Function at 0x18005a330
Capabilities:
Create thread
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [0x180090f80]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov r14, r8
mov qword [rbp - 0x68], rdx
mov edi, ecx
mov dword [rbp - 0x48], ecx
movdqa xmm0, xmmword [0x180082770]
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movdqa xmmword [rbp + 0x2d0], xmm0
mov byte [rbp + 0x2c0], 0
movdqa xmmword [rbp + 0x2f0], xmm0
mov byte [rbp + 0x2e0], 0
xor ecx, ecx
mov qword [rbp + 0xf0], rcx
mov word [rbp + 0xf8], cx
movdqu xmmword [rbp + 0x10a], xmm0
mov byte [rbp + 0xfa], cl
mov qword [rbp + 0xc0], rcx
mov word [rbp + 0xc8], cx
movdqu xmmword [rbp + 0xda], xmm0
mov byte [rbp + 0xca], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rcx
movdqa xmmword [rbp], xmm0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x128], rcx
mov qword [rbp + 0x130], rcx
mov ecx, 0x30
call fcn.180076448
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x128], rax
xor edx, edx
mov qword [rbp + 0x138], rdx
xorps xmm2, xmm2
movsd qword [rbp + 0x140], xmm2
mov qword [rbp + 0x148], rdx
mov r8d, 1
mov dword [rbp + 0x150], r8d
mov qword [rbp + 0x158], rdx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x170], xmm1
movdqa xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rdx
mov qword [rbp + 0x198], 0xffffffffffffffff
mov dword [rbp + 0x1a0], edx
xor eax, eax
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
movups xmmword [rbp + 0x1c8], xmm0
movups xmmword [rbp + 0x1d8], xmm0
mov qword [rbp + 0x1e8], rax
movdqa xmm0, xmmword [0x180082770]
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], al
mov word [rbp + 0x210], dx
mov dword [rbp + 0x214], edx
mov qword [rbp + 0x218], rdx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x220], xmm0
movsd qword [rbp + 0x230], xmm2
mov byte [rbp + 0x238], al
mov qword [rbp + 0x23c], rdx
mov eax, edi
mov dword [rbp - 0x70], eax
lea ebx, [rdi - 0xd]
mov dword [rsp + 0x78], ebx
mov qword [rbp - 0x50], 5
lea r11d, [rdx + 0x2e]
cmp edi, ebx
mov edi, dword [rbp - 0x40]
mov dword [rbp - 0x58], edi
jbe 0x18005a9ba
lea r10d, [rdx + 0x6f]
lea r9d, [rdx + 0x62]
mov r13, qword [rbp - 0x60]
mov ebx, dword [rbp - 0x6c]
mov r12d, dword [rbp - 0x6c]
mov rsi, qword [rbp - 0x50]
mov r15, qword [rbp - 0x50]
mov ecx, dword [rsp + 0x78]
nop dword [rax]
add eax, 0xffffff36
cmp eax, 0x1b
ja case.default.0x18005a596
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x5b734]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
movzx eax, word [0x18007c8a0]
mov word [rbp + 0x3a6], ax
movzx eax, byte [0x18007c8a2]
mov byte [rbp + 0x3a8], al
jmp case.0x18005a596.204
mov qword [r14 + 0x10], rdx
mov qword [r14 + 0x18], rdx
mov qword [r14 + 0x20], rdx
mov dword [r14 + 0x28], edx
jmp case.0x18005a596.204
mov eax, dword [str.B213]
mov dword [rbp + 0x3a8], eax
movzx eax, byte [0x18007c8a8]
mov byte [rbp + 0x3ac], al
mov r8d, 3
lea rdx, [0x18007c8ac]
lea rcx, [rbp + 0x3ac]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 5
lea rdx, str.Z256
lea rcx, [rbp + 0x3ae]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x3b2], 0x6d
xor edx, edx
lea r8d, [rdx + 1]
lea r9d, [rdx + 0x62]
lea r10d, [rdx + 0x6f]
lea r11d, [rdx + 0x2e]
jmp case.0x18005a596.204
mov r8d, 2
lea rdx, [0x18007c8b8]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x18007c8bc]
mov dword [rbp + 0x3ba], eax
movabs rax, 0x2f00430041
mov qword [rbp + 0x3be], rax
mov dword [rbp + 0x3c4], 0x4d
lea rcx, [rbp + 0x3b8]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18005a684
mov eax, dword [0x18007c8c4]
mov dword [rcx], eax
movzx eax, word [0x18007c8c8]
mov word [rcx + 4], ax
jmp 0x18005a621
mov byte [rbp + 0x385], 0
jmp case.0x18005a596.204
mov word [rbp + 0x385], r10w
mov word [rbp + 0x386], r11w
movzx eax, word [0x18007c8cc]
mov word [rbp + 0x387], ax
movzx eax, byte [0x18007c8ce]
mov byte [rbp + 0x389], al
jmp case.0x18005a596.204
lea r13, [rbp - 0x40]
mov qword [rbp - 0x60], r13
mov qword [rsp + 0x20], r14
mov r9d, 0x10c
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1800630a0
mov qword [rbp - 0x38], rax
jmp 0x18005a621
mov r12, qword [rbp - 0x68]
mov dword [r12], r8d
mov dword [rbp - 0x80], 2
mov dword [rbp - 0x78], 0xfffffffe
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rdx
mov r9, r14
xor r8d, r8d
lea edx, [r8 + 0x73]
lea rcx, [rbp - 0x80]
call fcn.18006a490
mov rbx, rax
cmp dword [r12], 0
je 0x18005aaae
cmp byte [r14 + 0x41], 0
je 0x18005b49c
mov r12d, 0xfffffffd
jmp 0x18005a621
mov word [rbp + 0x380], r9w
mov dword [rbp + 0x381], 0x616269
mov byte [rbp + 0x384], 0x62
jmp case.0x18005a596.204
mov eax, dword [str.VFMAD]
mov dword [rbp + 0x3a0], eax
movzx eax, word [0x18007c8d4]
mov word [rbp + 0x3a4], ax
mov word [rbp + 0x3a5], 0x44
jmp case.0x18005a596.204
cmp r13, qword [rbp - 0x38]
jae 0x18005a853
jmp 0x18005a7c2
xor edx, edx
movzx eax, word [r13]
mov word [rbp - 0x80], ax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r9d, pe_nt_image_headers64
xor r8d, r8d
lea rdx, [rbp + 0x70]
mov rcx, r14
call fcn.18003bc50
test al, al
je 0x18005a841
mov dword [rbp - 0x78], 2
mov dword [rbp - 0x58], 0xfffffffe
lea rax, [rbp - 0x58]
mov qword [rsp + 0x30], rax
mov rdi, qword [rbp - 0x68]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x73]
lea rcx, [rbp - 0x78]
call fcn.18006a490
neg eax
cmp dword [rdi], 0
je 0x18005aaae
cmp eax, r12d
cmovg r12d, eax
add r13, 2
mov qword [rbp - 0x60], r13
cmp r13, qword [rbp - 0x38]
jb 0x18005a7c0
cmp r12d, 0xfffffffd
jle 0x18005a958
cmp r12d, ebx
jl 0x18005a86f
mov ebx, r12d
mov edi, ebx
mov dword [rbp - 0x58], ebx
jmp 0x18005a621
test ebx, ebx
jne 0x18005a958
mov edi, 0x19
movzx r13d, byte [rsp + 0x70]
mov eax, edi
sub eax, 0x19
je 0x18005a93d
sub eax, 1
je 0x18005a928
sub eax, 1
je 0x18005a8a5
cmp eax, 1
je 0x18005a90f
jmp 0x18005a944
xor r13b, r13b
cmp rsi, r15
jae 0x18005a944
movzx eax, word [rsi]
mov word [rbp - 0x80], ax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
mov ecx, 0xa1
call fcn.180021fd0
test al, al
jne 0x18005a906
movzx eax, word [rsi]
mov word [rbp - 0x80], ax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, pe_nt_image_headers64
xor r8d, r8d
lea rdx, [rbp + 0x70]
mov rcx, r14
call fcn.18003bc50
test al, al
jne 0x18005a90c
add rsi, 2
jmp 0x18005a8a8
mov r13b, 1
mov edi, 0x1c
mov dword [rbp - 0x70], 0xd6
mov eax, r12d
test r13b, r13b
cmovne eax, ebx
mov ebx, eax
jmp 0x18005a944
mov r8, rsi
mov rdx, r14
mov ecx, 0xbc
call fcn.1800272f0
mov r15, rax
jmp 0x18005a944
lea rsi, [rbp + 0x3e0]
inc edi
cmp edi, 0x1d
jb 0x18005a882
mov byte [rsp + 0x70], r13b
mov r13, qword [rbp - 0x60]
mov edi, ebx
mov dword [rbp - 0x58], ebx
jmp 0x18005a621
mov qword [r14 + 0x30], rdx
mov qword [r14 + 0x38], rdx
jmp case.0x18005a596.204
mov eax, dword [0x18007c8d8]
mov dword [rbp + 0x3ca], eax
mov eax, dword [0x18007c8e0]
mov dword [rbp + 0x3ce], eax
mov eax, dword [0x18007c8e8]
mov dword [rbp + 0x3d2], eax
mov eax, dword [0x18007c8f0]
mov dword [rbp + 0x3d6], eax
mov dword [rbp + 0x3da], 0x52
mov ecx, dword [rsp + 0x78]
mov eax, dword [rbp - 0x70]
dec eax
mov dword [rbp - 0x70], eax
cmp eax, ecx
ja 0x18005a570
mov r14d, dword [rbp - 0x48]
lea eax, [r14 + 0x53b]
mov dword [rbp - 0x6c], eax
cmp r14d, eax
jae case.0x18005ae8d.9
mov ecx, 0x1bb
lea r8, [0x18008de70]
movzx esi, word [rsp + 0x78]
mov dword [rbp - 0x70], esi
movzx ebx, word [rsp + 0x78]
mov dword [rbp - 0x78], ebx
movzx r13d, byte [rbp - 0x80]
mov r15d, dword [rbp - 0x6c]
mov r12, qword [rbp - 0x50]
nop word [rax + rax]
cmp r14d, 0x2e8
ja 0x18005ad14
je 0x18005acc6
cmp r14d, 0x1b3
ja 0x18005ac15
je 0x18005abfd
mov eax, r14d
sub eax, 0xd8
je case.0x18005ae8d.9
sub eax, 0xd
je 0x18005abf1
cmp eax, 0x67
jne 0x18005b27a
lea rcx, [rbp + 0x3a0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18005aa50
movzx eax, word [0x18007cb84]
mov word [rcx], ax
movzx eax, byte [0x18007cb86]
mov byte [rcx + 2], al
mov qword [rsp + 0x20], rdx
mov r9d, 0x11f
lea r8, [0x18008de78]
xor edx, edx
xor ecx, ecx
call fcn.18004fc40
test al, al
jne 0x18005b26c
xor ebx, ebx
cmp ebx, 6
ja case.default.0x18005aaac
lea rdx, [0x180000000]
mov ecx, dword [rdx + rbx*4 + 0x5b7a4]
add rcx, rdx
jmp rcx
xor ebx, ebx
jmp 0x18005b49c
movzx eax, word [0x18007cb88]
mov word [rbp + 0x395], ax
mov eax, 0x65
mov word [rbp + 0x397], ax
movzx eax, word [0x18007cb8c]
mov word [rbp + 0x398], ax
mov dword [rbp + 0x39a], 0x732520
mov byte [rbp - 0x80], 1
jmp case.default.0x18005aaac
lea rax, [rbp + 0x390]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
jne 0x18005ab27
mov byte [rbp - 0x80], al
jmp case.default.0x18005aaac
cmp byte [rbp - 0x80], 0
je case.default.0x18005aaac
lea rdx, [rbp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetCommState]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.default.0x18005aaac
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x58], eax
mov edx, 0xd431
mov ecx, 0x3039
mov r8d, 0x10932
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [rbp + 0x40], 0x1c
jmp case.default.0x18005aaac
mov r8d, 2
lea rdx, [0x1800797f0]
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 1
lea rdx, [0x1800799e0]
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x18005aaac
mov byte [rbp + 0x395], 0
jmp case.default.0x18005aaac
mov r8d, 2
lea rdx, [0x18007cb90]
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x394], 0x69
inc ebx
lea eax, [rbx + 0x48]
cmp eax, 0x4f
jb 0x18005aa92
mov esi, dword [rbp - 0x70]
jmp 0x18005b26c
mov byte [rbp + 0x3b3], 0
jmp 0x18005b27a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov byte [rsp + 0x70], 1
jmp 0x18005b26c
mov eax, r14d
sub eax, 0x21a
je 0x18005ac52
cmp eax, 0x67
jne 0x18005b27a
mov dword [rsp + 0x28], 0x30
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x2c0]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x250]
call fcn.18001b0d0
jmp 0x18005b26c
lea rax, [rbp + 0x380]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18005ac60
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x250]
call fcn.18002dfd0
mov r8d, 1
lea rdx, [0x18007c8f8]
lea rcx, [rbp + 0x270]
call fcn.18002dfd0
mov eax, 0x1bb
mov word [rbp + 0x2b0], ax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x290]
mov ecx, 0x94
call fcn.180016a20
mov esi, 0x100
mov dword [rbp - 0x70], esi
jmp 0x18005b26c
mov word [rsp + 0x78], cx
lea r9, [rsp + 0x78]
lea r8, [0x18008ded8]
mov edx, 0x1d
lea rcx, [rbp + 0xf0]
call fcn.18001e540
mov eax, 0x1bb
mov word [rsp + 0x78], ax
lea r9, [rbp + 0xc0]
lea r8, [rsp + 0x78]
mov edx, 0x4b
lea rcx, [0x18008def8]
call fcn.18003e9f0
jmp 0x18005b26c
cmp r14d, 0x484
ja 0x18005b1a6
je 0x18005ae42
mov eax, r14d
sub eax, 0x34f
je 0x18005ae2c
sub eax, 0x67
je 0x18005aded
cmp eax, 0x67
jne 0x18005b27a
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp - 0x10]
je 0x18005ad6d
lea rcx, [rbp + 0xc0]
mov qword [rax], rcx
add qword [rbp - 0x18], 8
jmp 0x18005ad7e
lea r8, [rbp - 0x60]
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.18000da20
mov eax, dword [0x18008df20]
mov dword [rbp - 0x48], eax
lea r9, [rbp - 0x48]
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea ecx, [r8 + 0xe]
call fcn.18001b6e0
lea rax, [rbp - 0x20]
mov qword [rbp + 0x60], rax
mov eax, dword [0x18008df20]
mov dword [rbp + 0x68], eax
mov eax, dword [0x18008df24]
mov dword [rbp + 0x6c], eax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x30], xmm0
movsx eax, si
lea rcx, [rbp + 0x3b8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x60], rax
jmp 0x18005b26c
lea rax, [rbp + 0xf0]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbp - 0x10]
je 0x18005ae16
lea rcx, [rbp + 0xf0]
mov qword [rax], rcx
add qword [rbp - 0x18], 8
jmp 0x18005b275
lea r8, [rbp - 0x48]
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x20]
call fcn.18000da20
jmp 0x18005b26c
lea r9, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x1f]
call fcn.180041b10
jmp 0x18005b26c
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], edx
lea r9, [rbp + 0x30]
lea r8, [0x18001eea0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x18005b165
xor esi, esi
cmp esi, 9
ja case.default.0x18005ae8d
lea rax, [0x180000000]
mov edx, dword [rax + rsi*4 + 0x5b7c0]
add rdx, rax
jmp rdx
mov r8d, 1
lea rdx, [0x18007c916]
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x51], 0x29
jmp case.default.0x18005ae8d
mov byte [rbp + 0x40], 0
jmp case.default.0x18005ae8d
mov byte [rbp + 0x52], 0
mov r13b, 1
jmp case.default.0x18005ae8d
mov r8d, 4
lea rdx, [0x18007c933]
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18007c96f]
mov word [rbp + 0x44], ax
movzx eax, byte [0x18007c971]
mov byte [rbp + 0x46], al
mov byte [rbp + 0x47], 0
jmp case.default.0x18005ae8d
mov ebx, 0x100
mov dword [rbp - 0x78], ebx
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x3c]
lea rdx, [rbp - 0x3c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp qword [rbp - 0x68], 0
jne case.default.0x18005ae8d
mov ebx, 0xc2
xor r14d, r14d
lea edi, [r14 + 0x2e]
nop dword [rax]
cmp ebx, 0xc2
je 0x18005b06a
cmp ebx, 0x178
je 0x18005b023
cmp ebx, 0x22e
je 0x18005b007
cmp ebx, 0x2e4
je 0x18005afb7
cmp ebx, 0x39a
jne 0x18005b08a
mov r9d, r15d
lea r8, [rbp + 0x300]
lea rdx, [rbp + 0x70]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_ControlTraceW]
xor r13b, r13b
jmp 0x18005b08a
mov word [rbp + 0x96], r14w
mov r12, r14
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
movups xmmword [rbp + 0x340], xmm0
movups xmmword [rbp + 0x350], xmm0
movups xmmword [rbp + 0x360], xmm0
mov qword [rbp + 0x370], rax
mov r15d, r14d
jmp 0x18005b08a
mov eax, dword [0x18007cab0]
mov dword [rbp + 0x90], eax
movzx eax, word [0x18007cab4]
mov word [rbp + 0x94], ax
jmp 0x18005b08a
mov word [rbp + 0x82], r14w
mov r8d, 2
lea rdx, [0x18007c9ea]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movsd xmm0, qword [0x18007ca7c]
movsd qword [rbp + 0x86], xmm0
movzx eax, word [0x18007ca84]
mov word [rbp + 0x8e], ax
mov word [rbp + 0x90], r14w
jmp 0x18005b08a
movabs rax, 0x74007300750073
mov qword [rbp + 0x70], rax
mov word [rbp + 0x78], di
movabs rax, 0x640031002e0062
mov qword [rbp + 0x7a], rax
add ebx, 0xb6
cmp ebx, 0x450
jb 0x18005af60
mov edi, dword [rbp - 0x58]
mov r14, qword [rsp + 0x78]
mov ebx, dword [rbp - 0x78]
jmp case.default.0x18005ae8d
mov r8d, 5
lea rdx, str.Error_while_updating_namespace_end_comment:
lea rcx, [rbp + 0x4b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x50], 0
jmp case.default.0x18005ae8d
mov edi, 1
mov dword [rbp - 0x58], edi
jmp case.default.0x18005ae8d
test r13b, r13b
je case.default.0x18005ae8d
movsx rax, bx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x18005b113
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13b, r13b
mov ebx, dword [rbp - 0x78]
jmp case.default.0x18005ae8d
mov rcx, rbx
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x78]
jmp case.default.0x18005ae8d
mov r8d, 4
lea rdx, [0x18007cb68]
lea rcx, [rbp + 0x47]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x4b], 0
inc esi
lea eax, [rsi + 0x8e]
cmp eax, 0x98
jb 0x18005ae73
mov esi, dword [rbp - 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [0x1800155e0]
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x78]
mov ecx, 0xb3
call fcn.18000ff00
xor edx, edx
mov ecx, edx
movzx eax, byte [rsp + 0x70]
cmp qword [rbp - 0x60], rcx
cmovne ecx, eax
mov byte [rsp + 0x70], cl
mov r14d, dword [rbp - 0x48]
jmp 0x18005b26e
mov eax, r14d
sub eax, 0x4eb
je 0x18005b20f
cmp eax, 0x67
jne 0x18005b27a
movzx edx, byte [rsp + 0x70]
test dl, dl
je 0x18005b47c
mov r12d, 6
mov qword [rbp - 0x58], r12
mov rdi, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x50]
mov r14, qword [rbp - 0x50]
mov r15d, dword [rbp - 0x38]
mov r13, qword [rbp - 0x68]
mov ebx, 5
nop dword [rax]
cmp ebx, 5
ja case.default.0x18005b20d
mov eax, ebx
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x5b7e8]
add rcx, r8
jmp rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x50], 0x4a
lea rax, [rbp + 0x120]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180037d60
xor r8d, r8d
lea edx, [r8 + 0x79]
lea rcx, [rbp + 0x120]
call fcn.180052cd0
xor edx, edx
lea r8, [0x18008de70]
mov ecx, 0x1bb
add r14d, 0x67
mov dword [rbp - 0x48], r14d
cmp r14d, dword [rbp - 0x6c]
jae case.0x18005ae8d.9
mov ebx, dword [rbp - 0x78]
jmp 0x18005aa00
mov esi, 1
jmp 0x18005b4a0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
jmp case.default.0x18005b20d
test dl, dl
je case.default.0x18005b20d
mov ebx, 0xed
mov r13, qword [rbp - 0x60]
xor r12d, r12d
nop
mov eax, ebx
sub eax, 0xed
je 0x18005b363
sub eax, 1
je 0x18005b338
sub eax, 1
je 0x18005b2fe
cmp eax, 1
jne 0x18005b373
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18005b373
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x3e0]
mov r8, rsi
mov rdx, r14
mov ecx, r15d
call qword [sym.imp.dbghelp.dll_StackWalk64]
jmp 0x18005b373
mov r8d, 9
lea r9, [rbp - 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToData]
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x3e0]
call sub.VCRUNTIME140.dll_memset
jmp 0x18005b373
mov rsi, 0xffffffffffffffff
mov r15d, 0x14c
mov r14, rsi
inc ebx
cmp ebx, 0xf1
jb 0x18005b2d0
mov r12, qword [rbp - 0x58]
mov r13, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x50]
jmp 0x18005b463
mov r13, 0xffffffffffffffff
mov qword [rbp - 0x68], r13
jmp case.default.0x18005b20d
test rdi, rdi
jne case.default.0x18005b20d
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dl, dl
mov byte [rsp + 0x70], dl
jmp case.default.0x18005b20d
mov dword [rbp - 0x3c], 0x2000000
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
movsx rax, word [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
xor eax, eax
movups xmmword [rbp + 0x40], xmm1
mov dword [rbp + 0x50], eax
jmp 0x18005b463
mov dword [rbp - 0x6c], 0x14
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
lea rax, [rbp + 0x390]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x3c]
mov r8, r13
xor edx, edx
lea rcx, [rbp + 0x70]
call qword [sym.imp.ADVAPI32.dll_AccessCheckByType]
movzx edx, byte [rsp + 0x70]
dec ebx
mov qword [rbp - 0x50], rbx
sub r12, 1
mov qword [rbp - 0x58], r12
jne 0x18005b1f0
xor r9d, r9d
lea r8, [rbp + 0x570]
mov edx, 0x104
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor eax, eax
mov ebx, eax
mov edi, ebx
mov esi, edi
lea rcx, [rbp + 0x198]
call fcn.18000faa0
mov rbx, qword [rbp + 0x180]
test rbx, rbx
je 0x18005b535
mov rdi, qword [rbp + 0x188]
cmp rbx, rdi
je 0x18005b4e0
mov rcx, rbx
call fcn.180024ab0
add rbx, 0x20
cmp rbx, rdi
jne 0x18005b4c8
mov rbx, qword [rbp + 0x180]
mov rdx, qword [rbp + 0x190]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x18005b516
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b516
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180076484
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x180], xmm0
xor r14d, r14d
mov qword [rbp + 0x190], r14
jmp 0x18005b538
xor r14d, r14d
mov rdx, qword [rbp + 0x168]
test rdx, rdx
je 0x18005b570
mov r8, qword [rbp + 0x178]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x168]
call fcn.1800369f0
mov qword [rbp + 0x168], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x170], xmm0
lea rcx, [rbp + 0x128]
call fcn.18000f9d0
nop
mov rbx, qword [rbp - 8]
test rbx, rbx
je 0x18005b60e
mov rdi, qword [rbp]
cmp rbx, rdi
je 0x18005b5a8
mov rcx, rbx
call fcn.18000f2e0
add rbx, 0x28
cmp rbx, rdi
jne 0x18005b593
mov rbx, qword [rbp - 8]
mov rcx, qword [rbp + 8]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x18005b5fa
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b5fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180076484
mov qword [rbp - 8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp], xmm0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x18005b637
mov r8, qword [rbp - 0x10]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x20]
call fcn.1800369a0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r14
mov rdx, qword [rbp + 0xe2]
cmp rdx, 0x10
jb 0x18005b67b
inc rdx
mov rcx, qword [rbp + 0xca]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b676
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b676
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180076484
movdqa xmm0, xmmword [0x180082770]
movdqu xmmword [rbp + 0xda], xmm0
mov byte [rbp + 0xca], 0
mov rdx, qword [rbp + 0x112]
cmp rdx, 0x10
jb 0x18005b6d6
inc rdx
mov rcx, qword [rbp + 0xfa]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005b6d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005b6d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180076484
movdqa xmm0, xmmword [0x180082770]
movdqu xmmword [rbp + 0x10a], xmm0
mov byte [rbp + 0xfa], 0
lea rcx, [rbp + 0x2c0]
call fcn.18000f640
nop
lea rcx, [rbp + 0x250]
call fcn.18000f6f0
mov eax, esi
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.180076c30
mov rbx, qword [rsp + 0x7d0]
add rsp, 0x790
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret