Function at 0x18001c8f0
Capabilities:
Access the windows event log
Check for software breakpoints
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x18003ca28]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov ebx, dword [rbp + 0x98]
mov rdi, r8
mov r10, qword [rbp + 0xa0]
xor esi, esi
mov qword [rbp - 0x58], r8
mov r13, rcx
mov r8, qword [rbp + 0x90]
mov eax, ebx
lea r11d, [rbx + 0x4b6]
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x60], r10
mov dword [rbp - 0x80], ebx
mov dword [rsp + 0x60], r11d
cmp ebx, r11d
jae 0x18001d3c5
mov r14d, dword [rbp - 0x48]
mov r12d, dword [rbp - 0x48]
mov r15d, dword [rbp - 0x48]
lea rbx, [0x18002fa85]
cmp eax, 0x15a
ja 0x18001d163
je 0x18001d091
add eax, 0xffffffcd
cmp eax, 0xfe
ja case.0x18001d193.357
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x1d920]
mov ecx, dword [rcx + rax*4 + 0x1d8f4]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r12d, dword [0x18003cb1c]
jmp case.0x18001d193.357
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001ca70
mov ebx, 0x10d
lea rsi, [0x18002fa85]
mov eax, ebx
sub eax, 0x10d
je 0x18001ca0c
cmp eax, 1
jne 0x18001ca5f
xor edx, edx
mov ecx, 0xcb
call fcn.18002b650
jmp 0x18001ca5f
movzx edx, byte [0x18003cbb1]
mov ecx, 0x4f
mov eax, ecx
sub eax, 0x4c
je 0x18001ca32
sub eax, 1
je 0x18001ca3c
cmp eax, 2
jne 0x18001ca35
mov byte [0x18003900c], 0x2b
jmp 0x18001ca35
or dl, 2
inc ecx
cmp ecx, 0x52
jb 0x18001ca18
mov byte [0x18003cbb1], dl
lea r8, [rsp + 0x68]
mov rdx, rsi
mov dword [rsp + 0x68], 0
mov r9, rsi
mov ecx, 0x5d
call fcn.180007790
inc ebx
cmp ebx, 0x10f
jb 0x18001c9f0
lea rbx, [0x18002fa85]
mov rsi, qword [rdi + 0x30]
test rsi, rsi
je 0x18001d391
nop dword [rax]
mov rax, qword [rsi + 0x28]
mov r8, r13
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18001caa3
inc rax
test ecx, ecx
jne 0x18001ca90
test edx, edx
jne 0x18001cb97
mov edi, 0x14
mov eax, edi
sub eax, 0x14
je 0x18001cac5
cmp eax, 1
je 0x18001d8ce
jmp 0x18001cb8c
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001cb87
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x15]
call fcn.18002a460
mov r8d, dword [0x18003cb1c]
cmp r12d, r8d
je 0x18001cb6a
mov ebx, 0xca
lea r13, [0x18002fa85]
nop dword [rax]
mov eax, ebx
sub eax, 0xca
je 0x18001cb3f
cmp eax, 1
jne 0x18001cb55
xor r9d, r9d
lea rcx, str.CommonUtils.Database.JsonHelper
mov r8, r13
mov rdx, r13
call fcn.18002cfd0
mov r8d, r12d
mov dword [0x18003cb1c], r12d
jmp 0x18001cb55
mov edx, r12d
lea rcx, str.Tried_to_get_SPDY_stream_for_secure_content_over_an_unauthenticated_session.
call fcn.18002cfd0
mov r8d, dword [0x18003cb1c]
inc ebx
cmp ebx, 0xcc
jb 0x18001cb10
mov r13, qword [rbp - 0x50]
lea rbx, [0x18002fa85]
mov r9, rbx
mov dword [rsp + 0x68], 0
lea r8, [rsp + 0x68]
mov rdx, rbx
mov ecx, 0x5d
call fcn.180007790
mov qword [rsp + 0x78], rsi
inc edi
cmp edi, 0x16
jb 0x18001cab0
mov rsi, qword [rsi + 0x38]
test rsi, rsi
jne 0x18001ca80
jmp 0x18001d391
mov r8d, 7
lea rdx, str.Compar
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [0x180031200]
mov dword [rbp + 4], eax
mov eax, 0x65
mov word [rbp + 8], ax
jmp 0x18001d391
mov esi, 0x115
nop dword [rax]
mov eax, esi
sub eax, 0x115
je 0x18001cbf7
cmp eax, 0x1d
je 0x18001d8ce
jmp 0x18001ccf6
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001cced
mov edi, 0x43
lea r13, str.VGETMANTPDZ128rrik
mov eax, edi
sub eax, 0x43
je 0x18001cc5f
cmp eax, 1
jne 0x18001ccde
mov r9d, 0xda
mov dword [rsp + 0x68], 0
lea r8, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
lea rdx, str.IsSupportedWarning
mov rcx, rbx
call fcn.1800186f0
jmp 0x18001ccde
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x15]
call fcn.18002a460
cmp r12d, dword [0x18003cb1c]
je 0x18001ccd7
mov ebx, 0xfb
nop word [rax + rax]
mov eax, ebx
sub eax, 0xfb
je 0x18001ccba
sub eax, 1
je 0x18001cc9c
cmp eax, 1
jne 0x18001ccc6
mov dword [0x18003cb1c], r12d
jmp 0x18001ccc6
lea rax, [0x18002fa85]
xor r9d, r9d
mov r8, rax
lea rcx, str.private_key_type_not_recognised
mov rdx, rax
call fcn.18002cfd0
jmp 0x18001ccc6
lea rcx, str.UCInstallUpdates_:_Sending_install_request_to_Update_Installer_for_reffID
call fcn.18002cfd0
inc ebx
cmp ebx, 0xfe
jb 0x18001cc80
lea rbx, [0x18002fa85]
mov qword [0x18003cb60], r13
inc edi
cmp edi, 0x45
jb 0x18001cc26
mov r13, qword [rbp - 0x50]
mov qword [rsp + 0x78], 0
add esi, 0x1d
cmp esi, 0x14f
jb 0x18001cbe0
jmp 0x18001d391
cmp dword [0x18004cd8c], 0
je 0x18001ce38
mov esi, 0x1c
nop dword [rax]
mov eax, esi
sub eax, 0x1c
je 0x18001cd35
cmp eax, 1
je 0x18001d8ce
jmp 0x18001ce28
xor r14d, r14d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001ce23
mov edi, 0xf9
nop dword [rax]
mov eax, edi
sub eax, 0xf9
je 0x18001ce07
sub eax, 0x61
je 0x18001cd95
cmp eax, 0x61
jne 0x18001ce14
mov r9, rbx
mov dword [rsp + 0x68], r14d
lea r8, [rsp + 0x68]
mov rdx, rbx
lea ecx, [rax - 4]
call fcn.180007790
jmp 0x18001ce14
cmp r15d, dword [0x18003cb1c]
je 0x18001ce14
mov ebx, 0x86
mov eax, ebx
sub eax, 0x86
je 0x18001cddd
sub eax, 0xc
je 0x18001cdbf
cmp eax, 0xc
jne 0x18001cdf3
mov dword [0x18003cb1c], r15d
jmp 0x18001cdf3
lea rax, [0x18002fa85]
xor r9d, r9d
mov r8, rax
lea rcx, str.ERROR:_out_of_memory_in__s___s_
mov rdx, rax
call fcn.18002cfd0
jmp 0x18001cdf3
mov r8d, dword [0x18003cb1c]
lea rcx, str.e:_amigo_browser_38_amigo_3.0_src_third_party_boringssl_srccrypto_bio_bio.c
mov edx, r15d
call fcn.18002cfd0
add ebx, 0xc
cmp ebx, 0xaa
jb 0x18001cda3
lea rbx, [0x18002fa85]
jmp 0x18001ce14
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x15]
call fcn.18002a460
add edi, 0x61
cmp edi, 0x21c
jb 0x18001cd60
mov dword [rsp + 0x78], r14d
inc esi
cmp esi, 0x1e
jb 0x18001cd20
mov r11d, dword [rsp + 0x60]
mov dword [0x18004cd8c], 1
mov r14d, 0x120
jmp case.0x18001d193.357
mov r15d, dword [0x18003cb1c]
xor r9d, r9d
xor r8d, r8d
mov dword [0x18004cd8c], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001d391
mov ebx, 0x3a
lea rsi, [0x18002fa85]
cmp ebx, 0x3a
je 0x18001cea0
cmp ebx, 0x5e4
jne 0x18001cef7
xor edx, edx
mov ecx, 0xcb
call fcn.18002b650
jmp 0x18001cef7
movzx edx, byte [0x18003cbb1]
mov ecx, 0x4f
nop dword [rax]
mov eax, ecx
sub eax, 0x4c
je 0x18001ceca
sub eax, 1
je 0x18001ced4
cmp eax, 2
jne 0x18001cecd
mov byte [0x18003900c], 0x2b
jmp 0x18001cecd
or dl, 2
inc ecx
cmp ecx, 0x52
jb 0x18001ceb0
mov byte [0x18003cbb1], dl
lea r8, [rsp + 0x68]
mov rdx, rsi
mov dword [rsp + 0x68], 0
mov r9, rsi
mov ecx, 0x5d
call fcn.180007790
add ebx, 0x5aa
cmp ebx, 0xb54
jbe 0x18001ce85
jmp 0x18001d391
mov rcx, rdi
call qword [0x18004cd20]
jmp 0x18001d391
test byte [0x18003cbb1], 4
je 0x18001cf68
cmp byte [r8], 3
lea rax, str.FREE
lea rcx, str._RE_ALLOC
mov r8, rdi
cmove rcx, rax
mov eax, dword [r9]
mov r9d, dword [rdx]
mov rdx, r13
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea rcx, str.ProgramLocalParameterI4uiNV
call fcn.18002cfd0
mov rdx, qword [rbp - 0x78]
mov r9, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov r10, qword [rbp - 0x60]
mov eax, dword [0x18003d2f4]
inc eax
cmp eax, 0x7d0
je 0x18001d03d
mov ebx, 0x6f
cmp ebx, 0x6f
je 0x18001cfcd
cmp ebx, 0xd71
je 0x18001cfa2
cmp ebx, 0x1a73
jne 0x18001d01b
mov dword [rsp + 0x78], esi
jmp 0x18001d8ce
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x7c
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov byte [rsp + 0x58], 1
call fcn.18000e260
jmp 0x18001d01b
movzx eax, byte [r10]
mov rcx, r13
mov byte [rsp + 0x58], al
movzx eax, byte [r8]
lea r8, [rsp + 0x70]
mov byte [rsp + 0x50], al
mov eax, dword [r9]
lea r9, [rsp + 0x50]
mov dword [rsp + 0x68], eax
mov eax, dword [rdx]
mov rdx, rdi
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x91
mov qword [rsp + 0x20], rax
call fcn.1800297a0
mov rdx, qword [rbp - 0x78]
add ebx, 0xd02
mov r9, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov r10, qword [rbp - 0x60]
cmp ebx, 0x2706
jbe 0x18001cf80
mov byte [rsp + 0x50], 2
mov qword [rsp + 0x30], rsi
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], 0x7c
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000e260
jmp 0x18001d391
mov dword [rbp - 0x28], 0x50545448
mov dword [rbp - 0x24], 0x312e312f
jmp case.0x18001d193.357
mov dword [rbp + 0xa], 0x73
mov dword [rbp + 0xc], 0x74
jmp case.0x18001d193.357
mov ecx, r14d
mov edx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [0x18003d2f8], rax
test rax, rax
jne 0x18001d0f6
mov ebx, 5
cmp ebx, 5
je 0x18001d0c7
cmp ebx, 0x145
jne 0x18001d0e1
mov ecx, dword [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8d, 0xe
lea rdx, str.IV_ACCUM2FLOAT
lea ecx, [r8 - 0xd]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
mov dword [rbp - 0x48], eax
add ebx, 0x140
cmp ebx, 0x280
jbe 0x18001d0b0
lea rbx, [0x18002fa85]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001d391
mov eax, dword [0x18003d2f8]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], eax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x50]
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x30], rax
mov r8, rbx
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x121
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x58], 2
mov dword [rsp + 0x68], esi
call fcn.18001c8f0
jmp 0x18001d391
add eax, 0xfffffe9c
cmp eax, 0xbf
ja case.0x18001d193.357
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x1da40]
mov ecx, dword [rcx + rax*4 + 0x1da20]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rcx, qword [0x18003d2f8]
lea rdx, str.unknown
mov r8d, r14d
call sub.VCRUNTIME140.dll_memcpy
jmp 0x18001d391
movzx eax, byte [r10]
mov rcx, r13
mov byte [rsp + 0x50], al
movzx eax, byte [r8]
lea r8, [rsp + 0x68]
mov byte [rsp + 0x58], al
mov eax, dword [r9]
lea r9, [rsp + 0x58]
mov dword [rsp + 0x70], eax
mov eax, dword [rdx]
mov rdx, rdi
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x91
mov qword [rsp + 0x20], rax
call fcn.1800297a0
jmp 0x18001d391
mov eax, 0x6f48
mov byte [rbp - 0x20], 0
mov word [rbp - 0x30], ax
jmp case.0x18001d193.357
mov byte [rsp + 0x50], 1
jmp 0x18001d042
mov esi, 0x26
cmp esi, 0x26
je 0x18001d24a
cmp esi, 0x2d
je 0x18001d23d
cmp esi, 0x34
je 0x18001d8ce
jmp 0x18001d332
mov dword [rsp + 0x78], 0
jmp 0x18001d332
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
mov ecx, 0xf6
call fcn.18002c4e0
test al, al
je 0x18001d332
mov edi, 0x4a
cmp edi, 0x4a
je 0x18001d2a2
cmp edi, 0x109
jne 0x18001d320
mov r9, rbx
mov dword [rsp + 0x70], 0
lea r8, [rsp + 0x70]
mov rdx, rbx
mov ecx, 0x5d
call fcn.180007790
jmp 0x18001d320
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x15]
call fcn.18002a460
cmp r15d, dword [0x18003cb1c]
je 0x18001d320
mov ebx, 0x10d
nop dword [rax]
cmp ebx, 0x10d
je 0x18001d2f5
cmp ebx, 0x1ca
jne 0x18001d30b
lea rax, [0x18002fa85]
xor r9d, r9d
mov r8, rax
lea rcx, str.29QHttpNetworkConnectionPrivate
mov rdx, rax
call fcn.18002cfd0
mov dword [0x18003cb1c], r15d
jmp 0x18001d30b
mov r8d, dword [0x18003cb1c]
lea rcx, str.MjM0OFoXDTE5MDYyNTIyMjM0OFowgbsxJDAiBgNVBAcTG1ZhbGlDZXJ0IFZhbGlkYXRpb24gTmV0
mov edx, r15d
call fcn.18002cfd0
add ebx, 0xbd
cmp ebx, 0x287
jb 0x18001d2c0
lea rbx, [0x18002fa85]
add edi, 0xbf
cmp edi, 0x1c8
jb 0x18001d272
add esi, 7
cmp esi, 0x3b
jb 0x18001d225
jmp 0x18001d391
mov ebx, 1
nop word [rax + rax]
mov r8d, ebx
lea rcx, [rsp + 0x70]
shl r8, 4
mov edx, ILFree
add r8, qword [0x18003d2f8]
mov dword [rsp + 0x70], ebx
call fcn.18001bc60
inc ebx
cmp ebx, 0x12
jl 0x18001d350
jmp 0x18001d391
mov r9d, 0x44
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18000dd60
mov r11d, dword [rsp + 0x60]
mov eax, dword [rbp - 0x80]
mov rdi, qword [rbp - 0x58]
add eax, 0x43
mov dword [rbp - 0x80], eax
cmp eax, r11d
jae 0x18001d3bf
mov rdx, qword [rbp - 0x78]
xor esi, esi
mov r9, qword [rbp - 0x70]
mov r8, qword [rbp - 0x68]
mov r10, qword [rbp - 0x60]
jmp 0x18001c971
mov ebx, dword [rbp + 0x98]
imul r12d, ebx, 0x2f8
mov esi, ebx
cmp ebx, r12d
ja 0x18001d8ce
mov r15, qword [rbp - 0x50]
mov ecx, 0x7473
movzx r14d, byte [rsp + 0x50]
mov edx, 0x41
mov eax, 0x6e
cmp esi, 0xd66b
ja 0x18001d627
je 0x18001d57c
cmp esi, 0x50d3
ja 0x18001d4b2
je 0x18001d49b
mov eax, esi
sub eax, 0xab
je 0x18001d48e
sub eax, 0x76
je 0x18001d8c6
sub eax, 0x1a42
je 0x18001d467
cmp eax, 0x1ab8
jne 0x18001d8b2
movzx eax, word [0x1800313e8]
mov word [rbp - 0x45], ax
movzx eax, byte [0x1800313ea]
mov byte [rbp - 0x43], al
movzx eax, word [0x1800313ec]
mov word [rbp - 0x18], ax
movzx eax, byte [0x1800313ee]
mov byte [rbp - 0x16], al
jmp 0x18001d8b2
lea rcx, [rbp - 0x48]
mov byte [rbp - 0x48], 0
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d472
mov eax, dword [0x1800313d8]
mov dword [rcx], eax
mov ecx, 0x7473
jmp 0x18001d8b2
mov word [rbp - 0x2e], cx
mov byte [rbp - 0x2c], 0
jmp 0x18001d8b2
movzx eax, word [0x1800313f4]
mov word [rbp - 0x16], ax
mov dword [rbp - 0x14], 0x746365
jmp 0x18001d8b2
cmp esi, 0x6b8b
je 0x18001d558
cmp esi, 0x8643
je 0x18001d50a
cmp esi, 0xa0fb
je 0x18001d4ec
cmp esi, 0xbbb3
jne 0x18001d8b2
mov word [rbp - 0x38], ax
mov eax, 0x74
mov word [rbp - 0x37], ax
jmp 0x18001d8b2
movzx eax, word [0x1800313d4]
mov word [rbp - 0x3b], dx
mov word [rbp - 0x3a], ax
movzx eax, byte [0x1800313d6]
mov byte [rbp - 0x38], al
jmp 0x18001d8b2
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x40], 0
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d515
mov eax, dword [0x1800313e0]
mov dword [rcx], eax
lea rcx, [rbp - 0x40]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d530
movzx eax, word [0x1800313e4]
mov word [rcx], ax
movzx eax, byte [0x1800313e6]
mov byte [rcx + 2], al
mov ecx, 0x7473
jmp 0x18001d8b2
lea rcx, [rbp - 0x18]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d560
mov eax, dword [0x1800313dc]
mov dword [rcx], eax
mov ecx, 0x7473
jmp 0x18001d8b2
mov rdx, qword [r13 + 0x18]
mov rcx, qword [r13 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x18001d5ca
lea rax, [rcx + 3]
mov qword [r13 + 0x10], rax
mov rax, r13
cmp rdx, 0x10
jb 0x18001d5a5
mov rax, qword [r13]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800313f0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
mov ebx, dword [rbp + 0x98]
jmp 0x18001d5e9
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800313f0]
mov rcx, r13
lea edx, [r8 + 3]
call fcn.1800028f0
mov r14b, 1
mov rcx, qword [r13 + 0x10]
mov rdx, qword [r13 + 0x18]
cmp rcx, rdx
jae 0x18001d741
lea rax, [rcx + 1]
mov qword [r13 + 0x10], rax
mov rax, r13
cmp rdx, 0x10
jb 0x18001d612
mov rax, qword [r13]
mov word [rax + rcx], 0x20
mov edx, 0x41
mov ecx, 0x7473
jmp 0x18001d8b2
cmp esi, 0x15c03
ja 0x18001d7da
je 0x18001d7b5
cmp esi, 0xf123
je 0x18001d746
cmp esi, 0x10bdb
je 0x18001d721
cmp esi, 0x12693
je 0x18001d6a2
cmp esi, 0x1414b
jne 0x18001d8b2
lea rdx, [rbp - 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov r15, rax
jb 0x18001d681
mov rdx, qword [rdi]
mov r9d, 0xb
lea r8, [rbp - 0x30]
mov rcx, r13
call fcn.180004130
mov ecx, 0x7473
mov edx, 0x41
jmp 0x18001d8b2
xor eax, eax
mov rdi, 0xffffffffffffffff
mov r15d, eax
lea rax, [rbp - 0x28]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x18001d6b2
mov rdx, qword [r13 + 0x18]
mov rcx, qword [r13 + 0x10]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x18001d705
lea rax, [rcx + rdi]
mov qword [r13 + 0x10], rax
mov rax, r13
cmp rdx, 0x10
jb 0x18001d6e3
mov rax, qword [r13]
lea rbx, [rax + rcx]
mov r8, rdi
mov rcx, rbx
lea rdx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], r15b
mov ebx, dword [rbp + 0x98]
jmp 0x18001d806
lea r9, [rbp - 0x28]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.1800028f0
jmp 0x18001d806
cmp qword [rdi + 0x38], 0x10
lea rdx, [rdi + 0x20]
jb 0x18001d730
mov rdx, qword [rdi + 0x20]
mov r8, qword [rdi + 0x30]
mov rcx, r13
call fcn.18001b8d0
jmp 0x18001d5ec
mov r9b, 0x20
jmp 0x18001d797
cmp qword [rdi + 0x38], 0x10
lea rax, [rdi + 0x20]
jb 0x18001d754
mov rax, qword [rax]
cmp byte [rax], 0x2f
je 0x18001d8b2
mov rcx, qword [r13 + 0x10]
mov rdx, qword [r13 + 0x18]
cmp rcx, rdx
jae 0x18001d794
lea rax, [rcx + 1]
mov qword [r13 + 0x10], rax
mov rax, r13
cmp rdx, 0x10
jb 0x18001d77f
mov rax, qword [r13]
mov word [rax + rcx], 0x2f
mov edx, 0x41
mov ecx, 0x7473
jmp 0x18001d8b2
mov r9b, 0x2f
xor r8d, r8d
mov rcx, r13
lea edx, [r8 + 1]
call fcn.180002790
mov ecx, 0x7473
mov edx, 0x41
jmp 0x18001d8b2
mov r9d, 0xb
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x48]
mov rcx, r13
call fcn.180004130
mov ecx, 0x7473
mov edx, 0x41
jmp 0x18001d8b2
cmp esi, 0x176bb
je 0x18001d8a2
cmp esi, 0x19173
je 0x18001d87d
cmp esi, 0x1ac2b
je 0x18001d838
cmp esi, 0x1c6e3
jne 0x18001d8b2
cmp qword [0x180039208], 0x10
lea rdx, [0x1800391f0]
mov r8, qword [0x180039200]
mov rcx, r13
cmovae rdx, qword [0x1800391f0]
call fcn.18001b8d0
mov ecx, 0x7473
mov edx, 0x41
jmp 0x18001d8b2
test r14b, r14b
je 0x18001d8b2
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov dword [rsp + 0x30], eax
mov rcx, r15
mov word [rsp + 0x28], ax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov ecx, 0x7473
mov edx, 0x41
jmp 0x18001d8b2
cmp qword [rdi + 0x58], 0x10
lea rdx, [rdi + 0x40]
jb 0x18001d88b
mov rdx, qword [rdx]
mov r9d, 0xb
lea r8, [rbp - 0x40]
mov rcx, r13
call fcn.180004130
jmp 0x18001d806
test r15, r15
movzx r14d, r14b
mov eax, 0
cmove r14d, eax
lea eax, [rbx + rbx*4]
lea esi, [rsi + rax*8]
cmp esi, r12d
ja 0x18001d8ce
mov rdi, qword [rbp - 0x58]
jmp 0x18001d3eb
mov dword [rsp + 0x78], 1
mov rax, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.18002d670
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret