Function at 0x180039340
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1800b43d8]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov r15, r9
mov edi, r8d
mov dword [rsp + 0x58], r8d
mov rsi, rdx
mov qword [rbp - 0x78], rdx
mov rbx, rcx
movdqa xmm0, xmmword [0x1800acbe0]
movdqa xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
movdqa xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movdqa xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
xor ecx, ecx
mov qword [rbp + 0xb0], rcx
mov word [rbp + 0xb8], cx
movdqu xmmword [rbp + 0xca], xmm0
mov byte [rbp + 0xba], cl
mov qword [rbp + 0x80], rcx
mov word [rbp + 0x88], cx
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], rcx
mov ecx, 0x30
call fcn.18005fd8c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xf8], rax
xor r8d, r8d
mov qword [rbp + 0x108], r8
xorps xmm2, xmm2
movsd qword [rbp + 0x110], xmm2
mov qword [rbp + 0x118], r8
mov dword [rbp + 0x120], 1
mov qword [rbp + 0x128], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
movdqa xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r8
mov qword [rbp + 0x168], 0xffffffffffffffff
mov dword [rbp + 0x170], r8d
xor eax, eax
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm0
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rax
movdqa xmm0, xmmword [0x1800acbe0]
movdqa xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], al
mov word [rbp + 0x1e0], r8w
mov dword [rbp + 0x1e4], r8d
mov qword [rbp + 0x1e8], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1f0], xmm0
movsd qword [rbp + 0x200], xmm2
mov byte [rbp + 0x208], al
mov qword [rbp + 0x20c], r8
mov r14d, edi
mov dword [rsp + 0x68], edi
lea eax, [rdi + 0x12]
lea r9, [0x180000000]
cmp edi, eax
jae 0x180039968
mov r12d, dword [rsp + 0x78]
mov edi, dword [rsp + 0x78]
mov r13d, dword [rsp + 0x78]
mov ecx, r14d
lea rdx, [0x1800a9369]
lea eax, [r14 - 0xbb]
cmp eax, 0x4d
ja case.default.0x180039597
movzx eax, byte [r9 + rax + 0x3a6ec]
mov ecx, dword [r9 + rax*4 + 0x3a6a4]
add rcx, r9
jmp rcx
mov r14d, r8d
cmp dword [rbp - 0x80], 0
jle 0x1800395d2
mov rsi, qword [rbp - 0x70]
nop word [rax + rax]
movsx ecx, byte [rsi]
mov rdx, qword [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
je 0x180039922
inc r14d
inc rsi
cmp r14d, dword [rbp - 0x80]
jl 0x1800395b0
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r8d, r8d
mov dword [rsp + 0x70], r8d
mov r14d, dword [rsp + 0x68]
jmp case.0x180039597.204
mov rsi, r8
mov qword [rbp - 0x68], r8
mov rax, qword [r15]
cmp rax, qword [rbx + 0x10]
jae 0x180039634
nop
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18003960d
mov rcx, qword [rbx]
movsx ecx, byte [rax + rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isxdigit]
test eax, eax
je 0x18003962d
inc rsi
mov rax, qword [r15]
inc rax
mov qword [r15], rax
cmp rax, qword [rbx + 0x10]
jb 0x180039600
mov qword [rbp - 0x68], rsi
xor r8d, r8d
mov r14d, SHTestTokenMembership
jmp case.0x180039597.204
mov edi, r8d
mov r12d, r8d
cmp dword [rbx + 8], 1
cmova r12d, dword [rbx + 8]
jmp case.0x180039597.204
mov edx, edi
mov rcx, qword [rbx]
mov rax, qword [r15]
mov qword [rcx + rdx*8], rax
jmp case.0x180039597.204
cmp r13d, r12d
je case.0x180039597.204
nop dword [rax]
lea edi, [r12 + r13]
shr edi, 1
mov rdx, qword [rbx]
mov rdx, qword [rdx + rdi*8]
mov rcx, qword [r15]
call qword [rbx + 0x18]
test eax, eax
jns 0x18003968c
mov r12d, edi
jmp 0x180039692
jle case.0x180039597.201
lea r13d, [rdi + 1]
cmp r13d, r12d
jne 0x180039670
jmp 0x1800398fb
mov r14d, 0x106
cmp dword [rbx + 8], 0
jbe 0x1800396bd
mov eax, edi
mov rdx, qword [rbx]
mov rdx, qword [rdx + rax*8]
mov rcx, qword [r15]
call qword [rbx + 0x18]
test eax, eax
jle 0x1800396bd
inc edi
mov eax, dword [rbx + 8]
inc eax
cmp eax, dword [rbx + 0xc]
jbe 0x1800396ea
mov esi, dword [rbx + 0xc]
add esi, esi
mov edx, esi
shl rdx, 3
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x180039939
mov qword [rbx], rax
mov dword [rbx + 0xc], esi
mov r9, qword [rbx]
mov r8d, dword [rbx + 8]
sub r8d, edi
shl r8, 3
mov eax, edi
lea rdx, [r9 + rax*8]
lea eax, [rdi + 1]
lea rcx, [r9 + rax*8]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1800398fb
mov byte [rbp + 0x2d3], 0x66
movzx eax, word [0x1800ac415]
mov word [rbp + 0x2d4], ax
movzx eax, byte [0x1800ac417]
mov byte [rbp + 0x2d6], al
jmp case.0x180039597.204
mov byte [rbp + 0x2d3], 0
jmp case.0x180039597.204
movsxd rcx, dword [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x70], rax
jmp 0x1800398fb
mov eax, dword [r15]
mov dword [rsp + 0x68], eax
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x68]
mov rdx, rbx
mov ecx, 0x4c
call fcn.18001f920
test eax, eax
je 0x1800398fb
mov dword [rsp + 0x70], eax
jmp case.0x180039e76.0
test rbx, rbx
jne 0x1800397d0
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
xor r9d, r9d
lea r8, str.a___NULL
mov edx, 0xcd
xor ecx, ecx
call fcn.180026490
lea rdx, [0x1800a9369]
xor r8d, r8d
test r15, r15
jne 0x180039813
mov dword [rsp + 0x68], r8d
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
xor r9d, r9d
lea r8, str.b___NULL
mov edx, 0xcd
xor ecx, ecx
call fcn.180026490
test rsi, rsi
jne 0x18003985c
xor ecx, ecx
mov dword [rsp + 0x68], ecx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rcx
lea rax, [0x1800a9369]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
xor r9d, r9d
lea r8, str.c___NULL
mov edx, 0xcd
call fcn.180026490
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, rbx
mov edx, 0xde
mov rcx, r15
call fcn.18001ca80
mov dword [rsp + 0x68], eax
lea r8, [rsp + 0x68]
xor edx, edx
lea ecx, [rdx + 3]
call fcn.180029d80
mov dword [rsp + 0x70], eax
jmp 0x1800398fb
inc dword [rbx + 8]
mov dword [rsp + 0x70], 1
jmp case.0x180039597.204
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x70], rax
jmp case.0x180039597.204
mov r13d, r8d
jmp case.0x180039597.204
movzx eax, word [0x1800ac451]
mov word [rbp + 0x2d0], ax
movzx eax, byte [0x1800ac453]
mov byte [rbp + 0x2d2], al
jmp case.0x180039597.204
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x180039957
mov eax, dword [r15]
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x68]
mov r8d, 0x3b
mov rdx, rbx
xor ecx, ecx
call fcn.180015e60
mov esi, eax
test eax, eax
jne 0x180039944
xor r8d, r8d
mov ecx, dword [rsp + 0x58]
inc r14d
mov dword [rsp + 0x68], r14d
lea eax, [rcx + 0x12]
lea r9, [0x180000000]
cmp r14d, eax
jae 0x180039964
mov rsi, qword [rbp - 0x78]
jmp 0x18003956c
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x70], 0xfffffffd
jmp case.0x180039e76.0
xor esi, esi
mov dword [rsp + 0x70], esi
jmp 0x18003a434
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rsp + 0x70], esi
jmp case.0x180039e76.0
mov dword [rsp + 0x70], 0xfffffffe
jmp case.0x180039e76.0
mov edi, dword [rsp + 0x58]
lea ebx, [rdi + 0xc18]
mov dword [rsp + 0x54], ebx
cmp edi, ebx
jae case.0x180039e76.0
mov ecx, 0x1bb
mov edx, 0x5f
lea r11d, [rdx + 2]
lea r10d, [rdx - 0x1c]
movzx ebx, word [rsp + 0x58]
mov dword [rsp + 0x7c], ebx
movzx r13d, byte [rsp + 0x51]
movzx r12d, byte [rsp + 0x51]
mov esi, dword [rsp + 0x78]
mov r15, qword [rbp - 0x60]
mov r14, qword [rbp - 0x60]
mov eax, dword [rsp + 0x54]
cmp edi, 0x581
ja 0x180039e06
je 0x180039dbd
cmp edi, 0x225
ja 0x180039ab5
je 0x180039a93
mov eax, edi
sub eax, 0xcd
je 0x180039a49
sub eax, 0x12
je case.0x180039e76.0
sub eax, 0x24
je case.0x180039e76.0
cmp eax, 0x76
jne 0x18003a415
movzx eax, word [0x1800ac538]
mov word [rbp + 0x2da], ax
movzx eax, byte [0x1800ac53a]
mov byte [rbp + 0x2dc], al
mov byte [rbp + 0x2dd], 0
movsd xmm0, qword [str.M2_vcmpy_s1_]
movsd qword [rbp + 0x310], xmm0
mov eax, dword [0x1800ac558]
mov dword [rbp + 0x318], eax
movzx eax, byte [0x1800ac55c]
mov byte [rbp + 0x31c], al
jmp 0x18003a415
mov byte [rbp + 0x2d7], 0
mov r8d, 2
lea rdx, [0x1800ac4d8]
lea rcx, [rbp + 0x2d7]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x2d9], 0
mov r8d, 1
lea rdx, [0x1800ac507]
lea rcx, [rbp + 0x2d9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r8d, r8d
jmp 0x18003a403
mov r8d, 6
lea rdx, str.sat_i
lea rcx, [rbp + 0x31c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
xor r8d, r8d
jmp 0x18003a403
cmp edi, 0x2d1
je 0x180039b7f
cmp edi, 0x37d
je 0x180039b19
cmp edi, 0x429
je 0x180039ae2
cmp edi, 0x4d5
je 0x18003a34c
jmp 0x18003a419
mov qword [rsp + 0x20], r8
mov r9d, 0x86
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x260]
call fcn.180012bd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbp + 0x50], rax
mov ebx, 0x100
mov dword [rsp + 0x7c], ebx
xor r8d, r8d
jmp 0x18003a403
lea rax, [rbp + 0x2d0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180039b30
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x220]
call fcn.18001c7f0
mov r8d, 1
lea rdx, [0x1800ac568]
lea rcx, [rbp + 0x240]
call fcn.18001c7f0
mov ecx, 0x1bb
mov word [rbp + 0x280], cx
mov byte [rsp + 0x60], 1
xor r8d, r8d
jmp 0x18003a408
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x74]
lea rcx, [0x1800b42e8]
call fcn.180055060
test al, al
jne 0x180039da0
mov ebx, 0xd
lea r12, [0x180000000]
nop dword [rax + rax]
cmp ebx, 0xd
ja case.default.0x180039bc6
mov eax, ebx
mov ecx, dword [r12 + rax*4 + 0x3a73c]
add rcx, r12
jmp rcx
movups xmm0, xmmword [str.e_Display]
movups xmmword [rbp + 0x332], xmm0
mov eax, dword [0x1800ac4a0]
mov dword [rbp + 0x342], eax
jmp case.default.0x180039bc6
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
jmp case.default.0x180039bc6
mov r9d, dword [rbp - 0x54]
lea r8, [rbp + 0x328]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
mov dword [rsp + 0x70], 1
jmp case.default.0x180039bc6
mov dword [rbp + 0x328], 0x52
movsd xmm0, qword [str.emot]
movsd qword [rbp + 0x32a], xmm0
movzx eax, word [0x1800ac4b0]
mov word [rbp + 0x332], ax
jmp case.default.0x180039bc6
lea rcx, [rbp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp case.default.0x180039bc6
xor eax, eax
mov qword [rbp - 0x68], rax
mov qword [rbp + 0x20], rax
jmp case.default.0x180039bc6
mov dword [rbp - 0x58], 0
jmp case.default.0x180039bc6
lea r9, [rbp - 0x68]
mov r8d, dword [rbp - 0x58]
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x58]
call sub.ADVAPI32.dll_LsaOpenPolicy
mov rcx, qword [rbp - 0x68]
test rcx, rcx
jne 0x180039c99
mov byte [rsp + 0x51], cl
jmp case.default.0x180039bc6
cmp byte [rsp + 0x51], 0
je case.default.0x180039bc6
lea r9, [rbp + 0x20]
mov r8d, 1
lea rdx, [rbp + 0x58]
call sub.ADVAPI32.dll_LsaQueryTrustedDomainInfoByName
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x180039cc5
call sub.ADVAPI32.dll_LsaFreeMemory
mov rcx, qword [rbp - 0x68]
call sub.ADVAPI32.dll_LsaClose
jmp case.default.0x180039bc6
movabs rax, 0x6100500020
mov qword [rbp + 0x344], rax
lea rcx, [rbp + 0x328]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180039cf0
mov eax, dword [0x1800ac4b4]
mov dword [rcx], eax
mov dword [rbp + 0x34c], 0x61
movsd xmm0, qword [0x1800ac4b8]
movsd qword [rbp + 0x34e], xmm0
movzx eax, word [0x1800ac4c0]
mov word [rbp + 0x356], ax
jmp case.default.0x180039bc6
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
movups xmmword [rbp + 0x2f0], xmm0
movups xmmword [rbp + 0x300], xmm0
mov dword [rbp + 0x2e0], 0x30
jmp case.default.0x180039bc6
mov eax, dword [0x1800ac4c4]
mov dword [rbp + 0x356], eax
movzx eax, word [0x1800ac4c8]
mov word [rbp + 0x35a], ax
mov byte [rsp + 0x51], 1
jmp case.default.0x180039bc6
mov dword [rbp - 0x54], 0
jmp case.default.0x180039bc6
xor eax, eax
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], eax
dec ebx
lea eax, [rbx + 0x86]
cmp eax, 0x85
ja 0x180039bb0
mov ebx, dword [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r13b, 1
movzx r12d, r13b
xor r8d, r8d
jmp 0x18003a403
mov word [rsp + 0x58], cx
lea r9, [0x1800b4368]
lea r8, [rbp + 0x80]
mov edx, 0xbf
lea rcx, [rsp + 0x58]
call fcn.180007290
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x45]
lea rcx, [rbp - 0x30]
call fcn.180024340
xor r8d, r8d
mov qword [rbp - 0x40], r8
jmp 0x18003a403
cmp edi, 0x8dd
ja 0x18003a1e3
je 0x18003a1b3
cmp edi, 0x62d
je 0x18003a162
cmp edi, 0x6d9
je 0x18003a0e4
cmp edi, 0x785
je 0x18003a07c
cmp edi, 0x831
jne 0x18003a419
mov rax, qword [rbp + 0x28]
test rax, rax
jne 0x18003a04a
mov ebx, 0xb
nop word [rax + rax]
cmp ebx, 0xb
ja case.default.0x180039e76
mov eax, ebx
mov ecx, dword [r9 + rax*4 + 0x3a774]
add rcx, r9
jmp rcx
mov edx, dword [rbp - 0x50]
mov rcx, qword [rbp + 0x38]
call sub.SHELL32.dll_SHTestTokenMembership
mov edx, 0x5f
lea r10d, [rdx - 0x1c]
lea r11d, [rdx + 2]
jmp case.default.0x180039e76
mov dword [rbp + 0x2e8], 0x49005f
mov eax, 0x64
mov word [rbp + 0x2ec], ax
jmp case.default.0x180039e76
mov dword [rbp + 0x2f4], 0x43005f
mov dword [rbp + 0x2f8], 0x380053
mov eax, 0x33
mov word [rbp + 0x2fc], ax
jmp case.default.0x180039e76
mov dword [rbp - 0x50], r8d
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rbp - 0x78], rax
mov edx, 0x5f
lea r10d, [rdx - 0x1c]
lea r11d, [rdx + 2]
jmp case.default.0x180039e76
mov dword [rbp + 0x2ee], 0x680061
mov eax, 0x6f
mov word [rbp + 0x2f2], ax
jmp case.default.0x180039e76
mov byte [rsp + 0x50], 1
mov qword [rbp - 0x78], r8
mov qword [rbp + 0x38], r8
jmp case.default.0x180039e76
mov eax, 0x50
mov word [rbp + 0x2e0], ax
mov dword [rbp + 0x2e2], 0x6f0072
mov eax, 0x6a
mov word [rbp + 0x2e6], ax
jmp case.default.0x180039e76
mov dword [rbp + 0x2fe], 0x43005f
mov eax, 0x65
mov word [rbp + 0x302], ax
mov dword [rbp + 0x304], 0x74006e
jmp case.default.0x180039e76
mov dword [rbp + 0x308], 0x610072
mov dword [rbp + 0x30c], 0x6c
jmp case.default.0x180039e76
mov ecx, r8d
movzx eax, byte [rsp + 0x50]
mov r9, qword [rbp - 0x78]
test r9, r9
cmovne ecx, eax
mov byte [rsp + 0x50], cl
cmp cl, 0
je case.default.0x180039e76
mov r8d, 0xf01ff
lea rdx, [rbp + 0x2e0]
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x180039fe7
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov byte [rsp + 0x50], dil
mov edx, 0x5f
lea r10d, [rdx - 0x1c]
lea r11d, [rdx + 2]
jmp case.default.0x180039e76
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceLockStatusW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, 0x5f
lea r10d, [rdx - 0x1c]
lea r11d, [rdx + 2]
jmp case.default.0x180039e76
mov dword [rsp + 0x70], 1
dec ebx
lea eax, [rbx + 0x67]
cmp eax, 0x66
mov r8d, 0
lea r9, [0x180000000]
ja 0x180039e60
mov edi, dword [rsp + 0x58]
mov ebx, dword [rsp + 0x7c]
mov rax, qword [rbp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x180008330]
mov qword [rsp + 0x58], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb9
lea rcx, [rsp + 0x58]
call fcn.180005df0
xor r8d, r8d
jmp 0x18003a403
lea r8, [rbp - 0x40]
mov edx, esi
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [rbp - 0x4c], eax
movsx ecx, bx
lea rax, [rbp + 0x310]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r15, rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x70]
lea r8, [0x18000fb90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
xor r8d, r8d
jmp 0x18003a403
lea rax, [rbp + 0x80]
mov qword [rsp + 0x58], rax
mov rdx, qword [rbp - 0x28]
cmp rdx, qword [rbp - 0x20]
je 0x18003a10b
lea rax, [rbp + 0x80]
mov qword [rdx], rax
add qword [rbp - 0x28], 8
jmp 0x18003a119
lea r8, [rsp + 0x58]
lea rcx, [rbp - 0x30]
call fcn.180002f40
mov eax, dword [0x1800b4390]
mov dword [rsp + 0x58], eax
mov r8d, 0x128
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x30]
call fcn.180045500
lea rax, [rbp - 0x30]
mov qword [rbp + 0x40], rax
mov eax, dword [0x1800b4390]
mov dword [rbp + 0x48], eax
mov eax, dword [0x1800b4394]
mov dword [rbp + 0x4c], eax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x70], xmm0
xor r8d, r8d
jmp 0x18003a403
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x68], rax
mov rdx, qword [rbp - 0x28]
cmp rdx, qword [rbp - 0x20]
je 0x18003a189
lea rax, [rbp + 0xb0]
mov qword [rdx], rax
add qword [rbp - 0x28], 8
jmp 0x18003a197
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.180002f40
lea r9, [rbp - 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rsp + 0x68], eax
xor r8d, r8d
jmp 0x18003a403
mov ecx, r8d
movzx eax, byte [rsp + 0x60]
cmp dword [rsp + 0x68], 0
cmove ecx, eax
mov byte [rsp + 0x60], cl
mov ecx, r8d
movzx eax, r13b
cmp dword [rbp - 0x4c], 0
cmovne ecx, eax
movzx r13d, cl
mov ecx, 0x1bb
jmp 0x18003a415
cmp edi, 0x989
je 0x18003a3d3
cmp edi, 0xa35
je 0x18003a39a
cmp edi, 0xae1
jne 0x18003a419
mov esi, 0x1f
nop dword [rax]
mov eax, esi
sub eax, 0x1f
je 0x18003a225
cmp eax, 1
je case.0x180039e76.0
jmp 0x18003a33d
test r12b, r12b
je 0x18003a2fc
mov edi, 0x10a
mov eax, edi
sub eax, 0x10a
je 0x18003a2b7
cmp eax, 1
jne 0x18003a2e8
test r12b, r12b
je 0x18003a2e8
mov ebx, 0xcf
mov eax, ebx
sub eax, 0xcf
je 0x18003a275
cmp eax, 1
jne 0x18003a2a1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003a2a1
mov qword [rbp - 0x60], r8
mov qword [rbp + 0x30], r8
mov dword [rsp + 0x78], r8d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp - 0x60]
mov edx, 4
mov rcx, r14
call sub.dbghelp.dll_MiniDumpReadDumpStream
inc ebx
cmp ebx, 0xd1
mov r8d, 0
jb 0x18003a253
mov ebx, dword [rsp + 0x7c]
jmp 0x18003a2e8
movsx rax, bx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
jne 0x18003a2e8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r12b, r12b
inc edi
cmp edi, 0x10c
mov r8d, 0
jb 0x18003a233
cmp byte [rsp + 0x60], 0
je 0x18003a335
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x48]
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov dword [rsp + 0x68], eax
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x18003a335
call sub.RPCRT4.dll_MesHandleFree
mov dword [rsp + 0x68], eax
xor r8d, r8d
mov dword [rsp + 0x70], r8d
inc esi
cmp esi, 0x21
jb 0x18003a210
mov edi, dword [rsp + 0x58]
lea r8, [rbp + 0x220]
mov edx, 0xcb
lea rcx, [rbp + 0x290]
call fcn.18000c3b0
mov eax, 0x1bb
mov word [rsp + 0x58], ax
mov r9d, 0xab
lea r8, [rbp + 0xb0]
lea rdx, [0x1800b4348]
lea rcx, [rsp + 0x58]
call fcn.1800169a0
mov esi, 0x20008
xor r8d, r8d
mov qword [rbp - 0x48], r8
jmp 0x18003a403
mov r9d, 0x1c
xor r8d, r8d
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call fcn.18001bc10
test r13b, r13b
je 0x180039a8b
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_IsTokenRestricted]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
jmp 0x18003a403
lea r9, [rbp - 0x30]
lea r8, [rbp + 0xf0]
mov edx, 0xae
lea rcx, [0x1800b42e0]
call fcn.180007290
xor r8d, r8d
mov ecx, r8d
movzx eax, r12b
test r15, r15
cmovne ecx, eax
movzx r12d, cl
mov ecx, 0x1bb
mov edx, 0x5f
lea r11d, [rdx + 2]
lea r10d, [rdx - 0x1c]
mov eax, dword [rsp + 0x54]
add edi, 0xac
mov dword [rsp + 0x58], edi
cmp edi, eax
lea r9, [0x180000000]
jb 0x1800399b1
xor esi, esi
lea rcx, [rbp + 0x168]
call fcn.180004fc0
mov rbx, qword [rbp + 0x150]
test rbx, rbx
je 0x18003a49f
mov rdi, qword [rbp + 0x158]
cmp rbx, rdi
je 0x18003a470
mov rcx, rbx
call fcn.180017a50
add rbx, 0x20
cmp rbx, rdi
jne 0x18003a458
mov rbx, qword [rbp + 0x150]
mov r8, qword [rbp + 0x160]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x150]
call fcn.180022450
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rsi
mov rdx, qword [rbp + 0x138]
test rdx, rdx
je 0x18003a4d7
mov r8, qword [rbp + 0x148]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x138]
call fcn.1800223b0
mov qword [rbp + 0x138], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x140], xmm0
lea rcx, [rbp + 0xf8]
call fcn.180004ef0
nop
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x18003a57b
mov rdi, qword [rbp - 0x10]
cmp rbx, rdi
je 0x18003a515
nop word [rax + rax]
mov rcx, rbx
call fcn.180004800
add rbx, 0x28
cmp rbx, rdi
jne 0x18003a500
mov rbx, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18003a567
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003a567
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.18005fdc8
mov qword [rbp - 0x18], rsi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x18003a5a4
mov r8, qword [rbp - 0x20]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x30]
call fcn.180022360
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rsi
mov rdx, qword [rbp + 0xa2]
cmp rdx, 0x10
jb 0x18003a5e8
inc rdx
mov rcx, qword [rbp + 0x8a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003a5e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003a5e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005fdc8
movdqa xmm0, xmmword [0x1800acbe0]
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], 0
mov rdx, qword [rbp + 0xd2]
cmp rdx, 0x10
jb 0x18003a643
inc rdx
mov rcx, qword [rbp + 0xba]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003a63e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003a63e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18005fdc8
movdqa xmm0, xmmword [0x1800acbe0]
movdqu xmmword [rbp + 0xca], xmm0
mov byte [rbp + 0xba], 0
lea rcx, [rbp + 0x290]
call fcn.180004b60
nop
lea rcx, [rbp + 0x220]
call fcn.180004c10
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1800602e0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret