Function at 0x18000e3a0
Capabilities:
Check for software breakpoints
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x180080a28]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov esi, dword [rsp + 0x78]
lea r12d, [rcx + 0xe]
mov r15d, ecx
mov qword [rbp - 0x68], rdx
mov rbx, rdx
mov dword [rbp - 0x78], ecx
xor edx, edx
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x80], r8
mov r14d, ecx
lea rcx, [0x180000000]
cmp r15d, r12d
jae 0x18000e80b
mov edi, dword [rsp + 0x78]
lea rdx, str.orps
add r14d, 0xffffffee
lea r10, str.int_src_step_
movabs r13, 0x3300740061006f
lea r11, str.NumPRCopies
cmp r14d, 0x15
ja case.default.0x18000e43f
mov ecx, dword [rcx + r14*4 + 0xf144]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor eax, eax
mov qword [rbp + 0x2c], r13
mov word [rbp + 0x34], ax
jmp case.0x18000e43f.8
mov r8d, 3
lea rdx, [0x180079c16]
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rbp - 0x80]
jmp case.0x18000e43f.8
xor eax, eax
mov esi, eax
cmp byte [r9 + 1], al
jbe case.0x18000e43f.8
nop
mov ebx, 0x52
mov eax, ebx
sub eax, 0x52
je 0x18000e4a3
cmp eax, 1
jne 0x18000e4cb
cmp edi, 0xffffffff
je 0x18000e9a2
mov eax, esi
mov byte [rbp + rax - 0x58], dil
jmp 0x18000e4cb
lea eax, [rsi + 2]
xor r8d, r8d
movzx eax, byte [rax + r9]
lea rcx, [rsp + 0x78]
mov r9d, 0x57
mov dword [rsp + 0x78], eax
xor edx, edx
call fcn.180065570
mov r9, qword [rbp - 0x70]
mov rdi, rax
inc ebx
cmp ebx, 0x54
jb 0x18000e485
movzx eax, byte [r9 + 1]
inc esi
cmp esi, eax
jb 0x18000e480
mov r8, qword [rbp - 0x80]
mov rbx, qword [rbp - 0x68]
jmp case.0x18000e43f.8
test r9, r9
jne 0x18000e542
xor ecx, ecx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x50], rcx
xor r8d, r8d
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
lea rdx, [0x180077149]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x78], ecx
call fcn.18002b8a0
mov r8, qword [rbp - 0x80]
lea r10, str.int_src_step_
test rbx, rbx
jne case.0x18000e43f.8
xor ecx, ecx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
xor r8d, r8d
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x78], ecx
call fcn.18002b8a0
mov r8, qword [rbp - 0x80]
jmp case.0x18000e43f.8
cmp dword [r8], 0x64
jb case.0x18000e43f.8
mov eax, 0xcc
nop dword [rax + rax]
cmp eax, 0xcc
je 0x18000e5c4
cmp eax, 0x1188
je case.0x18000ec8e.0
jmp 0x18000e5cc
mov dword [rsp + 0x70], 7
add eax, 0x10bc
cmp eax, 0x2178
jbe 0x18000e5b0
jmp case.0x18000e43f.8
mov r8d, 2
lea rdx, str.Float_image_sum_c1____float__
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8, qword [rbp - 0x80]
jmp case.0x18000e43f.8
add esi, 2
lea r8, [rsp + 0x60]
mov r9d, 5
xor edx, edx
movzx ecx, byte [rbp + rsi - 0x58]
mov byte [rsp + 0x60], cl
xor ecx, ecx
call fcn.18003ea40
mov ebx, eax
lea r8, [rsp + 0x68]
lea eax, [rsi + 1]
mov r9d, 5
xor edx, edx
xor ecx, ecx
movzx eax, byte [rbp + rax - 0x58]
mov byte [rsp + 0x68], al
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
mov rbx, qword [rbp - 0x68]
lea edx, [rax + rcx*2]
mov dword [r8 + 4], edx
jmp case.0x18000e43f.8
xor eax, eax
lea r8, [rsp + 0x68]
mov esi, eax
mov r9d, 5
movzx eax, byte [rbp - 0x58]
xor edx, edx
xor ecx, ecx
mov byte [rsp + 0x68], al
call fcn.18003ea40
mov ebx, eax
lea r8, [rsp + 0x60]
movzx eax, byte [rbp - 0x57]
mov r9d, 5
xor edx, edx
mov byte [rsp + 0x60], al
xor ecx, ecx
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
mov rbx, qword [rbp - 0x68]
lea edx, [rax + rcx*2]
mov dword [r8], edx
jmp case.0x18000e43f.8
cmp dword [r8 + 4], 0xd
jb case.0x18000e43f.8
mov ecx, 0x101
nop word [rax + rax]
mov eax, ecx
sub eax, 0x101
je 0x18000e6d4
cmp eax, 0x2b
je case.0x18000ec8e.0
jmp 0x18000e6dc
mov dword [rsp + 0x70], 7
add ecx, 0x2b
cmp ecx, 0x157
jb 0x18000e6c0
jmp case.0x18000e43f.8
mov r8d, 1
lea rdx, [0x180079ca4]
lea rcx, [rbp + 0x3c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8, qword [rbp - 0x80]
xor eax, eax
mov word [rbp + 0x3e], ax
jmp case.0x18000e43f.8
xor eax, eax
mov word [rbp + 0x2c], ax
jmp case.0x18000e43f.8
mov r8d, 4
lea rdx, [0x180079cba]
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rbp - 0x80]
jmp case.0x18000e43f.8
test r8, r8
jne 0x18000e78f
xor ecx, ecx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rcx
lea rdx, [0x180077149]
mov qword [rsp + 0x50], rcx
mov r9d, SHSetInstanceExplorer
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x78], ecx
call fcn.18002b8a0
mov r8, qword [rbp - 0x80]
mov r9, qword [rbp - 0x70]
mov ecx, dword [rbx]
cmp ecx, 2
jb 0x18000e7a6
movzx eax, byte [r9 + 1]
cmp al, 0x20
jae 0x18000e7a6
add eax, 2
cmp eax, ecx
jbe case.0x18000e43f.8
mov ecx, 0x73
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x72
je case.0x18000ec8e.0
cmp eax, 1
jne 0x18000e7c8
mov dword [rsp + 0x70], 7
dec ecx
cmp ecx, 0x71
ja 0x18000e7b0
jmp case.0x18000e43f.8
lea eax, [rsi + 2]
mov dword [rbx], eax
lea rcx, [0x180000000]
mov r9, qword [rbp - 0x70]
lea rdx, str.orps
inc r15d
lea r10, str.int_src_step_
inc r14d
lea r11, str.NumPRCopies
cmp r15d, r12d
jb 0x18000e423
mov r14d, dword [rbp - 0x78]
xor edx, edx
lea r15d, [r14 + 0x230]
mov edi, r14d
cmp r14d, r15d
jae 0x18000eb08
mov r12d, 0x72
lea r14d, [rsi + 1]
lea r13d, [r12 - 6]
jmp 0x18000e837
lea rcx, [0x180000000]
cmp edi, 0x117
ja 0x18000eaab
je 0x18000ea6b
lea eax, [rdi - 0x12]
cmp eax, 0xe2
ja case.0x18000e870.30
movzx eax, byte [rcx + rax + 0xf1d0]
mov ecx, dword [rcx + rax*4 + 0xf19c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
cmp dword [r8 + 8], 0x20
jb case.0x18000e870.24
mov ecx, 1
nop
mov eax, ecx
sub eax, 1
je 0x18000e894
cmp eax, 0x83
je case.0x18000ec8e.0
jmp 0x18000e89c
mov dword [rsp + 0x70], 7
add ecx, 0x83
cmp ecx, 0x106
jbe 0x18000e880
add esi, 2
add r14d, 2
jmp case.0x18000e870.30
mov r8d, 4
lea rdx, [0x180079d10]
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rbp - 0x80]
mov word [rbp + 0x4c], r12w
jmp case.0x18000e870.30
mov dword [rbp + 0x54], 0x6c0061
mov word [rbp + 0x58], dx
jmp case.0x18000e870.30
add esi, 2
lea r8, [rsp + 0x68]
mov r9d, 5
xor edx, edx
add r14d, 2
movzx ecx, byte [rbp + rsi - 0x58]
mov byte [rsp + 0x68], cl
xor ecx, ecx
call fcn.18003ea40
movzx ecx, byte [rbp + r14 - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 8], edx
jmp case.0x18000e870.30
mov word [rbp], r13w
jmp case.0x18000e870.30
mov eax, esi
lea r8, [rsp + 0x68]
mov r9d, 5
xor edx, edx
movzx ecx, byte [rbp + rax - 0x58]
mov byte [rsp + 0x68], cl
xor ecx, ecx
call fcn.18003ea40
movzx ecx, byte [rbp + r14 - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0xc], edx
cmp edx, 0x18
jb case.0x18000e870.30
mov eax, 7
jmp 0x18000f11a
mov word [rbp + 2], dx
jmp case.0x18000e870.30
lea rax, [rbp]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x18000e9c0
movsd xmm0, qword [0x180079d48]
movsd qword [rax], xmm0
mov eax, dword [0x180079d50]
mov dword [rbp + 8], eax
movzx eax, word [0x180079d54]
mov word [rbp + 0xc], ax
jmp case.0x18000e870.30
mov r8d, 3
lea rdx, [0x180079d6a]
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8, qword [rbp - 0x80]
jmp case.0x18000e870.30
mov eax, esi
lea r8, [rsp + 0x68]
mov r9d, 5
xor edx, edx
movzx ecx, byte [rbp + rax - 0x58]
mov byte [rsp + 0x68], cl
xor ecx, ecx
call fcn.18003ea40
movzx ecx, byte [rbp + r14 - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0x10], edx
jmp case.0x18000e870.30
mov word [rbp + 0x4e], dx
jmp case.0x18000e870.30
lea rcx, [rbp]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18000ea73
movzx eax, word [0x180079d30]
movsd xmm0, qword [str.oro.]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
mov eax, dword [0x180079d34]
mov dword [rbp + 0x14], eax
movzx eax, word [0x180079d38]
mov word [rbp + 0x18], ax
jmp case.0x18000e870.30
mov eax, edi
sub eax, 0x13a
je 0x18000eacd
sub eax, 0x23
je 0x18000eac7
cmp eax, 0x23
jne case.0x18000e870.30
mov dword [rbp + 0x1e], 0x6f
jmp case.0x18000e870.30
mov dword [rbp + 0x1c], r12d
jmp case.0x18000e870.30
lea rcx, [rbp]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18000ead5
mov eax, dword [0x180079d3c]
mov dword [rcx], eax
movzx eax, word [0x180079d40]
mov word [rcx + 4], ax
add edi, 0x23
mov edx, 0
cmp edi, r15d
jb 0x18000e830
mov r14d, dword [rbp - 0x78]
lea r12d, [r14 - 0xe]
mov r13d, r14d
mov r10d, 0x5f
cmp r14d, r12d
jbe case.0x18000ec8e.0
lea edx, [r10 - 0x1d]
lea ebx, [rdx + 4]
lea edi, [rdx + 2]
lea r9d, [r10 - 0x1c]
lea r11d, [r10 - 0x10]
lea eax, [r13 - 0xd]
cmp eax, 0x15
ja case.0x18000eb4f.19
lea r14, [0x180000000]
mov ecx, dword [r14 + rax*4 + 0xf2b4]
add rcx, r14
jmp rcx
mov word [rbp - 0x38], dx
jmp case.0x18000eb4f.19
add esi, 2
jmp case.0x18000eb4f.19
mov dword [rbp - 0x2e], 0x4c0045
jmp case.0x18000eb4f.19
mov word [rbp - 0x32], r10w
jmp case.0x18000eb4f.19
mov word [rbp - 0x28], r9w
jmp case.0x18000eb4f.19
mov eax, 0x52
mov word [rbp - 0x30], ax
jmp case.0x18000eb4f.19
cmp dword [r8 + 0x14], 0x3c
jb case.0x18000eb4f.19
mov ecx, 0x40
mov eax, ecx
sub eax, 0x40
je 0x18000ebb2
cmp eax, 1
je case.0x18000ec8e.0
jmp 0x18000ebba
mov dword [rsp + 0x70], 7
inc ecx
cmp ecx, 0x42
jb 0x18000eba0
jmp case.0x18000eb4f.19
cmp dword [r8 + 0x10], 0x3c
jb case.0x18000eb4f.19
mov ecx, 0x12b
mov eax, ecx
sub eax, 0x12b
je 0x18000ebea
cmp eax, 0x51
je case.0x18000ec8e.0
jmp 0x18000ebf2
mov dword [rsp + 0x70], 7
add ecx, 0x51
cmp ecx, 0x1cd
jb 0x18000ebd6
jmp case.0x18000eb4f.19
mov dword [rbp + 0x20], 0x79
jmp case.0x18000eb4f.19
xor r14d, r14d
mov eax, esi
mov qword [r8 + 0x14], r14
mov qword [r8 + 0x1c], r14
movzx ecx, byte [rbp + rax - 0x58]
cmp cl, 0x5a
jne 0x18000ec53
mov ecx, 0x52
nop word [rax + rax]
mov eax, ecx
sub eax, 0x52
je 0x18000ec42
cmp eax, 1
je case.0x18000ec8e.0
jmp 0x18000ec47
mov dword [rsp + 0x70], r14d
inc ecx
cmp ecx, 0x54
jb 0x18000ec30
jmp case.0x18000eb4f.19
sub cl, 0x2b
test cl, 0xfd
jne case.0x18000eb4f.19
mov r15d, 0x21
lea edi, [rsi + 1]
mov r14d, 5
nop
cmp r14d, 5
ja case.default.0x18000ec8e
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0xf30c]
add rcx, rdx
jmp rcx
mov eax, esi
lea r8, [rsp + 0x68]
mov r9d, 5
xor edx, edx
movzx ecx, byte [rbp + rax - 0x58]
mov byte [rsp + 0x68], cl
xor ecx, ecx
call fcn.18003ea40
movzx ecx, byte [rbp + rdi - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0x20], edx
cmp edx, 0x3c
jb case.default.0x18000ec8e
mov ecx, 0xd8
nop word [rax + rax]
mov eax, ecx
sub eax, 0xd8
je 0x18000ed04
cmp eax, 1
je case.0x18000ec8e.0
jmp 0x18000ed0c
mov dword [rsp + 0x70], 7
inc ecx
cmp ecx, 0xda
jb 0x18000ecf0
jmp case.default.0x18000ec8e
xor eax, eax
mov dword [rsp + 0x70], eax
jmp case.default.0x18000ec8e
cmp dword [r8 + 0x1c], 0x18
jae 0x18000e9a2
add esi, 2
add edi, 2
jmp case.default.0x18000ec8e
mov ecx, esi
xor eax, eax
inc esi
inc edi
mov r9d, 5
cmp byte [rbp + rcx - 0x58], 0x2b
movzx ecx, byte [rbp + rsi - 0x58]
setne al
mov byte [rsp + 0x68], cl
mov dword [r8 + 0x18], eax
xor edx, edx
lea r8, [rsp + 0x68]
xor ecx, ecx
call fcn.18003ea40
movzx ecx, byte [rbp + rdi - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0x1c], edx
dec r15d
dec r14d
cmp r15d, 0x1b
ja 0x18000ec70
jmp 0x18000efc9
mov word [rbp - 0x2a], r11w
jmp case.0x18000eb4f.19
mov dword [rbp - 0x36], 0x440046
jmp case.0x18000eb4f.19
mov eax, esi
lea r8, [rsp + 0x68]
mov r9d, 5
xor edx, edx
movzx ecx, byte [rbp + rax - 0x58]
mov byte [rsp + 0x68], cl
xor ecx, ecx
call fcn.18003ea40
mov ebx, eax
lea r8, [rsp + 0x60]
lea eax, [rsi + 1]
mov r9d, 5
xor edx, edx
xor ecx, ecx
movzx eax, byte [rbp + rax - 0x58]
mov byte [rsp + 0x60], al
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0x14], edx
jmp 0x18000efce
add esi, 2
movzx ecx, byte [rbp + rsi - 0x58]
cmp cl, 0x5a
je 0x18000f040
sub cl, 0x2b
test cl, 0xfd
je 0x18000ee56
mov ecx, 0x5d
nop
mov eax, ecx
sub eax, 0x5d
je 0x18000ee42
cmp eax, 1
je case.0x18000ec8e.0
jmp 0x18000ee4a
mov dword [rsp + 0x70], 7
inc ecx
cmp ecx, 0x5f
jb 0x18000ee30
jmp case.0x18000eb4f.19
mov edi, 0x81
lea r14d, [rsi + 1]
nop
cmp edi, 0x7af4
ja 0x18000ef8a
je 0x18000ef56
cmp edi, 0x81
je 0x18000ef3f
cmp edi, 0x2952
je 0x18000eee9
cmp edi, 0x5223
jne 0x18000efb7
add esi, 2
lea r8, [rsp + 0x68]
mov r9d, 5
xor edx, edx
add r14d, 2
movzx ecx, byte [rbp + rsi - 0x58]
mov byte [rsp + 0x68], cl
xor ecx, ecx
call fcn.18003ea40
movzx ecx, byte [rbp + r14 - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0x20], edx
jmp 0x18000efb7
movzx ecx, byte [rbp + rsi - 0x58]
lea r8, [rsp + 0x68]
mov byte [rsp + 0x68], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
call fcn.18003ea40
movzx ecx, byte [rbp + r14 - 0x58]
lea r8, [rsp + 0x60]
mov byte [rsp + 0x60], cl
mov r9d, 5
xor ecx, ecx
xor edx, edx
mov ebx, eax
call fcn.18003ea40
mov r8, qword [rbp - 0x80]
lea ecx, [rbx + rbx*4]
lea edx, [rax + rcx*2]
mov dword [r8 + 0x1c], edx
cmp edx, 0x18
jae 0x18000e9a2
jmp 0x18000efb7
xor eax, eax
mov ecx, esi
inc esi
inc r14d
cmp byte [rbp + rcx - 0x58], 0x2b
setne al
mov dword [r8 + 0x18], eax
jmp 0x18000efb7
cmp dword [r8 + 0x20], 0x3c
jb 0x18000efb7
mov eax, 0x27
cmp eax, 0x27
je 0x18000ef74
cmp eax, 0x1bba
je case.0x18000ec8e.0
jmp 0x18000ef7c
mov dword [rsp + 0x70], 7
add eax, 0x1b93
cmp eax, 0x3726
jbe 0x18000ef62
jmp 0x18000efb7
cmp edi, 0xa3c5
je 0x18000efb0
cmp edi, 0xcc96
je 0x18000efa8
cmp edi, 0xf567
je case.0x18000ec8e.0
jmp 0x18000efb7
xor eax, eax
mov dword [rsp + 0x70], eax
jmp 0x18000efb7
add esi, 2
add r14d, 2
add edi, 0x28d1
cmp edi, 0x11db7
jbe 0x18000ee60
mov edi, 0x44
mov edx, 0x42
lea ebx, [rdx + 4]
lea r10d, [rdx + 0x1d]
lea r9d, [rdx + 1]
lea r11d, [rdx + 0xd]
dec r13d
cmp r13d, r12d
ja 0x18000eb30
mov r14d, dword [rbp - 0x78]
cmp r14d, r12d
jbe case.0x18000ec8e.0
mov edi, dword [rsp + 0x78]
lea ebx, [r14 - 0x15]
mov esi, dword [rsp + 0x78]
mov edx, 0x54
lea r15d, [rdx - 0xf]
lea r8d, [rdx - 0xd]
lea r9d, [rdx + 4]
lea r13d, [rdx - 0x13]
nop dword [rax]
cmp ebx, 0xd
ja case.0x18000f03b.3
lea r11, [0x180000000]
mov ecx, dword [r11 + rbx*4 + 0xf324]
add rcx, r11
jmp rcx
xor eax, eax
jmp 0x18000f11a
mov dword [rbp - 0x22], 0x4c0049
jmp case.0x18000f03b.3
xor eax, eax
lea r8, [rbp - 0x38]
mov qword [rbp - 0x60], rax
lea rdx, [rbp]
lea rax, [rbp - 0x60]
mov r9d, esi
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x28]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_LogonUserW]
mov edx, 0x54
lea r8d, [rdx - 0xd]
lea r9d, [rdx + 4]
jmp case.0x18000f03b.3
xor eax, eax
mov esi, 5
mov edi, eax
jmp case.0x18000f03b.3
mov word [rbp - 0x18], r10w
jmp case.0x18000f03b.3
mov dword [rbp - 0x16], 0x4d004d
mov dword [rbp - 0x12], 0x540053
jmp case.0x18000f03b.3
mov dword [rbp - 0x26], 0x54005f
jmp case.0x18000f03b.3
mov word [rbp - 0x1e], r15w
jmp case.0x18000f03b.3
mov dword [rbp - 0x1c], 0x580047
jmp case.0x18000f03b.3
xor eax, eax
mov dword [rbp - 6], 0x300058
mov word [rbp - 2], ax
jmp case.0x18000f03b.3
mov word [rbp - 8], r10w
jmp case.0x18000f03b.3
mov word [rbp - 0xe], r13w
mov dword [rbp - 0xc], 0x540052
dec r14d
dec ebx
cmp r14d, r12d
jbe case.0x18000ec8e.0
mov r10d, 0x5f
jmp 0x18000f020
mov r8, qword [rbp - 0x70]
mov ecx, 0xc8
mov rdx, qword [rbp - 0x68]
call fcn.180015860
mov byte [rsp + 0x70], al
mov eax, dword [rsp + 0x70]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180072740
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret