Function at 0x18002c8f0
Capabilities:
Get geographical location
Parse credit card information

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd8
mov rax, qword [0x180143ae0]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov eax, dword [rbp + 0x77]
xor ebx, ebx
mov r11, qword [rbp + 0x6f]
mov r13, r9
mov r15, qword [rbp + 0x7f]
mov r10, rcx
mov qword [rbp - 0x59], rcx
mov r9, rdx
lea r14d, [rax - 0xf]
mov qword [rbp - 0x71], r8
mov qword [rsp + 0x50], rdx
mov esi, eax
mov qword [rbp - 0x79], r11
lea rcx, [0x180000000]
cmp eax, r14d
jbe 0x18002cd9e
lea edi, [rax - 0x3c]
lea r12, str.com.adobe.processcoordination.CreateBinaryDataAlias
nop
cmp edi, 0x4c
ja case.default.0x18002c982
movzx eax, byte [rcx + rdi + 0x2d5ac]
mov ecx, dword [rcx + rax*4 + 0x2d56c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor edx, edx
xor r9d, r9d
mov r8, r15
lea ecx, [rdx + 0x49]
call fcn.18009aa90
cmp al, 0x42
jne 0x18002c9b0
xor edx, edx
xor r9d, r9d
mov r8, r15
lea ecx, [rdx + 0x49]
call fcn.18009aa90
cmp al, 0x4d
je case.0x18002c982.3
mov ebx, 0x3d
mov eax, ebx
sub eax, 0x3c
je 0x18002cde8
cmp eax, 1
jne 0x18002c9d2
mov r8, r15
lea edx, [rax + 0x43]
xor ecx, ecx
call fcn.18001be70
dec ebx
cmp ebx, 0x3b
ja 0x18002c9b5
xor ebx, ebx
jmp case.0x18002c982.3
mov ecx, 0x8f
mov eax, ecx
sub eax, 0x8f
je 0x18002ca19
cmp eax, 1
jne 0x18002ca1e
mov ebx, dword [rsp + 0x40]
mov eax, ebx
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.1800c9c10
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov byte [rsp + 0x40], 1
inc ecx
cmp ecx, 0x91
jb 0x18002c9e5
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0x8e
xor ecx, ecx
call fcn.18006bec0
mov edx, dword [r15 + 0x18]
cmp dword [rax + 0x1c0], edx
jl 0x18002ca6b
jne case.0x18002c982.3
mov ecx, dword [r15 + 0x1c]
cmp dword [rax + 0x1c4], ecx
jge case.0x18002c982.3
mov ebx, 0xf0
cmp ebx, 0xf0
je 0x18002ca86
cmp ebx, 0x99c0
je case.0x18002c982.8
jmp 0x18002ca97
xor edx, edx
mov ecx, 0x10007
call fcn.18003e500
mov byte [rsp + 0x40], 0
add ebx, 0x98d0
cmp ebx, 0x131a0
jbe 0x18002ca70
xor ebx, ebx
jmp case.0x18002c982.3
mov dword [rbp - 0x69], ebx
jmp case.0x18002c982.3
mov qword [0x180194e58], r12
mov qword [rbp - 0x39], rbx
jmp case.0x18002c982.3
mov dword [rsp + 0x28], 0x8f
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r15
xor ecx, ecx
call fcn.18008e550
test al, al
je 0x18002cbd0
cmp qword [r15 + 0x30], 0
jne case.0x18002c982.3
mov ebx, 0xeb
nop dword [rax]
mov eax, ebx
sub eax, 0xeb
je 0x18002cb82
sub eax, 0x54
je 0x18002cb6c
sub eax, 0x54
je 0x18002cb23
cmp eax, 0x54
jne 0x18002cb8a
lea ecx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18002cb8a
mov eax, dword [r15 + 0x28]
xor r9d, r9d
mov rdx, qword [r15 + 0x30]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [r15 + 0x20]
test eax, eax
je 0x18002cb8a
mov ecx, 0xf6
mov eax, ecx
sub eax, 0xf6
je 0x18002cb5b
cmp eax, 1
je case.0x18002c982.8
jmp 0x18002cb60
mov byte [rsp + 0x40], 0
inc ecx
cmp ecx, 0xf8
jb 0x18002cb47
jmp 0x18002cb8a
mov eax, dword [r15 + 0x28]
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, qword [r15 + 0x10]
mov qword [r15 + 0x38], rcx
jmp 0x18002cb8a
mov rax, qword [r15 + 0x10]
mov qword [r15 + 0x30], rax
add ebx, 0x54
cmp ebx, 0x23b
jb 0x18002cb00
xor ebx, ebx
jmp case.0x18002c982.3
mov eax, dword [r15 + 0x28]
xor r9d, r9d
mov rdx, qword [r15 + 0x38]
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [r15 + 0x20]
test eax, eax
je case.0x18002c982.3
nop dword [rax]
nop word [rax + rax]
mov byte [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
jmp 0x18002c9f9
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov r8, r15
xor edx, edx
mov dword [rsp + 0x20], 0x82
xor ecx, ecx
call fcn.180096640
jmp case.0x18002c982.3
mov qword [rsp + 0x28], rbx
lea rcx, [rbp - 0x51]
mov r9d, 0x88
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov dword [rbp - 0x51], 0xc
mov rdx, r15
call fcn.1800815d0
jmp case.0x18002c982.3
mov rcx, qword [r15 + 0x30]
mov rax, qword [r15 + 0x38]
mov qword [r15 + 0x30], rax
mov qword [r15 + 0x38], rcx
mov byte [rsp + 0x40], 1
jmp case.0x18002c982.3
mov r8d, dword [r15 + 0x34]
lea rbx, [r15 + 0x38]
mov rcx, qword [r15 + 0x28]
mov rdx, rbx
call qword [r15 + 0x10]
movsxd r8, eax
test eax, eax
jne 0x18002ccc7
mov ecx, 0x54
xor edx, edx
nop word [rax + rax]
cmp ecx, 0x54
je 0x18002ccae
cmp ecx, 0x3624
je 0x18002cca5
cmp ecx, 0x6bf4
je 0x18002cc98
cmp ecx, 0xa1c4
jne 0x18002ccb2
mov rax, qword [r15 + 0xb8]
mov byte [rax], dl
jmp 0x18002ccb2
lea rax, [r15 + 0x39]
mov qword [r15 + 0xc0], rax
jmp 0x18002ccb2
mov qword [r15 + 0xb8], rbx
jmp 0x18002ccb2
mov dword [r15 + 0x30], edx
add ecx, 0x35d0
cmp ecx, 0xd740
jbe 0x18002cc70
xor ebx, ebx
jmp case.0x18002c982.3
mov edx, 0xaf
nop dword [rax]
cmp edx, 0xaf
je 0x18002ccf0
cmp edx, 0x8084
jne 0x18002ccf7
lea rcx, [r15 + 0x38]
add rcx, r8
mov qword [r15 + 0xc0], rcx
jmp 0x18002ccf7
mov qword [r15 + 0xb8], rbx
add edx, 0x7fd5
cmp edx, 0xffaa
jbe 0x18002ccd0
xor ebx, ebx
jmp case.0x18002c982.3
mov dword [rbp - 0x65], ebx
jmp case.0x18002c982.3
mov rdx, qword [r15 + 0x10]
lea rcx, [rbp - 0x31]
xor r8d, r8d
call fcn.1800028b0
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call fcn.180003390
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x18002cd66
mov rcx, qword [rbp - 0x31]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002cd61
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002cdf1
call fcn.1800c9704
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
lea rcx, [0x180000000]
dec esi
dec edi
cmp esi, r14d
ja 0x18002c960
mov r8, qword [rbp - 0x71]
mov r9, qword [rsp + 0x50]
mov r10, qword [rbp - 0x59]
mov eax, dword [rbp + 0x77]
mov r11, qword [rbp - 0x79]
lea r12d, [rax + 0xf]
cmp eax, r12d
jae case.0x18002c982.8
movzx edx, byte [rsp + 0x48]
mov r14d, 1
mov ebx, dword [rsp + 0x40]
mov edi, dword [rbp - 0x61]
mov dword [rsp + 0x40], edx
add eax, 0xffffffc3
cmp eax, 0x52
ja case.0x18002cde6.66
movzx eax, byte [rcx + rax + 0x2d638]
mov ecx, dword [rcx + rax*4 + 0x2d5fc]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor edx, edx
mov eax, edx
jmp 0x18002c9f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test r15, r15
jne case.0x18002cde6.66
mov esi, 0x3f
cmp esi, 0x3f
je 0x18002ce28
cmp esi, 0x1bcf
je 0x18002ce21
cmp esi, 0x375f
je case.0x18002cde6.65
jmp 0x18002ce4b
mov ebx, 0xffffffff
jmp 0x18002ce4b
mov rax, qword [0x180194e58]
lea r9, str.filter__u.Count.count___0
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov edx, 0x61
mov rcx, r13
call fcn.1800c8a10
add esi, 0x1b90
cmp esi, 0x52b0
jbe 0x18002ce06
jmp 0x18002d531
cmp qword [r9 + 0x18], 0x10
mov rdx, r9
jb 0x18002ce6b
mov rdx, qword [r9]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x18002ce78
mov rcx, qword [r15]
mov eax, dword [r15 + 0x10]
lea r9, [rsp + 0x48]
mov dword [rbp - 0x49], eax
xor r8d, r8d
lea rax, [rbp - 0x49]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], PathMakeUniqueName
call fcn.180049e70
mov r9, qword [rsp + 0x50]
test al, al
je 0x18002cee6
mov eax, dword [rbp - 0x69]
cmp qword [r9 + 0x10], rax
jb 0x18002d563
mov qword [r9 + 0x10], rax
mov rcx, r9
cmp qword [r9 + 0x18], 0x10
jb 0x18002ced9
mov rcx, qword [r9]
mov edx, dword [rsp + 0x40]
mov byte [rcx + rax], 0
jmp 0x18002d53a
mov qword [r9 + 0x10], 0
mov rax, r9
cmp qword [r9 + 0x18], 0x10
jb 0x18002cefb
mov rax, qword [r9]
mov edx, dword [rsp + 0x40]
mov byte [rax], 0
jmp 0x18002d53a
test r8, r8
jne 0x18002cf65
mov esi, 0x9f
cmp esi, 0x9f
je 0x18002cf27
cmp esi, 0x1dd
je case.0x18002cde6.65
jmp 0x18002cf4f
mov rax, qword [0x180194e58]
lea r9, str._6___3__.2_269_1__02F34_K77BO
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov edx, 0x61
mov rcx, r13
call fcn.1800c8a10
mov ebx, 0xffffffff
add esi, 0x13e
cmp esi, 0x27c
jbe 0x18002cf11
mov edx, dword [rsp + 0x40]
mov r11, qword [rbp - 0x79]
test r11, r11
jne 0x18002d0ef
mov esi, 0x4a
mov eax, esi
sub eax, 0x4a
je 0x18002cf89
cmp eax, 1
jne 0x18002cfac
mov eax, 0xffffffff
jmp 0x18002c9f9
mov rax, qword [0x180194e58]
lea r9, str._config_PluginsConfig.xml
mov r8d, r14d
mov qword [rsp + 0x20], rax
mov edx, 0x61
mov rcx, r13
call fcn.1800c8a10
inc esi
cmp esi, 0x4c
jb 0x18002cf73
jmp 0x18002d531
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x82
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.180035860
mov rdi, rax
jmp 0x18002d531
xor dl, dl
mov dword [rbp - 0x41], 0
mov dword [rsp + 0x40], edx
jmp case.0x18002cde6.66
test dl, dl
je 0x18002d0af
mov r14d, 0xa1
nop dword [rax]
nop dword [rax + rax]
mov eax, r14d
sub eax, 0xa0
je 0x18002d092
cmp eax, 1
jne 0x18002d095
mov rax, qword [r9]
cmp qword [r8], rax
jb 0x18002d088
mov esi, SHRegGetIntW
mov eax, esi
sub eax, 0x117
je 0x18002d050
sub eax, 0x3e
je 0x18002d049
cmp eax, 0x3e
je case.0x18002cde6.65
jmp 0x18002d074
mov ebx, 0xffffffff
jmp 0x18002d074
mov rax, qword [0x180194e58]
lea r9, str.v8::ArrayBufferView::Cast__
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rdx - 0x5c]
call fcn.1800c8a10
add esi, 0x3e
cmp esi, 0x1d1
jb 0x18002d030
mov r8, qword [rbp - 0x71]
mov r9, qword [rsp + 0x50]
mov rax, qword [r8]
mov byte [r15 + rax], 0
jmp 0x18002d095
inc qword [r8]
dec r14d
cmp r14d, 0x9f
ja 0x18002d010
mov edx, dword [rsp + 0x40]
mov r14d, 1
mov ebx, r14d
jmp 0x18002d53a
mov dword [rsp + 0x28], 0x7f
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, r15
call fcn.18007dd10
mov r11, qword [rbp - 0x79]
cdq
and edx, 7
mov ebx, r14d
add eax, edx
mov edx, dword [rsp + 0x40]
sar eax, 3
mov dword [r11], eax
mov r9, qword [rsp + 0x50]
jmp case.0x18002cde6.66
cmp edi, 0xc
je 0x18002d1dc
cmp edi, 0x28
je 0x18002d152
cmp edi, 0x38
je 0x18002d152
cmp edi, 0x6c
je 0x18002d152
cmp edi, 0x7c
je 0x18002d152
mov esi, 0x4b
nop dword [rax + rax]
cmp esi, 0x4b
je 0x18002d133
cmp esi, 0x294f
je case.0x18002cde6.65
jmp 0x18002d144
mov r8, r15
mov edx, 0x44
xor ecx, ecx
call fcn.18001be70
xor ebx, ebx
add esi, 0x2904
cmp esi, 0x5208
jbe 0x18002d120
mov r14, qword [rbp - 0x71]
mov esi, 0x64
nop dword [rax + rax]
mov eax, esi
sub eax, 0x64
je 0x18002d1ae
cmp eax, 1
jne 0x18002d193
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x82
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.180035860
mov dword [r14], eax
mov r9, qword [rsp + 0x50]
inc esi
cmp esi, 0x66
jb 0x18002d160
mov edx, dword [rsp + 0x40]
mov r14d, 1
jmp 0x18002d53a
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov edx, 0x82
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.180035860
mov r9, qword [rsp + 0x50]
mov dword [r9], eax
jmp 0x18002d198
mov r14, qword [rbp - 0x71]
mov esi, reloc.SHLWAPI.dll_SHRegGetIntW
cmp esi, reloc.SHLWAPI.dll_SHRegGetIntW
jne 0x18002d239
mov dword [rsp + 0x28], 0x7f
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, r15
call fcn.18007dd10
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x28], 0x7f
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], 0
mov dword [rcx], eax
mov rcx, r15
call fcn.18007dd10
mov dword [r14], eax
add esi, 0x9290
cmp esi, 0x9290
jbe 0x18002d1e5
mov r14d, 1
jmp 0x18002d531
mov rax, qword [r10]
movzx edx, dl
cmp byte [r11 + rax - 1], 0
cmovne edx, r14d
mov dword [rsp + 0x40], edx
cmp qword [rbp - 0x39], rax
jae case.0x18002cde6.66
mov r14, qword [rbp - 0x71]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r10]
lea r8, [rbp - 0x61]
mov qword [rbp - 0x61], rax
lea rdx, [rbp - 0x41]
lea rax, [rbp - 0x65]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x39]
mov r9, r11
mov dword [rsp + 0x20], 0x4d
call fcn.18007cbb0
cmp eax, 1
je 0x18002d300
mov esi, 0x25
nop dword [rax + rax]
mov eax, esi
sub eax, 0x24
je case.0x18002cde6.65
cmp eax, 1
jne 0x18002d2f9
mov rax, qword [0x180194e58]
lea r9, str.short16___OVERLOADABLE___convert_short_sat_rtz_int16__
mov edx, 0x63
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rdx - 0x62]
call fcn.1800c8a10
mov ebx, 0xffffffff
dec esi
cmp esi, 0x23
ja 0x18002d2c0
mov rax, qword [rsp + 0x50]
lea rdx, [rbp - 0x49]
mov dword [rsp + 0x28], 0xb1
mov r9, r15
mov r8, r14
mov rcx, r13
mov rax, qword [rax]
mov qword [rbp - 0x49], rax
mov eax, dword [rbp - 0x65]
mov dword [rbp - 0x61], eax
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
call fcn.18006b500
cmp eax, 1
je 0x18002d387
mov esi, 0x71
nop
mov eax, esi
sub eax, 0x6f
je case.0x18002cde6.65
sub eax, 1
je 0x18002d37b
cmp eax, 1
jne 0x18002d380
mov rax, qword [0x180194e58]
lea r9, str.COpenGLInterceptionContext::glVertexAttribP4ui
mov edx, 0x63
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rdx - 0x61]
call fcn.1800c8a10
jmp 0x18002d380
mov ebx, 0xffffffff
dec esi
cmp esi, 0x6e
ja 0x18002d340
mov r10, qword [rbp - 0x59]
mov r11, qword [rbp - 0x79]
mov rax, qword [r10]
cmp qword [rbp - 0x39], rax
jb 0x18002d280
mov edx, dword [rsp + 0x40]
mov r14d, 1
mov r9, qword [rsp + 0x50]
jmp case.0x18002cde6.66
cmp qword [r9], 0x7fffffff
jbe case.0x18002cde6.66
mov esi, 0xcd
mov eax, esi
sub eax, 0xcd
je 0x18002d3d6
cmp eax, 0x72
je case.0x18002cde6.65
jmp 0x18002d3ff
mov rax, qword [0x180194e58]
lea r9, str.vim.vm.guest.WindowsRegistryManager.setRegistryValue
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rdx - 0x5d]
call fcn.1800c8a10
mov ebx, 0xffffffff
add esi, 0x72
cmp esi, 0x1b1
jb 0x18002d3c2
jmp 0x18002d531
mov dword [rsp + 0x28], 0x7f
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, r15
call fcn.18007dd10
cmp eax, 1
je 0x18002d531
mov esi, 0xd8
nop
cmp esi, 0xd8
je 0x18002d462
cmp esi, 0x2a30
je 0x18002d45e
cmp esi, 0x5388
je case.0x18002cde6.65
jmp 0x18002d471
xor ebx, ebx
jmp 0x18002d471
mov r8, r15
mov edx, 0x44
xor ecx, ecx
call fcn.18001be70
add esi, 0x2958
cmp esi, 0x7c08
jbe 0x18002d440
jmp 0x18002d531
cmp qword [r10], 0x7fffffff
jbe 0x18002d4e6
mov esi, 0x8c
mov eax, esi
sub eax, 0x8a
je case.0x18002cde6.65
sub eax, 1
je 0x18002d4cf
cmp eax, 1
jne 0x18002d4d4
mov rax, qword [0x180194e58]
lea r9, str.Array_of_VmodlVimHostAutoStartManagerAutoPowerInfo
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rdx - 0x5d]
call fcn.1800c8a10
jmp 0x18002d4d4
mov ebx, 0xffffffff
dec esi
cmp esi, 0x89
ja 0x18002d492
mov edx, dword [rsp + 0x40]
mov r10, qword [rbp - 0x59]
cmp qword [r10], 1
jae 0x18002d535
mov esi, 0xa2
mov eax, esi
sub eax, 0xa1
je 0x18002cf7f
cmp eax, 1
jne 0x18002d527
mov rax, qword [0x180194e58]
lea r9, str.gadget_pref_geolocation_section
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r13
lea r8d, [rdx - 0x5c]
call fcn.1800c8a10
dec esi
cmp esi, 0xa0
ja 0x18002d4f1
mov edx, dword [rsp + 0x40]
mov r9, qword [rsp + 0x50]
mov r11, qword [rbp - 0x79]
mov eax, dword [rbp + 0x77]
inc eax
mov dword [rbp + 0x77], eax
cmp eax, r12d
jae case.0x18002cde6.65
mov r8, qword [rbp - 0x71]
lea rcx, [0x180000000]
mov r10, qword [rbp - 0x59]
jmp 0x18002cdc1
call fcn.180039150
int3