Function at 0x18000d860
Capabilities:
Check if file exists
Set registry value

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x1500]
mov eax, 0x1600
call fcn.18001e190
sub rsp, rax
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1620], rbx
mov qword [rsp + 0x1628], rsi
mov qword [rsp + 0x1630], rdi
mov rax, qword [0x180064138]
xor rax, rsp
mov qword [rbp + 0x14f0], rax
mov r14, rcx
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e60c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.OnCommand_Install
mov rbx, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x18000d8f5
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.18000cc80
jmp 0x18000d918
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000d900
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.18000fcf0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.18000b530
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000d945
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xec0]
call fcn.180027560
lea rcx, [rbp + 0xec0]
call fcn.180009450
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x470]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x470]
call fcn.1800094b0
test eax, eax
jne 0x18000dac0
lea rdx, str.Fail_GetInstallLdsShellExtDllPath
lea rcx, [rbp - 0x70]
call fcn.18000b860
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e617
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.install_fail
cmp rdx, 0x10000
jae 0x18000d9e1
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.18000cc80
jmp 0x18000d9fc
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000d9e4
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e622
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000da3b
movzx edx, dx
lea rcx, [rsp + 0x38]
call fcn.18000cc80
jmp 0x18000da58
mov rax, rbx
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000da40
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000da99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e5c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x18000e5c8
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x680]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x680]
call fcn.1800094b0
test eax, eax
je 0x18000e49e
mov ecx, 0x104
lea rax, [rbp + 0x680]
nop dword [rax]
cmp word [rax], 0
je 0x18000db10
add rax, 2
sub rcx, 1
jne 0x18000db00
xor edi, edi
test rcx, rcx
je 0x18000db21
mov eax, 0x104
sub rax, rcx
jmp 0x18000db24
mov rax, rdi
test rcx, rcx
je 0x18000db80
mov edx, 0x104
sub rdx, rax
lea rcx, [rbp + 0x680]
lea rcx, [rcx + rax*2]
je 0x18000db72
add rax, 0x7ffffefa
add rax, rdx
lea r9, str..helper.exe
sub r9, rcx
test rax, rax
je 0x18000db72
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x18000db72
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x18000db51
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x12e0]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x12e0]
call fcn.18000c6c0
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0xec0]
call fcn.180033a50
test eax, eax
je 0x18000df0c
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xcb0]
call fcn.180027560
lea rcx, [rbp + 0xcb0]
call fcn.180009450
test eax, eax
je 0x18000dc17
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
lea rcx, str.RunDll64.exe
lea rdx, str.RunDll.exe
test al, al
cmovne rdx, rcx
lea rcx, [rbp + 0xcb0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x260]
call fcn.180027560
lea rcx, [rbp + 0x260]
call fcn.180009450
lea r15, str.Base64.dll
lea rsi, str.Base.dll
test eax, eax
je 0x18000dcc2
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
mov rdx, rsi
test al, al
cmovne rdx, r15
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000dcc2
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
lea rcx, str.360Base64.dll
lea rdx, str.360Base.dll
test al, al
cmovne rdx, rcx
lea rcx, [rbp + 0x260]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x890]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x890]
call fcn.1800094b0
test eax, eax
je 0x18000e1ed
lea rcx, [rbp + 0x890]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
test al, al
cmovne rsi, r15
mov rdx, rsi
lea rcx, [rbp + 0x890]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x50]
call fcn.180027560
lea rcx, [rbp + 0x50]
call fcn.180009450
test eax, eax
je 0x18000ddb1
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
lea rcx, str.lpiHpSvc64.dll
lea rdx, str.lpiHpSvc.dll
test al, al
cmovne rdx, rcx
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000ddb1
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.1800097d0
lea rcx, str.WpSvc64.dll
lea rdx, str.WpSvc.dll
test al, al
cmovne rdx, rcx
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor r8d, r8d
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0xec0]
call fcn.180009130
xor r8d, r8d
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0xcb0]
call fcn.180009130
xor r8d, r8d
lea rdx, [rbp + 0x890]
lea rcx, [rbp + 0x260]
call fcn.180009130
xor r8d, r8d
lea rdx, [rbp + 0x12e0]
lea rcx, [rbp + 0x50]
call fcn.180009130
lea rcx, [rbp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000e0b8
lea rcx, [rbp + 0x680]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000e0b8
lea rcx, [rbp + 0x890]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000e0b8
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xaa0]
call fcn.180027560
mov r8d, 0x104
lea rdx, [rbp + 0xaa0]
mov rcx, qword [0x18006f2d0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rdx, str.inst_bizhi_ui.exe
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x10d0]
call fcn.180027560
mov edx, 1
lea rcx, [rbp + 0x10d0]
call fcn.1800093d0
lea rdx, str.inst_bizhi_ui.exe
lea rcx, [rbp + 0x10d0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rbp + 0xaa0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x18000e0ac
xor r8d, r8d
lea rdx, [rbp + 0x10d0]
lea rcx, [rbp + 0xaa0]
call fcn.180009130
test eax, eax
jne 0x18000df0c
lea rdx, str.fail_copy_szInstallDownloader
lea rcx, [rbp - 0x70]
call fcn.18000b860
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x12e0]
call fcn.180009de0
mov rsi, rax
movdqa xmm0, xmmword [0x180047150]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
mov r8d, 7
lea rdx, str.__dll_
lea rcx, [rbp + 0x30]
call fcn.1800083e0
nop
lea rax, [rbp + 0x470]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x18000df52
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x30]
call fcn.18000a4a0
mov r8d, 0x26
lea rdx, str.____entryShellOpen_Ludashi32W___verb
lea rcx, [rbp + 0x30]
call fcn.18000a4a0
mov r8d, 6
lea rdx, str.DllReg
lea rcx, [rbp + 0x30]
call fcn.18000a4a0
mov dword [rbp - 0x40], 0x70
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rbp - 0x3c]
call fcn.180027560
mov qword [rbp - 0x38], rsi
mov rax, qword [str.RunAs]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x680]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rax, qword [rbp + 0x30]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x10], 5
mov dword [rbp - 0x3c], 0x40
lea rcx, [rbp - 0x40]
call fcn.180009e60
test eax, eax
je 0x18000e30e
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.18000d380
test eax, eax
js 0x18000e015
xor ecx, ecx
call fcn.180009290
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x18000e024
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x78]
call fcn.180018660
nop
mov rax, qword [rbp - 0x78]
mov ecx, dword [rax - 0x10]
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.LDSShellExt_InstallSource
lea rdx, str.Software360WallPaperEver
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e62d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.install_succeed
cmp rdx, 0x10000
jae 0x18000e1f7
movzx edx, dx
lea rcx, [rsp + 0x60]
call fcn.18000cc80
jmp 0x18000e218
lea rdx, str.fail_find_szAppDownloader
jmp 0x18000df03
lea rdx, str.Fail_Copy_szInstallDllPath
lea rcx, [rbp - 0x70]
call fcn.18000b860
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e638
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, str.install_fail
cmp rdx, 0x10000
jae 0x18000e107
movzx edx, dx
lea rcx, [rsp + 0x50]
call fcn.18000cc80
jmp 0x18000e128
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e110
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e643
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000e167
movzx edx, dx
lea rcx, [rsp + 0x48]
call fcn.18000cc80
jmp 0x18000e188
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e170
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x48]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e1c7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000e1e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, 0xfffffffc
jmp 0x18000e5c8
mov ebx, 0xfffffffd
jmp 0x18000e5c8
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e200
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e64e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000e257
movzx edx, dx
lea rcx, [rsp + 0x58]
call fcn.18000cc80
jmp 0x18000e278
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e260
mov r8d, eax
lea rcx, [rsp + 0x58]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e2b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e2d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test r14, r14
je 0x18000e2df
call fcn.18000d280
xor edx, edx
xor ecx, ecx
call fcn.180014560
mov esi, edi
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000e448
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x18000e448
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.fail_regsvr32_d
lea rcx, [rbp - 0x70]
call fcn.18000b860
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e659
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rdx, str.install_fail
cmp rdx, 0x10000
jae 0x18000e366
movzx edx, dx
lea rcx, [rsp + 0x70]
call fcn.18000cc80
jmp 0x18000e388
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e370
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e664
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000e3c7
movzx edx, dx
lea rcx, [rsp + 0x68]
call fcn.18000cc80
jmp 0x18000e3e8
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e3d0
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x68]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e427
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000e443
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov esi, 0xfffffffb
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x18000e488
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e66f
call fcn.18001dbb8
movdqa xmm0, xmmword [0x180047150]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], di
jmp 0x18000e5ca
lea rdx, str.Fail_GetInstallLdsShellExtHelperPath
lea rcx, [rbp - 0x70]
call fcn.18000b860
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e675
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rdx, str.install_fail
cmp rdx, 0x10000
jae 0x18000e4eb
movzx edx, dx
lea rcx, [rbp - 0x80]
call fcn.18000cc80
jmp 0x18000e507
mov rax, rbx
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e4f0
mov r8d, eax
lea rcx, [rbp - 0x80]
call fcn.18000fcf0
nop
call fcn.180007b50
mov rcx, rax
test rax, rax
je 0x18000e601
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rdx, str.LDSShellExt
cmp rdx, 0x10000
jae 0x18000e546
movzx edx, dx
lea rcx, [rsp + 0x78]
call fcn.18000cc80
jmp 0x18000e568
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x18000e550
mov r8d, eax
lea rcx, [rsp + 0x78]
call fcn.18000fcf0
nop
call fcn.18000c770
mov rcx, rax
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x78]
call fcn.180017910
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18000e5a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x18000e5c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov ebx, 0xfffffffe
mov esi, ebx
lea rcx, [rbp - 0x70]
call fcn.18000b6c0
mov eax, esi
mov rcx, qword [rbp + 0x14f0]
xor rcx, rsp
call fcn.18001e0c0
lea r11, [rsp + 0x1600]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
mov ecx, 0x80004005
call fcn.180008e40
nop
call fcn.180029c54
int3
mov ecx, 0x80004005
call fcn.180008e40
int3