi, esi
mov rcx, qword [rbp + 0x1f8]
test rcx, rcx
je 0x1800ee907
mov rdx, qword [rbp + 0x208]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ee8f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ee8f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800fe31c
mov qword [rbp + 0x1f8], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x200], xmm0
lea rcx, [rbp + 0x1b8]
call fcn.1800e6750
nop
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x1800ee9ab
mov rdi, qword [rbp + 0x40]
cmp rbx, rdi
je 0x1800ee945
nop word [rax + rax]
mov rcx, rbx
call fcn.1800e6060
add rbx, 0x28
cmp rbx, rdi
jne 0x1800ee930
mov rbx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x48]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800ee997
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ee997
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800fe31c
mov qword [rbp + 0x38], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
mov rdx, qword [rbp + 0x20]
test rdx, rdx
je 0x1800ee9d4
mov r8, qword [rbp + 0x30]
sub r8, rdx
sar r8, 3
lea rcx, [rbp + 0x20]
call fcn.1800fc9f0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rsi
mov rdx, qword [rbp + 0x152]
cmp rdx, 0x10
jb 0x1800eea18
inc rdx
mov rcx, qword [rbp + 0x13a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800eea13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800eea13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800fe31c
movdqa xmm0, xmmword [0x180105260]
movdqu xmmword [rbp + 0x14a], xmm0
mov byte [rbp + 0x13a], 0
mov rdx, qword [rbp + 0x182]
cmp rdx, 0x10
jb 0x1800eea73
inc rdx
mov rcx, qword [rbp + 0x16a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800eea6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800eea6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800fe31c
movdqa xmm0, xmmword [0x180105260]
movdqu xmmword [rbp + 0x17a], xmm0
mov byte [rbp + 0x16a], 0
lea rcx, [rbp + 0x350]
call fcn.1800e63c0
nop
lea rcx, [rbp + 0x2e0]
call fcn.1800e6470
mov eax, r12d
mov rcx, qword [rbp + 0x1110]
xor rcx, rsp
call fcn.1800fe830
lea r11, [rsp + 0x1220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret