Function at 0x180037f80
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov eax, r8d
mov dword [rbp - 0x80], eax
mov r15, rdx
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x78], rcx
xor r9d, r9d
mov qword [rbp + 0x38], r9
mov qword [rbp + 0x40], ILRemoveLastID
mov byte [rbp + 0x28], r9b
lea esi, [r8 - 0x11]
mov dword [rsp + 0x78], esi
lea r10, [0x180000000]
mov ebx, 0xffffffff
lea r11d, [r9 + 0x63]
lea r14d, [r9 + 0x72]
cmp r8d, esi
jbe 0x1800383eb
lea edi, [r8 - 0x29]
mov edx, 0x2274
mov r8d, 0x646f
cmp edi, 0x28
ja case.0x18003802d.17
movzx eax, byte [r10 + rdi + 0x39204]
mov ecx, dword [r10 + rax*4 + 0x391bc]
add rcx, r10
jmp rcx
mov word [rbp + 0x1cc], r11w
jmp case.0x18003802d.17
lea r8, [r15 + 0x48]
mov r9d, 0x11f
lea rdx, [rbp + 0x28]
xor ecx, ecx
call fcn.18002e610
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
cmp rcx, rdx
jae 0x18003807b
lea rax, [rcx + 1]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x28]
mov word [rax + rcx], 0x7d
jmp 0x18003808e
mov r9b, 0x7d
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp + 0x28]
call fcn.18002cd00
mov edx, 0x2274
mov r8d, 0x646f
xor r9d, r9d
lea r10, [0x180000000]
lea r11d, [r9 + 0x63]
jmp case.0x18003802d.17
mov byte [rbp + 0x1b0], 0
mov r8d, 1
lea rdx, [0x18009e137]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18003808e
mov word [rbp + 0x1be], dx
mov byte [rbp + 0x1c0], 0
mov qword [rbp - 8], r9
mov qword [rbp], ILRemoveLastID
mov byte [rbp - 0x18], 0
lea rax, [rbp + 0x1b0]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180038100
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp - 0x18]
call fcn.180047840
nop
lea r12, [rbp - 0x18]
mov r14, qword [rbp - 0x18]
mov r13, qword [rbp]
cmp r13, 0x10
cmovae r12, r14
mov r15, qword [rbp - 8]
cmp r15, 0x10
jae 0x18003814b
movups xmm0, xmmword [r12]
mov qword [rbp + 0x60], ILRemoveLastID
jmp 0x1800381cc
mov rsi, r15
or rsi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18003819f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800391b4
mov rcx, rax
call fcn.1800890b8
mov rcx, rax
test rax, rax
je 0x180038448
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800381ad
test rcx, rcx
je 0x1800381ab
call fcn.1800890b8
jmp 0x1800381ad
xor eax, eax
mov qword [rbp + 0x48], rax
lea r8, [r15 + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x60], rsi
movups xmm0, xmmword [rbp + 0x48]
mov esi, dword [rsp + 0x78]
movups xmmword [rbp + 0x208], xmm0
mov qword [rbp + 0x58], r15
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x180038212
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003820d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180038448
call fcn.1800890f4
movups xmm0, xmmword [rbp + 0x208]
movups xmmword [rbp + 0x28], xmm0
movups xmm0, xmmword [rbp + 0x58]
movups xmmword [rbp + 0x38], xmm0
cmp r13, 0x10
jb 0x18003825c
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x180038254
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003844f
mov rcx, r14
call fcn.1800890f4
mov r15, qword [rbp - 0x68]
lea rcx, [r15 + 0xa8]
mov r8d, 0x11b
lea rdx, [rbp + 0x28]
call fcn.18007c140
lea r8, [rbp + 0x28]
mov edx, SHTestTokenMembership
xor ecx, ecx
call fcn.180035500
mov edx, 0x2274
mov r8d, 0x646f
xor r9d, r9d
lea r10, [0x180000000]
lea r11d, [r9 + 0x63]
lea r14d, [r9 + 0x72]
jmp case.0x18003802d.17
mov word [rbp + 0x1b6], r8w
mov byte [rbp + 0x1b8], 0
mov r8d, 2
lea rdx, [0x18009e1d5]
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18003808e
mov dword [rbp + 0x226], 0x30
jmp case.0x18003802d.17
mov dword [rbp + reloc.SHELL32.dll_SHChangeNotification_Lock], 0x650062
mov word [rbp + 0x288], r9w
jmp case.0x18003802d.17
mov byte [rbp + 0x1b1], 0x22
mov dword [rbp + 0x1b2], 0x6874656d
jmp case.0x18003802d.17
mov eax, dword [0x18009e270]
mov dword [rbp + 0x218], eax
movzx eax, word [0x18009e274]
mov word [rbp + 0x21c], ax
lea rcx, [rbp + 0x218]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180038340
mov eax, dword [0x18009e278]
mov dword [rcx], eax
movzx eax, word [0x18009e27c]
mov word [rcx + 4], ax
mov dword [rbp + 0x220], r14d
mov r8d, 0xa
lea rdx, [rbp + 0x222]
lea ecx, [r8 + 2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
jmp 0x18003808e
mov dword [rbp + 0x1ba], 0x696e6922
mov byte [rbp + 0x1be], 0
jmp case.0x18003802d.17
mov r8d, 4
lea rdx, [0x18009e33c]
lea rcx, [rbp + 0x288]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18003808e
mov dword [rbp + 0x1c8], 0x6a624f
mov word [rbp + 0x1cb], 0x65
jmp case.0x18003802d.17
mov dword [rbp + 0x280], 0x69006c
jmp case.0x18003802d.17
mov word [rbp + 0x290], r9w
add edi, ebx
lea eax, [rdi + 0x29]
cmp eax, esi
ja 0x180038010
mov eax, dword [rbp - 0x80]
lea edx, [rax + 0x11]
mov dword [rsp + 0x50], edx
cmp eax, edx
jae case.0x180038446.97
movzx edx, word [rsp + 0x58]
mov dword [rsp + 0x64], edx
movzx esi, byte [rsp + 0x58]
mov dword [rsp + 0x6c], esi
mov r13d, dword [rbp - 0x7c]
movzx edi, word [rsp + 0x58]
mov dword [rsp + 0x70], edi
mov ecx, dword [rsp + 0x50]
mov r14d, 0x65
lea r12d, [r14 + 9]
lea r11d, [r14 + 0xe]
lea r8d, [r14 + 0xf]
add eax, 0xffffffaf
cmp eax, 0x10
ja case.default.0x180038446
mov ecx, dword [r10 + rax*4 + 0x39230]
add rcx, r10
jmp rcx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r14, qword [rbp - 0x78]
mov eax, dword [r14]
mov dword [rsp + 0x78], eax
movzx eax, byte [r15]
mov byte [rsp + 0x58], al
mov r8d, 0x77
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.1800340f0
test al, al
je 0x1800384bb
mov ebx, dword [r14]
cmp ebx, 0x80
jae 0x180038492
and ebx, 0xfffffffc
jmp 0x1800384bb
add ebx, 0xffffff80
and ebx, 0xfffffff0
sub ebx, 0xffffff80
jmp 0x1800384bb
mov r8d, 0x28
lea rdx, [rbp + 0x28]
mov rcx, qword [0x180cabbd0]
call fcn.18006a7b0
mov byte [rsp + 0x68], al
mov ebx, dword [rsp + 0x68]
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x18003917c
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039177
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180039177
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rax, [rbp + 0x280]
mov qword [rbp + 0x1a0], rax
lea rax, [rbp + 0x230]
mov qword [rbp + 0x1a8], rax
jmp 0x1800390eb
mov word [rbp + 0x1cd], r8w
jmp 0x1800390eb
mov r8d, 0xa
lea rdx, [rbp + 0x1df]
lea ecx, [r8 - 1]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov dword [rbp + 0x248], 0x56004e
mov dword [rbp + 0x24c], 0x320049
mov dword [rbp + 0x250], 0x4e002e
jmp 0x1800390e7
mov dword [rbp + 0x266], 0x740073
mov dword [rbp + 0x26a], 0x6f0043
jmp 0x1800390eb
lea rcx, [rbp + 0x1c8]
dec rcx
nop dword [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180038590
movzx eax, word [0x18009e354]
mov word [rcx], ax
movzx eax, byte [0x18009e356]
mov byte [rcx + 2], al
mov eax, 0x3a
mov word [rbp + 0x1dc], ax
lea rcx, [rbp + 0x1c8]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1800385c3
movzx eax, word [0x18009e358]
mov word [rcx], ax
movzx eax, byte [0x18009e35a]
mov byte [rcx + 2], al
jmp 0x1800390eb
mov word [rbp + 0x26e], r12w
mov dword [rbp + 0x270], 0x740073
mov eax, 0x72
mov word [rbp + 0x274], ax
mov dword [rbp + 0x276], 0x690061
jmp 0x1800390eb
test sil, sil
je 0x18003868e
mov esi, 0xb7
movzx ebx, byte [rsp + 0x60]
mov r13d, dword [rsp + 0x6c]
nop word [rax + rax]
mov eax, esi
sub eax, 0xb7
je 0x180038713
sub eax, 1
je 0x180038698
cmp eax, 1
jne 0x18003866e
test r13b, r13b
je 0x18003866e
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x64]
inc esi
cmp esi, 0xba
jb 0x180038630
mov dword [rsp + 0x6c], r13d
mov byte [rsp + 0x60], bl
mov ebx, 0xffffffff
mov r13d, dword [rbp - 0x7c]
mov esi, dword [rsp + 0x6c]
mov byte [rsp + 0x68], 1
jmp 0x1800390eb
movsx rax, dx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov r15, qword [rbp - 0x58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp - 0x78], rax
xor r8d, r8d
xor edx, edx
mov r14, qword [rbp - 0x48]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov edi, eax
cmp qword [rbp - 0x78], 0
jne 0x1800386e4
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r13b, r13b
test edi, edi
jne 0x1800386ef
xor bl, bl
jmp 0x18003866a
test bl, bl
je 0x18003866a
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymEnumerateModules64]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18003866a
mov bl, 1
mov qword [rbp - 0x48], 0xffffffffffffffff
jmp 0x18003866e
mov dword [rbp + 0x27a], 0x74006e
mov word [rbp + 0x27e], r9w
jmp 0x1800390eb
mov r8d, 1
lea rdx, [0x18009e3ac]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movups xmm0, xmmword [rbp + 0x180]
movups xmmword [rbp + 0x198], xmm0
movsd xmm1, qword [rbp + 0x190]
movsd qword [rbp + 0x1a8], xmm1
mov sil, 1
mov dword [rsp + 0x6c], esi
jmp 0x1800390e7
mov dword [rbp + 0x254], 0x520056
mov dword [rbp + 0x258], 0x6a0065
mov word [rbp + 0x25c], r14w
mov dword [rbp + 0x25e], 0x740063
mov dword [rbp + 0x262], 0x650054
jmp 0x1800390eb
mov edx, 0x100
mov dword [rsp + 0x64], edx
jmp 0x1800390eb
lea rax, [rbp + 0x218]
mov qword [rbp + 0x198], rax
jmp 0x1800390eb
mov word [rbp + 0x1d3], r14w
mov dword [rbp + 0x1d4], 0x437373
mov eax, 0x6c
mov word [rbp + 0x1d7], ax
lea r8d, [rax - 0x69]
lea rdx, [0x18009e3bc]
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800390e7
mov word [rbp + 0x230], r11w
movsd xmm0, qword [0x18009e3cc]
movsd qword [rbp + 0x232], xmm0
movzx eax, word [0x18009e3d4]
mov word [rbp + 0x23a], ax
mov word [rbp + 0x23c], r9w
mov r8d, 1
lea rdx, [0x18009e3dc]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x1800390e7
mov eax, 0x53
mov word [rbp + 0x1ce], ax
mov word [rbp + 0x1cf], r8w
mov dword [rbp + 0x1d0], 0x6c6275
jmp 0x1800390eb
movsx eax, dx
lea rcx, [rbp + 0x248]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x58], rax
xor esi, esi
mov dword [rsp + 0x78], esi
lea r14, [rbp + 0x198]
mov qword [rbp - 0x70], r14
jmp 0x1800388c2
xor esi, esi
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], 7
mov word [rbp + 8], si
mov r12d, 0x12
mov dword [rsp + 0x74], r12d
jmp 0x1800388e2
xor esi, esi
cmp r12d, 0x1b0
ja 0x180038b62
je 0x1800389d9
cmp r12d, 0x12
je 0x1800389bc
cmp r12d, 0x9c
je 0x18003894f
cmp r12d, 0x126
jne 0x18003903d
movzx eax, word [0x18009e428]
mov word [rbp + 0x18c], ax
mov eax, 0x69
mov word [rbp + 0x18e], ax
movzx eax, word [0x18009bd0c]
mov word [rbp + 0x18f], ax
movzx eax, byte [0x18009bd0e]
mov byte [rbp + 0x191], al
jmp 0x18003903d
movzx eax, word [0x18009e3fc]
mov word [rbp + 0x182], ax
movzx eax, byte [0x18009e3fe]
mov byte [rbp + 0x184], al
mov r8d, 1
lea rdx, [0x18009e400]
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x65
mov word [rbp + 0x185], ax
mov eax, dword [str.Sign]
mov dword [rbp + 0x186], eax
movzx eax, word [0x18009e40c]
mov word [rbp + 0x18a], ax
movzx eax, byte [0x18009e40e]
mov byte [rbp + 0x18c], al
jmp 0x18003903d
mov eax, 0x43
mov word [rbp + 0x180], ax
mov eax, 0x3f
mov word [rbp + 0x181], ax
jmp 0x18003903d
mov eax, 0x74
mov word [rbp + 0x191], ax
mov rsi, qword [r15 + 0x10]
mov rdi, r15
cmp qword [r15 + 0x18], 8
jb 0x1800389f6
mov rdi, qword [r15]
cmp rsi, 8
jae 0x180038a0f
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x18], xmm0
mov r15d, 7
mov r13, qword [rbp - 0x18]
jmp 0x180038a4e
mov r15, rsi
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rbp - 0x18]
call fcn.180047440
mov r13, rax
mov qword [rbp - 0x18], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp], r15
mov qword [rbp - 8], rsi
lea r14, [rbp - 0x18]
cmp r15, 8
cmovae r14, r13
cmp rsi, 8
jae 0x180038a76
movups xmm0, xmmword [r14]
mov qword [rbp + 0x60], 7
jmp 0x180038aba
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x48]
call fcn.180047440
mov qword [rbp + 0x48], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x60], rdi
movups xmm0, xmmword [rbp + 0x48]
movups xmmword [rbp + 0x1e8], xmm0
mov qword [rbp + 0x58], rsi
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x180038b05
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180038b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039116
call fcn.1800890f4
movups xmm0, xmmword [rbp + 0x1e8]
movups xmmword [rbp + 8], xmm0
movups xmm0, xmmword [rbp + 0x58]
movups xmmword [rbp + 0x18], xmm0
cmp r15, 8
jb 0x180038b53
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x180038b4b
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039169
mov rcx, r13
call fcn.1800890f4
mov r13d, 0x14c
mov dword [rbp - 0x7c], r13d
jmp 0x180039039
cmp r12d, 0x23a
je 0x180038f00
cmp r12d, 0x2c4
je 0x180038e89
cmp r12d, 0x34e
jne 0x18003903d
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0x208]
lea rcx, [rbp + 0x180]
call qword [sym.imp.dbghelp.dll_FindDebugInfoFile]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
mov r8, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov ecx, r13d
call qword [sym.imp.dbghelp.dll_StackWalk64]
cmp qword [rbp - 0x38], 0
jne 0x18003903d
mov r15d, esi
mov dword [rsp + 0x74], esi
nop dword [rax + rax]
cmp r15d, 9
ja case.default.0x180038c0e
mov eax, r15d
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x39274]
add rcx, rdx
jmp rcx
mov eax, dword [str.t8_sa]
mov dword [rbp + 0x1f7], eax
movzx eax, word [0x18009e434]
mov word [rbp + 0x1fb], ax
jmp case.default.0x180038c0e
movzx eax, word [0x18009e438]
mov word [rbp + 0x1fc], ax
movzx eax, byte [0x18009e43a]
mov byte [rbp + 0x1fe], al
mov r8d, 3
lea rdx, [0x18009e43c]
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x180038c0e
mov r8d, 4
lea rdx, str._Z17
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x63
mov word [rbp + 0x1ec], ax
mov eax, dword [str.onver]
mov dword [rbp + 0x1ed], eax
movzx eax, word [0x18009e44c]
mov word [rbp + 0x1f1], ax
mov eax, 0x74
mov word [rbp + 0x1f2], ax
mov eax, dword [str._uin]
mov dword [rbp + 0x1f3], eax
movzx eax, byte [0x18009e454]
mov byte [rbp + 0x1f7], al
jmp case.default.0x180038c0e
mov dword [rbp - 0x16], 0x61
lea rax, [rbp - 0x18]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x180038ce2
movsd xmm0, qword [0x18009e458]
movsd qword [rax], xmm0
mov eax, dword [0x18009e460]
mov dword [rbp - 0xe], eax
mov dword [rbp - 0xa], 0x4d
movsd xmm0, qword [str.R__SA]
movsd qword [rbp - 8], xmm0
mov eax, dword [0x18009e478]
mov dword [rbp], eax
jmp case.default.0x180038c0e
mov dword [rbp + 2], 0x52
mov r8d, 1
lea rdx, [0x18009e47c]
lea rcx, [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x180038c0e
mov eax, 0x73
mov word [rbp + 0x201], ax
mov byte [rsp + 0x58], 1
mov qword [rbp - 0x40], 0xffffffff80000001
mov edi, 0x100
mov dword [rsp + 0x70], edi
mov dword [rbp - 0x60], esi
jmp case.default.0x180038c0e
mov word [rbp - 0x18], si
mov r8d, 1
lea rdx, [0x18009e468]
lea rcx, [rbp - 0x18]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x180038c0e
mov byte [rbp + 0x1e8], 0
jmp case.default.0x180038c0e
movsx eax, di
lea rcx, [rbp + 0x1e8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x50]
xor r8d, r8d
lea rdx, [rbp - 0x18]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test r14, r14
jne 0x180038df4
mov byte [rsp + 0x58], r14b
jmp 0x180038e6a
cmp byte [rsp + 0x58], 0
je 0x180038e6a
mov esi, 0x84
movsxd r15, dword [rsp + 0x70]
mov eax, esi
sub eax, 0x83
je 0x180038e4c
cmp eax, 1
jne 0x180038e55
movsx rax, r15w
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, rax
call qword [sym.imp.dbghelp.dll_GetTimestampForLoadedLibrary]
test rdi, rdi
je 0x180038e55
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x180038e55
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, ebx
cmp esi, 0x82
ja 0x180038e05
mov r15d, dword [rsp + 0x74]
mov edi, dword [rsp + 0x70]
xor esi, esi
mov byte [rsp + 0x68], 0
inc r15d
mov dword [rsp + 0x74], r15d
lea eax, [r15 + 0x70]
cmp eax, 0x7a
jb 0x180038bf0
jmp 0x180039039
movsd xmm0, qword [str.time_base_den]
movsd qword [rbp + 0x208], xmm0
mov eax, dword [0x18009e418]
mov dword [rbp + 0x210], eax
movzx eax, word [0x18009e41c]
mov word [rbp + 0x214], ax
mov r8d, 3
lea rdx, [0x18009e420]
lea rcx, [rbp + 8]
call fcn.180047540
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rcx, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rsi
jmp 0x18003903d
mov qword [rbp - 0x28], 0xffffffffffffffff
mov rdx, qword [r14]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180038f12
lea rcx, [rbp + 8]
call fcn.180047540
mov r15, qword [rbp + 0x18]
mov r14, qword [rbp + 0x20]
cmp r15, r14
jae 0x180038f55
lea rax, [r15 + 1]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 8]
cmp r14, 8
cmovae rax, qword [rbp + 8]
mov dword [rax + r15*2], 0x2e
jmp 0x180039031
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, r15
cmp rax, 1
jb 0x1800391ae
lea r12, [r15 + 1]
mov rdi, r12
or rdi, 7
cmp rdi, rdx
jbe 0x180038f84
mov rdi, rdx
jmp 0x180038fa5
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x180038f9a
mov rdi, rdx
jmp 0x180038fa5
lea rax, [r14 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 8]
call fcn.180047440
mov rsi, rax
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], rdi
add r15, r15
mov r8, r15
mov rcx, rax
cmp r14, 8
jb 0x180039017
mov rdi, qword [rbp + 8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x18003900d
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x180039169
mov rdi, rcx
mov rcx, rdi
call fcn.1800890f4
jmp 0x180039028
lea rdx, [rbp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
mov r12d, dword [rsp + 0x74]
mov qword [rbp + 8], rsi
mov qword [rbp - 0x20], 0xffffffffffffffff
mov r14, qword [rbp - 0x70]
add r12d, 0x8a
mov dword [rsp + 0x74], r12d
cmp r12d, 0x3d8
mov edi, dword [rsp + 0x70]
mov r15, qword [rbp - 0x68]
jb 0x1800388e0
mov rax, qword [rbp + 0x20]
cmp rax, 8
jb 0x18003909e
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039099
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180039170
call fcn.1800890f4
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
add r14, 8
mov qword [rbp - 0x70], r14
cmp eax, 3
mov edi, dword [rsp + 0x70]
mov r15, qword [rbp - 0x68]
jb 0x1800388c0
mov esi, dword [rsp + 0x6c]
movzx esi, sil
cmp qword [rbp - 0x58], 0
mov eax, 0
cmove esi, eax
mov dword [rsp + 0x6c], esi
lea rcx, [rbp + 0x1c8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x50]
mov eax, dword [rbp - 0x80]
inc eax
mov dword [rbp - 0x80], eax
cmp eax, ecx
jae case.0x180038446.97
mov edi, dword [rsp + 0x70]
mov r15, qword [rbp - 0x68]
xor r9d, r9d
lea r10, [0x180000000]
jmp 0x18003841d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb case.0x180038446.97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003915f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003915f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800890f4
jmp case.0x180038446.97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1800890f4
mov eax, ebx
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.180089600
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180047360
nop
call fcn.180047220
int3