Function at 0x18002da20
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1800a74e0]
xor rax, rsp
mov qword [rbp + 0x27], rax
lea r8d, [rcx + 0x4c2]
mov dword [rbp - 0x29], ecx
mov dword [rsp + 0x30], ecx
mov r15, rdx
mov dword [rsp + 0x34], r8d
mov r14d, ecx
mov edx, ecx
mov r9d, 0x65
cmp ecx, r8d
jae 0x18002dafc
mov rbx, qword [rbp - 0x79]
lea r9, [0x180000000]
mov rsi, qword [rbp - 0x79]
xor edi, edi
mov r14, qword [rbp - 0x79]
mov r13d, 0x6b69
lea eax, [rdi + 0x6c]
lea ecx, [rdi + 0x43]
lea r10d, [rdi + 0x10]
lea r12d, [rdi + 0x4c]
cmp edx, 0x43
ja 0x18002dbf1
je 0x18002dbdc
cmp edx, 9
jne 0x18002dae6
lea ecx, [rdx + 0xf]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x51], rax
mov edx, dword [rsp + 0x30]
lea r9, [0x180000000]
mov r8d, dword [rsp + 0x34]
mov r10d, ILClone
mov ecx, 0x43
mov eax, 0x6c
add edx, 0x3a
mov dword [rsp + 0x30], edx
cmp edx, r8d
jb 0x18002daa5
mov r14d, dword [rbp - 0x29]
mov r9d, 0x65
lea esi, [r14 + 0xc8d]
cmp r14d, esi
jae case.0x18002dc25.132
mov eax, 0x31
mov ecx, 0x3330
mov r8d, 0x3739
lea r13d, [rax + 3]
lea r12d, [rax + 0x3c]
nop dword [rax]
nop dword [rax + rax]
cmp r14d, 0x6bb
ja 0x18002e6b8
je 0x18002e61d
cmp r14d, 0x3be
ja 0x18002e2cf
je 0x18002e1c2
cmp r14d, 0xc1
je 0x18002e1ac
cmp r14d, 0x15a
je 0x18002e19a
cmp r14d, 0x1f3
je 0x18002e176
cmp r14d, 0x28c
je 0x18002e16b
cmp r14d, 0x325
jne 0x18002ec3a
mov r8d, 0xb
lea rdx, str.Mozilla_5.0
mov rcx, r15
call fcn.18003c070
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e116
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002dbd1
mov rax, qword [r15]
mov word [rax + rcx], 0x20
jmp 0x18002e128
mov rax, qword [rbp - 0x51]
test rax, rax
je 0x18002e0ef
mov qword [rax], rdi
jmp case.default.0x18002dc25
cmp edx, 0x1a9
ja 0x18002e033
je 0x18002e024
lea eax, [rdx - 0x7d]
cmp eax, 0xfb
ja case.default.0x18002dc25
movzx eax, byte [r9 + rax + 0x2ecb8]
mov ecx, dword [r9 + rax*4 + 0x2ec88]
add rcx, r9
jmp rcx
mov eax, edi
cmp qword [r15], rax
sete al
mov dword [rbp - 0x79], eax
jmp case.0x18002dc25.136
mov r9d, 0xff
mov dword [rbp - 0x71], 0xffffffff
xor r8d, r8d
lea rdx, [rbp - 0x71]
xor ecx, ecx
call fcn.180079c80
jmp 0x18002dac6
mov r8d, 4
mov byte [rbp + 0x17], dil
lea rdx, str.Wind
lea rcx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x18009cd5c]
mov word [rbp + 0x1b], ax
movzx eax, byte [0x18009cd5e]
mov byte [rbp + 0x1d], al
jmp 0x18002dac6
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
lea ecx, [r9 + 0x44]
call fcn.18006e850
jmp 0x18002dac6
mov r8d, 2
lea rdx, [0x18009cd78]
lea rcx, [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x18002dac6
mov ebx, 0xb5
mov r12d, edi
mov dword [rsp + 0x38], ebx
mov r13d, r10d
nop
cmp r13d, 0x14
ja case.0x18002dce8.1
mov eax, r13d
mov ecx, dword [r9 + rax*4 + 0x2edb4]
add rcx, r9
jmp rcx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x42]
call fcn.18001bef0
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.bzip2__a_block_sorting_file_compressor.__Version__s._n____n___Copyright__C__1996_2010_by_Julian_Seward._n____n___This_program_is_free_software__you_can_redistribute_it_and_or_modify_n___it_under_the_terms_set_out_in_the_LICENSE_file__which_is_included_n___in_the_bzip2_1.0.6_source_distribution._n____n___This_program_is_distributed_in_the_hope_that_it_will_be_useful__n___but_WITHOUT_ANY_WARRANTY__without_even_the_implied_warranty_of_n___MERCHANTABILITY_or_FITNESS_FOR_A_PARTICULAR_PURPOSE.__See_the_n___LICENSE_file_for_more_details._n____n
mov rcx, rax
call fcn.180085950
mov ebx, dword [rsp + 0x38]
jmp 0x18002ddee
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
cmp rax, 0
jne 0x18002ddee
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, rdi
mov rbx, rdi
jmp 0x18002de13
mov rax, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x61]
mov qword [rax], rcx
mov dword [rax + 8], edi
jmp case.0x18002dce8.1
test r12d, r12d
cmove r12d, r10d
mov ecx, r12d
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x61], rax
cmp rax, 0
je 0x18002dd47
jmp 0x18002ddee
mov eax, 0x51
nop dword [rax + rax]
cmp eax, 0x51
je 0x18002de38
add eax, 0x35ca
cmp eax, 0x35ca
jbe 0x18002dd90
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], r12d
jmp case.0x18002dce8.1
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002ddee
xor eax, eax
lock cmpxchg qword [0x1800a75b0], rdi
mov qword [rbp - 0x49], rax
je 0x18002de10
mov rcx, rdi
lea r8, [rbp - 0x41]
xchg qword [0x1800a75b0], rcx
xor ecx, ecx
mov qword [rbp - 0x41], rax
xor r9d, r9d
mov edx, 0x8b
call fcn.1800330d0
lea r9, [0x180000000]
mov r10d, ILClone
inc ebx
inc r13d
mov dword [rsp + 0x38], ebx
cmp ebx, 0xbd
jb 0x18002dcd0
mov rbx, rsi
mov edx, dword [rsp + 0x30]
lea r9, [0x180000000]
mov r8d, dword [rsp + 0x34]
mov r10d, ILClone
mov r13d, 0x6b69
lea r12d, [r10 + 0x3c]
jmp case.0x18002dc25.136
mov rax, qword [rsp + 0x40]
lea rcx, [0x1800859e0]
mov rsi, rax
mov rbx, rax
mov qword [rax + 0x10], rcx
lea rcx, [0x1800859d0]
mov qword [rax + 0x18], rcx
jmp 0x18002de13
mov byte [rbp - 0x20], dil
jmp case.0x18002dc25.136
mov eax, dword [str.s_NT]
mov dword [rbp + 0x1d], eax
movzx eax, byte [0x18009cd98]
mov byte [rbp + 0x21], al
mov byte [rbp - 0x21], 0x57
jmp case.0x18002dc25.136
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x44]
call fcn.18006e850
mov r9d, 0xff
mov dword [rbp - 0x69], edi
xor r8d, r8d
lea rdx, [rbp - 0x69]
xor ecx, ecx
call fcn.180079c80
mov r8d, ILClone
mov ebx, 0xb5
mov r13d, r8d
mov dword [rsp + 0x38], ebx
mov r12d, edi
nop dword [rax]
cmp r13d, 0x14
ja case.0x18002dede.1
lea rdx, [0x180000000]
mov eax, r13d
mov ecx, dword [rdx + rax*4 + 0x2ee08]
add rcx, rdx
jmp rcx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x42]
call fcn.18001bef0
mov ecx, 2
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.bzip2__a_block_sorting_file_compressor.__Version__s._n____n___Copyright__C__1996_2010_by_Julian_Seward._n____n___This_program_is_free_software__you_can_redistribute_it_and_or_modify_n___it_under_the_terms_set_out_in_the_LICENSE_file__which_is_included_n___in_the_bzip2_1.0.6_source_distribution._n____n___This_program_is_distributed_in_the_hope_that_it_will_be_useful__n___but_WITHOUT_ANY_WARRANTY__without_even_the_implied_warranty_of_n___MERCHANTABILITY_or_FITNESS_FOR_A_PARTICULAR_PURPOSE.__See_the_n___LICENSE_file_for_more_details._n____n
mov rcx, rax
call fcn.180085950
mov ebx, dword [rsp + 0x38]
jmp 0x18002dfdb
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x48], rax
cmp rax, 0
jne 0x18002dfdb
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, rdi
mov rbx, rdi
jmp 0x18002de13
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbp - 0x59]
mov qword [rax], rcx
mov dword [rax + 8], edi
jmp case.0x18002dede.1
test r12d, r12d
cmove r12d, r8d
mov ecx, r12d
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x59], rax
cmp rax, 0
je 0x18002df3d
jmp 0x18002dfdb
mov eax, 0x51
cmp eax, 0x51
je 0x18002dffe
add eax, 0x35ca
cmp eax, 0x35ca
jbe 0x18002df81
mov rax, qword [rsp + 0x48]
mov dword [rax + 0xc], r12d
jmp case.0x18002dede.1
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18002dfdb
xor eax, eax
lock cmpxchg qword [0x1800a75b0], rdi
mov qword [rbp - 0x39], rax
je 0x18002dff6
mov rcx, rdi
lea r8, [rbp - 0x31]
xchg qword [0x1800a75b0], rcx
xor ecx, ecx
mov qword [rbp - 0x31], rax
xor r9d, r9d
mov edx, 0x8b
call fcn.1800330d0
mov r8d, ILClone
inc ebx
inc r13d
mov dword [rsp + 0x38], ebx
cmp ebx, 0xbd
jb 0x18002dec0
mov rbx, r14
jmp 0x18002de13
mov rax, qword [rsp + 0x48]
lea rcx, [0x1800859e0]
mov r14, rax
mov rbx, rax
mov qword [rax + 0x10], rcx
lea rcx, [0x1800859d0]
mov qword [rax + 0x18], rcx
jmp 0x18002de13
mov word [rbp - 0x1e], 0x3436
mov byte [rbp - 0x1c], dil
jmp 0x18002dae6
cmp edx, 0x291
ja 0x18002e0b2
je 0x18002e0a9
mov eax, edx
sub eax, 0x1e3
je 0x18002e089
sub eax, 0x3a
je 0x18002e065
cmp eax, 0x3a
mov eax, 0x6c
jne 0x18002dae6
mov dword [rbp - 7], 0x4c4d54
jmp 0x18002dae6
mov eax, 0x3633
mov byte [rbp - 0x13], dil
mov word [rbp - 0x15], ax
mov eax, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov word [rbp - 9], ax
mov eax, PathYetAnotherMakeUniqueName
mov word [rbp - 8], ax
jmp case.default.0x18002dc25
movzx eax, word [0x18009cd39]
mov word [rbp - 0x19], ax
movzx eax, byte [0x18009cd3b]
mov byte [rbp - 0x17], al
mov word [rbp - 0x16], PathMakeUniqueName
jmp case.default.0x18002dc25
mov word [rbp - 0x11], ax
jmp 0x18002dae6
mov eax, edx
sub eax, 0x2cb
je 0x18002e0d8
cmp eax, 0x3a
mov eax, 0x6c
jne 0x18002dae6
mov word [rbp + 3], 0x6f
mov word [rbp + 7], cx
jmp 0x18002dae6
mov dword [rbp - 0x10], 0x656b69
mov dword [rbp - 1], 0x6b636547
mov byte [rbp + 3], dil
jmp case.default.0x18002dc25
mov rax, rdi
jmp 0x18002ec5a
mov rcx, qword [rbp - 0x51]
mov rax, qword [r15]
mov qword [rcx + 8], rax
mov rax, rcx
mov dword [rcx + 0x10], edi
jmp 0x18002ec5a
xor r8d, r8d
mov r9b, 0x20
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e154
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e149
mov rax, qword [r15]
mov word [rax + rcx], 0x28
jmp 0x18002ec30
mov r9b, 0x28
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002ec30
mov word [rbp + 0x14], 0x69
jmp 0x18002ec3a
mov r8d, 4
mov byte [rbp - 0x25], 0
lea rdx, [0x18009ce06]
lea rcx, [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x13], 0x72
jmp 0x18002ec30
mov word [rbp - 0x29], r13w
mov word [rbp - 0x28], ax
mov word [rbp - 0x27], cx
jmp 0x18002ec3a
mov dword [rbp + 8], 0x6f7268
mov word [rbp + 0xb], r12w
mov word [rbp + 0xc], r9w
jmp 0x18002ec3a
lea rax, [rbp + 0x17]
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e1d0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e219
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e200
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp + 0x17]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x18002e230
lea r9, [rbp + 0x17]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.180015b30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e259
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e251
mov rax, qword [r15]
mov word [rax + rcx], 0x20
jmp 0x18002e26b
xor r8d, r8d
mov r9b, 0x20
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x18002e2b5
lea rax, [rcx + 3]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e293
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x18009ce28]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x18002ec30
mov qword [rsp + 0x20], 3
lea r9, [0x18009ce28]
mov edx, 3
jmp 0x18002ec25
cmp r14d, 0x457
je 0x18002e5da
cmp r14d, 0x4f0
je 0x18002e490
cmp r14d, 0x589
je 0x18002e453
cmp r14d, 0x622
jne 0x18002ec3a
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x18002e34a
lea rax, [rcx + 0xb]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e32b
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8d, 0xb
mov rcx, rbx
lea rdx, str.AppleWebKit
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xb], 0
jmp 0x18002e369
xor r8d, r8d
mov qword [rsp + 0x20], ILClone
lea r9, str.AppleWebKit
mov rcx, r15
lea edx, [r8 + 0xb]
call fcn.180015b30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e392
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e38a
mov rax, qword [r15]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x18002e3a4
xor r8d, r8d
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
lea rax, [rbp - 0x19]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e3b0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e3f9
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e3e0
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x19]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x18002e410
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.180015b30
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
cmp rcx, rdx
jae 0x18002e43c
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e431
mov rax, qword [r15]
mov word [rax + rcx], 0x20
jmp 0x18002ec30
mov r9b, 0x20
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002ec30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e47c
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e474
mov rax, qword [r15]
mov word [rax + rcx], 0x29
jmp 0x18002e410
mov r9b, 0x29
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002e410
lea rax, [rbp - 0x21]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e4a0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e4e9
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e4d0
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x21]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x18002e500
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.180015b30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e529
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e521
mov rax, qword [r15]
mov word [rax + rcx], 0x3b
jmp 0x18002e53b
xor r8d, r8d
mov r9b, 0x3b
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e564
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e55c
mov rax, qword [r15]
mov word [rax + rcx], 0x20
jmp 0x18002e576
xor r8d, r8d
mov r9b, 0x20
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x18002e5c0
lea rax, [rcx + 3]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e59e
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x18009ce4c]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x18002ec30
mov qword [rsp + 0x20], 3
lea r9, [0x18009ce4c]
mov edx, 3
jmp 0x18002ec25
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e606
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e5fb
mov rax, qword [r15]
mov word [rax + rcx], 0x3b
jmp 0x18002e410
mov r9b, 0x3b
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002e410
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e646
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e63e
mov rax, qword [r15]
mov word [rax + rcx], 0x28
jmp 0x18002e658
xor r8d, r8d
mov r9b, 0x28
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
lea rax, [rbp - 9]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e663
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e6af
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e693
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 9]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x18002ec30
lea r9, [rbp - 9]
jmp 0x18002ec1d
cmp r14d, 0xa51
ja 0x18002ea02
je 0x18002e96a
cmp r14d, 0x754
je 0x18002e894
cmp r14d, 0x7ed
je 0x18002e7ab
cmp r14d, 0x886
je 0x18002e410
cmp r14d, 0x91f
je 0x18002e74b
cmp r14d, 0x9b8
jne 0x18002ec3a
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e734
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e729
mov rax, qword [r15]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x18002ec30
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002ec30
lea rax, [rbp + 7]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e756
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e7a2
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e786
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp + 7]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x18002ec30
lea r9, [rbp + 7]
jmp 0x18002ec1d
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e7d4
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e7cc
mov rax, qword [r15]
mov word [rax + rcx], 0x20
jmp 0x18002e7e6
xor r8d, r8d
mov r9b, 0x20
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
lea rax, [rbp - 1]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e7f1
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e83a
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e821
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 1]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x18002e851
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.180015b30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e87d
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e872
mov rax, qword [r15]
mov word [rax + rcx], 0x29
jmp 0x18002ec30
mov r9b, 0x29
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002ec30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e8bd
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e8b5
mov rax, qword [r15]
mov word [rax + rcx], PathMakeUniqueName
jmp 0x18002e8cf
xor r8d, r8d
mov r9b, 0x2c
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002e8f8
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e8f0
mov rax, qword [r15]
mov word [rax + rcx], 0x20
jmp 0x18002e90a
xor r8d, r8d
mov r9b, 0x20
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
lea rax, [rbp - 0x11]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002e915
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002e961
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e945
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x11]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x18002ec30
lea r9, [rbp - 0x11]
jmp 0x18002ec1d
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x18002e9a0
lea rax, [rcx + 4]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e992
mov rax, qword [r15]
mov dword [rax + rcx], 0x302e3338
mov byte [rax + rcx + 4], 0
jmp 0x18002e9bf
xor r8d, r8d
mov qword [rsp + 0x20], 4
lea r9, str.83.0
mov rcx, r15
lea edx, [r8 + 4]
call fcn.180015b30
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
cmp rcx, rdx
jae 0x18002e9eb
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002e9e0
mov rax, qword [r15]
mov word [rax + rcx], PathMakeUniqueName
jmp 0x18002ec30
mov r9b, PathMakeUniqueName
xor r8d, r8d
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
jmp 0x18002ec30
cmp r14d, 0xaea
je 0x18002ebbf
cmp r14d, 0xb83
je 0x18002e9bf
cmp r14d, 0xc1c
je 0x18002ead1
cmp r14d, 0xcb5
jne 0x18002ec3a
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002ea5b
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002ea53
mov rax, qword [r15]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x18002ea6d
xor r8d, r8d
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x18002eab7
lea rax, [rcx + 6]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002ea95
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8d, 6
mov rcx, rbx
lea rdx, str.537.36
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 6], 0
jmp 0x18002ec30
mov qword [rsp + 0x20], 6
lea r9, str.537.36
mov edx, 6
jmp 0x18002ec25
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x18002eb05
lea rax, [rcx + 2]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002eaf9
mov rax, qword [r15]
mov word [rcx + rax], r8w
mov byte [rcx + rax + 2], 0
jmp 0x18002eb24
xor r8d, r8d
mov qword [rsp + 0x20], 2
lea r9, [0x18009ce50]
mov rcx, r15
lea edx, [r8 + 2]
call fcn.180015b30
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
cmp rcx, rdx
jae 0x18002eb4d
lea rax, [rcx + 1]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002eb45
mov rax, qword [r15]
mov word [rcx + rax], 0x20
jmp 0x18002eb5f
xor r8d, r8d
mov r9b, 0x20
mov rcx, r15
lea edx, [r8 + 1]
call fcn.1800159d0
lea rax, [rbp + 0xf]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002eb70
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002ebb9
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002eba0
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp + 0xf]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x18002ec30
lea r9, [rbp + 0xf]
jmp 0x18002ec1d
lea rax, [rbp - 0x29]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18002ebd0
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18002ec19
lea rax, [rcx + rdi]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x18002ec00
mov rax, qword [r15]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x29]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
jmp 0x18002ec30
lea r9, [rbp - 0x29]
mov qword [rsp + 0x20], rdi
mov rdx, rdi
xor r8d, r8d
mov rcx, r15
call fcn.180015b30
mov eax, 0x31
mov ecx, 0x3330
add r14d, 0x99
mov r8d, 0x3739
mov r9d, 0x65
cmp r14d, esi
jb 0x18002db30
mov rax, qword [rbp - 0x79]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800864a0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret