Function at 0x18003e110
Capabilities:
Get file size
Modify service
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd10]
sub rsp, 0xe10
mov rax, qword [0x1800a0238]
xor rax, rsp
mov qword [rbp + 0xd00], rax
mov r13d, ecx
mov qword [rbp - 0x70], r9
add ecx, 0x4d8
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x38], rdx
mov r12, r8
mov dword [rbp - 0x74], ecx
mov r15, rdx
cmp r13d, ecx
ja 0x18003e6ce
movzx r14d, byte [rbp - 0x80]
xor edi, edi
mov rbx, qword [rbp - 0x20]
mov dword [rbp - 0x30], r14d
mov qword [rbp], rbx
lea r11, [0x180000000]
mov r8d, 0x57
lea r10d, [r8 - 0x4f]
lea edx, [r8 + 0x1c]
cmp r13d, 0x3847
ja 0x18003f404
je 0x18003f365
cmp r13d, 0x376e
ja 0x18003ed56
je case.0x18003e201.4
cmp r13d, 0x36f2
ja 0x18003e60b
je case.0x18003e201.0
cmp r13d, 0x1f
je 0x18003e5fe
cmp r13d, 0x3e
je 0x18003e6ce
cmp r13d, 0x36d3
jne case.default.0x180040d82
mov eax, dword [r12]
cmp eax, 0x1b
ja case.default.0x18003e201
mov ecx, dword [r11 + rax*4 + 0x42888]
add rcx, r11
jmp rcx
mov esi, 0x7455
cmp esi, 0x74fd
ja 0x18003e261
je 0x18003ed7e
mov eax, esi
sub eax, 0x7455
je 0x18003e24f
sub eax, 0x38
je 0x18003e239
cmp eax, 0x38
jne 0x18003e2e3
mov qword [rbp + 0x120], rdi
jmp 0x18003e2e3
mov dword [rbp + 0x78], edi
mov dword [rbp + 0x70], 0xa
mov dword [rbp + 0x68], 0x14
jmp 0x18003e2e3
mov qword [rbp + 0x128], rdi
mov dword [rbp + 0x98], edi
jmp 0x18003e2e3
mov eax, esi
sub eax, 0x7535
je 0x18003e2d3
sub eax, 0x38
je 0x18003e27f
cmp eax, 0x38
jne 0x18003e2e3
mov r13d, 0x36f2
jmp case.0x180040d82.14692
mov eax, dword [rbp + 0xc]
mov r9d, dword [rbp + 0x70]
mov r8d, dword [rbp + 0x78]
mov edx, dword [rbp + 0x98]
mov rcx, qword [rbp + 0x128]
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], 0xa
mov dword [rsp + 0x40], eax
mov eax, dword [rbp + 8]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x9c]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp + 0x120]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x68]
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_GdiAlphaBlend]
jmp 0x18003e2e3
mov dword [rbp + 0x9c], edi
mov dword [rbp + 8], edi
mov dword [rbp + 0xc], 0x14
add esi, 0x38
cmp esi, 0x75a5
jbe 0x18003e208
lea r11, [0x180000000]
mov ecx, 0x4f51
nop
mov eax, ecx
sub eax, 0x4f51
je 0x18003f04a
sub eax, 0x12
je 0x18003f0b2
sub eax, 0x12
je 0x18003f041
cmp eax, 0x12
je 0x18003e6ce
jmp 0x18003f0b7
mov esi, 0x4d10
mov eax, esi
sub eax, 0x4d10
je 0x18003e39b
sub eax, 0x61
je 0x18003e3ed
sub eax, 0x61
je 0x18003e385
cmp eax, 0x61
jne 0x18003e3ab
mov rcx, qword [rbp + 0x110]
test rcx, rcx
je 0x18003e374
mov rdx, rcx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, rdi
mov qword [rbp + 0x110], rcx
call qword [sym.imp.GDI32.dll_GetFontLanguageInfo]
mov r13d, 0x36f2
jmp case.0x180040d82.14692
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x110], rax
jmp 0x18003e3ab
mov rcx, rdi
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov qword [rbp + 0x108], rax
add esi, 0x61
cmp esi, 0x4e33
jbe 0x18003e332
mov esi, 0x743b
nop
mov eax, esi
sub eax, 0x743b
je 0x18003f333
sub eax, 0x1f
je 0x18003f323
sub eax, 0x1f
je 0x18003f2d7
cmp eax, 0x1f
je case.0x18003e41f.6
jmp 0x18003f34b
lea r11, [0x180000000]
mov r13d, 0x3809
mov esi, edi
nop dword [rax]
cmp esi, 0x48
ja case.0x18003e41f.7
mov eax, esi
movzx eax, byte [r11 + rax + 0x42918]
mov ecx, dword [r11 + rax*4 + 0x428f8]
add rcx, r11
jmp rcx
mov esi, 0x39ef
mov eax, esi
sub eax, 0x39ef
je 0x18003e495
sub eax, 0x49
je 0x18003e43f
cmp eax, 0x49
je case.0x18003e201.0
jmp 0x18003e44f
mov edx, dword [rbp - 0x48]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
add esi, 0x49
cmp esi, 0x3a81
jbe 0x18003e426
lea r11, [0x180000000]
mov r15d, 0x6c5
nop word [rax + rax]
mov eax, r15d
sub eax, 0x6c5
je 0x180040d84
sub eax, 0x62
je 0x180040dc3
cmp eax, 0x62
je case.0x18003e41f.6
jmp 0x180040dc9
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
mov qword [rbp + 0x130], rdi
mov r13d, 0x393f
mov r12d, 0x187b
mov dword [rbp - 0x48], r13d
mov dword [rbp - 0xc], r12d
nop dword [rax + rax]
mov eax, r12d
sub eax, 0x187b
je 0x1800408c5
cmp eax, 0x14
je case.0x18003e41f.6
jmp 0x180040d42
mov esi, edi
nop
cmp esi, 0x5f
ja case.0x18003e4ff.6
mov eax, esi
movzx eax, byte [r11 + rax + 0x42980]
mov ecx, dword [r11 + rax*4 + 0x42964]
add rcx, r11
jmp rcx
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x138], rdi
jmp case.0x18003e4ff.6
mov eax, dword [rbp + 0x18]
xor r8d, r8d
mov r9, qword [rbp + 0x148]
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x140]
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_GrayStringA]
lea r11, [0x180000000]
jmp case.0x18003e4ff.6
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
mov dword [rbp + 0x18], 2
jmp case.0x18003e4ff.6
lea rax, [0x180086390]
mov qword [rbp + 0x148], rax
add esi, 0x13
lea eax, [rsi + 0x68ac]
cmp eax, 0x690b
jbe 0x18003e4e0
mov r9, qword [rbp - 0x70]
mov ecx, 0x18f
mov eax, ecx
sub eax, 0x18f
je 0x18003e5b2
sub eax, 7
je case.0x180040d82.14688
cmp eax, 7
je case.0x18003e201.0
add ecx, 7
cmp ecx, 0x19d
jbe 0x18003e597
mov r14d, 0x593e
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
sub eax, 0x593e
je 0x1800410c8
sub eax, 0xf
je case.0x1800410ee.9
sub eax, 0xf
je 0x1800410bc
cmp eax, 0xf
je 0x18003e6ce
jmp 0x18004116e
mov qword [rbp - 0x58], 0x2000
jmp case.default.0x180040d82
mov eax, r13d
sub eax, 0x3711
je 0x18003e8cf
sub eax, 0x1f
je 0x18003e8c4
cmp eax, 0x1f
jne case.default.0x180040d82
mov ecx, 0x70bd
mov eax, ecx
sub eax, 0x70bd
je 0x18003e647
cmp eax, 0x26
je case.0x18003e41f.6
jmp 0x18003e7c1
movsx eax, byte [r15]
add eax, 0xffffffde
cmp eax, 0x53
ja case.0x18003e66d.36
cdqe
movzx eax, byte [r11 + rax + 0x429ec]
mov ecx, dword [r11 + rax*4 + 0x429e0]
add rcx, r11
jmp rcx
cmp dword [r12 + 4], 0
jne 0x18003e7b5
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffe
jae 0x18003e6fc
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
je 0x18003e7b5
mov dword [rbp - 0x58], 6
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp + 0xd00]
xor rcx, rsp
call fcn.18005fbe0
mov rbx, qword [rsp + 0xe50]
add rsp, 0xe10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r12 + 4], 1
jmp 0x18003e7b5
mov esi, 0x5d7
nop
mov eax, esi
sub eax, 0x5d7
je 0x18003e733
sub eax, 0x30
je 0x18003e729
cmp eax, 0x30
je 0x18003e7b5
jmp 0x18003e78f
mov dword [r12], 3
jmp 0x18003e78f
cmp dword [r12 + 4], 0
jne 0x18003e78f
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffa
jae 0x18003e786
mov rdx, qword [r12 + 8]
lea rcx, [rbp - 0x80]
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x75
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003e78f
mov dword [r12 + 4], 1
add esi, 0x30
cmp esi, 0x637
jbe 0x18003e710
mov eax, 0x1a0c
cmp eax, eax
je case.0x18003edcf.49
add eax, 0x22
cmp eax, 0x1a0c
jbe 0x18003e7a5
mov ecx, 0x70bd
lea r11, [0x180000000]
add ecx, 0x26
cmp ecx, 0x70e3
jbe 0x18003e630
mov ecx, 0x102f
mov r13d, 0x374f
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x102f
je 0x18003e7f7
cmp eax, 0x35
je 0x18003e6ce
jmp 0x18003e8ad
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18003edcf.49
cdqe
movzx eax, byte [r11 + rax + 0x42a48]
mov ecx, dword [r11 + rax*4 + 0x42a40]
add rcx, r11
jmp rcx
mov eax, 0x174b
cmp eax, 0x174b
ja case.0x18003edcf.49
je 0x18003e836
add eax, 0x52
jmp 0x18003e824
cmp dword [r12 + 4], 0
jne 0x18003e899
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffb
jae 0x18003e889
mov rdx, qword [r12 + 8]
lea rcx, [rbp - 0x80]
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x75
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003e892
mov dword [r12 + 4], 1
lea r11, [0x180000000]
mov dword [r12], 4
mov ecx, 0x102f
mov dword [rbp - 0x58], 1
add ecx, 0x35
cmp ecx, 0x1064
jbe 0x18003e7e0
jmp case.0x180040d82.14692
mov ecx, dword [rbp - 0x74]
mov r13d, 0x3730
jmp case.default.0x180040d82
mov r14d, 0x50e0
mov eax, r14d
sub eax, 0x50e0
je 0x18003e8ed
cmp eax, 0x15
je case.0x18003e41f.6
jmp 0x18003eb95
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18003e913.23
cdqe
movzx eax, byte [r11 + rax + 0x42abc]
mov ecx, dword [r11 + rax*4 + 0x42a80]
add rcx, r11
jmp rcx
mov esi, 0x47c8
nop word [rax + rax]
mov eax, esi
sub eax, 0x47c8
je 0x18003e934
cmp eax, 0x1e
je case.0x18003e41f.6
jmp 0x18003e94b
mov rax, qword [r9 + 0x50]
test rax, rax
je 0x18003e943
call rax
mov r9, qword [rbp - 0x70]
mov dword [r12], 0x1b
add esi, 0x1e
cmp esi, 0x47e6
jbe 0x18003e920
mov ecx, 0x71bf
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x71bf
je 0x18003e9a9
cmp eax, 0x39
jne 0x18003e9b1
mov r9d, 0xd6
mov qword [rbp - 0x28], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
mov byte [rbp - 0x80], 0x30
mov rdx, rax
jmp 0x180042039
mov qword [r12], 0x11
add ecx, 0x39
cmp ecx, 0x71f8
jbe 0x18003e960
mov esi, 0x5f2b
mov eax, esi
sub eax, 0x5f2b
je 0x18003e9d5
cmp eax, 0x17
je 0x180041cea
jmp 0x18003ea0c
mov r9d, 0xd6
mov qword [r12], 0x18
xor r8d, r8d
mov qword [rbp - 0x48], 5
xor edx, edx
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
add esi, 0x17
cmp esi, 0x5f42
jbe 0x18003e9c1
mov esi, 0x3b5c
nop dword [rax]
cmp esi, 0x3c01
ja 0x18003ea9a
je 0x18003ea62
mov eax, esi
sub eax, 0x3b5c
je 0x18003ea58
sub eax, 0x37
je 0x18003ea4b
cmp eax, 0x37
jne 0x18003eae6
mov qword [r12 + 8], rdi
jmp 0x18003eae6
mov dword [r12], 0x17
jmp 0x18003eae6
mov dword [r12 + 4], edi
jmp 0x18003eae6
mov r9d, 0xd6
mov qword [rbp + 0x150], rdi
xor r8d, r8d
mov qword [rbp - 0x48], 5
xor edx, edx
mov qword [rsp + 0x20], rdi
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
jmp 0x18003eae6
mov eax, esi
sub eax, 0x3c38
je 0x18003eaae
cmp eax, 0x37
je case.0x18003e41f.6
jmp 0x18003eae6
mov rdx, qword [r12 + 8]
lea rcx, [rbp - 0x80]
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x2d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
mov rcx, qword [rbp + 0x150]
xor edx, edx
call qword [sym.imp.USER32.dll_GetSubMenu]
add esi, 0x37
cmp esi, 0x3c6f
jbe 0x18003ea20
mov esi, 0x16a9
nop word [rax + rax]
mov eax, esi
sub eax, 0x16a9
je 0x18003eb70
sub eax, 0x3b
je 0x18003eb55
sub eax, 0x3b
je 0x18003eb24
cmp eax, 0x3b
jne 0x18003eb7b
mov dword [rbp - 0x58], 7
jmp 0x18003e6ce
movzx eax, byte [rbp - 0x60]
mov ecx, edi
mov edx, dword [rbp + 0x20]
cmp edx, 0xffffffff
cmovne ecx, eax
mov byte [rbp - 0x60], cl
movzx r13d, cl
test cl, cl
je 0x18003eb7b
mov r8d, dword [rbp + 0x1c]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov byte [rbp - 0x60], r13b
jmp 0x18003eb7b
mov rcx, qword [rbp + 0x100]
xor edx, edx
mov dword [rbp + 0x1c], edi
lea r8d, [rdx + 2]
call qword [sym.imp.USER32.dll_GetMenuDefaultItem]
mov dword [rbp + 0x20], eax
jmp 0x18003eb7b
mov byte [rbp - 0x60], 1
mov qword [rbp + 0x100], rdi
add esi, 0x3b
cmp esi, 0x175a
jbe 0x18003eb00
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
add r14d, 0x15
cmp r14d, 0x50f5
jbe 0x18003e8d5
mov ecx, 0x7138
mov r13d, 0x3711
mov eax, ecx
sub eax, 0x7138
je 0x180041cae
cmp eax, 0x22
je case.0x18003e41f.6
add ecx, 0x22
cmp ecx, 0x715a
jbe 0x18003ebb1
jmp case.0x180040d82.14692
mov ecx, 0x3c2a
mov r13d, 0x376e
mov eax, ecx
sub eax, 0x3c2a
je 0x18003ebfb
sub eax, 0x10
je 0x18003ec5c
cmp eax, 0x10
je case.0x18003e41f.6
jmp 0x18003ec61
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18003edcf.49
cdqe
movzx eax, byte [r11 + rax + 0x42b3c]
mov ecx, dword [r11 + rax*4 + 0x42b34]
add rcx, r11
jmp rcx
mov r14d, 0x2053
nop dword [rax]
cmp r14d, 0x20d9
ja case.0x18003edcf.49
mov eax, r14d
sub eax, 0x2053
je 0x18003ec83
sub eax, 0x43
je 0x18003ec75
cmp eax, 0x43
jne 0x18003ed4d
lea r11, [0x180000000]
mov ecx, 0x3c3a
add ecx, 0x10
cmp ecx, 0x3c4a
jbe 0x18003ebe2
jmp case.0x180040d82.14692
mov dword [r12], 5
add r14d, 0x43
jmp 0x18003ec30
cmp dword [r12 + 4], 0
jne 0x18003ed4d
mov esi, 0x6611
nop dword [rax]
nop dword [rax + rax]
mov eax, esi
sub eax, 0x6611
je 0x18003ed30
sub eax, 0x27
je 0x18003ed14
cmp eax, 0x27
jne 0x18003ed3e
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffc
jae 0x18003ed09
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003ed3e
mov dword [r12 + 4], 1
jmp 0x18003ed3e
lea r9, [rbp + 0x6c]
xor ecx, ecx
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x158]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
jmp 0x18003ed3e
mov qword [rbp + 0x158], rdi
mov dword [rbp + 0x6c], 0x104
add esi, 0x27
cmp esi, 0x665f
jbe 0x18003eca0
add r14d, 0x43
jmp 0x18003ec30
lea eax, [r13 - 0x378d]
cmp eax, 0x9b
ja case.default.0x180040d82
movzx eax, byte [r11 + rax + 0x42b90]
mov ecx, dword [r11 + rax*4 + 0x42b74]
add rcx, r11
jmp rcx
lea r11, [0x180000000]
mov ecx, 0x7301
mov r13d, 0x378d
mov eax, ecx
sub eax, 0x7301
je 0x18003eda9
sub eax, 0x5f
je 0x18003ee0d
cmp eax, 0x5f
je 0x18003e6ce
jmp 0x18003ee19
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18003edcf.49
cdqe
movzx eax, byte [r11 + rax + 0x42c34]
mov ecx, dword [r11 + rax*4 + 0x42c2c]
add rcx, r11
jmp rcx
mov esi, 0x2f85
nop word [rax + rax]
cmp esi, 0x2f99
ja case.0x18003edcf.49
mov eax, esi
sub eax, 0x2f85
je 0x18003ee2d
cmp eax, 0x14
jne 0x18003ee92
mov dword [r12], 6
lea r11, [0x180000000]
mov ecx, 0x7360
mov dword [rbp - 0x58], 1
add ecx, 0x5f
cmp ecx, 0x73bf
jbe 0x18003ed90
jmp case.0x180040d82.14692
cmp dword [r12 + 4], 0
jne 0x18003ee92
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffd
jae 0x18003ee89
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
add esi, 0x14
jmp 0x18003ede0
mov dword [r12 + 4], 1
add esi, 0x14
jmp 0x18003ede0
mov ecx, 0x5b36
nop
mov eax, ecx
sub eax, 0x5b36
je 0x18003eeb4
cmp eax, 0x60
je 0x18003e6ce
jmp 0x18003eec9
cmp byte [r15], 0x72
jne case.0x18003edcf.49
mov dword [r12], r10d
mov dword [rbp - 0x58], 1
add ecx, 0x60
cmp ecx, 0x5b96
jbe 0x18003eea0
mov esi, 0x578f
mov r13d, 0x37cb
nop
mov eax, esi
sub eax, 0x578f
je 0x18003ef28
sub eax, 0x1a
je 0x18003ef1e
sub eax, 0x1a
je 0x18003ef0c
sub eax, 0x1a
je 0x18003ef03
cmp eax, 0x1a
je 0x18003e6ce
jmp 0x18003ef39
mov dword [rbp - 0x58], 1
jmp 0x18003ef39
mov edx, dword [rbp + 0x5c]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_IsBadHugeReadPtr]
jmp 0x18003ef39
mov dword [r12], 9
jmp 0x18003ef39
cmp byte [r15], 0x75
mov dword [rbp + 0x5c], 0xc
jne case.0x18003edcf.49
add esi, 0x1a
cmp esi, 0x57f7
jbe 0x18003eee0
jmp case.0x180040d82.14692
mov rax, qword [rbp + 0x80]
test rax, rax
je 0x18003ef6c
mov rcx, qword [rbp + 0x118]
mov rdx, rax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rbp + 0x80], rdi
mov dword [r12], 0xb
jmp case.0x18003e41f.7
cmp byte [r15], 0x61
mov rbx, rdi
movzx eax, word [0x18008606c]
mov word [rbp + 0xc36], ax
movzx eax, byte [0x18008606e]
mov byte [rbp + 0xc38], al
mov qword [rbp], rbx
jne case.0x18003edcf.49
jmp case.0x18003e41f.7
mov rcx, qword [rbp + 0x80]
lea r8, [rbp + 0xc30]
mov edx, 9
call qword [sym.imp.GDI32.dll_GetTextFaceA]
jmp case.0x18003e41f.7
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0x80], rax
jmp case.0x18003e41f.7
mov rcx, rbx
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov qword [rbp + 0x118], rax
jmp case.0x18003e41f.7
lea rdx, str.Name
lea rcx, [rbp + 0xc30]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 0x46
lea rdx, [0x180084f40]
lea rcx, [rbp + 0xc35]
mov word [rbp + 0xc34], ax
lea r8d, [rax - 0x44]
call fcn.180061240
add esi, 0xc
lea r11, [0x180000000]
lea eax, [rsi + 0xc0f]
cmp eax, 0xc57
jbe 0x18003e400
jmp case.0x180040d82.14692
mov dword [rbp - 0x58], 1
jmp 0x18003f0b7
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18003edcf.49
cdqe
movzx eax, byte [r11 + rax + 0x42c74]
mov ecx, dword [r11 + rax*4 + 0x42c6c]
add rcx, r11
jmp rcx
mov r13, qword [rbp - 0x38]
mov r15d, 0x576e
nop dword [rax]
cmp r15d, 0x57a3
ja case.0x18003edcf.49
mov eax, r15d
sub eax, 0x576e
je 0x18003f0d1
cmp eax, 0x35
jne 0x18003f278
mov dword [r12], 1
lea r11, [0x180000000]
mov r15, r13
mov ecx, 0x4f63
add ecx, 0x12
cmp ecx, 0x4f87
jbe 0x18003e300
mov r13d, 0x37ac
jmp case.0x180040d82.14692
cmp dword [r12 + 4], 0
jne 0x18003f278
mov r14d, 0x2cbf
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
sub eax, 0x2cbf
je 0x18003f259
cmp eax, 0x2a
jne 0x18003f267
mov rdi, qword [rbp + 0x160]
mov esi, 0x696f
mov eax, esi
sub eax, 0x696f
je 0x18003f1dd
sub eax, 0x16
je 0x18003f1c0
sub eax, 0x16
je 0x18003f19e
sub eax, 0x16
je 0x18003f172
cmp eax, 0x16
jne 0x18003f1ee
lea r8d, [rax - 0x14]
lea rdx, str._pROFILEPIC_
lea rcx, [rbp + 0xc13]
call fcn.1800643c0
mov r8, rdi
mov byte [rbp + 0xc15], 0
lea rdx, [rbp + 0xc00]
lea rcx, [rbp + 0x1e0]
call fcn.18005d500
jmp 0x18003f1ee
mov r8d, 2
lea rdx, [0x180086140]
lea rcx, [rbp + 0xc00]
call fcn.180064210
mov dword [rbp + 0xc0f], 0x20656372
mov byte [rbp + 0xc13], 0
jmp 0x18003f1ee
mov eax, dword [0x1800860c0]
mov dword [rbp + 0xc08], eax
movzx eax, byte [0x1800860c4]
mov byte [rbp + 0xc0c], al
mov byte [rbp + 0xc0d], 0
jmp 0x18003f1ee
movzx eax, word [0x1800860d4]
mov word [rbp + 0xc05], ax
movzx eax, byte [0x1800860d6]
mov byte [rbp + 0xc07], al
jmp 0x18003f1ee
mov dword [rbp + 0xc00], 0x6f6d6552
mov byte [rbp + 0xc04], 0x76
add esi, 0x16
cmp esi, 0x69c7
jbe 0x18003f113
mov rdx, qword [r12 + 8]
xor edi, edi
mov r9d, 0x5ea0
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffe
jae 0x18003f24e
movzx eax, byte [r13]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003f267
mov dword [r12 + 4], 1
jmp 0x18003f267
mov rax, qword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov qword [rbp + 0x160], rax
add r14d, 0x2a
cmp r14d, 0x2ce9
jbe 0x18003f0f0
add r15d, 0x35
jmp 0x18003f080
mov esi, 0x51fd
mov r13d, 0x37ea
nop dword [rax]
mov eax, esi
sub eax, 0x51fd
je 0x18003f2ba
sub eax, 1
je 0x18003f2a9
cmp eax, 1
je case.0x18003e41f.6
jmp 0x18003f2c8
mov rax, qword [r9 + 0x30]
test rax, rax
je 0x18003f2c8
call rax
mov r9, qword [rbp - 0x70]
jmp 0x18003f2c8
cmp byte [r15], 0x65
jne case.0x18003edcf.49
mov dword [r12], edi
inc esi
cmp esi, 0x51ff
jbe 0x18003f290
jmp case.0x180040d82.14692
mov r9d, dword [rbp + 0x54]
lea rax, [rbp + 0x19c]
mov r8d, dword [rbp + 0x58]
mov edx, dword [rbp + 0x74]
mov rcx, qword [rbp + 0x168]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [r12], 0xc
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x18003f34b
mov dword [rbp + 0x58], 0xffffffff
mov dword [rbp + 0x54], 0xffffffff
jmp 0x18003f34b
cmp byte [r15], 0x6c
mov qword [rbp + 0x168], rdi
mov dword [rbp + 0x74], 0xffffffff
jne case.0x18003edcf.49
add esi, 0x1f
cmp esi, 0x7498
jbe 0x18003e3c0
mov r13d, 0x3828
jmp case.0x180040d82.14692
mov esi, 0x1abf
nop word [rax + rax]
mov eax, esi
sub eax, 0x1abf
je 0x18003f3d6
sub eax, 0x29
je 0x18003f39d
sub eax, 0x29
je 0x18003f38e
cmp eax, 0x29
je case.0x18003e41f.6
jmp 0x18003f3f0
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.GDI32.dll_GetTextColor]
jmp 0x18003f3f0
mov r14, qword [rbp + 0x170]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbp + 0xd0], rax
mov dword [r12], 0xd
test rax, rax
je 0x18003f3f0
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rbp + 0xd0], rdi
jmp 0x18003f3f0
cmp byte [r15], 0x73
jne case.0x18003edcf.49
mov rcx, rdi
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov qword [rbp + 0x170], rax
add esi, 0x29
cmp esi, 0x1b3a
jbe 0x18003f370
jmp case.0x180040d82.14692
cmp r13d, 0x393f
ja 0x180040d5c
je 0x18003e4a7
lea eax, [r13 - 0x3866]
cmp eax, 0xba
ja case.default.0x180040d82
movzx eax, byte [r11 + rax + 0x42ccc]
mov ecx, dword [r11 + rax*4 + 0x42cac]
add rcx, r11
jmp rcx
mov ecx, 0x3c33
mov r13d, 0x38c3
nop word [rax + rax]
mov eax, ecx
sub eax, 0x3c33
je 0x18003f467
cmp eax, 0x1f
je 0x18003e6ce
jmp 0x18003f88b
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18003f48d.14
cdqe
movzx eax, byte [r11 + rax + 0x42da0]
mov ecx, dword [r11 + rax*4 + 0x42d88]
add rcx, r11
jmp rcx
mov esi, 0x6757
cmp esi, 0x686e
ja 0x18003f55c
je 0x18003f52a
mov eax, esi
sub eax, 0x6757
je 0x18003f51b
sub eax, 0x5d
je 0x18003f502
cmp eax, 0x5d
jne 0x18003f5bc
mov eax, 0x65
mov qword [rbp - 0x48], 5
mov r14b, 1
mov word [rbp + 0xc49], ax
xor r8d, r8d
mov dword [rbp - 0x30], r14d
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 0x71]
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
jmp 0x18003f5b7
mov dword [rbp + 0xc43], 0x6f5365
mov dword [rbp + 0xc46], 0x737275
jmp 0x18003f5bc
mov dword [rbp + 0xc40], 0x6d614e
jmp 0x18003f5bc
mov rdx, qword [r12 + 8]
lea rcx, [rbp - 0x80]
mov r9d, 0x1d25
mov qword [rbp + 0x88], rdi
xor r8d, r8d
mov byte [rbp - 0x80], 0x2e
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003f5b7
mov eax, esi
sub eax, 0x68cb
je 0x18003f589
sub eax, 0x5d
je 0x18003f575
cmp eax, 0x5d
je 0x18003f86b
jmp 0x18003f5bc
test r14b, r14b
je 0x18003f5bc
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x18003f5b7
lea rdx, [rbp + 0xc40]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
cmp rax, 0
movzx r14d, r14b
mov qword [rbp + 0x88], rax
cmove r14d, edi
mov dword [r12], 0x12
mov dword [rbp - 0x30], r14d
mov edx, 0x73
add esi, 0x5d
cmp esi, 0x6985
jbe 0x18003f494
mov r9, qword [rbp - 0x70]
mov esi, 0x1ad8
mov eax, esi
sub eax, 0x1ad8
je 0x18003f600
cmp eax, 0x19
jne 0x18003f61c
lea rdx, [r12 + 8]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov dword [r12], edi
jmp 0x18003f86b
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x18003e6c7
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x18003f61c
mov rcx, qword [rcx]
call rax
mov r9, qword [rbp - 0x70]
add esi, 0x19
cmp esi, 0x1af1
jbe 0x18003f5d4
mov r14d, 0x7613
mov eax, r14d
sub eax, 0x7613
je 0x18003f65f
sub eax, 0xd
je 0x18003f64b
cmp eax, 0xd
je 0x18003f86b
jmp 0x18003f690
cmp qword [r9], 0
je 0x18003f655
call qword [r9 + 8]
mov dword [r12], 0x1a
jmp 0x18003f690
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x18003e6c7
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x18003f67b
mov rcx, qword [rcx]
call rax
xor r9d, r9d
lea rdx, [r12 + 8]
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov r9, qword [rbp - 0x70]
add r14d, 0xd
cmp r14d, 0x762d
jbe 0x18003f631
mov r14d, 0x6734
nop word [rax + rax]
cmp r14d, 0x685d
ja 0x18003f757
je 0x18003f74d
mov eax, r14d
sub eax, 0x6734
je 0x18003f73b
sub eax, 0x63
je 0x18003f6fc
cmp eax, 0x63
jne 0x18003f7a5
cmp qword [r9], 0
je 0x18003f6e5
call qword [r9 + 0x18]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x178], rax
jmp 0x18003f7a5
mov rax, qword [r9 + 0x28]
lea rsi, [r12 + 8]
test rax, rax
je 0x18003f712
mov rcx, qword [rsi]
mov rcx, qword [rcx]
call rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x527d
call fcn.1800434e0
xor edx, edx
lea rcx, [rbp + 0x1e0]
mov r8d, 0xa00
call fcn.1800616b0
jmp 0x18003f7a5
cmp qword [r12 + 8], 0
mov byte [rbp - 0x5f], 1
je 0x18003e6c7
jmp 0x18003f7a5
mov dword [r12], 0x1a
jmp 0x18003f7a5
mov eax, r14d
sub eax, 0x68c0
je 0x18003f76c
cmp eax, 0x63
je 0x18003f86b
jmp 0x18003f7a5
movzx eax, byte [rbp - 0x5f]
mov ecx, edi
mov r10, qword [rbp + 0x178]
cmp r10, 0xffffffffffffffff
cmovne ecx, eax
mov byte [rbp - 0x5f], cl
cmp cl, 0
je 0x18003f7a5
lea r9, [rbp + 0x198]
mov r8d, 0x80
lea rdx, [rbp + 0x1e0]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov r9, qword [rbp - 0x70]
add r14d, 0x63
cmp r14d, 0x6923
jbe 0x18003f6b0
mov esi, 0x7b21
nop
mov eax, esi
sub eax, 0x7b21
je 0x18003f81f
sub eax, 0xf
je 0x18003f80a
sub eax, 0xf
je 0x18003f7de
cmp eax, 0xf
je 0x18003f86b
jmp 0x18003f82b
lea rdx, [r12 + 8]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov rax, qword [rbp - 0x70]
cmp qword [rax], 0
je 0x18003f800
call qword [rax + 0x48]
mov dword [r12], 0x1b
jmp 0x18003f82b
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x18003f82b
mov rcx, qword [r12 + 8]
mov rcx, qword [rcx]
call rax
jmp 0x18003f82b
cmp qword [r12 + 8], 0
je 0x18003e6c7
mov r9, qword [rbp - 0x70]
add esi, 0xf
cmp esi, 0x7b4e
jbe 0x18003f7c0
mov ecx, 0x1985
nop
mov eax, ecx
sub eax, 0x1985
je 0x18003f859
sub eax, 0x43
je 0x18003e6ce
cmp eax, 0x43
je 0x18003f86b
jmp 0x18003f860
mov dword [rbp - 0x58], 7
add ecx, 0x43
cmp ecx, 0x1a0b
jbe 0x18003f840
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
mov r14d, dword [rbp - 0x30]
mov ecx, 0x3c33
mov dword [rbp - 0x58], 1
mov edx, 0x73
add ecx, 0x1f
cmp ecx, 0x3c52
jbe 0x18003f450
jmp case.0x180040d82.14692
mov ecx, 0x6f78
mov eax, ecx
sub eax, 0x6f78
je 0x18003f8bb
cmp eax, 0x21
je 0x18003e6ce
jmp 0x18003fb9e
movsx eax, byte [r15]
add eax, 0xffffffd5
cmp eax, 0xe
ja case.0x18003f8d8.44
cdqe
mov ecx, dword [r11 + rax*4 + 0x42e18]
add rcx, r11
jmp rcx
mov esi, 0x5c75
nop
mov eax, esi
sub eax, 0x5c75
je 0x18003f950
sub eax, 0x1e
je 0x18003f917
cmp eax, 0x1e
jne 0x18003f981
mov r8d, dword [rbp + 0x24]
lea rcx, [rbp + 0xc50]
mov edx, dword [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
call sub.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorA
jmp 0x18003fb8b
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
mov dword [r12], 0x16
mov dword [rbp + 0x24], edi
jmp 0x18003f981
xor eax, eax
mov dword [r12 + 4], edi
mov qword [rbp + 0xc50], rax
mov qword [rbp + 0xc58], rax
mov qword [rbp + 0xc60], rax
mov qword [rbp + 0xc68], rax
mov qword [rbp + 0xc70], rax
mov dword [rbp + 0x38], 1
add esi, 0x1e
cmp esi, 0x5cb1
jbe 0x18003f8e0
mov esi, 0x3014
mov eax, esi
sub eax, 0x3014
je 0x18003f9a9
cmp eax, 0x3d
je 0x18003fb8b
jmp 0x18003fa10
cmp dword [r12 + 4], 0
jne 0x18003fa08
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffe
jae 0x18003f9ff
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003fa08
mov dword [r12 + 4], 1
mov dword [r12], 0x15
add esi, 0x3d
cmp esi, 0x3051
jbe 0x18003f995
mov r15d, 0x6a22
mov eax, r15d
sub eax, 0x6a22
je 0x18003fa5b
sub eax, 0x5d
je 0x18003fa42
cmp eax, 0x5d
je 0x18003e6ce
jmp 0x18003fb76
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.USER32.dll_IsWindowVisible]
mov dword [rbp - 0x58], 7
jmp 0x18003fb76
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, edi
mov qword [rbp + 0x180], rax
mov r14d, 7
lea rdi, [0x180000000]
cmp esi, 0x2a
ja case.0x18003fa94.7
mov ecx, esi
movzx ecx, byte [rdi + rcx + 0x42e74]
mov edx, dword [rdi + rcx*4 + 0x42e54]
add rdx, rdi
jmp rdx
mov r8d, 7
lea rdx, str.SetDeb
lea rcx, [rbp + 0xc00]
call fcn.1800643c0
jmp case.0x18003fa94.7
mov r8, qword [sym.imp.USER32.dll_SetDebugErrorLevel]
lea rdx, [rbp + 0xc00]
lea rcx, [rbp + 0x1e0]
call fcn.18005d500
jmp case.0x18003fa94.7
mov r8d, 1
lea rdx, [0x180085e9c]
lea rcx, [rbp + 0xc00]
call fcn.180064210
mov r8d, 7
lea rdx, str.evel__p
lea rcx, [rbp + 0xc00]
call fcn.180064210
mov r8d, 2
lea rdx, [0x180083230]
lea rcx, [rbp + 0xc15]
call fcn.1800643c0
jmp case.0x18003fa94.7
mov r8d, 2
lea rdx, [0x180083540]
lea rcx, [rbp + 0xc06]
call fcn.180061240
jmp case.0x18003fa94.7
mov byte [rbp + 0xc0c], 0x72
jmp case.0x18003fa94.7
mov eax, dword [str.gErro]
mov dword [rbp + 0xc07], eax
movzx eax, word [0x180085eac]
mov word [rbp + 0xc0b], ax
jmp case.0x18003fa94.7
mov byte [rbp + 0xc0d], 0
add esi, 7
sub r14, 1
jne 0x18003fa77
xor edi, edi
add r15d, 0x5d
cmp r15d, 0x6adc
jbe 0x18003fa25
mov r15, qword [rbp - 0x38]
mov ecx, 0x6f78
mov dword [rbp - 0x58], 1
lea r11, [0x180000000]
add ecx, 0x21
cmp ecx, 0x6f99
jbe 0x18003f8a4
jmp case.0x180040d82.14692
mov ecx, 0x11e4
mov eax, ecx
sub eax, 0x11e4
je 0x18003fbd9
sub eax, 0x13
je 0x18003fbd0
cmp eax, 0x13
je 0x18003e6ce
jmp 0x18003fbeb
mov dword [rbp - 0x58], 1
jmp 0x18003fbeb
cmp byte [r15], 0x75
jne case.0x18003edcf.49
mov dword [r12], 0xf
add ecx, 0x13
cmp ecx, 0x120a
jbe 0x18003fbb7
mov ecx, 0x61ce
mov r13d, 0x3885
mov eax, ecx
sub eax, 0x61ce
je 0x18003fc23
cmp eax, 0x13
jne 0x18003fc2d
mov dword [r12], 0x10
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
cmp byte [r15], 0x6c
jne case.0x18003edcf.49
add ecx, 0x13
cmp ecx, 0x61e1
jbe 0x18003fc01
jmp case.0x180040d82.14692
mov r13d, 0x38e2
mov r14d, 0x5248
nop dword [rax]
mov eax, r14d
sub eax, 0x5248
je 0x18003fc71
sub eax, 2
je 0x18003fd06
cmp eax, 2
je 0x18003e6ce
jmp 0x18003fd20
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 9
ja case.default.0x18003fc8e
cdqe
mov ecx, dword [r11 + rax*4 + 0x42ea0]
add rcx, r11
jmp rcx
mov esi, 0x1885
nop word [rax + rax]
mov eax, esi
sub eax, 0x1885
je 0x18003fdce
sub eax, 0x22
je 0x18003fd5d
sub eax, 0x22
je 0x18003fd4d
sub eax, 0x22
je 0x18003fd36
cmp eax, 0x22
jne 0x18003fddd
mov eax, dword [rbp + 0x28]
lea rcx, [rbp + 0xd8]
mov r9d, dword [rbp + 0x2c]
mov r8d, dword [rbp + 0x30]
mov edx, dword [rbp + 0x34]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AddAuditAccessObjectAce]
mov r14d, 0x524a
mov dword [rbp - 0x58], 1
lea r11, [0x180000000]
mov r10d, 8
add r14d, 2
cmp r14d, 0x524c
jbe 0x18003fc50
jmp case.0x180040d82.14692
xor eax, eax
mov dword [rbp + 0x28], edi
mov qword [rbp + 0x1c0], rax
mov dword [rbp + 0x1c8], eax
jmp 0x18003fddd
mov dword [rbp + 0x2c], edi
mov dword [r12], 0x13
jmp 0x18003fddd
cmp dword [r12 + 4], 0
jne 0x18003fdc2
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xffffffffffffffff
jae 0x18003fdb3
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003fdbc
mov dword [r12 + 4], 1
mov r10d, 8
mov dword [rbp + 0x34], edi
mov dword [rbp + 0x30], 4
jmp 0x18003fddd
mov qword [rbp + 0xd8], rdi
mov word [rbp + 0xda], r10w
add esi, 0x22
cmp esi, 0x190d
jbe 0x18003fca0
mov esi, 0x6aad
mov eax, esi
sub eax, 0x6aad
je 0x18003fe31
sub eax, 0x38
je 0x18003fe13
sub eax, 0x38
je case.0x18003edcf.49
cmp eax, 0x38
je 0x18003fd06
jmp 0x18003fe3b
mov edx, dword [rbp + 0x3c]
lea r9, [rbp + 0x50]
mov ecx, dword [rbp + 0x4c]
lea r8, [rbp - 0x80]
mov byte [rbp - 0x80], 0
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_ToAscii]
jmp 0x18003fe3b
mov dword [rbp + 0x4c], 1
mov dword [rbp + 0x3c], edi
add esi, 0x38
cmp esi, 0x6b55
jbe 0x18003fdf1
jmp 0x18003fd13
mov esi, 0x5234
mov r13d, 0x38a4
mov eax, esi
sub eax, 0x5234
je 0x18003fe78
sub eax, 0xf
je 0x18003fe6f
cmp eax, 0xf
je 0x18003e6ce
jmp 0x18003fe95
mov dword [rbp - 0x58], 1
jmp 0x18003fe95
cmp byte [r15], 0x6c
jne case.0x18003edcf.49
mov dword [r12], edi
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x18003fe95
call rax
mov r9, qword [rbp - 0x70]
add esi, 0xf
cmp esi, 0x5252
jbe 0x18003fe56
jmp case.0x180040d82.14692
mov ecx, 0x3cdd
nop word [rax + rax]
mov eax, ecx
sub eax, 0x3cdd
je 0x18003fec7
cmp eax, 0x1e
je case.0x18003e41f.6
jmp 0x18004084b
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18003feed.15
cdqe
movzx eax, byte [r11 + rax + 0x42ee4]
mov ecx, dword [r11 + rax*4 + 0x42ec8]
add rcx, r11
jmp rcx
cmp dword [r12 + 4], 0
jne case.0x1800401cc.9
mov esi, 0x67e0
mov eax, esi
sub eax, 0x67e0
je 0x18003ffb6
sub eax, 0x23
je 0x18003ffa0
sub eax, 0x23
je 0x18003ff90
cmp eax, 0x23
jne 0x18003ffca
cmp byte [rbp - 0x4c], 0
je 0x18003ff37
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xffffffffffffffff
jae 0x18003ff85
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18003ffca
mov dword [r12 + 4], 1
jmp 0x18003ffca
cmp qword [rbp + 0xe0], 0
jne 0x18003ffca
mov byte [rbp - 0x4c], 0
jmp 0x18003ffca
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.GDI32.dll_CreatePenIndirect]
mov qword [rbp + 0xe0], rax
jmp 0x18003ffca
xor eax, eax
mov byte [rbp - 0x4c], 1
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], rax
add esi, 0x23
cmp esi, 0x6849
jbe 0x18003ff00
jmp case.0x1800401cc.9
mov esi, 0x56ac
cmp esi, 0x5800
ja 0x1800400e5
je 0x1800400a9
mov eax, esi
sub eax, 0x56ac
je 0x180040082
sub eax, 0x55
je 0x18004004b
sub eax, 0x55
je 0x180040024
cmp eax, 0x55
jne 0x18004018c
mov dword [rbp + 0xbef], 0x7463656a
jmp 0x18004018c
movzx eax, word [0x18008624e]
mov word [rbp + 0xbec], ax
movzx eax, byte [0x180086250]
mov byte [rbp + 0xbee], al
mov byte [rbp + 0xbef], 0
jmp 0x18004018c
mov r8d, 5
lea rdx, [0x180086163]
lea rcx, [rbp + 0xbe0]
call fcn.180064210
mov r8d, 3
lea rdx, [0x1800861e4]
lea rcx, [rbp + 0xbe0]
call fcn.180064210
jmp 0x18004018c
mov r8d, 3
mov word [rbp + 0xbe0], 0x4d
lea rdx, [0x180086280]
lea rcx, [rbp + 0xbe0]
call fcn.180064210
jmp 0x18004018c
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov byte [rbp + 0xbf3], 0
mov byte [rbp - 0x4b], 1
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18004018c
mov eax, esi
sub eax, 0x5855
je 0x180040176
sub eax, 0xaa
je 0x180040135
sub eax, 0x55
je 0x18004010c
cmp eax, 0x55
je case.0x1800401cc.9
jmp 0x18004018c
cmp byte [rbp - 0x4b], 0
je 0x18004018c
mov rcx, qword [rbp + 0xe8]
lea rdx, [rbp + 0xc00]
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004018c
xor r9d, r9d
mov dword [r12], 0x14
xor edx, edx
lea rax, [rbp + 0xbe0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbp + 0xe8], rax
cmp rax, 0
jne 0x18004018c
mov byte [rbp - 0x4b], al
jmp 0x18004018c
xor eax, eax
mov qword [rbp + 0xc00], rax
mov qword [rbp + 0xc08], rax
mov dword [rbp + 0xc10], eax
add esi, 0x55
cmp esi, 0x59a9
jbe 0x18003ffe3
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
mov r10d, 8
mov edx, edi
mov dword [rbp - 0x50], edx
cmp edx, 0x75
ja case.0x1800401cc.10
mov eax, edx
movzx eax, byte [r11 + rax + 0x42f88]
mov ecx, dword [r11 + rax*4 + 0x42f5c]
add rcx, r11
jmp rcx
mov qword [rbp + 0xf0], rdi
jmp case.0x1800401cc.10
lea rdx, [r12 + 8]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov dword [rbp + 0x40], edi
jmp 0x180040215
xor edx, edx
lea rcx, [rbp + 0xc28]
mov r8d, 0x60000
call qword [sym.imp.USER32.dll_OpenWindowStationA]
mov r12, rax
test rax, rax
jne 0x18004027d
mov byte [rbp - 0x78], al
mov r12, qword [rbp - 0x68]
mov edx, dword [rbp - 0x50]
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
add edx, 0xd
mov r10d, 8
mov dword [rbp - 0x50], edx
lea eax, [rdx + 0x4962]
cmp eax, 0x49d7
jbe 0x1800401b1
mov r14d, 0x77f
nop word [rax + rax]
mov eax, r14d
sub eax, 0x77f
je 0x18004059d
sub eax, 0x43
je 0x180040560
cmp eax, 0x43
jne 0x1800405a9
mov dword [r12], 0x1a
jmp case.0x1800401cc.9
cmp byte [rbp - 0x78], 0
je 0x180040211
mov ebx, dword [rbp + 0x40]
mov r13d, 0x5da2
cmp r13d, r13d
jne 0x180040479
mov rsi, qword [rbp - 0x40]
lea rax, [rbp + 0x44]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea rdx, [rbp + 0x48]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetUserObjectSecurity]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1800402d2
mov rcx, r12
call qword [sym.imp.USER32.dll_CloseWindowStation]
mov byte [rbp - 0x78], 0
jmp 0x180040479
movzx ecx, byte [rbp - 0x78]
test cl, cl
je 0x180040479
mov r15d, 0x7858
nop dword [rax]
nop dword [rax + rax]
mov eax, r15d
sub eax, 0x7858
je 0x180040429
cmp eax, 0x5a
jne 0x180040468
test cl, cl
je 0x180040468
mov r14d, 0x33d2
nop word [rax + rax]
mov eax, r14d
sub eax, 0x33d2
je 0x1800403b3
cmp eax, 0x2c
jne 0x18004039d
test cl, cl
je 0x18004039d
mov rdi, qword [rbp - 0x40]
mov esi, 0x1dd1
mov eax, esi
sub eax, 0x1dd1
je 0x18004036d
cmp eax, 0x21
jne 0x18004038b
mov rcx, r12
call qword [sym.imp.USER32.dll_CloseWindowStation]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18004038b
mov rcx, qword [rbp + 0xf0]
lea rdx, [rbp + 0x1b0]
mov r9d, 2
lea r8d, [r9 + 0xa]
call qword [sym.imp.ADVAPI32.dll_GetAclInformation]
add esi, 0x21
cmp esi, 0x1df2
jbe 0x180040340
mov rsi, rdi
movzx ecx, byte [rbp - 0x78]
add r14d, 0x2c
cmp r14d, 0x33fe
jbe 0x180040320
jmp 0x180040468
lea r9, [rbp + 0x60]
mov rcx, rsi
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x64]
call qword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x180040399
mov rdi, qword [rbp - 0x40]
mov esi, 0x5c81
nop dword [rax + rax]
mov eax, esi
sub eax, 0x5c81
je 0x180040409
cmp eax, 5
jne 0x180040412
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor cl, cl
mov byte [rbp - 0x78], cl
jmp 0x180040416
mov rcx, r12
call qword [sym.imp.USER32.dll_CloseWindowStation]
movzx ecx, byte [rbp - 0x78]
add esi, 5
cmp esi, 0x5c86
jbe 0x1800403e0
mov rsi, rdi
jmp 0x18004039d
mov dword [rbp + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 7]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbp - 0x40], rax
mov rsi, rax
test rax, rax
jne 0x180040464
mov rcx, r12
call qword [sym.imp.USER32.dll_CloseWindowStation]
xor cl, cl
mov byte [rbp - 0x78], cl
jmp 0x180040468
movzx ecx, byte [rbp - 0x78]
add r15d, 0x5a
cmp r15d, 0x78b2
jbe 0x1800402f0
add r13d, 0x16
cmp r13d, 0x5da2
jbe 0x18004028f
mov rbx, qword [rbp]
xor edi, edi
jmp 0x180040211
mov byte [rbp + 0xc28], 0
jmp case.0x1800401cc.10
mov rax, qword [r9 + 0x28]
mov dword [rbp + 0x1b4], r10d
test rax, rax
je 0x1800404be
mov rcx, qword [r12 + 8]
mov rcx, qword [rcx]
call rax
mov edx, dword [rbp - 0x50]
mov qword [rbp - 0x40], rdi
jmp case.0x1800401cc.10
mov dword [rbp + 0x48], 4
mov dword [r12], edi
jmp case.0x1800401cc.10
cmp qword [r12 + 8], 0
je 0x18003e6c7
xor eax, eax
mov qword [rbp + 0x1b0], rax
mov dword [rbp + 0x1b8], eax
jmp case.0x1800401cc.10
mov r8d, 3
lea rdx, [0x1800862b3]
lea rcx, [rbp + 0xc28]
call fcn.180064210
movzx eax, word [0x1800862f4]
mov word [rbp + 0xc2b], ax
movzx eax, byte [0x1800862f6]
mov byte [rbp + 0xc2d], al
mov byte [rbp + 0xc2e], 0
jmp 0x180040215
mov r8d, 1
lea rdx, [0x180086330]
lea rcx, [rbp + 0xc2e]
call fcn.1800643c0
mov byte [rbp + 0xc2f], 0
mov byte [rbp - 0x78], 1
jmp 0x180040215
mov rax, qword [r9 + 0x28]
lea rsi, [r12 + 8]
test rax, rax
je 0x180040576
mov rcx, qword [rsi]
mov rcx, qword [rcx]
call rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x527d
call fcn.1800434e0
mov r9, qword [rbp - 0x70]
cmp qword [r9], 0
je 0x1800405a9
call qword [r9 + 8]
mov r9, qword [rbp - 0x70]
jmp 0x1800405a9
cmp qword [r12 + 8], 0
je 0x18003e6c7
add r14d, 0x43
cmp r14d, 0x805
jbe 0x180040250
mov r8d, 0x57
mov r15d, 0x2d9e
mov dword [rbp - 0x50], r15d
nop word [rax + rax]
mov eax, r15d
sub eax, 0x2d9e
je 0x180040604
sub eax, 0x51
je 0x1800405ed
cmp eax, 0x51
je case.0x1800401cc.9
jmp 0x18004076e
cmp qword [r9], 0
je 0x1800405f7
call qword [r9 + 0x18]
mov dword [r12], 0x1a
jmp 0x18004076e
cmp qword [r9 + 0x28], 0
je 0x180040665
mov r14d, 0x3462
mov eax, r14d
sub eax, 0x3462
je 0x180040647
cmp eax, 0x43
jne 0x180040653
mov rcx, qword [r12 + 8]
mov rcx, qword [rcx]
call qword [r9 + 0x28]
xor r9d, r9d
lea rdx, [r12 + 8]
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov r9, qword [rbp - 0x70]
jmp 0x180040653
cmp qword [r12 + 8], 0
je 0x18003e6c7
add r14d, 0x43
cmp r14d, 0x34a5
jbe 0x180040611
jmp 0x18004076e
mov rbx, qword [rbp + 0x188]
mov esi, 0x4c2f
mov r15d, dword [rbp - 0x14]
cmp esi, 0x4d77
ja 0x1800406f6
je 0x1800406ed
mov eax, esi
sub eax, 0x4c2f
je 0x1800406cd
sub eax, 0x52
je 0x1800406c1
sub eax, 0x52
je 0x1800406a3
cmp eax, 0x52
jne 0x180040746
mov r15d, edi
jmp 0x180040746
lea rdx, [r12 + 8]
mov byte [rbp - 0x5e], 1
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
jmp 0x180040746
mov dword [rbp + 0xc7f], 0x776f64
jmp 0x180040746
mov eax, 0x6e69
mov word [rbp + 0xc7c], r8w
mov word [rbp + 0xc7d], ax
mov dword [rbp + 0xc78], 0x656d614e
jmp 0x180040746
mov dword [rbp - 0x18], 0x200
jmp 0x180040746
mov eax, esi
sub eax, 0x4dc9
je 0x18004072f
sub eax, 0x52
je 0x180040710
cmp eax, 0x52
jne 0x180040746
mov qword [r12 + 8], rdi
jmp 0x180040746
movzx eax, byte [rbp - 0x5e]
test rbx, rbx
mov ecx, edi
cmovne ecx, eax
mov byte [rbp - 0x5e], cl
cmp cl, 0
je 0x180040746
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseWindowStation]
jmp 0x180040746
mov r8d, dword [rbp - 0x18]
lea rcx, [rbp + 0xc78]
mov edx, r15d
call qword [sym.imp.USER32.dll_OpenWindowStationA]
mov rbx, rax
add esi, 0x52
mov r8d, 0x57
cmp esi, 0x4e6d
jbe 0x180040675
mov dword [rbp - 0x14], r15d
mov r15d, dword [rbp - 0x50]
mov qword [rbp + 0x188], rbx
mov rbx, qword [rbp]
mov r9, qword [rbp - 0x70]
add r15d, 0x51
mov dword [rbp - 0x50], r15d
mov r8d, 0x57
cmp r15d, 0x2e40
jbe 0x1800405d0
mov esi, 0x669
mov eax, esi
sub eax, 0x669
je 0x1800407d9
sub eax, 0x15
je 0x1800407ab
cmp eax, 0x15
je case.0x1800401cc.9
jmp 0x1800407f5
lea rdx, [r12 + 8]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x1800407cf
call rax
mov dword [r12], 0x1b
jmp 0x1800407f5
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x18003e6c7
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x1800407f5
mov rcx, qword [rcx]
call rax
add esi, 0x15
cmp esi, 0x693
ja case.0x18003feed.15
mov r9, qword [rbp - 0x70]
jmp 0x180040792
mov ecx, 0x7bf6
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x7bf6
je case.0x18003edcf.49
cmp eax, 0xa
je case.0x1800401cc.9
add ecx, 0xa
cmp ecx, 0x7c00
jbe 0x180040810
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
mov r15, qword [rbp - 0x38]
mov r10d, 8
mov ecx, 0x3cdd
lea r8d, [r10 + 0x4f]
add ecx, 0x1e
cmp ecx, 0x3cfb
jbe 0x18003feb0
mov r13d, 0x3901
jmp case.0x180040d82.14692
mov esi, 0x41ec
nop word [rax + rax]
mov eax, esi
sub eax, 0x41ec
je 0x1800408a1
sub eax, 0xd
je 0x180040889
cmp eax, 0xd
je 0x18003e6ce
jmp 0x1800408af
mov rax, qword [r9 + 0x38]
test rax, rax
je 0x180040898
call rax
mov r9, qword [rbp - 0x70]
mov dword [rbp - 0x58], 1
jmp 0x1800408af
cmp byte [r15], 0x65
jne case.0x18003edcf.49
mov dword [r12], edi
add esi, 0xd
cmp esi, 0x4206
jbe 0x180040870
mov r13d, 0x3866
jmp case.0x180040d82.14692
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x1800408eb.14
cdqe
movzx eax, byte [r11 + rax + 0x43018]
mov ecx, dword [r11 + rax*4 + 0x43000]
add rcx, r11
jmp rcx
mov r15, qword [rbp - 0x68]
mov r14d, 0x4b78
nop word [rax + rax]
mov eax, r14d
sub eax, 0x4b78
je 0x1800409d4
sub eax, 0x21
je 0x180040997
sub eax, 0x21
je 0x180040984
cmp eax, 0x21
jne 0x1800409e6
mov rdi, qword [rbp - 0x20]
lea esi, [rax + 0x53]
mov ebx, 0xe46
cmp ebx, 0xefa
ja 0x180041f78
je 0x180041f61
mov eax, ebx
sub eax, 0xe46
je 0x180041f26
sub eax, 0x2d
je 0x180041f0d
sub eax, 0x2d
je 0x180041efc
cmp eax, 0x2d
jne 0x180041fe6
lea rdx, [0x18008638c]
lea rcx, [rbp + 0xbe7]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x180041fe6
mov rax, qword [sym.imp.GDI32.dll_GetBitmapBits]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x68]
mov dword [rax], edi
jmp 0x1800409e3
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x1800409af
mov rcx, qword [r15 + 8]
lea rsi, [r15 + 8]
mov rcx, qword [rcx]
call rax
jmp 0x1800409bb
mov rsi, qword [rbp - 0x68]
mov r15, qword [rbp - 0x68]
add rsi, 8
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x527d
call fcn.1800434e0
mov r9, qword [rbp - 0x70]
jmp 0x1800409e6
mov rax, qword [rbp - 0x68]
cmp qword [rax + 8], 0
je 0x18003e6c7
mov r15, rax
add r14d, 0x21
cmp r14d, 0x4bdb
jbe 0x180040900
jmp 0x1800409fd
mov r15, qword [rbp - 0x68]
mov esi, 0x1bb6
mov eax, esi
sub eax, 0x1bb6
je 0x180040a65
sub eax, 0x39
je 0x180040a51
sub eax, 0x39
je 0x180040a20
cmp eax, 0x39
je case.0x18003e41f.6
jmp 0x180040a77
mov r14, qword [rbp - 0x68]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
lea rdx, [r14 + 8]
call fcn.1800434e0
mov rax, qword [rbp - 0x70]
cmp qword [rax], 0
je 0x180040a45
call qword [rax + 8]
mov dword [r14], 0x1a
mov r15, r14
jmp 0x180040a77
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x180040a77
mov rcx, qword [r15 + 8]
mov rcx, qword [rcx]
call rax
jmp 0x180040a77
mov rax, qword [rbp - 0x68]
cmp qword [rax + 8], 0
je 0x18003e6c7
mov r15, rax
mov r9, qword [rbp - 0x70]
add esi, 0x39
cmp esi, 0x1c61
jbe 0x180040a02
mov r14d, 0x56d1
mov eax, r14d
sub eax, 0x56d1
je 0x180040ab9
cmp eax, 0x3e
jne 0x180040b3d
mov rax, qword [rbp - 0x68]
mov dword [rax], 0x1a
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
cmp qword [r9 + 0x28], 0
je 0x180040b1a
mov esi, 0x34da
mov eax, esi
sub eax, 0x34da
je 0x180040af1
sub eax, 0xe
je 0x180040ae2
cmp eax, 0xe
jne 0x180040b0d
mov rax, qword [rbp - 0x68]
mov qword [rax + 8], rdi
jmp 0x180040b0d
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
call fcn.18006452c
jmp 0x180040b09
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18003e6c7
mov rcx, qword [rcx]
call qword [r9 + 0x28]
mov r9, qword [rbp - 0x70]
add esi, 0xe
cmp esi, 0x34f6
jbe 0x180040ac5
jmp 0x180040b2f
mov rsi, qword [rbp - 0x68]
mov rcx, qword [rsi + 8]
call fcn.18006452c
mov r9, qword [rbp - 0x70]
mov qword [rsi + 8], rdi
cmp qword [r9], 0
je 0x180040b3d
call qword [r9 + 0x18]
mov r9, qword [rbp - 0x70]
add r14d, 0x3e
cmp r14d, 0x570f
jbe 0x180040a90
mov r15d, 0x2631
mov dword [rbp - 0x10], r15d
nop dword [rax + rax]
mov eax, r15d
sub eax, 0x2631
je 0x180040b78
cmp eax, 0x4a
je case.0x18003e41f.6
jmp 0x180040d07
cmp qword [r9 + 0x28], 0
je 0x180040ce1
mov r14d, 0x7456
mov dword [rbp - 0x50], r14d
nop dword [rax]
mov eax, r14d
sub eax, 0x7456
je 0x180040cc3
sub eax, 0x5b
je 0x180040c9a
cmp eax, 0x5b
jne 0x180040ca8
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax + 8]
call fcn.18006452c
mov rdi, qword [rbp + 0x190]
mov ebx, 0x63
mov esi, 0x510b
lea r15d, [rbx - 0x1f]
lea r13d, [rbx + 0xd]
cmp esi, 0x520a
ja 0x180040c2f
je 0x180040c19
mov eax, esi
sub eax, 0x510b
je 0x180040c05
sub eax, 0x55
je 0x180040bfc
cmp eax, 0x55
jne 0x180040c67
mov word [rbp + 0xbe5], bx
jmp 0x180040c67
mov word [rbp + 0xbe4], bx
jmp 0x180040c67
mov word [rbp + 0xbe0], r15w
mov dword [rbp + 0xbe1], 0x416564
jmp 0x180040c67
mov dword [rbp + 0xbe6], 0x737365
mov dword [rbp + 0xbe9], 0x746144
jmp 0x180040c67
mov eax, esi
sub eax, 0x525f
je 0x180040c5d
cmp eax, 0x55
jne 0x180040c67
mov r8, rdi
mov word [rbp + 0xbef], r13w
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0x1e0]
call fcn.18005d500
jmp 0x180040c67
mov dword [rbp + 0xbec], 0x252061
add esi, 0x55
cmp esi, 0x52b4
jbe 0x180040bd6
mov rsi, qword [rbp - 0x68]
xor edi, edi
mov rbx, qword [rbp]
mov r14d, dword [rbp - 0x50]
mov r15d, dword [rbp - 0x10]
mov r12d, dword [rbp - 0xc]
mov r13d, dword [rbp - 0x48]
mov r9, qword [rbp - 0x70]
mov qword [rsi + 8], rdi
jmp 0x180040cac
lea rax, [0x18005d581]
mov qword [rbp + 0x190], rax
mov rsi, qword [rbp - 0x68]
add r14d, 0x5b
mov dword [rbp - 0x50], r14d
cmp r14d, 0x750c
jbe 0x180040b90
jmp 0x180040cf2
mov rsi, qword [rbp - 0x68]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18003e6c7
mov rcx, qword [rcx]
call qword [r9 + 0x28]
mov r9, qword [rbp - 0x70]
jmp 0x180040cac
mov rsi, qword [rbp - 0x68]
mov rcx, qword [rsi + 8]
call fcn.18006452c
mov qword [rsi + 8], rdi
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x180040d01
call rax
mov dword [rsi], 0x1b
mov r9, qword [rbp - 0x70]
add r15d, 0x4a
mov dword [rbp - 0x10], r15d
cmp r15d, 0x267b
jbe 0x180040b60
mov r15, qword [rbp - 0x38]
lea r11, [0x180000000]
mov eax, 0x358f
cmp eax, eax
je case.0x18003edcf.49
add eax, 0x5a
cmp eax, 0x358f
jbe 0x180040d32
add r12d, 0x14
mov dword [rbp - 0xc], r12d
cmp r12d, 0x188f
jbe 0x18003e4c0
jmp case.0x180040d82.14692
lea eax, [r13 - 0x395e]
cmp eax, 0x9b
ja case.default.0x180040d82
movzx eax, byte [r11 + rax + 0x430ac]
mov ecx, dword [r11 + rax*4 + 0x43090]
add rcx, r11
jmp rcx
mov r13, qword [rbp - 0x38]
movsx eax, byte [r13]
add eax, 0xffffffd0
cmp eax, 9
ja case.default.0x180040da6
cdqe
mov ecx, dword [r11 + rax*4 + 0x43148]
add rcx, r11
jmp rcx
mov r14d, 0x5d9d
nop
mov eax, r14d
sub eax, 0x5d9d
je 0x180040dec
cmp eax, 0x45
jne 0x180040ef7
mov r15d, 0x727
add r15d, 0x62
lea r11, [0x180000000]
cmp r15d, 0x789
jbe 0x18003e470
mov r13d, 0x395e
jmp case.0x180040d82.14692
cmp dword [r12 + 4], 0
jne 0x180040eef
mov esi, 0x40dc
nop dword [rax]
mov eax, esi
sub eax, 0x40dc
je 0x180040ebe
sub eax, 0x42
je 0x180040eb5
sub eax, 0x42
je 0x180040eaa
sub eax, 0x42
je 0x180040ea1
cmp eax, 0x42
jne 0x180040ee0
xor r9d, r9d
mov byte [rbp + 0xc1e], 0
lea r8, [rbp + 0x1e0]
mov edx, 0x104
lea rcx, [rbp + 0xc18]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffe
jae 0x180040e96
movzx eax, byte [r13]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
jmp 0x180040ee0
mov dword [r12 + 4], 1
jmp 0x180040ee0
mov byte [rbp + 0xc1d], 0x65
jmp 0x180040ee0
mov word [rbp + 0xc1c], 0x6c
jmp 0x180040ee0
mov byte [rbp + 0xc1c], 0
jmp 0x180040ee0
movzx eax, word [0x180085e5e]
mov word [rbp + 0xc18], ax
movzx eax, byte [0x180085e60]
mov byte [rbp + 0xc1a], al
mov byte [rbp + 0xc1b], 0x69
add esi, 0x42
cmp esi, 0x41e4
jbe 0x180040e00
mov dword [r12], 0x15
add r14d, 0x45
cmp r14d, 0x5de2
jbe 0x180040db0
mov ecx, 0x266b
nop dword [rax]
mov eax, ecx
sub eax, 0x266b
je case.0x18003edcf.49
cmp eax, 0x59
je 0x180040dc3
add ecx, 0x59
cmp ecx, 0x26c4
jbe 0x180040f10
jmp 0x180040dc9
mov ecx, 0x5b49
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x5b49
je 0x180040f68
sub eax, 0x22
je 0x180040f5c
cmp eax, 0x22
je 0x18003e6ce
jmp 0x1800410a2
mov dword [rbp - 0x58], 1
jmp 0x1800410a2
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x180040f8e.13
cdqe
movzx eax, byte [r11 + rax + 0x43184]
mov ecx, dword [r11 + rax*4 + 0x43170]
add rcx, r11
jmp rcx
mov esi, 0x30ef
mov eax, esi
sub eax, 0x30ef
je 0x180040fcb
sub eax, 5
je 0x180040fae
cmp eax, 5
je case.0x180040f8e.9
jmp 0x180041009
xor r8d, r8d
lea r9, [rbp + 0x90]
lea rdx, [rbp + 0xa0]
lea ecx, [r8 + 1]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
jmp 0x180041009
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rax
mov rax, qword [r9 + 8]
test rax, rax
je 0x180041002
call rax
mov qword [rbp + 0x90], rdi
mov r9, qword [rbp - 0x70]
add esi, 5
cmp esi, 0x30f9
jbe 0x180040f95
mov rax, qword [r9 + 0x18]
test rax, rax
je case.0x180040f8e.9
call rax
jmp case.0x180040f8e.9
mov esi, 0x6acc
nop
mov eax, esi
sub eax, 0x6acc
je 0x180041040
cmp eax, 0x2d
je case.0x180040f8e.9
jmp 0x180041057
mov rax, qword [r9 + 0x50]
test rax, rax
je 0x18004104f
call rax
mov r9, qword [rbp - 0x70]
mov dword [r12], 0x1b
add esi, 0x2d
cmp esi, 0x6af9
jbe 0x180041030
mov ecx, 0x739b
mov eax, ecx
sub eax, 0x739b
je 0x180041080
sub eax, 0x5c
je 0x18003e6ce
cmp eax, 0x5c
je case.0x180040f8e.9
jmp 0x180041087
mov dword [rbp - 0x58], 7
add ecx, 0x5c
cmp ecx, 0x7453
jbe 0x180041067
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
mov ecx, 0x5b49
add ecx, 0x22
cmp ecx, 0x5b8d
jbe 0x180040f40
mov r13d, 0x39da
jmp case.0x180040d82.14692
mov dword [rbp - 0x58], 1
jmp 0x18004116e
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x1800410ee.12
cdqe
movzx eax, byte [r11 + rax + 0x4320c]
mov ecx, dword [r11 + rax*4 + 0x431fc]
add rcx, r11
jmp rcx
mov eax, 0x5c86
cmp eax, eax
je 0x18004115b
add eax, 0x40
cmp eax, 0x5c86
jbe 0x1800410f7
mov esi, 0x15f8
nop dword [rax + rax]
cmp esi, 0x1698
ja 0x18004126d
je 0x180041264
mov eax, esi
sub eax, 0x15f8
je 0x180041242
sub eax, 0x20
je 0x180041210
sub eax, 0x20
je 0x1800411d3
sub eax, 0x20
je 0x180041195
cmp eax, 0x20
jne 0x18004131a
mov byte [rbp + 0xbf3], 0
jmp 0x18004131a
mov qword [r12 + 8], rdi
mov dword [r12], 1
mov r14d, 0x594d
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
add r14d, 0xf
cmp r14d, 0x596b
jbe 0x18003e5d0
mov r13d, 0x39bb
jmp case.0x180040d82.14692
mov r8d, 2
lea rdx, [0x180085ec4]
lea rcx, [rbp + 0xbef]
call fcn.180061240
mov r8d, 3
lea rdx, [0x180085ec8]
lea rcx, [rbp + 0xbf0]
call fcn.180061240
mov byte [rbp + 0xbf2], 0x74
jmp 0x18004131a
lea rcx, [rbp + 0xbe0]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800411e0
mov eax, dword [0x180085eb0]
lea rdx, str.ingOb
mov dword [rcx], eax
mov r8d, 6
lea rcx, [rbp + 0xbea]
call fcn.180061240
jmp 0x18004131a
lea rdx, [0x180085ebc]
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 2
lea rdx, [0x180085ec0]
lea rcx, [rbp + 0xbe6]
call fcn.180061240
jmp 0x18004131a
lea rdx, [0x180085ecc]
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov word [rbp + 0xbe2], 0x46
jmp 0x18004131a
mov byte [rbp - 0x5d], 1
jmp 0x18004131a
mov eax, esi
sub eax, 0x16b8
je 0x18004130b
sub eax, 0x20
je 0x1800412d3
sub eax, 0x20
je 0x1800412bd
sub eax, 0x20
je 0x180041297
cmp eax, 0x20
je case.0x1800410ee.9
jmp 0x18004131a
cmp byte [rbp - 0x5d], 0
je 0x18004131a
mov rcx, qword [rbp + 0xf8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, qword [rbp + 0xf8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004131a
movzx eax, byte [rbp - 0x5d]
mov ecx, edi
cmp qword [rbp + 0xf8], 0
cmovne ecx, eax
mov byte [rbp - 0x5d], cl
jmp 0x18004131a
xor r9d, r9d
mov dword [r12], 0x1a
xor edx, edx
lea rax, [rbp + 0xbe0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbp + 0xf8], rax
jmp 0x18004131a
mov rax, qword [r9 + 8]
test rax, rax
je 0x180041316
call rax
mov qword [rbp - 0x28], rdi
mov r9, qword [rbp - 0x70]
add esi, 0x20
cmp esi, 0x1738
jbe 0x180041110
mov ecx, 0x7406
mov eax, ecx
sub eax, 0x7406
je case.0x18003edcf.49
cmp eax, 0x17
je case.0x1800410ee.9
add ecx, 0x17
cmp ecx, 0x741d
jbe 0x180041332
jmp 0x18004116e
mov eax, 0x3942
cmp eax, eax
je 0x180042071
add eax, 0x21
cmp eax, 0x3942
jbe 0x18004135f
mov r13d, 0x399c
mov r15d, 0x4739
nop dword [rax + rax]
cmp r15d, 0x48c9
ja 0x1800417e4
je 0x1800417d5
mov eax, r15d
sub eax, 0x4739
je 0x18004179a
sub eax, 0xc8
je 0x1800413b6
cmp eax, 0x64
je 0x18004170e
jmp 0x18004180d
lea rcx, [rbp + 0xc20]
call qword [sym.imp.USER32.dll_CharNextA]
lea rcx, [rbp + 0xc21]
call qword [sym.imp.USER32.dll_CharNextA]
mov r14, qword [rbp - 0x38]
movsx eax, byte [r14]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x1800413ff.16
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x432a4]
mov ecx, dword [rdx + rax*4 + 0x43284]
add rcx, rdx
jmp rcx
cmp dword [r12 + 4], 0
jne 0x18004170e
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xffffffffffffffff
jae 0x18004148b
mov r9d, 0xd6
mov qword [rbp - 0x48], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
movzx ecx, byte [r14]
mov r9d, 0x1d25
mov byte [rbp - 0x80], cl
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rdi
mov rdx, rax
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x18004170e
mov dword [r12 + 4], 1
jmp 0x18004170e
mov esi, 0x32ba
nop
mov eax, esi
sub eax, 0x32ba
je 0x1800414b4
cmp eax, 7
je 0x18004170e
jmp 0x180041512
mov r9d, 0xd6
mov qword [rbp - 0x48], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x2e
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
mov dword [r12], 0x12
add esi, 7
cmp esi, 0x32c1
jbe 0x1800414a0
mov esi, 0x2af9
mov eax, esi
sub eax, 0x2af9
je 0x18004153d
cmp eax, 0x24
jne 0x18004159b
mov dword [r12], 0x14
jmp 0x18004170e
mov r9d, 0xd6
mov qword [rbp - 0x48], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
movzx ecx, byte [r14]
mov r9d, 0x1d25
mov byte [rbp - 0x80], cl
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rdi
mov rdx, rax
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
mov dword [r12 + 4], edi
add esi, 0x24
cmp esi, 0x2b1d
jbe 0x180041522
mov esi, 0x30de
nop
mov eax, esi
sub eax, 0x30de
je 0x1800415dc
cmp eax, 0x4e
jne 0x1800415fc
lea rdx, [r12 + 8]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov dword [r12], edi
jmp 0x18004170e
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x18003e6c7
mov rax, qword [rbp - 0x70]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1800415fc
mov rcx, qword [rcx]
call rax
add esi, 0x4e
cmp esi, 0x312c
jbe 0x1800415b0
mov r14d, 0x244c
nop dword [rax]
mov eax, r14d
sub eax, 0x244c
je 0x180041639
cmp eax, 0x23
jne 0x18004166e
mov rax, qword [rbp - 0x70]
cmp qword [rax], 0
je 0x18004162c
call qword [rax + 8]
mov dword [r12], 0x1a
jmp 0x18004170e
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x18003e6c7
mov rax, qword [rbp - 0x70]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180041659
mov rcx, qword [rcx]
call rax
xor r9d, r9d
lea rdx, [r12 + 8]
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
add r14d, 0x23
cmp r14d, 0x246f
jbe 0x180041610
mov esi, 0x2fa9
mov eax, esi
sub eax, 0x2fa9
je 0x1800416c1
sub eax, 3
je 0x180041695
cmp eax, 3
je 0x18004170e
jmp 0x1800416e1
lea rdx, [r12 + 8]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
mov rax, qword [rbp - 0x70]
cmp qword [rax], 0
je 0x1800416b7
call qword [rax + 0x18]
mov dword [r12], 0x1a
jmp 0x1800416e1
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x18003e6c7
mov rax, qword [rbp - 0x70]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x1800416e1
mov rcx, qword [rcx]
call rax
add esi, 3
cmp esi, 0x2faf
jbe 0x180041680
mov r14d, 0x1f4f
mov eax, r14d
sub eax, 0x1f4f
je 0x180041764
sub eax, 0x36
je 0x180041726
cmp eax, 0x36
jne 0x180041770
mov dword [r12], 0x1b
lea rcx, [rbp + 0xc22]
mov r15d, 0x4865
call qword [sym.imp.USER32.dll_CharNextA]
jmp 0x18004180d
mov rax, qword [rbp - 0x70]
lea rsi, [r12 + 8]
mov rax, qword [rax + 0x28]
test rax, rax
je 0x180041740
mov rcx, qword [rsi]
mov rcx, qword [rcx]
call rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x527d
call fcn.1800434e0
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx + 0x48]
test rax, rax
je 0x180041770
call rax
jmp 0x180041770
cmp qword [r12 + 8], 0
je 0x18003e6c7
add r14d, 0x36
cmp r14d, 0x1fbb
jbe 0x1800416f2
mov eax, 0x5412
cmp eax, eax
je case.0x18003edcf.49
add eax, 0x56
cmp eax, 0x5412
jbe 0x180041788
jmp 0x18004180d
mov r8d, 4
lea rdx, [0x180085fe9]
lea rcx, [rbp + 0xc20]
call fcn.1800643c0
mov r8d, 2
mov byte [rbp + 0xc24], 0
lea rdx, [0x180086014]
lea rcx, [rbp + 0xc20]
call fcn.180064210
jmp 0x18004180d
lea rcx, [rbp + 0xc23]
call qword [sym.imp.USER32.dll_CharNextA]
jmp 0x18004180d
mov eax, r15d
sub eax, 0x492d
je 0x1800417f9
cmp eax, 0x64
je 0x18003e6ce
jmp 0x18004180d
lea rcx, [rbp + 0xc24]
call qword [sym.imp.USER32.dll_CharNextA]
mov dword [rbp - 0x58], 1
add r15d, 0x64
cmp r15d, 0x4991
jbe 0x180041380
jmp case.0x180040d82.14692
mov ecx, 0x69e5
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x69e5
je 0x180041847
cmp eax, 0x48
je case.0x18003e41f.6
jmp 0x180041a71
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 9
ja case.default.0x180041864
cdqe
mov ecx, dword [r11 + rax*4 + 0x4331c]
add rcx, r11
jmp rcx
mov esi, 0x3382
nop dword [rax + rax]
mov eax, esi
sub eax, 0x3382
je 0x180041893
sub eax, 0xf
je 0x180041889
cmp eax, 0xf
je 0x180041a65
jmp 0x1800418b6
mov dword [r12], 0x11
jmp 0x1800418b6
movzx eax, byte [r15]
lea rcx, [rbp - 0x80]
mov rdx, qword [r12 + 8]
mov r9d, 0x1d25
xor r8d, r8d
mov byte [rbp - 0x80], al
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
add esi, 0xf
cmp esi, 0x33a0
jbe 0x180041870
mov esi, 0x2c10
mov eax, esi
sub eax, 0x2c10
je 0x1800418dd
cmp eax, 0x5f
je 0x180041a65
jmp 0x18004196b
cmp dword [r12 + 4], 0
jne 0x180041963
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xffffffffffffffff
jae 0x180041963
mov r9d, 0xd6
mov qword [rbp - 0x48], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.180014ca0
mov qword [r12 + 8], rax
test rax, rax
je 0x18003e6c7
movzx ecx, byte [r15]
mov r9d, 0x1d25
mov byte [rbp - 0x80], cl
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rdi
mov rdx, rax
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
mov dword [r12 + 4], eax
mov dword [r12], 0x18
add esi, 0x5f
cmp esi, 0x2c6f
jbe 0x1800418c6
mov esi, 0x3812
nop
mov eax, esi
sub eax, 0x3812
je 0x180041a10
sub eax, 0x13
je 0x1800419cb
sub eax, 0x13
je 0x1800419ae
sub eax, 0x13
je 0x18003e6ce
cmp eax, 0x13
je 0x180041a65
jmp 0x180041a56
lea rdx, [rbp - 8]
lea rcx, [rbp + 0xc50]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov dword [rbp - 0x58], 7
jmp 0x180041a56
mov r8d, 0xa
lea rdx, str.tion
lea rcx, [rbp + 0xc5e]
call fcn.180061240
mov r8d, 4
lea rdx, [0x180085f88]
lea rcx, [rbp + 0xc66]
call fcn.180061240
movabs rax, 0x65006d0061
mov qword [rbp + 0xc68], rax
jmp 0x180041a56
lea rdx, [0x180086048]
lea rcx, [rbp + 0xc50]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r8d, 8
lea rdx, [0x180086050]
lea rcx, [rbp + 0xc54]
call fcn.180061240
mov r8d, 6
lea rdx, [0x180086058]
lea rcx, [rbp + 0xc5a]
call fcn.180061240
add esi, 0x13
cmp esi, 0x385e
jbe 0x180041980
mov ecx, 0x69e5
lea r11, [0x180000000]
add ecx, 0x48
cmp ecx, 0x6a2d
jbe 0x180041830
mov ecx, dword [rbp - 0x74]
add r13d, 0x1f
cmp r13d, ecx
ja 0x18003e6ce
mov r12, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
mov r15, qword [rbp - 0x38]
mov r14d, dword [rbp - 0x30]
jmp 0x18003e17a
mov ecx, 0x6e74
nop word [rax + rax]
mov eax, ecx
sub eax, 0x6e74
je 0x180041ac4
cmp eax, 0x47
je case.0x18003e41f.6
jmp 0x180041acc
mov qword [r12], 1
add ecx, 0x47
cmp ecx, 0x6ebb
jbe 0x180041ab0
mov eax, 0x289f
cmp eax, eax
je 0x180041b00
add eax, 0x2d
cmp eax, 0x289f
jbe 0x180041ade
mov ebx, 0x6f2d
nop
mov eax, ebx
sub eax, 0x6f2d
je 0x180041b1e
cmp eax, 0x1b
je case.0x18003e41f.6
jmp 0x180041b35
mov rax, qword [r9]
test rax, rax
je 0x180041b0a
call rax
mov dword [r12], 0x19
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov rax, qword [r9 + 8]
test rax, rax
je 0x180041b2d
call rax
mov r9, qword [rbp - 0x70]
mov dword [r12], 0x1a
add ebx, 0x1b
cmp ebx, 0x6f48
jbe 0x180041af0
mov rax, qword [r9 + 0x10]
test rax, rax
je case.0x18003e41f.6
call rax
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov ebx, 0x2ca2
nop dword [rax]
mov eax, ebx
sub eax, 0x2ca2
je 0x180041b70
cmp eax, 0x2c
je case.0x18003e41f.6
jmp 0x180041b87
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x180041b7f
call rax
mov r9, qword [rbp - 0x70]
mov dword [r12], 0x1a
add ebx, 0x2c
cmp ebx, 0x2cce
jbe 0x180041b60
mov dword [r12], 7
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov rcx, qword [rbp - 0x40]
mov ebx, edi
mov r14, qword [rbp - 0x20]
mov esi, dword [rbp - 8]
cmp ebx, 0x96
ja case.0x180041bd5.6
mov eax, ebx
movzx eax, byte [r11 + rax + 0x43360]
mov edx, dword [r11 + rax*4 + 0x43344]
add rdx, r11
jmp rdx
test rcx, rcx
je 0x180041be8
call sub.ADVAPI32.dll_LsaClose
mov rcx, rdi
mov qword [rbp - 0x40], rcx
mov r8, r14
mov edx, 2
call sub.ADVAPI32.dll_LsaSetDomainInformationPolicy
jmp 0x180041c72
xor eax, eax
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rax
jmp case.0x180041bd5.6
mov dword [rbp + 0xa0], 0x30
mov esi, edi
mov dword [r12], 0xa
jmp case.0x180041bd5.6
mov rcx, rdi
mov qword [rbp - 0x40], rcx
jmp case.0x180041bd5.6
lea r9, [rbp - 0x40]
mov r8d, esi
lea rdx, [rbp + 0xa0]
mov r14, rdi
lea rcx, [rbp + 0x1a0]
call sub.ADVAPI32.dll_LsaOpenPolicy
mov rcx, qword [rbp - 0x40]
lea r11, [0x180000000]
add ebx, 0x1e
lea eax, [rbx + 0x3bc5]
cmp eax, 0x3c5b
jbe 0x180041bb3
mov dword [r12], 0xe
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov rax, qword [r9 + 0x48]
jmp 0x180041b44
movzx eax, byte [r15]
cmp al, 0x22
je 0x180041e94
cmp al, 0x5c
je 0x180041d09
cmp dword [r12 + 4], 0
jne case.0x18003e41f.6
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffe
jae 0x180041cf4
mov rdx, qword [r12 + 8]
jmp 0x180042032
mov dword [r12 + 4], 1
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov esi, 0x54d9
nop
mov eax, esi
sub eax, 0x54d9
je 0x180041d27
cmp eax, 0x3d
je case.0x18003e41f.6
jmp 0x180041e7e
cmp dword [r12 + 4], 0
jne 0x180041e76
mov ebx, edi
cmp ebx, 0x2a
ja case.0x180041d54.6
mov eax, ebx
movzx eax, byte [r11 + rax + 0x43414]
mov ecx, dword [r11 + rax*4 + 0x433f8]
add rcx, r11
jmp rcx
mov r8d, 0xe
lea rdx, str.String
lea rcx, [rbp + 0xc96]
call fcn.180061240
mov dword [rbp + 0xc00], 0x54
jmp case.0x180041d54.6
lea rcx, [rbp + 0xc90]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180041d90
mov eax, dword [0x180086350]
mov dword [rcx], eax
movzx eax, word [0x180086354]
mov word [rcx + 4], ax
jmp case.0x180041d54.6
mov dword [rbp + 0xc90], 0x4f
jmp case.0x180041d54.6
lea rdx, str.woStr
lea rcx, [rbp + 0xc00]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, 8
lea rdx, [0x180086368]
lea rcx, [rbp + 0xc0c]
call fcn.180061240
jmp case.0x180041d54.6
lea rdx, [rbp + 0xc00]
lea rcx, [rbp + 0xc90]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp case.0x180041d54.6
mov rdx, qword [r12 + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffd
jae 0x180041e52
mov rdx, qword [r12 + 8]
lea rcx, [rbp - 0x80]
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x5c
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp case.0x180041d54.6
mov dword [r12 + 4], 1
add ebx, 7
lea r11, [0x180000000]
lea eax, [rbx + 0x7c44]
cmp eax, 0x7c6e
jbe 0x180041d35
mov dword [r12], 2
add esi, 0x3d
lea r11, [0x180000000]
cmp esi, 0x5516
jbe 0x180041d10
cmp qword [r12 + 8], 0
je case.default.0x18003e201
mov ebx, 0x4847
mov eax, ebx
sub eax, 0x4847
je 0x180041eca
cmp eax, 0x58
jne 0x180041ee5
xor r9d, r9d
lea rdx, [r12 + 8]
xor r8d, r8d
mov ecx, 0x527d
call fcn.1800434e0
jmp 0x180041ee5
mov rax, qword [rbp - 0x70]
mov dword [r12], edi
mov rax, qword [rax + 0x20]
test rax, rax
je 0x180041ee5
mov rcx, qword [r12 + 8]
mov rcx, qword [rcx]
call rax
add ebx, 0x58
cmp ebx, 0x489f
jbe 0x180041ea5
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov eax, 0x6d
mov word [rbp + 0xbe6], ax
jmp 0x180041fe6
lea rdx, [0x180086374]
lea rcx, [rbp + 0xbe4]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x180041fe6
lea rcx, [rbp + 0xbe0]
mov byte [rbp + 0xbe0], 0
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180041f40
mov eax, dword [str.GetB]
mov dword [rcx], eax
movzx eax, byte [0x18008637c]
mov byte [rcx + 4], al
jmp 0x180041fe6
movzx eax, word [0x180086370]
mov word [rbp + 0xbe9], ax
mov word [rbp + 0xbeb], si
jmp 0x180041fe6
mov eax, ebx
sub eax, 0xf27
je 0x180041fcd
sub eax, 0x2d
je 0x180041fa3
cmp eax, 0x2d
jne 0x180041fe6
mov r8, rdi
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0x1e0]
call fcn.18005d500
jmp 0x180041fe6
lea rdx, [0x180086384]
lea rcx, [rbp + 0xbed]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8d, 4
lea rdx, [0x180086388]
lea rcx, [rbp + 0xbee]
jmp 0x180041fe1
mov r8d, 2
lea rdx, [0x180086380]
lea rcx, [rbp + 0xbec]
call fcn.180061240
add ebx, 0x2d
cmp ebx, 0xf81
jbe 0x180040931
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov rbx, qword [rbp - 0x68]
cmp dword [rbx + 4], 0
jne case.0x18003e41f.6
mov rdx, qword [rbx + 8]
mov r9d, 0x5ea0
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002fb10
cmp rax, 0xfffffffffffffffe
jae 0x18004205e
mov rdx, qword [rbx + 8]
movzx eax, byte [r15]
mov byte [rbp - 0x80], al
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov r9d, 0x1d25
lea rcx, [rbp - 0x80]
call fcn.18002fb10
cmp eax, 1
je case.0x18003e41f.6
jmp 0x18003e6c7
mov dword [rbx + 4], 1
mov dword [rbp - 0x58], 1
jmp 0x18003e6ce
mov r12, qword [rbp - 0x20]
mov r13d, 0x2a2
mov rbx, qword [rbp - 0x20]
movabs r8, 0x6d00650074
mov r15, qword [rbp - 0x20]
nop dword [rax]
mov eax, r13d
sub eax, 0x2a2
je 0x1800420aa
sub eax, 0x39
je case.0x1800420d3.9
cmp eax, 0x39
je 0x18003e6ce
jmp 0x18004211b
mov rdx, qword [rbp - 0x38]
movsx eax, byte [rdx]
add eax, 0xfffffff7
cmp eax, 0x72
ja case.0x1800420d3.19
cdqe
movzx eax, byte [r11 + rax + 0x4346c]
mov ecx, dword [r11 + rax*4 + 0x43440]
add rcx, r11
jmp rcx
mov ecx, 0x6eb2
nop word [rax + rax]
mov eax, ecx
sub eax, 0x6eb2
je 0x180042142
sub eax, 0x30
je 0x180042138
cmp eax, 0x30
jne 0x18004214c
mov r13d, 0x2db
mov dword [rbp - 0x58], 1
mov r9, qword [rbp - 0x70]
lea r11, [0x180000000]
mov r10d, 8
movabs r8, 0x6d00650074
add r13d, 0x39
cmp r13d, 0x314
jbe 0x180042090
mov dword [rbp - 0x58], 0xa
jmp 0x18003e6ce
mov rax, qword [rbp - 0x68]
mov qword [rax + 8], rdi
jmp 0x18004214c
mov rax, qword [rbp - 0x68]
mov dword [rax], 1
add ecx, 0x30
cmp ecx, 0x6f12
jbe 0x1800420e0
mov esi, 0x6912
nop dword [rax]
mov eax, esi
sub eax, 0x6912
je 0x18004217d
cmp eax, 0x49
jne 0x18004218b
mov rax, qword [rbp - 0x68]
mov dword [rax], 0x19
jmp case.0x1800420d3.9
mov rax, qword [r9]
test rax, rax
je 0x18004218b
call rax
mov r9, qword [rbp - 0x70]
add esi, 0x49
cmp esi, 0x695b
jbe 0x180042160
mov esi, 0x2191
nop dword [rax + rax]
mov eax, esi
sub eax, 0x2191
je 0x1800421f1
sub eax, 0x2a
je 0x1800421c4
cmp eax, 0x2a
jne 0x18004220d
mov edx, dword [rbp - 0x48]
mov rcx, r12
call qword [sym.imp.GDI32.dll_SetICMMode]
jmp case.0x1800420d3.9
mov r14, qword [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetDC]
mov r12, rax
test rax, rax
je 0x1800421e8
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r12, rdi
mov dword [rbp - 0x48], 3
jmp 0x18004220d
mov rcx, rdi
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x18004220d
call rcx
add esi, 0x2a
cmp esi, 0x21e5
jbe 0x1800421a0
mov rax, qword [rbp - 0x68]
mov dword [rax], 7
jmp case.0x1800420d3.9
mov esi, 0x3297
nop dword [rax]
cmp esi, 0x34b2
ja 0x1800424ba
je 0x18004249f
cmp esi, 0x337e
ja 0x18004236b
je 0x180042332
mov eax, esi
sub eax, 0x3297
je 0x1800422eb
sub eax, 0x4d
je 0x1800422af
cmp eax, 0x4d
jne 0x1800425fc
lea r8d, [rax - 0x49]
lea rdx, [0x180085f98]
lea rcx, [rbp + 0xbea]
call fcn.1800641b4
mov eax, dword [0x180085fa0]
movabs r8, 0x6d00650074
mov dword [rbp + 0xbf0], eax
movzx eax, word [0x180085fa4]
mov word [rbp + 0xbf4], ax
jmp 0x1800425fc
mov r8d, 1
lea rdx, [0x18008527c]
lea rcx, [rbp + 0xbe0]
call fcn.18006416c
lea rdx, [0x180083288]
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
movabs r8, 0x6d00650074
jmp 0x1800425fc
lea rcx, [rbp + 0xbe0]
mov word [rbp + 0xbe0], di
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180042300
mov eax, dword [0x180085f88]
mov dword [rcx], eax
mov eax, dword [0x180085f8c]
mov dword [rbp + 0xbe2], eax
movzx eax, word [0x180085f90]
mov word [rbp + 0xbe6], ax
jmp 0x1800425fc
mov qword [rbp + 0xbf4], r8
lea rdx, [0x180085288]
mov r8d, 4
mov dword [rbp + 0xc50], 0x4e
lea rcx, [rbp + 0xc52]
call fcn.180061240
movabs r8, 0x6d00650074
jmp 0x1800425fc
mov eax, esi
sub eax, 0x33cb
je 0x180042432
sub eax, 0x4d
je 0x1800423d3
cmp eax, 0x4d
jne 0x1800425fc
movsd xmm0, qword [0x180085ee4]
lea rdx, [0x180085f18]
movzx eax, word [0x180085eec]
lea rcx, [rbp + 0xc00]
mov r8d, 2
movsd qword [rbp + 0xc00], xmm0
mov word [rbp + 0xc08], ax
mov word [rbp + 0xc0a], di
call fcn.18006416c
movabs r8, 0x6d00650074
jmp 0x1800425fc
mov r8d, 4
lea rdx, [0x180085f7c]
lea rcx, [rbp + 0xc64]
call fcn.180061240
mov r8d, 3
lea rdx, [0x180085f80]
lea rcx, [rbp + 0xc66]
call fcn.1800641b4
lea rcx, [rbp + 0xc50]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180042410
mov eax, dword [0x180085334]
movabs r8, 0x6d00650074
mov dword [rcx], eax
jmp 0x1800425fc
lea rcx, [rbp + 0xc50]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180042440
mov eax, dword [0x180083280]
lea rdx, [0x180085f74]
movsd xmm0, qword [str.Type]
mov dword [rcx], eax
movzx eax, word [0x180083284]
mov word [rcx + 4], ax
lea rcx, [rbp + 0xc60]
movzx eax, word [0x180085f70]
mov word [rbp + 0xc60], ax
movsd qword [rbp + 0xc58], xmm0
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movabs r8, 0x6d00650074
jmp 0x1800425fc
mov eax, 0x65
mov dword [rbp + 0xc10], 0x740063
mov word [rbp + 0xc0e], ax
jmp 0x1800425fc
cmp esi, 0x3633
ja 0x180042537
je 0x18004251f
mov eax, esi
sub eax, 0x34ff
je 0x180042513
sub eax, 0x9a
je 0x1800424e9
cmp eax, 0x4d
jne 0x1800425fc
mov dword [rbp - 0x18], 0x2000000
jmp 0x1800425fc
xor eax, eax
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xc0], rax
jmp 0x1800425fc
mov word [rbp + 0xc14], di
jmp 0x1800425fc
xor eax, eax
mov dword [rbp - 0x14], edi
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], rax
jmp 0x1800425fc
mov eax, esi
sub eax, 0x3680
je 0x1800425e2
sub eax, 0x4d
je 0x180042557
cmp eax, 0x4d
je case.0x1800420d3.9
jmp 0x1800425fc
lea rax, [rbp - 8]
xor edx, edx
mov qword [rsp + 0x78], rax
lea r9, [rbp + 0xc00]
lea rax, [rbp + 0x64]
mov qword [rsp + 0x70], rax
lea r8, [rbp + 0xc50]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x68], rax
lea rcx, [rbp + 0xbe0]
mov dword [rsp + 0x60], edi
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x1a0]
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], rax
mov eax, dword [rbp - 0x14]
mov dword [rsp + 0x40], eax
mov eax, dword [rbp - 0x18]
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckByTypeAndAuditAlarmW]
movabs r8, 0x6d00650074
jmp 0x1800425fc
mov rax, qword [rbp - 0x68]
mov dword [rax], 0xa
xor eax, eax
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rax
add esi, 0x4d
cmp esi, 0x371a
jbe 0x180042230
mov rax, qword [rbp - 0x68]
mov dword [rax], 0xe
jmp case.0x1800420d3.9
mov esi, 0x7f6e
nop
mov eax, esi
sub eax, 0x7f6e
je 0x180042634
cmp eax, 0x45
je case.0x1800420d3.9
jmp 0x180042694
mov r14, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
mov r9d, 0xd6
mov qword [rbp - 0x28], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov dword [r14], 0x11
call fcn.180014ca0
mov qword [r14 + 8], rax
test rax, rax
je 0x18003e6c7
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x30
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
add esi, 0x45
cmp esi, 0x7fb3
jbe 0x180042620
mov rdx, qword [rbp - 0x38]
mov esi, 0x3c44
nop dword [rax + rax]
mov eax, esi
sub eax, 0x3c44
je 0x1800426f9
sub eax, 0x63
je 0x1800426c9
cmp eax, 0x63
je case.0x1800420d3.9
jmp 0x180042732
movzx eax, byte [rdx]
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x80], al
mov r9d, 0x1d25
mov rax, qword [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, qword [rax + 8]
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp 0x180042732
mov r14, qword [rbp - 0x68]
lea rcx, [rbp - 0x28]
mov r9d, 0xd6
mov qword [rbp - 0x28], 5
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov dword [r14], 0x18
call fcn.180014ca0
mov qword [r14 + 8], rax
test rax, rax
je 0x18003e6c7
mov rdx, qword [rbp - 0x38]
add esi, 0x63
cmp esi, 0x3d0a
jbe 0x1800426b0
mov r10d, 8
mov esi, 0x3e49
mov eax, esi
sub eax, 0x3e49
je 0x1800427c4
sub eax, 0x60
je 0x180042794
cmp eax, 0x60
jne 0x1800427ce
mov rax, qword [rbp - 0x68]
lea rcx, [rbp - 0x80]
mov r9d, 0x1d25
mov byte [rbp - 0x80], 0x2d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, qword [rax + 8]
call fcn.18002fb10
cmp eax, 1
jne 0x18003e6c7
jmp case.0x1800420d3.9
mov r9d, 0xd6
mov qword [rbp - 0x28], r10
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.180014ca0
mov rcx, qword [rbp - 0x68]
mov qword [rcx + 8], rax
test rax, rax
je 0x18003e6c7
jmp 0x1800427ce
mov rax, qword [rbp - 0x68]
mov dword [rax], 0x17
add esi, 0x60
cmp esi, 0x3f09
ja case.0x1800420d3.19
mov r10d, 8
jmp 0x180042750
mov esi, 0x39d7
nop dword [rax]
cmp esi, 0x3a73
ja 0x18004285b
je 0x180042849
mov eax, esi
sub eax, 0x39d7
je 0x180042844
sub eax, 0x34
je 0x180042816
cmp eax, 0x34
jne 0x180042871
mov qword [rbp + 0x90], rdi
jmp 0x180042871
mov rcx, rbx
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
mov r14, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r15, rax
test rax, rax
je 0x180042871
mov rdx, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_ReleaseDC]
mov r15, rdi
jmp 0x180042871
mov rbx, rdi
jmp 0x180042871
lea rdx, [rbp + 0x90]
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetAspectRatioFilterEx]
jmp 0x180042871
mov eax, esi
sub eax, 0x3aa7
je case.0x18003edcf.49
cmp eax, 0x34
je case.0x1800420d3.9
add esi, 0x34
cmp esi, 0x3adb
jbe 0x1800427f0
jmp 0x180042100