Function at 0x18001b650
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
xor ebp, ebp
mov rsi, r8
mov rdi, rcx
cmp edx, 0xd2
jg 0x18001bf63
je 0x18001bf4d
lea eax, [rdx - 3]
cmp eax, 0xcc
ja case.0x18001d7de.40296
lea r8, sym.usermode.dll__q_Qc_aAjQz7hd_8AArZ1jhGIM:9enOvl_
cdqe
movzx eax, byte [r8 + rax + 0x1d9f8]
mov ecx, dword [r8 + rax*4 + 0x1d8a8]
add rcx, r8
jmp rcx
mov eax, dword [rsi]
cmp eax, 0xffffffff
jl 0x18001d78e
mov dword [rdi + 0x6e8], eax
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
test eax, eax
js 0x18001d78e
mov qword [rdi + 0xa68], rax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xae7], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xae8], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xae5], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xae0], al
jmp case.0x18001c439.10029
mov edx, dword [rsi]
test edx, edx
mov ecx, dword [rdi + 0xb54]
setne al
mov byte [rdi + 0xada], al
mov eax, ecx
and eax, 0xffffffef
or ecx, 0x10
test edx, edx
cmove ecx, eax
mov dword [rdi + 0xb54], ecx
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
test ecx, ecx
setne al
mov byte [rdi + 0xae3], al
test ecx, ecx
je 0x18001b75e
mov byte [rdi + 0x56a], 5
jmp case.0x18001c439.10029
cmp byte [rdi + 0x56a], 5
jne case.0x18001c439.10029
mov byte [rdi + 0x56a], bpl
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xadb], al
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
test ecx, ecx
setne al
mov byte [rdi + 0xae4], al
test ecx, ecx
je 0x18001b7ac
mov al, 4
mov byte [rdi + 0xae3], bpl
mov byte [rdi + 0x56a], al
jmp case.0x18001c439.10029
xor al, al
mov byte [rdi + 0x56a], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xacf], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0x20c49b
ja 0x18001d78e
imul eax, eax, 0x3e8
mov dword [rdi + 0x304], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0x310], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 2
ja 0x18001d78e
mov byte [rdi + 0x738], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad1], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 3
ja 0x18001d78e
mov byte [rdi + 0x568], al
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
mov qword [rdi + 0x560], rax
jmp case.0x18001c439.10029
movsxd rbx, dword [rsi]
cmp rbx, 0xffffffffffffffff
jl 0x18001d78e
cmp qword [rdi + 0x230], rbx
jge 0x18001b881
mov rcx, qword [rdi + 0x9b8]
cmp qword [rdi + 0x220], rcx
jne 0x18001b881
call qword [fcn.180079934]
mov qword [rdi + 0x9b8], rbp
mov qword [rdi + 0x220], rbp
mov qword [rdi + 0x230], rbx
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xae2], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xade], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xadd], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xadf], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0xffffffff
jl 0x18001d78e
mov dword [rdi + 0x218], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
and al, 7
mov byte [rdi + 0xab8], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
je 0x18001b7ac
mov al, 1
mov byte [rdi + 0xae3], bpl
mov byte [rdi + 0x56a], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xacc], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
je case.0x18001c439.10029
mov byte [rdi + 0x56a], bpl
mov word [rdi + 0xae3], bp
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
cmp eax, 3
jl 0x18001b95a
mov eax, 1
jmp 0x18001d894
mov byte [rdi + 0x56b], al
jmp case.0x18001c439.10029
mov edx, dword [rsi]
test edx, edx
jne 0x18001b976
mov dword [rdi + 0x20c], ebp
jmp case.0x18001c439.10029
mov eax, edx
shr eax, 4
and al, 1
mov byte [rdi + 0xe16], al
test dl, 0x10
je 0x18001b98e
and edx, 0xffffffef
or edx, 2
and edx, 0xffffffdf
mov ecx, ebp
mov eax, ecx
inc ecx
bt edx, eax
jb 0x18001b9ab
cmp ecx, 0x1f
jl 0x18001b993
mov eax, 4
jmp 0x18001d894
mov dword [rdi + 0x20c], edx
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad0], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0xffff
ja 0x18001d78e
mov dword [rdi + 0x1e8], eax
jmp case.0x18001c439.10029
mov edx, dword [rsi]
test edx, edx
jne 0x18001b9ef
mov dword [rdi + 0x210], ebp
jmp case.0x18001c439.10029
mov eax, edx
shr eax, 4
and al, 1
mov byte [rdi + 0xe26], al
test dl, 0x10
je 0x18001ba07
and edx, 0xffffffef
or edx, 2
and edx, 0xffffffdf
mov ecx, ebp
nop dword [rax]
mov eax, ecx
inc ecx
bt edx, eax
jb 0x18001ba28
cmp ecx, 0x1f
jl 0x18001ba10
mov eax, 4
jmp 0x18001d894
mov dword [rdi + 0x210], edx
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 7
ja 0x18001d78e
mov byte [rdi + 0x569], al
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
test ecx, ecx
je 0x18001ba63
cmp ecx, 1
jne 0x18001bb33
mov byte [rdi + 0xaef], cl
jmp case.0x18001c439.10029
mov byte [rdi + 0xaef], bpl
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf0], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad3], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad2], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 3
ja 0x18001d78e
mov byte [rdi + 0x718], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad6], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad5], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad7], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 2
ja 0x18001d78e
mov byte [rdi + 0x71a], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad8], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 2
ja 0x18001d78e
mov byte [rdi + 0x719], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 2
ja 0x18001bb33
mov byte [rdi + 0x720], al
jmp case.0x18001c439.10029
mov ebp, Ordinal_45
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
cmp eax, 0xffffffff
jl 0x18001d78e
mov qword [rdi + 0x318], rax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0x320], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0x324], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0xffff
ja 0x18001d78e
mov word [rdi + 0x208], ax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0x20c49b
ja 0x18001d78e
imul eax, eax, 0x3e8
mov dword [rdi + 0x2f8], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov ecx, 0xffffffff
cmp eax, ecx
cmovae eax, ecx
mov dword [rdi + 0x2f8], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0x20c49b
ja 0x18001d78e
imul eax, eax, 0x3e8
mov dword [rdi + 0x2fc], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov ecx, 0xffffffff
cmp eax, ecx
cmovae eax, ecx
mov dword [rdi + 0x2fc], eax
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
cmp eax, 0xffffffff
jl 0x18001d78e
mov qword [rdi + 0x338], rax
jmp case.0x18001c439.10029
mov rcx, qword [rdi + 0x898]
call qword [fcn.180079934]
mov rcx, rdi
mov qword [rdi + 0x898], rbp
call fcn.180029c50
mov ebp, eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xacd], al
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
cmp ecx, 0xffff
ja 0x18001d78e
call fcn.1800320e0
mov word [rdi + 0x238], ax
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
cmp ecx, 0xffff
ja 0x18001d78e
call fcn.1800320c0
mov dword [rdi + 0x23c], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0x5d9], al
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je case.0x18001c439.10029
mov byte [rcx + 0x329], al
jmp case.0x18001c439.10029
test byte [rsi], 3
setne al
mov byte [rdi + 0x5da], al
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je case.0x18001c439.10029
mov byte [rcx + 0x32a], al
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 2
je case.0x18001bfa1.244
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0x620], al
jmp case.0x18001c439.10029
cmp qword [rdi + 0xce8], rbp
jne 0x18001d78e
mov ecx, dword [rsi]
mov eax, 0x80000
cmp ecx, eax
jg 0x18001bd2b
cmp ecx, 1
jge 0x18001bd1f
mov eax, 0x4000
mov dword [rdi + 0x6ec], eax
jmp case.0x18001c439.10029
mov edx, 0x400
mov eax, ecx
cmp ecx, edx
cmovl eax, edx
mov dword [rdi + 0x6ec], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xae9], al
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
test eax, eax
js 0x18001d78e
mov qword [rdi + 0x710], rax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 3
ja 0x18001d78e
mov dword [rdi + 0x73c], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 2
ja 0x18001d78e
mov byte [rdi + 0x708], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaea], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaeb], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaec], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0x5dc], al
mov byte [rdi + 0x694], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
sete al
mov byte [rdi + 0xaed], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
sete al
mov byte [rdi + 0xaee], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0x1ff
ja 0x18001d78e
mov dword [rdi + 0x740], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 0x1ff
ja 0x18001d78e
mov dword [rdi + 0x744], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov dword [rdi + 0xa08], eax
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
mov qword [rdi + 0xa10], rax
jmp case.0x18001c439.10029
movsxd rax, dword [rsi]
mov qword [rdi + 0xa18], rax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
dec eax
cmp eax, 0xa
ja case.default.0x18001be64
cdqe
mov ecx, dword [r8 + rax*4 + 0x1dac8]
add rcx, r8
jmp rcx
mov ebx, 1
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 2
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 3
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 4
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 5
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 6
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 7
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 8
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 9
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, 0xa
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, ntohs
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov ebx, ebp
mov dword [rdi + 0xa30], ebx
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov dword [rdi + 0x1180], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov dword [rdi + 0x1184], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xad9], al
jmp case.0x18001c439.10029
mov eax, dword [r8]
test eax, eax
js 0x18001d78e
mov dword [rcx + 0xa58], eax
jmp case.0x18001c439.10029
cmp edx, 0x2711
jg 0x18001c3f7
je 0x18001c3e8
lea eax, [rdx - 0xd4]
cmp eax, 0x67
ja case.0x18001d7de.40296
lea r8, sym.usermode.dll__q_Qc_aAjQz7hd_8AArZ1jhGIM:9enOvl_
cdqe
movzx eax, byte [r8 + rax + 0x1db98]
mov ecx, dword [r8 + rax*4 + 0x1daf4]
add rcx, r8
jmp rcx
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xadc], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaca], al
jmp case.0x18001c439.10029
cmp edx, 0x20
mov ecx, 0x570
mov r8d, 0x628
cmove r8d, ecx
mov ecx, dword [rsi]
movzx edx, cx
and ecx, 0xffff0000
cmp edx, 1
jbe 0x18001bff1
lea eax, [rdx - 4]
cmp eax, 3
ja 0x18001d78e
cmp ecx, 0x7ffff
ja 0x18001d78e
mov dword [r8 + rdi], edx
mov dword [r8 + rdi + 4], ecx
jmp case.0x18001c439.10029
movzx eax, byte [rsi]
and al, 1
mov byte [rdi + 0xacb], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0xa70], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
cmp eax, 1
jg 0x18001d78e
test eax, eax
setne al
mov byte [rdi + 0xb02], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov dword [rdi + 0x214], eax
and eax, 0xfffffffa
neg eax
sbb eax, eax
and eax, 4
mov ebp, eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov ecx, 0xffffffff
cmp eax, ecx
cmovae eax, ecx
mov dword [rdi + 0x71c], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xafb], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaff], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0x691], al
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je case.0x18001c439.10029
mov byte [rcx + 0x399], al
jmp case.0x18001c439.10029
test byte [rsi], 3
setne al
mov byte [rdi + 0xb00], al
jmp case.0x18001c439.10029
test byte [rsi], 3
setne al
mov byte [rdi + 0x692], al
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je case.0x18001c439.10029
mov byte [rcx + 0x39a], al
jmp case.0x18001c439.10029
call fcn.180029050
test al, al
jne 0x18001c106
mov ebp, 4
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0x5db], al
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je case.0x18001c439.10029
mov byte [rcx + 0x32b], al
jmp case.0x18001c439.10029
call fcn.180029050
test al, al
je case.0x18001bfa1.244
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xb01], al
jmp case.0x18001c439.10029
call fcn.180029680
test al, al
je case.0x18001bfa1.244
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0x621], al
jmp case.0x18001c439.10029
mov edx, dword [rsi]
mov ecx, 0x200000
cmp edx, ecx
jg 0x18001c172
mov eax, 0x4000
mov ecx, edx
cmp edx, eax
cmovl ecx, eax
mov dword [rdi + 0x6f0], ecx
mov rcx, qword [rdi + 0xcf0]
call qword [fcn.180079934]
mov qword [rdi + 0xcf0], rbp
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
movzx eax, cl
and al, 1
mov byte [rdi + 0x5d8], cl
mov byte [rdi + 0x622], al
mov eax, ecx
shr eax, 1
and al, 1
mov byte [rdi + 0x623], al
mov eax, ecx
shr eax, 2
and al, 1
mov byte [rdi + 0x624], al
mov eax, ecx
shr eax, 3
and al, 1
mov byte [rdi + 0x625], al
mov eax, ecx
shr eax, 4
and al, 1
shr ecx, 5
and cl, 1
mov byte [rdi + 0x626], al
mov byte [rdi + 0x627], cl
jmp case.0x18001c439.10029
mov ecx, dword [rsi]
movzx eax, cl
and al, 1
mov byte [rdi + 0x690], cl
mov byte [rdi + 0x6da], al
mov eax, ecx
shr eax, 1
and al, 1
mov byte [rdi + 0x6db], al
mov eax, ecx
shr eax, 2
and al, 1
mov byte [rdi + 0x6dc], al
mov eax, ecx
shr eax, 3
and al, 1
mov byte [rdi + 0x6dd], al
mov eax, ecx
shr eax, 4
and al, 1
shr ecx, 5
and cl, 1
mov byte [rdi + 0x6de], al
mov byte [rdi + 0x6df], cl
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xac8], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov dword [rdi + 0xa20], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf1], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf2], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0xa5c], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0xa60], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf4], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf5], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf6], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf7], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf8], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
mov ecx, 0xffffffff
cmp eax, ecx
cmovae eax, ecx
mov dword [rdi + 0x300], eax
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xaf9], al
jmp case.0x18001c439.10029
cmp dword [rsi], ebp
setne al
mov byte [rdi + 0xafd], al
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0xa88], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0x308], eax
jmp case.0x18001c439.10029
mov eax, dword [rsi]
test eax, eax
js 0x18001d78e
mov dword [rdi + 0x30c], eax
jmp case.0x18001c439.10029
test byte [rsi], 1
je 0x18001c39d
cmp qword [rdi + 0xb10], rbp
jne case.0x18001c439.10029
call fcn.180033a20
mov qword [rdi + 0xb10], rax
test rax, rax
jne case.0x18001c439.10029
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x18001d894
lea rcx, [rdi + 0xb10]
call fcn.1800339a0
jmp case.0x18001c439.10029
mov rax, qword [rdi + 0xb18]
test rax, rax
jne 0x18001c3cf
call fcn.1800328a0
mov qword [rdi + 0xb18], rax
test rax, rax
je 0x18001c681
mov edx, dword [rsi]
mov rcx, rax
call fcn.180032890
mov ebp, eax
test eax, eax
je case.0x18001c439.10029
jmp 0x18001d894
mov rax, qword [r8]
mov qword [rcx + 0x1f0], rax
jmp case.0x18001c439.10029
cmp edx, 0x27f4
jg 0x18001d033
je 0x18001d024
add edx, 0xffffd8ee
cmp edx, 0xde
ja case.0x18001d7de.40296
lea r8, sym.usermode.dll__q_Qc_aAjQz7hd_8AArZ1jhGIM:9enOvl_
movsxd rax, edx
movzx eax, byte [r8 + rax + 0x1dd24]
mov ecx, dword [r8 + rax*4 + 0x1dc00]
add rcx, r8
jmp rcx
mov rdx, qword [rsi]
lea rcx, [rdi + 0x850]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7f0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rsi, qword [rsi]
test rsi, rsi
je 0x18001c4dd
mov rax, qword [rdi + 0x230]
cmp rax, 0xffffffffffffffff
je 0x18001c4dd
test rax, rax
js 0x18001c4b6
mov rcx, qword [rdi + 0x9b8]
call qword [fcn.180079934]
mov qword [rdi + 0x9b8], rbp
mov ecx, 1
mov rax, qword [rdi + 0x230]
test rax, rax
cmovne rcx, rax
call qword [section.el___6]
mov rbx, rax
test rax, rax
jne 0x18001c4bd
mov ebp, reloc.WLDAP32.dll_Ordinal_27
jmp 0x18001c4ee
mov r8, qword [rdi + 0x230]
test r8, r8
je 0x18001c4d4
mov rdx, rsi
mov rcx, rbx
call fcn.180073fd0
mov qword [rdi + 0x9b8], rbx
jmp 0x18001c4ee
lea rcx, [rdi + 0x9b8]
mov rdx, rsi
call fcn.18001b5d0
mov ebp, eax
mov rax, qword [rdi + 0x9b8]
mov qword [rdi + 0x220], rax
mov byte [rdi + 0x56a], 1
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x220], rax
mov rcx, qword [rdi + 0x9b8]
call qword [fcn.180079934]
mov qword [rdi + 0x9b8], rbp
mov byte [rdi + 0x56a], 1
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
test rdx, rdx
je 0x18001c573
cmp byte [rdx], bpl
jne 0x18001c573
call fcn.180034800
mov rbx, rax
test rax, rax
jne 0x18001c554
lea ebp, [rax + 0x1b]
jmp case.0x18001c439.10029
lea rcx, [rdi + 0x798]
mov rdx, rbx
call fcn.18001b5d0
mov rcx, rbx
mov ebp, eax
call qword [fcn.180079934]
jmp case.0x18001c439.10029
lea rcx, [rdi + 0x798]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x350], rax
mov byte [rdi + 0x56a], 2
mov byte [rdi + 0xae3], bpl
jmp case.0x18001c439.10029
cmp byte [rdi + 0x1322], bpl
je 0x18001c5c7
mov rcx, qword [rdi + 0x1200]
call qword [fcn.180079934]
mov qword [rdi + 0x1200], rbp
mov byte [rdi + 0x1322], bpl
mov rdx, qword [rsi]
lea rcx, [rdi + 0x810]
call fcn.18001b5d0
mov ebp, eax
mov rax, qword [rdi + 0x810]
mov qword [rdi + 0x1200], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x870]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x340], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x700], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x770]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
test rax, rax
je 0x18001c697
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], bpl
jne 0x18001c644
cmp rdx, 0x7a1200
ja 0x18001d78e
mov rcx, qword [rdi + 0x1208]
mov rdx, rax
call fcn.18001e220
test rax, rax
jne 0x18001c68b
mov rcx, qword [rdi + 0x1208]
call fcn.18001e2c0
mov qword [rdi + 0x1208], rbp
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x18001d894
mov qword [rdi + 0x1208], rax
jmp case.0x18001c439.10029
mov rcx, qword [rdi + 0x1208]
call fcn.18001e2c0
mov rax, qword [rdi + 0xe0]
mov qword [rdi + 0x1208], rbp
test rax, rax
je 0x18001c6bf
cmp qword [rax + 0xb0], rbp
jne 0x18001c6d7
mov rcx, qword [rdi + 0xb08]
call fcn.180022d00
mov rcx, qword [rdi + 0xb08]
call fcn.180022c10
mov qword [rdi + 0xb08], rbp
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x778]
call fcn.18001b5d0
movzx r9d, byte [rdi + 0xacc]
xor edx, edx
mov r8, qword [rdi + 0xb08]
mov rcx, rdi
mov ebp, eax
call fcn.180023390
test rax, rax
mov qword [rdi + 0xb08], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_27
cmove ebp, ecx
jmp case.0x18001c439.10029
mov rbx, qword [rsi]
test rbx, rbx
je case.0x18001c439.10029
lea rdx, [0x1800a1b8c]
mov rcx, rbx
call fcn.180034470
test eax, eax
je 0x18001c771
mov edx, 2
mov rcx, rdi
mov r8d, edx
call fcn.180034ba0
mov rcx, qword [rdi + 0xb08]
call fcn.180022d00
mov edx, 2
mov rcx, rdi
call fcn.180034be0
jmp case.0x18001c439.10029
lea rdx, [0x1800a1b90]
mov rcx, rbx
call fcn.180034470
test eax, eax
je 0x18001c7b2
mov edx, 2
mov rcx, rdi
mov r8d, edx
call fcn.180034ba0
mov rcx, qword [rdi + 0xb08]
call fcn.180022de0
mov edx, 2
mov rcx, rdi
call fcn.180034be0
jmp case.0x18001c439.10029
lea rdx, [0x1800a1b98]
mov rcx, rbx
call fcn.180034470
test eax, eax
je 0x18001c7d4
xor edx, edx
mov rcx, rdi
call fcn.180023890
jmp case.0x18001c439.10029
lea rdx, [0x1800a1ba0]
mov rcx, rbx
call fcn.180034470
test eax, eax
je 0x18001c7f4
mov rcx, rdi
call fcn.1800235c0
jmp case.0x18001c439.10029
cmp qword [rdi + 0xb08], rbp
jne 0x18001c814
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.180023390
mov qword [rdi + 0xb08], rax
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x18001c820
cmp rdx, 0x7a1200
ja 0x18001d78e
mov rcx, rbx
call qword [case.0x180024099.0]
mov rbx, rax
test rax, rax
je 0x18001c8cd
cmp qword [rdi + 0xb08], rbp
je 0x18001c8cd
mov edx, 2
mov rcx, rdi
mov r8d, edx
call fcn.180034ba0
mov r8d, ntohs
lea rdx, [0x1800a1ba8]
mov rcx, rbx
call fcn.1800345d0
test eax, eax
je 0x18001c886
mov r8b, 1
lea rax, [rbx + 0xb]
jmp 0x18001c88c
xor r8b, r8b
mov rax, rbx
mov rdx, qword [rdi + 0xb08]
xor r9d, r9d
mov byte [rsp + 0x38], 1
mov rcx, rdi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.180021dc0
mov edx, 2
mov rcx, rdi
call fcn.180034be0
mov rcx, rbx
call qword [fcn.180079934]
jmp case.0x18001c439.10029
mov rcx, rbx
mov ebp, reloc.WLDAP32.dll_Ordinal_27
call qword [fcn.180079934]
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x780]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7f8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x200], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x1e0], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7b0]
call fcn.18001b5d0
cmp qword [rdi + 0x7b0], 0
mov ebp, eax
setne al
mov byte [rdi + 0xad4], al
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7a0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7a8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7e8]
call fcn.18001b5d0
cmp qword [rdi + 0x7e8], 0
mov ebp, eax
setne al
mov byte [rdi + 0xae6], al
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x1f8], rax
jmp case.0x18001c439.10029
cmp byte [rdi + 0x1321], bpl
je 0x18001c9d7
mov rcx, qword [rdi + 0x11f8]
call qword [fcn.180079934]
mov qword [rdi + 0x11f8], rbp
mov byte [rdi + 0x1321], bpl
mov rdx, qword [rsi]
lea rcx, [rdi + 0x818]
call fcn.18001b5d0
mov ebp, eax
mov rax, qword [rdi + 0x818]
mov qword [rdi + 0x11f8], rax
jmp case.0x18001c439.10029
mov rbx, qword [rsi]
lea r14, [rdi + 0x8a8]
add rdi, 0x8a0
mov qword [rsp + 0x40], rbp
mov rax, rbp
mov qword [rsp + 0x88], rax
test rbx, rbx
je 0x18001ca6a
test r14, r14
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x88]
mov rdx, 0xffffffffffffffff
cmove r9, rbp
test rdi, rdi
cmove r8, rbp
inc rdx
cmp byte [rbx + rdx], al
jne 0x18001ca43
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call fcn.18002b780
mov ebp, eax
test eax, eax
jne case.0x18001c439.10029
mov rax, qword [rsp + 0x88]
test rdi, rdi
je 0x18001cab2
test rax, rax
jne 0x18001ca9e
test rbx, rbx
je 0x18001ca9e
cmp byte [rbx], 0x3a
jne 0x18001ca9e
lea rcx, [0x1800c7553]
call qword [case.0x180024099.0]
test rax, rax
mov qword [rsp + 0x88], rax
mov ecx, reloc.WLDAP32.dll_Ordinal_27
cmove ebp, ecx
mov rcx, qword [rdi]
call qword [fcn.180079934]
mov rax, qword [rsp + 0x88]
mov qword [rdi], rax
test r14, r14
je case.0x18001c439.10029
mov rcx, qword [r14]
call qword [fcn.180079934]
mov rax, qword [rsp + 0x40]
mov qword [r14], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8a0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8a8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8b0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x950]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x520], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x528], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x518], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x550], rax
mov qword [rdi + 0x1210], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2e8], rax
jmp case.0x18001c439.10029
mov rbx, qword [rsi]
lea r14, [rdi + 0x8c0]
add rdi, 0x8b8
mov qword [rsp + 0x40], rbp
mov rax, rbp
mov qword [rsp + 0x88], rax
test rbx, rbx
je 0x18001ca6a
test r14, r14
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x88]
mov rdx, 0xffffffffffffffff
cmove r9, rbp
test rdi, rdi
cmove r8, rbp
inc rdx
cmp byte [rbx + rdx], al
jne 0x18001cbc7
jmp 0x18001ca4b
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8b8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8c0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8c8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x808]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x1d8], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x1d0], rax
test rax, rax
jne case.0x18001c439.10029
lea ecx, [rax + 2]
call fcn.180079208
mov qword [rdi + 0x1d0], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2c0], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2f0], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x750]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x760]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7b8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7d8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7c8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rbx, qword [rsi]
test rbx, rbx
je case.0x18001c439.10029
cmp byte [rbx], bpl
je case.0x18001c439.10029
lea rcx, [rdi + 0x898]
mov rdx, rbx
call fcn.18001b5d0
mov ebp, eax
test eax, eax
jne case.0x18001c439.10029
mov rdx, rbx
mov rcx, rdi
call fcn.180029c40
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x790]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 8
je case.0x18001bfa1.244
mov rax, qword [rsi]
mov qword [rdi + 0x5f0], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x830]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 1
je case.0x18001bfa1.244
mov rdx, qword [rsi]
lea rcx, [rdi + 0x820]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x878]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x888]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x548], rax
jmp case.0x18001c439.10029
mov rax, qword [rdi + 0xe0]
mov ebx, 1
mov rsi, qword [rsi]
test rax, rax
je 0x18001ce6c
lea r8d, [rbx + 1]
mov edx, ebx
mov rcx, rdi
call fcn.180034ba0
cmp dword [rdi + 0xc8], 2
jne 0x18001ce14
mov qword [rdi + 0xc0], rbp
mov dword [rdi + 0xc8], ebp
mov rcx, qword [rdi + 0xe0]
mov rax, qword [rdi + 0xb08]
cmp qword [rcx + 0xb0], rax
jne 0x18001ce32
mov qword [rdi + 0xb08], rbp
mov rax, qword [rdi + 0xd18]
cmp qword [rcx + 0xb8], rax
jne 0x18001ce49
mov qword [rdi + 0xd18], rbp
mov ecx, dword [rcx + 8]
mov edx, ebx
mov rax, qword [rdi + 0xe0]
dec ecx
mov dword [rax + 8], ecx
mov rcx, rdi
call fcn.180034be0
mov rax, rbp
mov qword [rdi + 0xe0], rbp
test rsi, rsi
je case.0x18001c439.10029
cmp dword [rsi], 0x7e117a1e
jne 0x18001ce86
mov qword [rdi + 0xe0], rsi
jmp 0x18001ce8f
test rax, rax
je case.0x18001c439.10029
mov r8d, 2
mov edx, ebx
mov rcx, rdi
call fcn.180034ba0
mov rax, qword [rdi + 0xe0]
mov ecx, dword [rax + 8]
mov rax, qword [rdi + 0xe0]
inc ecx
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0xe0]
test byte [rcx + 4], 8
je 0x18001ceda
lea rax, [rcx + 0x80]
mov qword [rdi + 0xc0], rax
mov dword [rdi + 0xc8], 2
mov rdx, rcx
cmp qword [rcx + 0xb0], rbp
je 0x18001cf0a
mov rcx, qword [rdi + 0xb08]
call fcn.180022c10
mov rcx, qword [rdi + 0xe0]
mov rdx, rcx
mov rax, qword [rcx + 0xb0]
mov qword [rdi + 0xb08], rax
cmp qword [rcx + 0xb8], rbp
je 0x18001cf2f
mov rax, qword [rcx + 0xc0]
mov qword [rdi + 0x6e0], rax
mov rax, qword [rdx + 0xb8]
mov qword [rdi + 0xd18], rax
mov edx, ebx
mov rcx, rdi
call fcn.180034be0
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x6f8], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x288], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x298], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2a8], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x920]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x928]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xac0], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8d0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8d8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x8e0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xa28], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x1370], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xa50], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
mov qword [rcx + 0x348], rax
jmp case.0x18001c439.10029
cmp edx, 0x4e2b
jg 0x18001d4d4
je 0x18001d4ae
add edx, 0xffffd80a
cmp edx, 0x59
ja case.0x18001d7de.40296
lea r8, sym.usermode.dll__q_Qc_aAjQz7hd_8AArZ1jhGIM:9enOvl_
movsxd rax, edx
movzx eax, byte [r8 + rax + 0x1dea0]
mov ecx, dword [r8 + rax*4 + 0x1de04]
add rcx, r8
jmp rcx
mov rdx, qword [rsi]
lea rcx, [rdi + 0x858]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
call fcn.180029d70
test al, al
je case.0x18001d072.10235
mov rdx, qword [rsi]
lea rcx, [rdi + 0x860]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
call fcn.180029d70
test al, al
je case.0x18001d072.10235
mov rdx, qword [rsi]
lea rcx, [rdi + 0x868]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x960]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x9c0]
call fcn.18001b5d0
cmp qword [rdi + 0x9c0], 0
mov ebp, eax
je case.0x18001c439.10029
mov dword [rdi + 0x20c], pe_nt_image_headers64
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x358]
xor r8d, r8d
call fcn.180025b50
mov ebp, eax
test eax, eax
jne case.0x18001c439.10029
mov byte [rdi + 0x56a], 3
mov byte [rdi + 0xae3], al
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x800]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x910]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x918]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xaa0], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x758]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x768]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7c0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7e0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x7d0]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 4
je case.0x18001bfa1.244
mov rdx, qword [rsi]
lea rcx, [rdi + 0x840]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 4
je case.0x18001bfa1.244
mov rdx, qword [rsi]
lea rcx, [rdi + 0x848]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x838]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 1
je case.0x18001bfa1.244
mov rdx, qword [rsi]
lea rcx, [rdi + 0x828]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x880]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x890]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x9a8]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xa80], rax
jmp case.0x18001c439.10029
mov rcx, qword [rsi]
lea rdx, [rsp + 0x88]
call fcn.18001e090
mov ebp, eax
test eax, eax
jne 0x18001d894
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0xa10], rax
jmp case.0x18001c439.10029
mov rcx, qword [rsi]
lea rdx, [rsp + 0x88]
call fcn.18001e090
mov ebp, eax
test eax, eax
jne 0x18001d894
mov rax, qword [rsp + 0x88]
mov qword [rdi + 0xa18], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x788]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x980]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov byte [rdi + 0xafc], bpl
mov rdx, qword [rsi]
lea rcx, [rdi + 0x958]
call fcn.18001b5d0
mov ebp, eax
jmp case.0x18001c439.10029
mov byte [rdi + 0xafc], 1
jmp 0x18001d36c
mov rax, qword [rsi]
mov qword [rdi + 0x558], rax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
lea rcx, [rdi + 0x968]
call fcn.18001b5d0
cmp qword [rdi + 0x968], 0
mov ebp, eax
setne al
mov byte [rdi + 0xafe], al
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xaa8], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2d0], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2e0], rax
jmp case.0x18001c439.10029
cmp qword [rdi + 0xb10], rbp
jne 0x18001d40c
call fcn.180033a20
mov qword [rdi + 0xb10], rax
test rax, rax
je 0x18001c681
mov rbx, qword [rsi]
lea rcx, [rdi + 0x978]
mov rdx, rbx
call fcn.18001b5d0
mov ebp, eax
test eax, eax
jne 0x18001d894
test rbx, rbx
je case.0x18001c439.10029
mov rdx, qword [rdi + 0xb10]
mov r8, rbx
mov rcx, rdi
call fcn.180033b80
jmp case.0x18001c439.10029
cmp qword [rdi + 0xb18], rbp
jne 0x18001d466
call fcn.1800328a0
mov qword [rdi + 0xb18], rax
test rax, rax
je 0x18001c681
mov rbx, qword [rsi]
lea rcx, [rdi + 0x970]
mov rdx, rbx
call fcn.18001b5d0
mov ebp, eax
test eax, eax
jne 0x18001d894
test rbx, rbx
je case.0x18001c439.10029
mov rcx, qword [rdi + 0xb18]
mov rdx, rbx
call fcn.1800328e0
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2b8], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
mov qword [rcx + 0x240], rax
test rax, rax
jne case.0x18001c439.10029
lea rax, [fcn.180079528]
mov qword [rcx + 0x240], rax
jmp case.0x18001c439.10029
cmp edx, 0x4f30
jg 0x18001d657
je 0x18001d648
add edx, 0xffffb1d4
cmp edx, 0xcf
ja case.0x18001d7de.40296
lea r8, sym.usermode.dll__q_Qc_aAjQz7hd_8AArZ1jhGIM:9enOvl_
movsxd rax, edx
movzx eax, byte [r8 + rax + 0x1df3c]
mov ecx, dword [r8 + rax*4 + 0x1defc]
add rcx, r8
jmp rcx
mov rax, qword [rsi]
mov qword [rdi + 0x260], rax
test rax, rax
setne al
mov byte [rdi + 0xca4], al
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x268], rax
test rax, rax
setne al
mov byte [rdi + 0xca4], al
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x270], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x248], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x258], rax
test rax, rax
jne 0x18001d595
lea rax, [fcn.180079d60]
mov byte [rdi + 0xac9], bpl
mov qword [rdi + 0x258], rax
jmp case.0x18001c439.10029
mov byte [rdi + 0xac9], 1
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x228], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x278], rax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 8
je case.0x18001bfa1.244
mov rax, qword [rsi]
mov qword [rdi + 0x5e8], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x280], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x290], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x2a0], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0x250], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xa38], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xa40], rax
jmp case.0x18001c439.10029
mov rax, qword [rsi]
mov qword [rdi + 0xa48], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
mov qword [rcx + 0xa78], rax
jmp case.0x18001c439.10029
cmp edx, 0x75c1
jg 0x18001d75c
je 0x18001d748
cmp edx, 0x75a3
jg 0x18001d6e3
je 0x18001d6ca
sub edx, 0x4f3b
je 0x18001d6bb
sub edx, 0x12
je 0x18001d6ac
sub edx, 2
je 0x18001d69d
cmp edx, 9
jne case.0x18001d7de.40296
mov rax, qword [r8]
mov qword [rcx + 0x2b0], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
mov qword [rcx + 0x2d8], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
mov qword [rcx + 0x2c8], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
mov qword [rcx + 0xab0], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
cmp rax, 0xffffffffffffffff
jl 0x18001d78e
mov qword [rcx + 0x318], rax
jmp case.0x18001c439.10029
sub edx, 0x75a4
je 0x18001d733
sub edx, 1
je 0x18001d71f
cmp edx, 3
jne case.0x18001d7de.40296
mov rbx, qword [r8]
cmp rbx, 0xffffffffffffffff
jl 0x18001d78e
cmp qword [rcx + 0x230], rbx
jge 0x18001b881
mov rcx, qword [rcx + 0x9b8]
jmp 0x18001b864
mov rax, qword [r8]
test rax, rax
js 0x18001d78e
mov qword [rcx + 0x710], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
cmp rax, 0xffffffffffffffff
jl 0x18001d78e
mov qword [rcx + 0x338], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
test rax, rax
js 0x18001d78e
mov qword [rcx + 0x328], rax
jmp case.0x18001c439.10029
cmp edx, 0x9d63
jg 0x18001d7ba
je 0x18001d7a4
sub edx, 0x75c2
je 0x18001d786
cmp edx, 0x7c
jne case.0x18001d7de.40296
mov rax, qword [r8]
mov qword [rcx + 0x560], rax
jmp case.0x18001c439.10029
mov rax, qword [r8]
test rax, rax
jns 0x18001d798
mov eax, Ordinal_45
jmp 0x18001d894
mov qword [rcx + 0x330], rax
jmp case.0x18001c439.10029
mov rdx, qword [r8]
add rcx, 0x9c8
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
add edx, 0xffff629c
cmp edx, 0x12
ja case.0x18001d7de.40296
lea r8, sym.usermode.dll__q_Qc_aAjQz7hd_8AArZ1jhGIM:9enOvl_
movsxd rax, edx
mov eax, dword [r8 + rax*4 + 0x1e00c]
add rax, r8
jmp rax
mov rdx, qword [rsi]
add rcx, 0x9d0
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
add rcx, 0x9d8
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
add rcx, 0x9e0
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 0x40
je case.0x18001d072.10235
mov rdx, qword [rsi]
add rcx, 0x9f8
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov rax, qword [case.0x180024099.2]
test byte [rax + 0x10], 0x40
je case.0x18001d072.10235
mov rdx, qword [rsi]
add rcx, 0xa00
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
add rcx, 0x9e8
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov rdx, qword [rsi]
add rcx, 0x9f0
call fcn.18001b510
mov ebp, eax
jmp case.0x18001c439.10029
mov ebp, Ordinal_50
mov eax, ebp
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret