Function at 0x1800b97f0
Capabilities:
Check for time delay via gettickcount
Get file size
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1730
call fcn.180124410
sub rsp, rax
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x1710], rbx
mov rax, qword [0x1801dc960]
xor rax, rbp
mov qword [rbp + 0x16b0], rax
mov r13, rdx
mov r12, rcx
test rcx, rcx
je 0x1800b983e
call fcn.1800fd3f0
test r13, r13
je 0x1800b984b
mov rcx, r13
call fcn.1800fd3f0
mov byte [rbp + 0x6d0], 0
xor edx, edx
mov r8d, 0x7ff
lea rcx, [rbp + 0x6d1]
call fcn.1800f4fb0
lea rbx, [0x180152644]
xor r14d, r14d
lea esi, [r14 + 1]
cmp dword [0x1802210f4], r14d
je 0x1800ba2f9
mov esi, r14d
mov dword [rbp], r14d
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
cmp dword [0x1802211f8], r14d
je 0x1800b9916
movzx ecx, byte [0x18025c210]
cmp byte [r13], cl
je 0x1800b9916
mov rcx, r13
call fcn.1800658c0
test eax, eax
jne 0x1800b98c3
movzx ecx, byte [r13]
call fcn.180065cb0
test eax, eax
je 0x1800b9909
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022151c]
call fcn.18008efc0
test eax, eax
je 0x1800b9909
mov r15d, 1
mov r8d, r15d
mov rdx, r12
lea rcx, [0x1802211fc]
call fcn.18008f400
test eax, eax
je 0x1800b9909
mov esi, r15d
mov dword [rbp], r15d
movzx eax, byte [r13]
mov byte [0x18025c214], al
jmp 0x1800b9910
mov byte [0x18025c214], sil
mov dword [0x18025c218], ebx
cmp dword [0x1802216ac], edi
je 0x1800b9a34
movzx eax, byte [0x18025c211]
cmp byte [r12], al
je 0x1800b99a4
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800b9949
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800b9987
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022151c]
call fcn.18008efc0
test eax, eax
je 0x1800b9987
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022138c]
call fcn.18008f400
test eax, eax
je 0x1800b9987
mov edi, 1
movzx eax, byte [r12]
mov byte [0x18025c215], al
jmp 0x1800b998e
mov byte [0x18025c215], dil
mov dword [0x18025c21c], ebx
movzx eax, byte [r12]
mov byte [0x18025c211], al
jmp 0x1800b9a34
mov eax, ebx
sub eax, dword [0x18025c21c]
cmp eax, 0xea60
jbe 0x1800b9a1c
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800b99cd
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800b9a0d
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022151c]
call fcn.18008efc0
test eax, eax
je 0x1800b9a0d
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022138c]
call fcn.18008f400
test eax, eax
je 0x1800b9a0d
mov ecx, 1
mov edi, ecx
movzx eax, byte [r12]
mov byte [0x18025c215], al
jmp 0x1800b9a27
xor al, al
mov byte [0x18025c215], al
mov ecx, 1
jmp 0x1800b9a27
mov al, byte [0x18025c215]
mov ecx, 1
mov dword [0x18025c21c], ebx
cmp byte [r12], al
cmove edi, ecx
test esi, esi
jne 0x1800b9a40
test edi, edi
je 0x1800ba2d1
cmp dword [0x1802216b4], r14d
jne 0x1800b9a56
cmp dword [0x1802216b8], r14d
je 0x1800ba2c3
mov byte [rbp + 0x50], r14b
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0x51]
call fcn.1800f4fb0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov r15d, r14d
cmp rax, 0xffffffffffffffff
je 0x1800b9ab3
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x1800b9f50
test edi, edi
jne 0x1800ba241
mov byte [rbp + 0x38], r14b
xor eax, eax
mov qword [rbp + 0x39], rax
mov byte [rbp + 0x41], al
movsx r8d, byte [r13]
lea rdx, [0x18015cc84]
lea rcx, [rbp + 0x38]
call fcn.1800f509c
lea r8d, [rdi + 1]
lea rdx, str.uatinfo.ini
lea rcx, [rbp + 8]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b9b07
mov rax, qword [rax + 8]
jmp 0x1800b9b0b
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x64
lea r9, [rbp + 0x50]
lea r8, [0x180152644]
lea rdx, [rbp + 0x38]
lea rcx, str.UsbDisk
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
cmp qword [rbp + 0x28], 0x10
jb 0x1800b9b45
mov rcx, qword [rbp + 0x10]
call fcn.1800f4b9c
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
mov byte [rbp + 0x130], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0x131]
call fcn.1800f4fb0
mov byte [rbp + 0xc0], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0xc1]
call fcn.1800f4fb0
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
test rax, rax
je 0x1800b9c05
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800b9bd9
lea r8, [rcx - 2]
inc rdx
lea rcx, [rbp + 0xc0]
call fcn.1800f6e10
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov byte [rax], 0
lea r8, [rbp + 0x50]
lea rdx, [0x180166564]
lea rcx, [rbp + 0x130]
call fcn.1800f509c
jmp 0x1800b9c23
mov rcx, r14
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x50]
mov byte [rbp + rcx + 0x130], al
inc rcx
test al, al
jne 0x1800b9c10
mov byte [rbp + 0x1a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
lea rdx, [rbp + 0x1a0]
mov rcx, r12
call fcn.180065a00
cmp dword [0x180221ea0], 2
je 0x1800b9dd5
cmp byte [rbp + 0xc0], 0
je 0x1800b9d24
lea rdx, [0x1801514c0]
mov ecx, 8
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f90]
mov ecx, 0x428
call fcn.180001000
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s___s__context_s__s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov esi, dword [rbp]
jmp 0x1800ba241
lea rdx, [0x1801514c0]
mov ecx, 8
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f90]
mov ecx, 0x428
call fcn.180001000
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s__context_s__s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov esi, dword [rbp]
jmp 0x1800ba241
cmp byte [rbp + 0xc0], 0
je 0x1800b9e9f
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f90]
mov ecx, 0x428
call fcn.180001000
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s___s__context_s__s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov esi, dword [rbp]
jmp 0x1800ba241
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f90]
mov ecx, 0x428
call fcn.180001000
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s__context_s__s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov esi, dword [rbp]
jmp 0x1800ba241
test edi, edi
je 0x1800ba241
lea rdx, str.RECYCLED_
mov rcx, r13
call fcn.1800f4d08
test rax, rax
jne 0x1800ba241
lea rdx, str.RECYCLER_
mov rcx, r13
call fcn.1800f4d08
test rax, rax
jne 0x1800ba241
mov byte [rbp + 0x38], r14b
mov qword [rbp + 0x39], rax
mov byte [rbp + 0x41], al
movsx r8d, byte [r12]
lea rdx, [0x18015cc84]
lea rcx, [rbp + 0x38]
call fcn.1800f509c
mov r8d, 1
lea rdx, str.uatinfo.ini
lea rcx, [rbp + 8]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b9fcc
mov rax, qword [rax + 8]
jmp 0x1800b9fd0
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x64
lea r9, [rbp + 0x50]
lea r8, [0x180152644]
lea rdx, [rbp + 0x38]
lea rcx, str.UsbDisk
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
cmp qword [rbp + 0x28], 0x10
jb 0x1800ba00a
mov rcx, qword [rbp + 0x10]
call fcn.1800f4b9c
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
mov byte [rbp + 0xc0], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0xc1]
call fcn.1800f4fb0
mov byte [rbp + 0x130], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0x131]
call fcn.1800f4fb0
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
test rax, rax
je 0x1800ba0ca
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800ba09e
lea r8, [rcx - 2]
inc rdx
lea rcx, [rbp + 0x130]
call fcn.1800f6e10
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov byte [rax], 0
lea r8, [rbp + 0x50]
lea rdx, [0x180166564]
lea rcx, [rbp + 0xc0]
call fcn.1800f509c
jmp 0x1800ba0e3
mov rcx, r14
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x50]
mov byte [rbp + rcx + 0xc0], al
inc rcx
test al, al
jne 0x1800ba0d0
cmp byte [rbp + 0x130], 0
je 0x1800ba1a1
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f70]
mov ecx, 0x42a
call fcn.180001000
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind102__policyid_d__policyname_s___s__context_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov esi, dword [rbp]
jmp 0x1800ba241
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f70]
mov ecx, 0x42a
call fcn.180001000
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind102__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov esi, dword [rbp]
mov rdx, r12
lea rcx, [0x1801f5210]
call fcn.180067220
test eax, eax
jne 0x1800ba295
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyMoveFileExW_RemoteDiskPolicy
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1802216b8]
mov edx, dword [0x1802216b4]
lea rcx, [0x180162c48]
call fcn.18008e860
test esi, esi
je 0x1800ba2ed
cmp dword [0x1802216c4], 0
je 0x1800ba2df
mov edx, 0x500
mov r8d, 2
mov rcx, r12
call fcn.180068d50
mov esi, 1
lea rbx, [0x180152644]
jmp 0x1800ba2f9
mov esi, 1
lea rbx, [0x180152644]
jmp 0x1800ba2f9
mov esi, 1
lea rbx, [0x180152644]
jmp 0x1800ba2f9
mov esi, 1
lea rbx, [0x180152644]
jmp 0x1800ba2f9
mov esi, 1
lea rbx, [0x180152644]
cmp dword [0x180221ea4], 0
je 0x1800ba9a9
mov r8d, esi
lea rdx, str.EdpBigData.ini
lea rcx, [rbp + 8]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800ba327
mov r9, qword [rax + 8]
jmp 0x1800ba32b
lea r9, [rax + 8]
mov r8d, esi
lea rdx, str.CustomName
lea rcx, str.CUSTOMERS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
cmp qword [rbp + 0x28], 0x10
jb 0x1800ba354
mov rcx, qword [rbp + 0x10]
call fcn.1800f4b9c
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
cmp edi, 2
jne 0x1800ba3b5
mov dword [0x1802663bc], esi
lea rax, [rbp + 8]
mov qword [rbp], rax
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.180003700
nop
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov ecx, edi
call fcn.1800a33e0
jmp 0x1800ba9a9
cmp dword [0x180221ea4], 0
je 0x1800ba9a9
mov r15d, r14d
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
cmp dword [0x180221fac], r14d
je 0x1800ba433
movzx ecx, byte [0x18025c210]
cmp byte [r13], cl
je 0x1800ba433
mov rcx, r13
call fcn.1800658c0
test eax, eax
jne 0x1800ba400
movzx ecx, byte [r13]
call fcn.180065cb0
test eax, eax
je 0x1800ba426
mov r8d, esi
mov rdx, r12
lea rcx, [0x180221fb0]
call fcn.18008f400
test eax, eax
je 0x1800ba426
mov r15d, esi
movzx eax, byte [r13]
mov byte [0x18025c214], al
jmp 0x1800ba42d
mov byte [0x18025c214], dil
mov dword [0x18025c218], ebx
cmp dword [0x1802222d0], edi
je 0x1800ba510
movzx eax, byte [0x18025c211]
cmp byte [r12], al
je 0x1800ba4a5
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800ba466
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800ba48b
xor r8d, r8d
mov rdx, r12
lea rcx, [0x180222140]
call fcn.18008f400
test eax, eax
je 0x1800ba48b
mov edi, esi
movzx eax, byte [r12]
mov byte [0x18025c215], al
jmp 0x1800ba492
mov byte [0x18025c215], dil
mov dword [0x18025c21c], ebx
movzx eax, byte [r12]
mov byte [0x18025c211], al
jmp 0x1800ba510
mov eax, ebx
sub eax, dword [0x18025c21c]
cmp eax, 0xea60
jbe 0x1800ba4fd
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800ba4ce
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800ba4f3
xor r8d, r8d
mov rdx, r12
lea rcx, [0x180222140]
call fcn.18008f400
test eax, eax
je 0x1800ba4f3
mov edi, esi
movzx eax, byte [r12]
mov byte [0x18025c215], al
jmp 0x1800ba503
xor al, al
mov byte [0x18025c215], al
jmp 0x1800ba503
mov al, byte [0x18025c215]
mov dword [0x18025c21c], ebx
cmp byte [r12], al
cmove edi, esi
test r15d, r15d
jne 0x1800ba51d
test edi, edi
je 0x1800ba9a9
cmp dword [0x1802222d4], 0
jne 0x1800ba533
cmp dword [0x1802222d8], 0
je 0x1800ba9a9
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov esi, r14d
cmp rax, 0xffffffffffffffff
je 0x1800ba57c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x1800ba84a
test edi, edi
je 0x1800ba77c
mov edx, 0x5c
mov rcx, r12
call fcn.1800f7e94
mov rdi, rax
mov edx, 0x5c
mov rcx, r13
call fcn.1800f7e94
test rdi, rdi
je 0x1800ba950
test rax, rax
je 0x1800ba949
sub rdi, r12
sub rax, r13
cmp rdi, rax
jne 0x1800ba6ae
mov r8, rdi
mov rdx, r13
mov rcx, r12
call fcn.18010c858
test eax, eax
jne 0x1800ba6ae
mov byte [rbp + 0x1a0], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4d0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8d, 3
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov edi, 1
jmp 0x1800ba96a
mov byte [rbp + 0x1a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3c0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8d, 2
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov edi, 1
jmp 0x1800ba96a
mov byte [rbp + 0x1a0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3c0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8d, 2
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov edi, 1
jmp 0x1800ba96a
test edi, edi
je 0x1800ba965
lea rdx, str.RECYCLED_
mov rcx, r13
call fcn.1800f4d08
test rax, rax
jne 0x1800ba95e
lea rdx, str.RECYCLER_
mov rcx, r13
call fcn.1800f4d08
test rax, rax
jne 0x1800ba957
mov byte [rbp + 0x1a0], al
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3c0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xed0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r13
mov r9, r12
mov edi, 1
mov r8d, edi
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
jmp 0x1800ba96a
mov edi, 1
jmp 0x1800ba96a
mov edi, 1
jmp 0x1800ba96a
mov edi, 1
jmp 0x1800ba96a
mov edi, 1
jmp 0x1800ba96a
mov edi, 1
mov rdx, r12
lea rcx, [0x1801f5210]
call fcn.180067220
test eax, eax
jne 0x1800ba9a9
mov dword [rsp + 0x38], edi
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18008e860
cmp dword [0x180220ad8], 0
je 0x1800ba9fa
cmp dword [0x180220adc], 0
je 0x1800ba9d6
mov rcx, r12
call fcn.1800658c0
test eax, eax
je 0x1800ba9d6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800bb818
cmp dword [0x180220ae0], 0
je 0x1800ba9fa
mov rcx, r12
call fcn.180065ab0
test eax, eax
je 0x1800ba9fa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800bb818
cmp dword [0x1801e68d0], 0
je 0x1800baefa
mov rcx, r12
call fcn.1800679d0
test eax, eax
jne 0x1800baefa
mov rcx, r13
call fcn.1800679d0
test eax, eax
jne 0x1800baefa
mov rcx, r12
call fcn.1800676d0
mov esi, eax
cmp dword [0x1801f520c], 0
je 0x1800baa56
cmp byte [0x1801f5206], 0x4f
jne 0x1800baa56
test eax, eax
jne 0x1800baa56
mov rdx, r13
lea rcx, [0x1801f5210]
call fcn.180067220
mov edx, 0x5c
mov rcx, r12
call fcn.1800f7e94
mov rcx, r12
call fcn.180083ee0
lea r15, str.MyCopyFileA_FileProtectMainPolicy.DisableNetFile0
lea rdx, [0x1801ece6c]
cmp eax, 0xffffffff
je 0x1800bacb1
movsxd rdi, eax
mov rcx, rdi
imul rcx, rcx, 0x64
add rcx, rdx
mov ebx, 1
mov r8d, ebx
mov rdx, r12
call fcn.18008f400
test eax, eax
je 0x1800bacbd
imul rdi, rdi, 0x208
lea rax, [0x1801e1be0]
cmp byte [rdi + rax + 0x4cfc], 0x52
jne 0x1800babd1
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800bab77
test esi, esi
jne 0x1800bab77
call fcn.1800629f0
test eax, eax
je 0x1800bab77
lea rdx, [0x1801514fc]
lea ecx, [rbx + 2]
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151000]
mov ecx, 0x422
call fcn.180001000
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind612__policyid_d__policyname_s__context_s___s___s__s_
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
call fcn.1800629a0
test eax, eax
je 0x1800bacbd
lea rdx, [0x180166690]
mov ecx, 0x433
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800bb818
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800bacbd
call fcn.1800629f0
test eax, eax
je 0x1800bacbd
test esi, esi
jne 0x1800bacbd
lea rdx, [0x180151500]
lea ecx, [rsi + 2]
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150e08]
mov ecx, 0x443
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind611__policyid_d__policyname_s__context_s___s___s__s___s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
lea rcx, [rbp + 0x6d0]
call fcn.1800a7a30
test eax, eax
je 0x1800bacb8
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
lea ebx, [rsi + 1]
jmp 0x1800bacbd
mov ebx, 1
jmp 0x1800bacbd
mov ebx, 1
mov rcx, r13
call fcn.180083ee0
cmp eax, 0xffffffff
je 0x1800baefa
movsxd rdi, eax
mov rcx, rdi
imul rcx, rcx, 0x64
lea rax, [0x1801ece6c]
add rcx, rax
mov r8d, ebx
mov rdx, r13
call fcn.18008f400
test eax, eax
je 0x1800baefa
imul rdi, rdi, 0x208
lea rax, [0x1801e1be0]
cmp byte [rdi + rax + 0x4cfc], 0x52
jne 0x1800bae1f
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800badc5
test esi, esi
jne 0x1800badc5
call fcn.1800629f0
test eax, eax
je 0x1800badc5
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151000]
mov ecx, 0x422
call fcn.180001000
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind612__policyid_d__policyname_s__context_s___s___s__s_
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
call fcn.1800629a0
test eax, eax
je 0x1800baefa
lea rdx, [0x180166690]
mov ecx, 0x433
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800bb818
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800baefa
call fcn.1800629f0
test eax, eax
je 0x1800baefa
test esi, esi
jne 0x1800baefa
lea rdx, [0x180151500]
lea ecx, [rsi + 2]
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150e08]
mov ecx, 0x443
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind611__policyid_d__policyname_s__context_s___s___s__s___s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
lea rcx, [rbp + 0x6d0]
call fcn.1800a7a30
test eax, eax
je 0x1800baefa
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
movabs r15, 0xffffffffffffff0
cmp dword [0x1801e3950], 0
je 0x1800bb71e
cmp dword [0x1801e61a8], 0
je 0x1800baf46
cmp dword [0x18025a0ac], 0
je 0x1800baf46
lea rdx, str.TEMP_
mov rcx, r12
call fcn.1800f4d08
test rax, rax
je 0x1800baf46
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800bb818
mov r8d, 2
lea rdx, [0x180159ce8]
mov rcx, r13
call fcn.1800fbb00
test eax, eax
jne 0x1800bb71e
movzx eax, byte [r13 + 2]
cmp al, 0x3f
je 0x1800bb71e
cmp al, 0x2e
je 0x1800bb71e
cmp dword [0x1801e5424], 1
jne 0x1800bb087
xor r8d, r8d
mov rdx, r12
lea rcx, [0x1801e542c]
call fcn.18008f400
test eax, eax
je 0x1800bb087
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151238]
mov ecx, 0x433
call fcn.180001000
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s:___s___s_s.
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
lea rdx, [0x180151238]
mov ecx, 0x433
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800bb818
cmp dword [0x1801e5428], 1
jne 0x1800bb71e
xor r8d, r8d
mov rdx, r12
lea rcx, [0x1801e562c]
call fcn.18008f400
test eax, eax
je 0x1800bb71e
cmp dword [0x1801e59cc], 0
je 0x1800bb65d
mov esi, 1
mov r8d, esi
lea rdx, str.ckfiles64.dll
lea rcx, [rbp + 8]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800bb0e1
mov rcx, qword [rax + 8]
jmp 0x1800bb0e5
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
cmp qword [rbp + 0x28], 0x10
jb 0x1800bb0fe
mov rcx, qword [rbp + 0x10]
call fcn.1800f4b9c
mov qword [rbp + 0x28], 0xf
mov qword [rbp + 0x20], r14
mov byte [rbp + 0x10], 0
test rdi, rdi
je 0x1800bb65d
lea rdx, [0x180155630]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800bb65d
call rax
mov rbx, rax
test rax, rax
je 0x1800bb65d
mov byte [rbp + 0x4d0], 0
xor edx, edx
mov r8d, 0x1f3
lea rcx, [rbp + 0x4d1]
call fcn.1800f4fb0
mov edi, r14d
cmp dword [0x1801e59d4], r14d
jle 0x1800bb1b5
lea rsi, [0x1801e59d8]
nop dword [rax]
movsxd r8, edi
imul r8, r8, 0xc8
add r8, rsi
mov edx, 0x1f4
lea rcx, [rbp + 0x4d0]
call fcn.1800fe138
lea r8, [0x18015284c]
mov edx, 0x1f4
lea rcx, [rbp + 0x4d0]
call fcn.1800fe138
inc edi
cmp edi, dword [0x1801e59d4]
jl 0x1800bb170
mov esi, 1
mov byte [rbp + 0xed0], 0
xor edx, edx
mov r8d, 0x3e7
lea rcx, [rbp + 0xed1]
call fcn.1800f4fb0
lea r9, [rbp + 0x4d0]
lea r8, str.__xml_version_1.0__encoding_UTF_8____root__rules__group_id_65419047_3090_44b1_98c5_987ea08fea4a__name_
mov edx, 0x3e8
lea rcx, [rbp + 0xed0]
call fcn.1800f5158
mov byte [rbp + 0x12c0], 0
xor edx, edx
mov r8d, 0x3e7
lea rcx, [rbp + 0x12c1]
call fcn.1800f4fb0
mov r8d, 0x3e8
lea rdx, [rbp + 0x12c0]
lea rcx, [rbp + 0xed0]
call fcn.18005e260
mov rax, qword [rbx]
xor r8d, r8d
lea rdx, [rbp + 0x12c0]
mov rcx, rbx
call qword [rax + 0x18]
test r12, r12
jne 0x1800bb240
mov rdx, r14
jmp 0x1800bb292
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
cmp r8d, 0x3fffffff
jle 0x1800bb25b
mov rdx, r14
jmp 0x1800bb292
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800bb26d
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x70]
mov r9d, 3
mov rdx, r12
call fcn.18005df00
mov rdx, rax
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x1800bb597
mov eax, dword [0x1801e59d0]
test eax, eax
jne 0x1800bb3c1
cmp dword [0x1801e59c4], eax
je 0x1800bb374
lea rdx, [0x180151238]
mov ecx, 0x408
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f30]
mov ecx, 0x42c
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
lea rdx, [0x180151238]
mov ecx, 0x433
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800bb818
cmp eax, 2
jne 0x1800bb4d1
lea rdx, [0x18015150c]
mov ecx, esi
call fcn.180001000
mov rdi, rax
lea rdx, [0x180166618]
mov ecx, 0x42b
call fcn.180001000
mov rdx, rax
mov r9d, 4
mov r8, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x1800bb4d1
cmp dword [0x1801e59c4], 0
je 0x1800bb4ca
lea rdx, [0x180151238]
mov ecx, 0x408
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f30]
mov ecx, 0x42c
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800bb818
cmp dword [0x1801e59c4], 0
je 0x1800bb71e
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150f30]
mov ecx, 0x42c
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s__s_.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
jmp 0x1800bb71e
cmp dword [0x1801e59c4], 0
je 0x1800bb71e
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151248]
mov ecx, 0x407
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
jmp 0x1800bb71e
cmp dword [0x1801e59c4], 0
je 0x1800bb71e
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151248]
mov ecx, 0x407
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x6d0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x6d0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
cmp dword [0x18021adec], 0
je 0x1800bb813
cmp dword [0x1801e1bdc], 0
jne 0x1800bb813
test r13, r13
jne 0x1800bb742
mov rdi, r14
jmp 0x1800bb794
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
cmp r8d, 0x3fffffff
jle 0x1800bb75d
mov rdi, r14
jmp 0x1800bb794
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800bb76f
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x70]
mov r9d, 3
mov rdx, r13
call fcn.18005df00
mov rdi, rax
test r12, r12
je 0x1800bb7e6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
cmp r8d, 0x3fffffff
jg 0x1800bb7e6
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800bb7c1
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x70]
mov r9d, 3
mov rdx, r12
call fcn.18005df00
mov r14, rax
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.18005f6c0
test eax, eax
je 0x1800bb813
cmp dword [0x1802209d4], 0
je 0x1800bb80f
mov rcx, r13
call fcn.1800658c0
test eax, eax
jne 0x1800bb813
jmp 0x1800bb818
xor eax, eax
jmp 0x1800bb818
mov eax, 1
mov rcx, qword [rbp + 0x16b0]
xor rcx, rbp
call fcn.1800f4f80
mov rbx, qword [rbp + 0x1710]
lea rsp, [rbp + 0x16c0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret