Function at 0x180023d60
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc28]
sub rsp, 0xd28
mov edi, dword [rbp + 0xc90]
mov r14, rdx
mov r12, rcx
lea r13d, [rdi + 0x96]
mov dword [rsp + 0x70], r13d
cmp edi, r13d
jae 0x180024379
mov rsi, qword [rsp + 0x78]
mov ecx, 1
mov r15, qword [rbp - 0x80]
lea ebx, [rcx + 1]
cmp edi, 0xb7
ja 0x180024359
je 0x18002434d
mov eax, edi
sub eax, 0x10
je 0x180024202
sub eax, 0xf
je 0x180024166
sub eax, 0xf
je 0x180023e23
sub eax, 0xf
je 0x180024a21
cmp eax, 0x56
jne 0x180024a09
test r8, r8
je 0x180023e0c
movzx eax, word [r14 + 0x4c]
mov word [r8], ax
test r9, r9
je 0x180024a09
movzx eax, word [r14 + 0x4a]
mov word [r9], ax
jmp 0x180024a09
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rbp + 0xf0]
xor r14d, r14d
mov edx, dword [rbp + 0xe8]
cmp r11d, 1
mov r8d, dword [rbp + 0xe4]
mov r9d, r14d
sete r9b
mov r10d, r14d
test edx, edx
mov eax, r14d
sete r10b
mov ecx, r10d
and ecx, r9d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180023e7e
mov ecx, 1
mov qword [rsp + 0x50], rcx
jmp 0x1800249fb
cmp edx, 0xa
mov ecx, r14d
mov eax, r14d
sete cl
and ecx, r9d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180023ea2
mov qword [rsp + 0x50], rbx
jmp 0x1800249f6
cmp edx, 0x5a
mov ecx, r14d
mov eax, r14d
sete cl
and ecx, r9d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180023eca
mov qword [rsp + 0x50], 3
jmp 0x1800249f6
cmp r11d, 2
mov r9d, r14d
mov ecx, r14d
mov eax, r14d
sete r9b
cmp edx, 0x33
sete cl
and ecx, r9d
cmp r8d, 3
cmove eax, ecx
test eax, eax
je 0x180023efd
mov qword [rsp + 0x50], 0x15f
jmp 0x1800249f6
mov ecx, r9d
mov eax, r14d
and ecx, r10d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180023f1f
mov qword [rsp + 0x50], 0x190
jmp 0x1800249f6
cmp r8d, 5
mov eax, r14d
cmove eax, ecx
test eax, eax
je 0x180023f3b
mov qword [rsp + 0x50], 0x1f4
jmp 0x1800249f6
cmp edx, 1
mov ecx, r14d
mov eax, r14d
sete cl
and ecx, r9d
cmp r8d, 5
cmove eax, ecx
test eax, eax
je 0x180023f63
mov qword [rsp + 0x50], 0x1fe
jmp 0x1800249f6
cmp edx, 2
mov ecx, r14d
mov eax, r14d
sete cl
and ecx, r9d
cmp r8d, 5
cmove eax, ecx
test eax, eax
je 0x180023f8b
mov qword [rsp + 0x50], 0x208
jmp 0x1800249f6
movzx r11d, byte [rbp + 0x1fa]
mov r10d, r14d
cmp r11b, 1
mov ecx, r14d
mov eax, r14d
sete r10b
and r10d, r9d
cmp r8d, 6
sete cl
test edx, edx
cmove eax, r10d
test ecx, eax
je 0x180023fc6
mov qword [rsp + 0x50], 0x258
jmp 0x1800249f6
cmp r11b, 1
mov r8d, r14d
mov eax, r14d
setne r8b
and r8d, r9d
test edx, edx
cmove eax, r8d
test ecx, eax
je 0x180023fef
mov qword [rsp + 0x50], 0x259
jmp 0x1800249f6
cmp edx, 1
mov eax, r14d
cmove eax, r10d
test ecx, eax
je 0x18002400b
mov qword [rsp + 0x50], 0x262
jmp 0x1800249f6
cmp edx, 1
mov eax, r14d
cmove eax, r8d
test ecx, eax
je 0x180024027
mov qword [rsp + 0x50], 0x263
jmp 0x1800249f6
mov rsi, qword [rbp - 0x70]
mov ebx, 0x7f
mov eax, ebx
sub eax, 0x7f
je 0x1800240f4
sub eax, 1
je 0x1800240de
cmp eax, 1
jne 0x18002414a
mov rcx, qword [0x1800be690]
lea r9, [0x180095ab0]
mov dword [rsp + 0x28], r14d
lea r8, [rbp + 0x520]
lea rdx, [0x180095018]
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x18002414a
lea r9d, [rax + 0x75]
xor edx, edx
lea r8, [rbp + 0x310]
xor ecx, ecx
call fcn.180032640
lea rdx, [0x1800954e8]
lea rcx, [rbp + 0x310]
call fcn.180074404
test rax, rax
je 0x18002414a
mov r8, rax
lea rcx, [rbp - 0x50]
mov edx, 0x10
call fcn.18007432c
lea rcx, [rbp - 0x50]
call fcn.1800735a4
movsxd r14, eax
mov qword [rsp + 0x50], r14
xor r14d, r14d
jmp 0x18002414a
lea r8, str.WICMapShortNameToGuid
mov edx, 0x104
mov rcx, rsi
call fcn.180071430
jmp 0x18002414a
lea rdx, [rbp + 0x310]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.osVersion.txt
mov edx, 0x104
lea rcx, [rbp + 0x310]
call fcn.180071490
lea r8, [0x1800be480]
mov edx, 0x104
lea rcx, [rbp + 0x520]
call fcn.180071430
mov edx, 0x5c
lea rcx, [rbp + 0x520]
call fcn.18006db00
mov rsi, rax
inc ebx
cmp ebx, 0x82
jb 0x180024030
mov qword [rbp - 0x70], rsi
mov rsi, qword [rsp + 0x78]
jmp 0x1800249f1
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x104
call fcn.18006e5e0
lea rcx, [rbp + 0x520]
mov rdx, rbx
lea rax, [rbp + 0x200]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180024190
mov eax, dword [rax]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov dword [rcx], eax
mov qword [rbp - 0x70], rdx
mov dword [rbp + 0xe0], 0x11c
jmp 0x1800249f6
xor edx, edx
mov qword [rsp + 0x50], 0
mov r8d, 0xff
lea rcx, [rbp + 0x200]
call fcn.18006e5e0
lea rcx, [rbp + 0x200]
mov r8d, 0x104
movups xmm0, xmmword [rcx]
lea rdx, [rbp + 0x420]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x70]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
lea rcx, [rbp + 0x200]
mov byte [rdx + 0x7e], al
xor edx, edx
call fcn.18006e5e0
lea rcx, [rbp + 0x310]
mov rdx, rbx
lea rax, [rbp + 0x200]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1800242f1
mov eax, dword [rax]
mov dword [rcx], eax
jmp 0x1800249f6
xor r15d, r15d
mov qword [rbp - 0x80], r15
jmp 0x180024a09
mov eax, edi
sub eax, 0xc6
je 0x180024414
sub eax, 0xf
je 0x1800243be
sub eax, 0x35
je 0x180024390
cmp eax, 0xf
jne 0x180024a09
mov rax, r12
add rsp, 0xd28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0xffffff8d
lea rdx, [rbp + 0x630]
call qword [0x1800ce8f0]
movaps xmm0, xmmword [rbp + 0xa30]
mov eax, dword [rbp + 0xa40]
movups xmmword [r12], xmm0
mov dword [r12 + 0x10], eax
jmp 0x1800249f6
mov rax, qword [r14]
lea r9, [rbp + 0xc90]
mov qword [rsp + 0x40], 0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], 0
xor r8d, r8d
mov qword [rsp + 0x68], rax
xor edx, edx
lea rax, [rsp + 0x68]
mov dword [rbp + 0xc90], r15d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
jmp 0x1800249f6
lea rcx, str.brndsat_128B
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1800249f6
lea rdx, str.SaveTokensIfNeed
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x68], rax
mov rbx, rax
test rax, rax
je 0x1800249e6
mov ecx, 0x38
mov dword [rsp + 0x68], ecx
nop dword [rax + rax]
sub ecx, 0x36
je 0x180024964
sub ecx, 1
je 0x1800244ac
cmp ecx, 1
jne 0x1800249c3
mov eax, 1
lea r9d, [rcx + 0x52]
mov word [rbp + 0xc90], ax
lea r8, [rbp + 0xc90]
mov rax, qword [r14]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x78], rax
call fcn.18002dab0
mov byte [rbp + rax - 0x20], 0
jmp 0x1800249c3
mov edx, 0x258
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], 0x258
mov rcx, rax
mov qword [rsp + 0x78], rax
mov rsi, rax
call rbx
cmp eax, 0x6f
jne 0x1800244fb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [rsp + 0x58]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x58]
mov rcx, rsi
call rbx
test eax, eax
jne 0x180024b8f
movzx eax, word [0x180095758]
mov r11d, 0xf5
mov r14d, dword [0x180095b00]
movzx r15d, byte [0x180095b12]
movzx r12d, word [0x180095b10]
movups xmm1, xmmword [str.get_OldILOffset]
movzx ebx, byte [0x180095b30]
movzx r13d, word [0x180095b44]
nop word [rax + rax]
lea ecx, [r11 - 0xed]
cmp ecx, 8
ja case.default.0x180024572
lea r8, [0x180000000]
mov edx, dword [r8 + rcx*4 + 0x24bf0]
add rdx, r8
jmp rdx
lea rcx, [rbp - 0x20]
mov edi, 0xc6
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024580
mov word [rcx], ax
lea rcx, [rbp - 0x20]
dec rcx
cmp dword [rsi + 0x250], 0
je 0x1800245c5
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800245a0
movsd xmm0, qword [str.nss_Latn_ZZ]
mov r11d, 0xf1
movsd qword [rcx], xmm0
mov dword [rcx + 8], r14d
jmp case.default.0x180024572
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800245c5
mov edx, dword [str.DNS_No]
mov dword [rcx], edx
movzx edx, word [0x180095af0]
mov word [rcx + 4], dx
movzx edx, byte [0x180095af2]
mov byte [rcx + 6], dl
mov r11d, 0xf1
jmp case.default.0x180024572
lea r8, [rbp - 0x20]
mov rdx, rsi
sub r8, rsi
movzx ecx, byte [rdx]
mov byte [rdx + r8], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x180024601
jmp case.default.0x180024572
lea rcx, [rbp - 0x20]
mov edi, 0xc6
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024621
mov word [rcx], ax
lea rcx, [rbp - 0x20]
dec rcx
cmp dword [rsi + 0x248], 0
je 0x180024652
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024640
movups xmmword [rcx], xmm1
jmp case.default.0x180024572
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024652
movsd xmm0, qword [str.IsProperty]
movsd qword [rcx], xmm0
mov word [rcx + 8], r12w
mov byte [rcx + 0xa], r15b
mov edi, 0xc6
lea rcx, [rbp - 0x20]
dec rcx
lea r11d, [rdi + 0x29]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024681
mov word [rcx], ax
jmp case.default.0x180024572
lea rcx, [rbp - 0x20]
dec rcx
cmp dword [rsi + 0x24c], 0
je 0x1800246d5
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800246a3
movsd xmm0, qword [str.Frank_belgick]
mov edi, 0xc6
mov edx, dword [0x180095b40]
movsd qword [rcx], xmm0
mov dword [rcx + 8], edx
lea r11d, [rdi + 0x28]
mov word [rcx + 0xc], r13w
jmp case.default.0x180024572
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800246d5
movsd xmm0, qword [str.Proxy_No]
movsd qword [rcx], xmm0
mov byte [rcx + 8], bl
mov edi, 0xc6
lea r11d, [rdi + 0x28]
jmp case.default.0x180024572
lea rcx, [rbp - 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024703
mov word [rcx], ax
jmp case.default.0x180024572
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rsi + rcx + 0x118], 0
jne 0x180024720
test rcx, rcx
je case.default.0x180024572
mov r10d, 0x7d
nop dword [rax]
mov ecx, r10d
sub ecx, 0x7c
je 0x180024798
cmp ecx, 1
jne 0x18002480a
lea rcx, [rbp - 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024760
lea rdx, [rbp - 0x20]
mov word [rcx], ax
dec rdx
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x180024774
xor r8d, r8d
movzx ecx, byte [rsi + r8 + 0x118]
mov byte [rdx + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x180024781
jmp 0x18002480a
mov r9, qword [rsi + 0x110]
test r9, r9
je 0x18002480a
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rbp - 0x20]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800247c0
lea r8, [rbp - 0x20]
mov word [rcx], ax
dec r8
cmp byte [r8 + 1], 0
lea r8, [r8 + 1]
jne 0x1800247d4
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + rdx + 8]
mov byte [r8 + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800247f0
mov r9, qword [r9]
test r9, r9
jne 0x1800247b0
dec r10d
cmp r10d, 0x7b
ja 0x180024740
jmp case.default.0x180024572
mov ecx, 1
mov qword [rbp - 0x80], rcx
jmp case.default.0x180024572
lea rdx, [rbp - 0x20]
dec rdx
cmp byte [rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x180024831
xor r8d, r8d
nop
movzx ecx, byte [rsi + r8 + 0x84]
mov byte [rdx + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x180024840
lea rcx, [rbp - 0x20]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024860
mov word [rcx], ax
mov edx, dword [rsi + 0x140]
sub edx, 1
je 0x180024911
sub edx, 1
je 0x1800248df
sub edx, 2
je 0x1800248b8
cmp edx, 4
jne 0x180024941
lea rcx, [rbp - 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024896
mov edx, dword [str.Hybid]
mov dword [rcx], edx
movzx edx, word [0x180095b74]
mov word [rcx + 4], dx
jmp 0x180024941
lea rcx, [rbp - 0x20]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800248c0
mov edx, dword [str.Mixed]
mov dword [rcx], edx
movzx edx, word [0x180095b6c]
mov word [rcx + 4], dx
jmp 0x180024941
lea rcx, [rbp - 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800248e6
mov edx, dword [0x180095b60]
movsd xmm0, qword [str.VPLZCNTDZrmk]
movsd qword [rcx], xmm0
mov dword [rcx + 8], edx
movzx edx, byte [0x180095b64]
mov byte [rcx + 0xc], dl
jmp 0x180024941
lea rcx, [rbp - 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180024920
movsd xmm0, qword [str.Broadcast]
movzx edx, word [0x180095b50]
movsd qword [rcx], xmm0
mov word [rcx + 8], dx
mov r11d, 0xf2
dec r11d
cmp r11d, 0xec
ja 0x180024550
mov rbx, qword [rbp - 0x68]
mov r14, qword [rbp + 0xc78]
jmp 0x1800249c3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, [rbp - 0x20]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180024980
mov qword [rbp - 0x60], rax
lea r8, [rbp - 0x20]
mov eax, 1
lea rdx, [rbp - 0x78]
mov word [rbp + 0xc90], ax
lea rcx, [rbp - 0x60]
mov rax, qword [r14]
mov r9d, 0x2f
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0xc90]
mov qword [rsp + 0x20], rax
call fcn.1800203b0
mov ecx, dword [rsp + 0x68]
dec ecx
mov dword [rsp + 0x68], ecx
cmp ecx, 0x35
ja 0x180024460
mov r15, qword [rbp - 0x80]
mov r12, qword [rbp + 0xc70]
mov r13d, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, 2
mov ecx, 1
mov r8, qword [rbp + 0xc80]
mov r9, qword [rbp + 0xc88]
add edi, 0xf
cmp edi, r13d
jae 0x180024379
mov r14, qword [rbp + 0xc78]
jmp 0x180023dc1
cmp dword [r14], 0
mov rdi, qword [rsp + 0x50]
jne 0x180024b86
mov ebx, 0x2d
lea esi, [rbx - 0x2b]
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x2b
je 0x180024b1b
sub eax, 1
je 0x180024abc
cmp eax, 1
jne 0x180024b7b
mov rax, qword [r8]
mov r9d, 0xd9
mov qword [rsp + 0x60], rax
lea r8, [rbp + 0xc70]
lea rax, [rbp + 0xc90]
mov word [rbp + 0xc90], cx
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x60]
mov dword [rbp + 0xc70], edi
call fcn.180028370
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0xf4]
mov byte [rbp + rcx + 0x420], al
lea rcx, [rcx + 1]
test al, al
jne 0x180024aa0
jmp 0x180024b6f
lea rcx, [rbp + 0x420]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180024ad0
mov qword [rsp + 0x60], rax
lea rdx, [rbp + 0xc70]
mov rax, qword [r8]
lea rcx, [rsp + 0x60]
mov qword [rbp + 0xc70], rax
lea r8, [rbp + 0x420]
lea rax, [rbp + 0xc90]
mov word [rbp + 0xc90], si
mov r9d, 0x2f
mov qword [rsp + 0x20], rax
call fcn.1800203b0
jmp 0x180024b6f
mov rax, qword [r8]
lea r9, [rbp + 0xc90]
mov qword [rsp + 0x40], 0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], 0
xor r8d, r8d
mov qword [rbp + 0xc70], rax
xor edx, edx
lea rax, [rbp + 0xc70]
mov dword [rbp + 0xc90], edi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov r8, qword [rbp + 0xc80]
mov ecx, 1
dec ebx
cmp ebx, 0x2a
ja 0x180024a40
mov qword [r12], rdi
jmp 0x180024379
mov rax, qword [r14]
lea r9, [rbp + 0xc90]
mov qword [rsp + 0x40], 0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], 0
xor r8d, r8d
mov qword [rsp + 0x60], rax
xor edx, edx
lea rax, [rsp + 0x60]
mov dword [rbp + 0xc90], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x28
call fcn.180036ed0
mov rax, qword [rbp + 0xc70]
jmp 0x18002437c