Function at 0x18003f0a0
Capabilities:
Create thread
Encode data using base64
Enumerate services
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa00]
sub rsp, 0xb00
mov rax, qword [0x180080a28]
xor rax, rsp
mov qword [rbp + 0x9f0], rax
mov dword [rsp + 0x78], r9d
mov r12, r8
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rcx
mov r13, qword [rbp + 0xa60]
mov rsi, qword [rbp + 0xa68]
mov qword [rbp - 0x78], rsi
movdqa xmm0, xmmword [0x18007b7e0]
movdqa xmmword [rbp + 0x2d0], xmm0
mov byte [rbp + 0x2c0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x2f0], xmm0
mov byte [rbp + 0x2e0], 0
movdqa xmmword [rbp + 0x310], xmm0
mov byte [rbp + 0x300], 0
movdqa xmmword [rbp + 0x340], xmm0
mov byte [rbp + 0x330], 0
movdqa xmmword [rbp + 0x360], xmm0
mov byte [rbp + 0x350], 0
xor ecx, ecx
mov qword [rbp + 0x160], rcx
mov word [rbp + 0x168], cx
movdqu xmmword [rbp + 0x17a], xmm0
mov byte [rbp + 0x16a], cl
mov qword [rbp + 0x130], rcx
mov word [rbp + 0x138], cx
movdqu xmmword [rbp + 0x14a], xmm0
mov byte [rbp + 0x13a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rcx
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x198], rcx
mov qword [rbp + 0x1a0], rcx
mov ecx, 0x30
call fcn.180071f5c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x198], rax
xor r11d, r11d
mov qword [rbp + 0x1a8], r11
xorps xmm2, xmm2
movsd qword [rbp + 0x1b0], xmm2
mov qword [rbp + 0x1b8], r11
mov r10d, 1
mov dword [rbp + 0x1c0], r10d
mov qword [rbp + 0x1c8], r11
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], r11
mov qword [rbp + 0x208], 0xffffffffffffffff
mov dword [rbp + 0x210], r11d
xor eax, eax
movups xmmword [rbp + 0x218], xmm0
movups xmmword [rbp + 0x228], xmm0
movups xmmword [rbp + 0x238], xmm0
movups xmmword [rbp + 0x248], xmm0
mov qword [rbp + 0x258], rax
movdqa xmm0, xmmword [0x18007b7e0]
movdqa xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], al
mov word [rbp + 0x280], r11w
mov dword [rbp + 0x284], r11d
mov qword [rbp + 0x288], r11
xorps xmm0, xmm0
movaps xmmword [rbp + 0x290], xmm0
movsd qword [rbp + 0x2a0], xmm2
mov byte [rbp + 0x2a8], al
mov qword [rbp + 0x2ac], r11
mov edx, dword [rsp + 0x78]
mov r15d, edx
lea eax, [rdx + 0xe]
mov dword [rsp + 0x60], eax
lea r9, [0x180080738]
mov r8d, 0x1bb
lea rcx, [0x180000000]
mov ebx, dword [rbp - 0x80]
mov edi, dword [rsp + 0x70]
cmp edx, eax
jae 0x18003f95e
lea r14d, [rdx - 0x124]
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x60]
mov r8d, 0x6e
lea edx, [r8 - 5]
cmp r14d, 0x2d
ja case.default.0x18003f325
movzx eax, byte [rcx + r14 + 0x408fc]
mov ecx, dword [rcx + rax*4 + 0x408c0]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov byte [rbp + 0x370], 0
lea rcx, [rbp + 0x370]
dec rcx
nop dword [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18003f340
mov eax, dword [0x180077b3c]
mov dword [rcx], eax
jmp case.0x18003f325.14
cmp dword [rbp + 0x18], 0
je case.0x18003f325.14
mov esi, 0x5f
nop word [rax + rax]
cmp esi, 0x3453
ja 0x18003f4c2
je 0x18003f496
cmp esi, 0x5f
je 0x18003f44b
cmp esi, 0xd5c
je 0x18003f408
cmp esi, 0x1a59
je 0x18003f3ea
cmp esi, 0x2756
jne 0x18003f535
mov r9d, 0x4a
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x90]
call fcn.180026790
mov rbx, rax
test eax, eax
jne 0x18003f878
lea r9, [rbp + 0x30]
lea r8, [rbp + 0xd8]
mov edx, 0x10d
lea rcx, [rbp]
call fcn.180046c90
jmp 0x18003f52b
lea r9, [rbp + 0x30]
lea r8, [rbp + 0xf0]
mov edx, 0x10d
lea rcx, [rbp + 0x60]
call fcn.180046c90
jmp 0x18003f52b
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x108]
mov edx, 0x10d
lea rcx, [rbp + 0x48]
call fcn.180046c90
mov ebx, eax
test eax, eax
jne 0x18003f878
lea r9d, [rax + 0x4a]
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x90]
call fcn.180026790
jmp 0x18003f52b
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x8d
lea r8, [rbp + 0x18]
xor edx, edx
lea rcx, [rbp]
call fcn.180052330
mov ebx, eax
test eax, eax
jne 0x18003f878
lea r9d, [rax + 0x4a]
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x90]
call fcn.180026790
jmp 0x18003f52b
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0xc0]
mov ecx, 0x12b
call fcn.180063950
mov ebx, eax
test eax, eax
jne 0x18003f878
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xa8]
jmp 0x18003f521
cmp esi, 0x4150
je 0x18003f4f7
cmp esi, 0x4e4d
je 0x18003f4e7
cmp esi, 0x5b4a
jne 0x18003f535
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0xd8]
jmp 0x18003f521
lea r8, [rbp + 0xa8]
lea rdx, [rbp + 0xf0]
jmp 0x18003f521
lea r8, [rbp]
lea rdx, [rbp + 0x18]
mov ecx, 0x12b
call fcn.180063950
mov ebx, eax
test eax, eax
jne 0x18003f878
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x108]
mov ecx, 0x12b
call fcn.180063950
test eax, eax
mov ebx, eax
jne 0x18003f878
add esi, 0xcfd
cmp esi, 0x67e8
jbe 0x18003f370
cmp dword [rbp + 0x18], 0
jne 0x18003f360
jmp case.0x18003f325.14
mov ebx, r11d
jmp case.0x18003f325.14
mov rdx, qword [rbp - 0x68]
mov eax, dword [rdx]
dec eax
movsxd rcx, eax
mov rax, qword [rdx + 0x10]
lea rcx, [rax + rcx*4]
mov qword [rsp + 0x68], rcx
mov eax, dword [rsp + 0x60]
jmp 0x18003f91e
mov qword [rsp + 0x58], r11
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc0]
lea r8, [rbp]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x48]
call fcn.180071c40
mov ebx, eax
test eax, eax
je 0x18003f6a0
mov ecx, 0x16
nop dword [rax]
mov eax, ecx
sub eax, 0x16
je 0x18003f68f
cmp eax, 1
jne 0x18003f695
mov eax, edi
mov edi, eax
lea rcx, [rbp + 0x208]
call fcn.1800042a0
mov rbx, qword [rbp + 0x1f0]
test rbx, rbx
je 0x1800406c3
mov rsi, qword [rbp + 0x1f8]
cmp rbx, rsi
je 0x18003f658
mov rcx, rbx
call fcn.180025450
add rbx, 0x20
cmp rbx, rsi
jne 0x18003f640
mov rbx, qword [rbp + 0x1f0]
mov r8, qword [rbp + 0x200]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x1f0]
call fcn.18002c220
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1f0], xmm0
xor r14d, r14d
mov qword [rbp + 0x200], r14
jmp 0x1800406c6
mov edi, ebx
mov dword [rsp + 0x70], ebx
inc ecx
cmp ecx, 0x18
jb 0x18003f600
mov dword [rbp - 0x80], 1
lea r9, [rbp - 0x80]
xor r8d, r8d
mov edx, 0xa0
lea rcx, [rbp + 0x48]
call fcn.18005d5c0
jmp case.0x18003f325.14
mov rax, qword [rbp - 0x70]
mov eax, dword [rax]
mov rcx, qword [rbp - 0x68]
cmp dword [rcx], eax
jle case.0x18003f325.14
mov ecx, 0x1b
mov eax, ecx
sub eax, 0x1b
je 0x18003f6ea
cmp eax, 1
je 0x18003f614
jmp 0x18003f6f2
mov edi, r10d
mov dword [rsp + 0x70], r10d
inc ecx
cmp ecx, 0x1d
jb 0x18003f6d8
jmp case.0x18003f325.14
lea r8, [rbp]
mov rdx, qword [rbp - 0x68]
mov ecx, 0x12b
call fcn.180063950
mov ebx, eax
test eax, eax
jne 0x18003f878
mov dword [rbp - 0x80], 1
lea r9, [rbp - 0x80]
xor r8d, r8d
mov edx, 0xa0
lea rcx, [rbp + 0xa8]
call fcn.18005d5c0
jmp case.0x18003f325.14
mov ecx, 0x52
mov eax, ecx
sub eax, 0x51
je 0x18003f942
cmp eax, 1
jne 0x18003f760
mov rax, qword [rbp - 0x68]
cmp qword [rax], 0xffffffffffffffff
setne byte [rsp + 0x70]
dec ecx
cmp ecx, 0x50
ja 0x18003f743
mov edi, dword [rsp + 0x70]
mov eax, 0x61
mov word [rbp + 0x373], ax
jmp case.0x18003f325.14
test r12, r12
je 0x18003f793
mov r8d, 0xa3
lea rdx, [rbp + 0x60]
mov rcx, r12
call fcn.180045070
test rsi, rsi
je case.0x18003f325.14
mov r8d, 0xa3
lea rdx, [rbp]
mov rcx, rsi
call fcn.180045070
jmp case.0x18003f325.14
cmp dword [rbp + 8], 1
jne 0x18003f7fe
mov esi, 0x58
nop
cmp esi, 0x58
je 0x18003f7e4
cmp esi, 0x65
jne 0x18003f7f6
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x60]
lea ecx, [rsi + 0x5f]
call fcn.180062bf0
lea r8, [rbp]
lea rdx, [rbp]
jmp 0x18003f7ec
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x48]
mov ecx, 0xc4
call fcn.180062bf0
add esi, 0xd
cmp esi, 0x72
jb 0x18003f7c0
test r13, r13
je case.0x18003f325.14
mov r8d, 0xa3
lea rdx, [rbp + 0x48]
mov rcx, r13
call fcn.180045070
jmp case.0x18003f325.14
mov rax, qword [rbp - 0x70]
mov eax, dword [rax]
mov rcx, qword [rbp - 0x68]
cmp dword [rcx], eax
jge case.0x18003f325.14
mov ecx, 0x71
mov eax, ecx
sub eax, 0x71
je 0x18003f847
cmp eax, 1
je 0x18003f614
jmp 0x18003f850
mov edi, 0xffffffff
mov dword [rsp + 0x70], edi
inc ecx
cmp ecx, 0x73
jb 0x18003f835
jmp case.0x18003f325.14
lea r8, [rbp + 0x18]
mov rdx, qword [rbp - 0x70]
mov ecx, 0x12b
call fcn.180063950
mov ebx, eax
test eax, eax
je case.0x18003f325.14
mov r14, qword [rbp - 0x78]
mov r12d, dword [rbp - 0x80]
mov r13d, dword [rbp - 0x80]
mov rsi, qword [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov r15d, 0x133
mov qword [rsp + 0x58], 0
lea rax, [rbp + 0x30]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x108]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc0]
lea r8, [rbp]
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x48]
call fcn.180071bb0
jmp 0x18003ff96
mov word [rbp + 0x374], dx
mov word [rbp + 0x375], r8w
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
inc r15d
inc r14d
mov r10d, 1
xor r11d, r11d
cmp r15d, eax
jae 0x18003f94b
mov rsi, qword [rbp - 0x78]
lea rcx, [0x180000000]
jmp 0x18003f2f7
mov edi, dword [rsp + 0x70]
jmp 0x18003f614
mov edx, dword [rsp + 0x78]
mov r8d, 0x1bb
lea r9, [0x180080738]
jmp 0x18003f967
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x68], rcx
mov r15d, edx
mov r14, qword [rbp - 0x78]
mov r12d, dword [rbp - 0x80]
mov r13d, dword [rbp - 0x80]
mov rax, qword [rbp - 0x78]
mov qword [rbp - 0x78], rax
lea eax, [rdx + 0xa05]
cmp r15d, eax
jae 0x18003ffcb
cmp r15d, 0x289
ja 0x18003fe6d
je case.0x180040023.305
cmp r15d, 0x1cf
ja 0x18003fd79
je 0x18003fa06
mov eax, r15d
sub eax, 0x124
je 0x18003f9e7
sub eax, 0xf
je 0x18003f88c
cmp eax, 0xf
jne 0x18003ff9b
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
dec eax
movsxd rcx, eax
mov rax, qword [rbp - 0x70]
mov rax, qword [rax + 0x10]
lea r14, [rax + rcx*4]
jmp 0x18003ff96
mov r8d, 4
lea rdx, [0x180077b44]
lea rcx, [rbp + 0x376]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003ff96
movzx eax, word [0x180077b48]
mov word [rbp + 0x379], ax
movzx eax, byte [0x180077b4a]
mov byte [rbp + 0x37b], al
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], r9
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x7a]
xor ecx, ecx
call fcn.180065c20
test al, al
jne 0x18003ff96
mov esi, 0x1f
nop dword [rax]
cmp esi, 0x1f
ja case.0x18003fa6c.3
mov eax, esi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x4092c]
add rcx, rdx
jmp rcx
mov r8d, 1
lea rdx, [0x180077b84]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
mov r8d, 4
lea rdx, [0x180077c02]
lea rcx, [rbp + 0x3d2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x3da], ax
jmp case.0x18003fa6c.3
mov r8d, 2
lea rdx, [0x180077c88]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x398], ax
lea r8d, [rax + 3]
lea rdx, [0x180077cb8]
lea rcx, [rbp + 0x398]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
mov dword [rbp + 0x3f8], 0x74
jmp case.0x18003fa6c.3
mov r8d, 2
lea rdx, [0x180077de4]
lea rcx, [rbp + 0x3b2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x3b6], ax
jmp case.0x18003fa6c.3
mov eax, 0x61
mov word [rbp + 0x38e], ax
jmp case.0x18003fa6c.3
movabs rax, 0x48005400550041
mov qword [rbp + 0x3a8], rax
xor eax, eax
mov word [rbp + 0x3b0], ax
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x39e], ax
lea r8d, [rax + 5]
lea rdx, [0x180077e36]
lea rcx, [rbp + 0x380]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.0x18003fa6c.3
mov r8d, 5
lea rdx, [0x180077e66]
lea rcx, [rbp + 0x3e4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x3ee], ax
jmp case.0x18003fa6c.3
mov r8d, 5
lea rdx, [0x180077ebc]
lea rcx, [rbp + 0x3da]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x3e4], ax
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x3b2], ax
jmp case.0x18003fa6c.3
mov r8d, 3
lea rdx, [0x180077f02]
lea rcx, [rbp + 0x3ee]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
mov eax, dword [0x180077f54]
mov dword [rbp + 0x3cc], eax
movzx eax, word [0x180077f58]
mov word [rbp + 0x3d0], ax
jmp case.0x18003fa6c.3
mov r12d, ILFindLastID
jmp case.0x18003fa6c.3
xor ecx, ecx
mov dword [rbp - 0x80], ecx
mov qword [rsp + 0x38], rcx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov r8d, r13d
mov edx, r12d
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
jmp case.0x18003fa6c.3
mov dword [rbp + 0x388], 0x4c
jmp case.0x18003fa6c.3
movabs rax, 0x43005f00430056
mov qword [rbp + 0x380], rax
jmp case.0x18003fa6c.3
mov dword [rbp + 0x3c0], 0x690076
xor eax, eax
mov word [rbp + 0x3c4], ax
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x3c6], ax
lea r8d, [rax + 3]
lea rdx, [0x180077fb6]
lea rcx, [rbp + 0x3c6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
mov r8d, 2
lea rdx, [0x18007801c]
lea rcx, [rbp + 0x38a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x3f4], ax
jmp case.0x18003fa6c.3
xor eax, eax
mov qword [rbp - 0x78], rax
jmp case.0x18003fa6c.3
xor eax, eax
lea r13d, [rax + 1]
mov dword [rbp - 0x5c], eax
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x388], ax
jmp case.0x18003fa6c.3
mov r8d, 1
lea rdx, [0x180078070]
lea rcx, [rbp + 0x3c4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp case.0x18003fa6c.3
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp case.0x18003fa6c.3
xor eax, eax
mov word [rbp + 0x3d2], ax
jmp case.0x18003fa6c.3
movabs rax, 0x73006f00720063
mov qword [rbp + 0x390], rax
dec esi
lea eax, [rsi + 0xde]
cmp eax, 0xdd
ja 0x18003fa50
jmp 0x18003ff96
mov eax, r15d
sub eax, 0x1de
je 0x18003fe66
sub eax, 0xf
je 0x18003fdaa
cmp eax, 0x8d
jne 0x18003ff9b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x18003ff96
mov r8d, r11d
mov rax, qword [rbp - 0x68]
mov r9d, dword [rax]
test r9d, r9d
jle 0x18003fe5e
nop dword [rax]
mov edx, 0x118
mov eax, edx
sub eax, 0x118
je 0x18003fe07
cmp eax, 0x3a
jne 0x18003fe3a
mov eax, dword [r14]
cmp dword [rcx], eax
jae 0x18003fe3a
mov eax, 0xcf
nop
cmp eax, 0xcf
je 0x18003fdf4
cmp eax, 0x15d
je 0x18003f614
jmp 0x18003fdf9
mov edi, 0xffffffff
add eax, 0x8e
cmp eax, 0x1eb
jb 0x18003fde0
jmp 0x18003fe3a
mov eax, dword [r14]
cmp dword [rcx], eax
jbe 0x18003fe3a
mov ecx, 0x122
mov eax, ecx
sub eax, 0x122
je 0x18003fe27
cmp eax, 0x6c
je 0x18003f614
jmp 0x18003fe2a
mov edi, r10d
add ecx, 0x6c
cmp ecx, 0x1fa
jb 0x18003fe13
mov rcx, qword [rsp + 0x68]
add edx, 0x3a
cmp edx, 0x18c
jb 0x18003fdc5
inc r8d
sub rcx, 4
mov qword [rsp + 0x68], rcx
sub r14, 4
cmp r8d, r9d
jl 0x18003fdc0
mov edi, r11d
jmp 0x18003ff9b
mov edi, ebx
jmp 0x18003ff9b
cmp r15d, 0x47b
ja 0x18003fef3
je 0x18003fee6
cmp r15d, 0x298
je 0x18003f614
cmp r15d, 0x325
je 0x18003feb6
cmp r15d, 0x3d0
jne 0x18003ff9b
mov r8, r10
lea rdx, str._opyi
lea rcx, [rbp + 0x2e0]
call fcn.18002a970
jmp 0x18003ff96
lea rax, [rbp + 0x370]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18003fec4
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x2c0]
call fcn.18002a970
jmp 0x18003ff96
mov word [rbp + 0x320], r8w
jmp 0x18003ff9b
cmp r15d, 0x526
je 0x18003ff7f
cmp r15d, 0x5d1
je 0x18003ff3b
cmp r15d, 0x67c
jne 0x18003ff9b
mov word [rsp + 0x70], r8w
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x130]
mov edx, 0x7a
lea rcx, [0x1800807b8]
call fcn.18004f620
jmp 0x18003ff96
xor r9d, r9d
lea r8, [rbp + 0x2c0]
lea edx, [r9 + 0x5b]
lea rcx, [rbp + 0x330]
call fcn.180022220
mov eax, 0x1bb
mov word [rsp + 0x70], ax
mov r9d, 0x30
lea r8, [rsp + 0x70]
lea rdx, [0x180080798]
lea rcx, [rbp + 0x160]
call fcn.180024630
jmp 0x18003ff96
mov r9d, 0x72
xor r8d, r8d
lea rdx, [rbp + 0x300]
xor ecx, ecx
call fcn.18005e500
mov rcx, qword [rsp + 0x68]
add r15d, 0xab
mov r10d, 1
mov edx, dword [rsp + 0x78]
mov r8d, 0x1bb
lea r9, [0x180080738]
xor r11d, r11d
jmp 0x18003f97e
mov eax, 1
jmp 0x18003f616
mov ebx, dword [rsp + 0x60]
cmp edx, ebx
jae case.0x180040023.305
mov r15d, dword [rsp + 0x68]
movzx esi, byte [rsp + 0x70]
mov r14, qword [rbp - 0x78]
mov r12, qword [rbp - 0x78]
mov r13d, dword [rsp + 0x68]
mov r11d, 0x43
lea r8d, [r11 - 0x23]
lea r9d, [r11 + 0x1a]
lea eax, [rdx - 0x124]
cmp eax, 0xd
ja case.0x180040023.292
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x409ac]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rax, [rbp + 0x160]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x180040057
lea rcx, [rbp + 0x160]
mov qword [rax], rcx
add qword [rbp - 0x48], 8
xor eax, eax
mov word [rbp - 0x60], ax
mov byte [rbp - 0x5e], al
jmp case.0x180040023.292
lea r8, [rbp - 0x70]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.180002180
mov edx, dword [rsp + 0x78]
xor eax, eax
mov word [rbp - 0x60], ax
mov byte [rbp - 0x5e], al
jmp case.0x180040023.292
lea rax, [rbp + 0x130]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x1800400a3
lea rcx, [rbp + 0x130]
mov qword [rax], rcx
add qword [rbp - 0x48], 8
jmp case.0x180040023.292
lea r8, [rbp - 0x70]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.180002180
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
mov r8d, 0x52
lea rdx, [rbp + 0x190]
xor ecx, ecx
call fcn.1800093f0
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
lea rcx, [rbp - 0x60]
call qword [sym.imp.SHELL32.dll_ILFindLastID]
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
mov rax, qword [rbp - 0x78]
test rax, rax
jne 0x18004059e
mov ebx, 0xd0
nop
cmp ebx, 0x57a60
ja 0x1800402fb
je 0x1800402c6
cmp ebx, 0x28ee0
ja 0x1800401f2
je 0x1800401db
cmp ebx, 0x11920
ja 0x180040188
je 0x180040179
cmp ebx, 0xd0
je 0x18004016a
cmp ebx, 0x5e40
je 0x180040159
cmp ebx, 0xbbb0
jne 0x18004057e
mov dword [rbp + 0x5d6], 0x5b0029
jmp 0x18004057e
mov eax, 0x74
mov word [rbp + 0x5d4], ax
jmp 0x18004057e
mov dword [rbp + 0x5d0], 0x250028
jmp 0x18004057e
mov dword [rbp + 0x5da], 0x440025
jmp 0x18004057e
cmp ebx, 0x17690
je 0x1800401c0
cmp ebx, 0x1d400
je 0x1800401b1
cmp ebx, 0x23170
jne 0x18004057e
mov word [rbp + 0x5e8], r9w
jmp 0x18004057e
mov dword [rbp + 0x5e4], 0x4d0025
jmp 0x18004057e
mov dword [rbp + 0x5de], 0x20005d
mov eax, 0x5b
mov word [rbp + 0x5e2], ax
jmp 0x18004057e
mov word [rbp + 0x5ea], r8w
mov dword [rbp + 0x5ec], 0x490025
jmp 0x18004057e
cmp ebx, 0x404a0
ja 0x18004025c
je 0x18004024f
cmp ebx, 0x2ec50
je 0x180040242
cmp ebx, 0x349c0
je 0x180040231
cmp ebx, 0x3a730
jne 0x18004057e
mov dword [rbp + 0x5f4], 0x53004d
mov dword [rbp + 0x5f8], 0x25003a
jmp 0x18004057e
mov eax, 0x4c
mov word [rbp + 0x5f2], ax
jmp 0x18004057e
mov word [rbp + 0x5f0], r8w
jmp 0x18004057e
mov word [rbp + 0x5fc], r11w
jmp 0x18004057e
cmp ebx, 0x46210
je 0x1800402b8
cmp ebx, 0x4bf80
je 0x180040297
cmp ebx, 0x51cf0
jne 0x18004057e
mov eax, dword [0x180078100]
mov dword [rbp + 0x7ea], eax
movzx eax, word [0x180078104]
mov word [rbp + 0x7ee], ax
jmp 0x18004057e
movsd xmm0, qword [str.set_i]
movsd qword [rbp + 0x7e0], xmm0
mov eax, dword [0x180078138]
mov dword [rbp + 0x7e8], eax
jmp 0x18004057e
xor eax, eax
mov word [rbp + 0x5fe], ax
jmp 0x18004057e
mov eax, 0x61
mov dword [rbp + 0x7ee], eax
mov r8, r10
lea rdx, [0x18007734c]
lea rcx, [rbp + 0x7e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 0x20
lea r9d, [r8 + 0x3d]
lea r11d, [r8 + 0x23]
jmp 0x18004057e
cmp ebx, 0x865e0
ja 0x180040446
je 0x18004043c
cmp ebx, 0x6f020
ja 0x1800403e1
je 0x1800403cb
cmp ebx, 0x5d7d0
je 0x18004038d
cmp ebx, 0x63540
je 0x18004035d
cmp ebx, 0x692b0
jne 0x18004057e
lea rcx, [rbp + 0x7e0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180040346
mov eax, dword [0x1800780fc]
mov dword [rcx], eax
jmp 0x18004057e
mov eax, dword [0x180078120]
mov dword [rbp + 0x7fa], eax
movzx eax, word [0x180078124]
mov word [rbp + 0x7fe], ax
mov r8d, 3
lea rdx, [0x180078128]
lea rcx, [rbp + 0x7fe]
jmp 0x1800403b2
movabs rax, 0x4300650075
mov qword [rbp + 0x7f2], rax
mov r8d, 2
lea rdx, [0x1800780fc]
lea rcx, [rbp + 0x7f8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 0x20
lea r9d, [r8 + 0x3d]
lea r11d, [r8 + 0x23]
jmp 0x18004057e
mov r8d, 7
lea rdx, str.ateOwn
lea rcx, [rbp + 0x804]
jmp 0x1800403b2
cmp ebx, 0x74d90
je 0x18004041d
cmp ebx, 0x7ab00
je 0x18004040f
cmp ebx, 0x80870
jne 0x18004057e
mov r14, 0xffffffff80000001
mov r13d, 0x36
jmp 0x18004057e
mov sil, 1
xor eax, eax
mov qword [rbp - 0x68], rax
jmp 0x18004057e
mov eax, dword [0x180078118]
mov dword [rbp + 0x810], eax
movzx eax, word [0x18007811c]
mov word [rbp + 0x814], ax
jmp 0x18004057e
xor eax, eax
mov r12d, eax
jmp 0x18004057e
cmp ebx, 0x9dba0
ja 0x180040565
je 0x180040501
cmp ebx, 0x8c350
je 0x1800404f7
cmp ebx, 0x920c0
je 0x1800404b1
cmp ebx, 0x97e30
jne 0x18004057e
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, r12
mov edx, r13d
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
mov r8d, 0x20
lea r9d, [r8 + 0x3d]
lea r11d, [r8 + 0x23]
jmp 0x18004057e
xor ecx, ecx
mov dword [rsp + 0x70], ecx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x80]
lea r8, [rbp + 0x7e0]
lea rdx, [rbp + 0x5d0]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [rbp - 0x5c], eax
mov r8d, 0x20
lea r9d, [r8 + 0x3d]
lea r11d, [r8 + 0x23]
jmp 0x18004057e
xor eax, eax
mov r15d, eax
jmp 0x18004057e
xor ecx, ecx
cmp dword [rbp - 0x5c], ecx
je 0x180040528
mov eax, SHSetInstanceExplorer
nop dword [rax]
movzx esi, sil
cmp eax, 0x3601
cmove esi, ecx
add eax, 0x1aa9
cmp eax, 0x4ffb
jbe 0x180040510
test sil, sil
je 0x18004057e
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp - 0x80]
lea r8, [rbp + 0x7e0]
lea rdx, [rbp + 0x5d0]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov r8d, 0x20
lea r9d, [r8 + 0x3d]
lea r11d, [r8 + 0x23]
jmp 0x18004057e
cmp ebx, 0xa3910
je 0x18004057b
cmp ebx, 0xa9680
je case.0x180040023.305
jmp 0x18004057e
mov edi, r10d
add ebx, 0x5d70
cmp ebx, 0xaf320
mov r10d, 1
jbe 0x180040100
mov rax, qword [rbp - 0x78]
mov ebx, dword [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
mov eax, dword [0x1800807e0]
mov dword [rsp + 0x68], eax
lea r8, [rbp - 0x50]
mov edx, 0xc9
lea rcx, [rsp + 0x68]
call fcn.180010100
lea rax, [rbp - 0x50]
mov qword [rbp + 0x80], rax
mov eax, dword [0x1800807e0]
mov dword [rbp + 0x88], eax
mov eax, dword [0x1800807e4]
mov dword [rbp + 0x8c], eax
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x120], xmm0
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x120]
lea r8, [0x180015cd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x78], rax
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
lea rax, [0x18000caf0]
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x20], 0xef
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x70]
xor ecx, ecx
call fcn.18003b1c0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [0x180080730]
lea r8, [rbp + 0x190]
xor edx, edx
lea ecx, [rax + 0x50]
call fcn.180008b00
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
mov dword [rsp + 0x20], 0xfd
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x50]
xor ecx, ecx
call fcn.180059850
mov edx, dword [rsp + 0x78]
jmp case.0x180040023.292
xor eax, eax
mov edi, eax
inc edx
mov dword [rsp + 0x78], edx
cmp edx, ebx
jae case.0x180040023.305
mov r10d, 1
jmp 0x18003ffee
xor r14d, r14d
mov rdx, qword [rbp + 0x1d8]
test rdx, rdx
je 0x1800406fe
mov r8, qword [rbp + 0x1e8]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x1d8]
call fcn.18002c180
mov qword [rbp + 0x1d8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
lea rcx, [rbp + 0x198]
call fcn.1800041d0
nop
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x18004079c
mov rsi, qword [rbp - 0x30]
cmp rbx, rsi
je 0x180040736
mov rcx, rbx
call fcn.180003ae0
add rbx, 0x28
cmp rbx, rsi
jne 0x180040721
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x180040788
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180040788
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180071f98
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1800407c5
mov r8, qword [rbp - 0x40]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x50]
call fcn.18002c130
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp + 0x152]
cmp rdx, 0x10
jb 0x180040809
inc rdx
mov rcx, qword [rbp + 0x13a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180040804
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180040804
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180071f98
movdqa xmm0, xmmword [0x18007b7e0]
movdqu xmmword [rbp + 0x14a], xmm0
mov byte [rbp + 0x13a], 0
mov rdx, qword [rbp + 0x182]
cmp rdx, 0x10
jb 0x180040864
inc rdx
mov rcx, qword [rbp + 0x16a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004085f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004085f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180071f98
movdqa xmm0, xmmword [0x18007b7e0]
movdqu xmmword [rbp + 0x17a], xmm0
mov byte [rbp + 0x16a], 0
lea rcx, [rbp + 0x330]
call fcn.180003e40
nop
lea rcx, [rbp + 0x2c0]
call fcn.180003ef0
mov eax, edi
mov rcx, qword [rbp + 0x9f0]
xor rcx, rsp
call fcn.180072740
mov rbx, qword [rsp + 0xb58]
add rsp, 0xb00
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret