Function at 0x18004b6a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r12, qword [rbp + 0x110]
lea r14d, [r8 - 0x11]
mov dword [rsp + 0x30], r8d
mov r10, r9
mov r11d, dword [rsp + 0x30]
xor r15d, r15d
mov eax, dword [rsp + 0x30]
mov r13, rdx
mov ebx, dword [rsp + 0x30]
mov rsi, rcx
mov ecx, dword [rsp + 0x30]
lea rdx, [0x180000000]
mov qword [rbp - 0x80], r9
mov r9, qword [rbp + 0x118]
mov qword [rsp + 0x78], r9
mov dword [rsp + 0x4c], r11d
cmp r8d, r14d
jbe 0x18004bb45
mov r15, qword [rbp - 0x50]
lea edi, [r8 - 0x38]
mov r8d, dword [rsp + 0x30]
mov dword [rsp + 0x68], ecx
mov ecx, dword [rsp + 0x30]
mov dword [rbp - 0x58], ecx
mov ecx, dword [rsp + 0x30]
mov dword [rbp - 0x6c], ecx
mov rcx, qword [rbp - 0x60]
mov dword [rbp - 0x68], eax
mov eax, dword [rsp + 0x30]
mov qword [rbp - 0x60], rcx
mov dword [rbp - 0x70], r8d
mov dword [rsp + 0x48], eax
nop dword [rax + rax]
cmp edi, 0x36
ja case.0x18004b77b.17
movzx eax, byte [rdx + rdi + 0x4ca60]
mov ecx, dword [rdx + rax*4 + 0x4ca18]
add rcx, rdx
jmp rcx
mov eax, dword [0x1800cb68a]
movsd xmm0, qword [0x1800cb6a2]
mov dword [rbp + 0x70], eax
movzx eax, word [0x1800cb68e]
mov word [rbp + 0x74], ax
movzx eax, word [0x1800cb6aa]
mov word [rbp + 0x7e], ax
movsd qword [rbp + 0x76], xmm0
jmp case.0x18004b77b.17
test byte [rsi], 1
mov edx, dword [rsp + 0x48]
je 0x18004ba97
mov r11d, 1
mov eax, 0x7fff
mov dword [rsp + 0x4c], r11d
mov dword [rbp - 0x68], eax
jmp 0x18004ba97
mov r8, qword [r10]
test r8, r8
je 0x18004b816
mov ecx, dword [rbp + 0xc]
mov edx, 0x14
mov eax, edx
sub eax, 0x13
je 0x18004b804
cmp eax, 1
jne 0x18004b80f
mov dword [rbp + 8], eax
mov ecx, 1
mov rax, qword [r9]
mov qword [rbp], rax
mov qword [rbp - 8], r8
jmp 0x18004b80c
test r11d, r11d
je 0x18004b80f
or ecx, 2
mov dword [rbp + 0xc], ecx
dec edx
cmp edx, 0x12
ja 0x18004b7e3
mov rax, qword [r13]
cmp dword [rax + 0xa8], 0
jne 0x18004b82e
cmp dword [r15 + 8], 0
je 0x18004bab1
xor ebx, ebx
mov qword [rbp - 0x78], rax
mov r9d, 0x136
mov dword [rsp + 0x60], ebx
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x38]
call fcn.1800b14b0
test eax, eax
je 0x18004b86c
cmp eax, 0x7f2bb780
jne 0x18004c9cc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
mov rax, qword [r13]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x28], rbx
lea rcx, [rbp - 0x78]
xor r9d, r9d
mov qword [rbp - 0x78], rax
xor r8d, r8d
mov dword [rsp + 0x20], 0x4d
call fcn.180072640
mov ebx, eax
test eax, eax
jne 0x18004c9cc
mov r10, qword [rbp - 0x80]
mov r11d, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x78]
jmp case.0x18004b77b.17
test ebx, ebx
je 0x18004b8ed
cmp ebx, 0x7f2bb784
jne 0x18004b8c9
xor eax, eax
mov ebx, eax
mov dword [rbp - 0x70], eax
cmp qword [r10], rax
jne 0x18004b8ef
mov r14d, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
mov esi, dword [rsp + 0x30]
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x50], esi
mov edi, 0xceb5
jmp 0x18004c837
xor eax, eax
mov dword [rsp + 0x60], eax
lea r8, [rsp + 0x60]
mov rax, qword [r13]
lea rdx, [rbp - 0x78]
mov r9d, 0x136
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x38]
call fcn.1800b14b0
mov ebx, eax
test eax, eax
jne 0x18004b8c9
test byte [rbp - 0x24], 2
mov r10, qword [rbp - 0x80]
mov r11d, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x78]
mov edx, dword [rsp + 0x48]
je 0x18004ba97
mov dword [rsp + 0x68], 1
jmp 0x18004ba97
mov eax, 0x8000
mov dword [rbp - 0x68], eax
mov rax, qword [r13]
cmp dword [rax], 0x7f2bb712
je case.0x18004b77b.17
mov eax, 0x7f2bb712
jmp 0x18004c9cc
xor eax, eax
mov word [rbp + 0x80], ax
jmp case.0x18004b77b.17
xor eax, eax
mov dword [rbp - 0x70], 1
mov dword [rsp + 0x68], eax
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x6c], eax
jmp case.0x18004b77b.17
mov r9d, dword [r9]
mov r8d, dword [r10]
cmp r9d, r8d
jne 0x18004baf4
mov r9d, dword [rsi]
mov r8d, dword [r12]
cmp r9d, r8d
jne 0x18004bad9
mov r9, qword [rsp + 0x78]
jmp case.0x18004b77b.17
movzx eax, word [0x1800cb72c]
mov word [rbp + 0x3c], ax
movzx eax, byte [0x1800cb72e]
mov byte [rbp + 0x3e], al
mov byte [rbp + 0x3f], 0
jmp case.0x18004b77b.17
xor ebx, ebx
jmp case.0x18004b77b.17
mov rcx, qword [r13]
mov rax, qword [rcx + 8]
test byte [rax + 0x10], 1
je 0x18004bb19
mov rdx, qword [rcx + 0xb0]
test rdx, rdx
je 0x18004bb0f
movsxd rax, dword [rcx + 0xa4]
lea r15, [rax + rax*2]
shl r15, 4
add r15, rdx
jmp case.0x18004b77b.17
xor r11d, r11d
mov dword [rsp + 0x4c], r11d
jmp case.0x18004b77b.17
movzx eax, word [0x1800cb76b]
mov word [rbp + 0x39], ax
movzx eax, byte [0x1800cb76d]
mov byte [rbp + 0x3b], al
mov byte [rbp + 0x38], 0x63
jmp case.0x18004b77b.17
mov edx, dword [rbp + 0x50]
sub edx, dword [rbp + 0x44]
mov rax, qword [rbp - 0x30]
mov dword [rsp + 0x48], edx
mov qword [rbp - 0x60], rax
jmp 0x18004ba97
mov rax, qword [r9]
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [r13]
xor r9d, r9d
mov r8d, 0xf1
mov qword [rsp + 0x40], rax
call fcn.180037520
mov r10, qword [rbp - 0x80]
mov rbx, rax
mov r11d, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x78]
jmp case.0x18004b77b.17
xor eax, eax
cmp dword [r13], eax
setne al
mov dword [0x1800db31c], eax
mov edx, dword [rsp + 0x48]
dec edi
lea eax, [rdi + 0x38]
cmp eax, r14d
jbe 0x18004bb77
lea rdx, [0x180000000]
jmp 0x18004b760
lea r9, [rbp - 8]
mov dword [rsp + 0x30], 0
lea r8, [rbp - 0x60]
mov qword [rbp - 0x60], rax
lea rdx, [rsp + 0x30]
mov ecx, 0x102
call fcn.1800a7120
jmp 0x18004c9cc
mov rdx, r13
lea rcx, str.450_28_BERKANAN_BEORC_BJARKAN_B
call fcn.1800c03a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, r13
lea rcx, str.fixup_MICROMIPS_TLS_DTPREL_LO16
call fcn.1800c03a0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, 0x7f2bb780
jmp 0x18004c9cc
mov eax, 0x7f2bb715
jmp 0x18004c9cc
mov r9d, dword [r9]
lea rcx, str.D3DXIMAGE_INFO
mov edx, dword [rsi]
mov r8, r13
call fcn.1800c03a0
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx]
add eax, dword [rsi]
jmp 0x18004c9cc
mov r12d, dword [rsp + 0x30]
mov r14d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x30]
mov dword [rbp - 0x70], eax
mov eax, dword [rsp + 0x30]
mov dword [rbp - 0x6c], eax
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x68], r12d
mov dword [rsp + 0x68], r14d
mov dword [rbp - 0x58], ecx
mov dword [rsp + 0x48], edx
jmp 0x18004bb83
mov r12d, dword [rbp - 0x68]
xor r15d, r15d
mov r14d, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x30]
mov edi, ecx
mov r8d, dword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov esi, dword [rsp + 0x30]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x50], esi
imul eax, ecx, 0x8e0
cmp edi, eax
ja 0x18004c9c8
cmp edi, 0x9b1f
ja 0x18004be8c
je 0x18004be16
cmp edi, 0x41af
ja 0x18004bd30
je 0x18004bce4
cmp edi, 0x3b
je 0x18004bcbe
cmp edi, 0x5d
je 0x18004bc5b
cmp edi, 0x20f5
je 0x18004bc3a
cmp edi, 0x33f3
jne 0x18004c837
mov rax, qword [r9]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov rax, qword [r13]
xor r9d, r9d
mov r8d, 0xf1
mov qword [rsp + 0x38], rax
call fcn.180037520
mov ebx, eax
test eax, eax
je 0x18004c837
cmp eax, 0x7f2bb784
jne 0x18004b8e3
jmp 0x18004c837
movsd xmm0, qword [str.ws2_3]
mov eax, dword [0x1800cb8a8]
movsd qword [rbp + 0x88], xmm0
mov dword [rbp + 0x90], eax
jmp 0x18004c837
mov rax, qword [r13]
lea r8, [rsp + 0x58]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x58], 7
lea rcx, [rbp - 0x20]
call fcn.1800b14b0
mov ebx, eax
test eax, eax
je 0x18004bca0
mov dword [rsp + 0x58], r15d
cmp eax, 0x7f2bb77c
jne 0x18004b8e3
jmp 0x18004c837
test byte [rbp - 0xc], 2
mov dword [rsp + 0x58], 1
je 0x18004c837
mov dword [rbp - 0x6c], 1
jmp 0x18004c837
mov r8d, 1
lea rdx, [0x1800cb7aa]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov dword [rbp + 0x82], 0x6c
jmp 0x18004c837
mov r14d, 2
lea rdx, [rbp + 0x92]
mov ecx, r14d
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov dword [rbp + 0x94], 0x2e
lea rdx, [0x1800cb894]
mov r8d, r14d
mov dword [rbp + 0x96], 0x64
lea rcx, [rbp + 0x88]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18004c837
cmp edi, 0x6269
je 0x18004bdc1
cmp edi, 0x6789
je 0x18004bd5e
cmp edi, 0x8323
jne 0x18004c837
mov eax, 2
mov word [rbp + 0x28], ax
jmp 0x18004c837
mov rax, qword [r13]
lea r8, [rsp + 0x70]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x70], 8
lea rcx, [rbp + 0x10]
call fcn.1800b14b0
mov ebx, eax
test eax, eax
je 0x18004bda3
mov dword [rsp + 0x70], r15d
cmp eax, 0x7f2bb77d
jne 0x18004b8e3
jmp 0x18004c837
test byte [rbp + 0x24], 2
mov dword [rsp + 0x70], 1
je 0x18004c837
mov dword [rbp - 0x58], 1
jmp 0x18004c837
xor r8d, r8d
lea r9, [rbp + 0x70]
lea rdx, [rbp + 0x38]
lea ecx, [r8 + 0x59]
call fcn.18009e510
xor r8d, r8d
mov qword [rbp - 0x40], rax
lea r9, [rbp + 0x88]
lea edx, [r8 + 9]
lea ecx, [rdx + 0x50]
call fcn.18009e510
xor r9d, r9d
mov qword [rbp - 0x48], rax
mov r8, r13
mov qword [rsp + 0x20], r15
xor ecx, ecx
lea edx, [r9 + 0x62]
call fcn.180081000
test al, al
je 0x18004ca0e
jmp 0x18004c837
mov rax, qword [r9]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
mov rax, qword [r13]
xor r9d, r9d
mov r8d, 0xf1
mov qword [rsp + 0x40], rax
call fcn.180037520
mov ebx, eax
test eax, eax
je 0x18004be50
cmp eax, 0x7f2bb784
jne 0x18004b8e3
cmp dword [rbp - 0x70], 0
je 0x18004c837
cmp dword [rsp + 0x4c], r14d
jne 0x18004c837
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
sub rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x80]
add rax, qword [rbp - 0x38]
cmp rax, qword [rcx]
jne 0x18004c837
mov edi, 0xceb5
jmp 0x18004c837
cmp edi, 0x1024b
ja 0x18004c7e5
je 0x18004c7d0
cmp edi, 0xa3dd
je 0x18004c7a9
cmp edi, 0xc497
je 0x18004c86d
cmp edi, 0xceb5
jne 0x18004c837
cmp dword [rbp - 0x70], 0
jne 0x18004c14a
mov r14d, dword [rsp + 0x58]
mov esi, 0xb
mov eax, esi
sub eax, 0xb
je 0x18004bf26
sub eax, 1
je 0x18004bef0
sub eax, 1
je 0x18004bf06
cmp eax, 1
jne 0x18004c131
test ebx, ebx
je 0x18004c131
mov esi, dword [rsp + 0x50]
mov edi, 0xceb5
jmp 0x18004c837
mov rax, qword [r13]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov ecx, 0xab
call fcn.180055e10
jmp 0x18004c12a
mov edx, dword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov r9, qword [r9]
add rcx, rdx
cmp r9, rcx
jne 0x18004bf8c
mov rcx, qword [rbp - 0x38]
add rcx, rdx
cmp qword [r10], rcx
mov ecx, dword [rsp + 0x68]
jne 0x18004bf90
cmp r11d, ecx
jne 0x18004bf90
lea eax, [r12 - 1]
cmp edx, eax
jge 0x18004bf90
mov rax, qword [r13]
lea r8, [rbp - 0x38]
inc dword [rbp - 0x28]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
mov edx, 0xdf
mov qword [rsp + 0x20], rax
call fcn.180036cc0
jmp 0x18004c12a
mov ecx, dword [rsp + 0x68]
mov rax, qword [rbp - 0x30]
dec rax
cmp r9, rax
jne 0x18004c01a
mov rax, qword [rbp - 0x38]
dec rax
cmp qword [r10], rax
jne 0x18004c01a
cmp r11d, ecx
jne 0x18004c01a
lea eax, [r12 - 1]
cmp dword [rbp - 0x28], eax
jge 0x18004c01a
mov edi, 0x8f
nop dword [rax]
mov eax, edi
sub eax, 0x8e
je 0x18004bfd3
cmp eax, 1
jne 0x18004c00b
inc dword [rbp - 0x28]
jmp 0x18004c00b
mov rax, qword [r13]
lea r8, [rbp - 0x38]
dec qword [rbp - 0x30]
lea rcx, [rsp + 0x40]
dec qword [rbp - 0x38]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov edx, 0xdf
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x20], rax
call fcn.180036cc0
mov ebx, eax
dec edi
cmp edi, 0x8d
ja 0x18004bfc0
jmp 0x18004c12c
test r14d, r14d
je 0x18004c0f6
mov rax, qword [rbp - 0x18]
dec rax
cmp r9, rax
jne 0x18004c0f6
mov rax, qword [rbp - 0x20]
dec rax
cmp qword [r10], rax
jne 0x18004c0f6
cmp r11d, dword [rbp - 0x6c]
jne 0x18004c0f6
lea eax, [r12 - 1]
cmp dword [rbp - 0x10], eax
jge 0x18004c0f6
mov edi, 0x8b
mov eax, edi
sub eax, 0x8b
je 0x18004c0ab
sub eax, 1
je 0x18004c0a5
cmp eax, 1
jne 0x18004c0e6
mov rax, qword [r13]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xdf
call fcn.180036cc0
mov ebx, eax
jmp 0x18004c0e6
dec qword [rbp - 0x20]
jmp 0x18004c0e6
mov rax, qword [r13]
lea r8, [rsp + 0x40]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], 7
lea rcx, [rbp - 0x20]
call fcn.1800b14b0
mov ebx, eax
test eax, eax
jne 0x18004bef8
inc dword [rbp - 0x10]
dec qword [rbp - 0x18]
inc edi
cmp edi, 0x8e
jb 0x18004c060
jmp 0x18004c12c
mov rax, qword [r13]
lea r8, [rsp + 0x38]
cmp r9, qword [rbp - 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 8]
mov ecx, 0x102
mov dword [rsp + 0x40], r15d
jb 0x18004c125
mov dword [rsp + 0x40], 1
call fcn.1800a7120
mov ebx, eax
mov r11d, dword [rsp + 0x4c]
inc esi
cmp esi, 0xf
jae 0x18004bef8
mov r10, qword [rbp - 0x80]
mov r9, qword [rsp + 0x78]
jmp 0x18004bed6
mov rdx, qword [r9]
cmp rdx, qword [rbp - 0x30]
jne 0x18004c21b
cmp dword [rbp - 0x28], 1
jne 0x18004c21b
cmp qword [r10], 0
je 0x18004c1a1
mov rax, qword [r13]
lea r8, [rbp - 8]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xdf
call fcn.180036cc0
mov ebx, eax
mov edi, 0xceb5
jmp 0x18004c837
mov edi, 0x99
mov eax, edi
sub eax, 0x99
je 0x18004c1e0
cmp eax, 0x65
jne 0x18004c206
test ebx, ebx
jne 0x18004b8e3
mov rax, qword [r13]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov ecx, 0xab
call fcn.180055e10
cmp eax, 0x7f2bb780
je 0x18004c206
jmp 0x18004c204
mov rax, qword [r13]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov edx, 0xb5
mov dword [rsp + 0x40], r15d
xor ecx, ecx
call fcn.1800ba4e0
mov ebx, eax
add edi, 0x65
cmp edi, 0x163
jb 0x18004c1a6
mov edi, 0xceb5
jmp 0x18004c837
mov ecx, dword [rbp - 0x28]
dec rcx
add rcx, qword [rbp - 0x30]
cmp rdx, rcx
jne 0x18004c46c
mov r14d, 0x36
cmp r14d, 0x36
je 0x18004c254
cmp r14d, 0xc0
jne 0x18004c44f
test ebx, ebx
jne 0x18004bef8
jmp 0x18004c44f
cmp qword [r10], 0
je 0x18004c40d
mov esi, 0xe6
mov eax, esi
sub eax, 0xe6
je 0x18004c2b8
sub eax, 1
je 0x18004c287
cmp eax, 1
jne 0x18004c3ff
test ebx, ebx
jne 0x18004bef8
jmp 0x18004c3ff
mov rax, qword [r13]
lea r8, [rsp + 0x40]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], 8
lea rcx, [rbp - 0x38]
call fcn.1800b14b0
mov ebx, eax
jmp 0x18004c3ec
test r8d, r8d
je 0x18004c3b9
mov rax, qword [rbp - 0x18]
dec rax
cmp qword [r9], rax
jne 0x18004c3b9
mov rax, qword [rbp - 0x20]
dec rax
cmp qword [r10], rax
jne 0x18004c3b9
cmp r11d, dword [rbp - 0x6c]
jne 0x18004c3b9
lea eax, [r12 - 1]
cmp dword [rbp - 0x10], eax
jge 0x18004c3b9
mov edi, 0xb7
nop
cmp edi, 0xb7
je 0x18004c379
cmp edi, 0xa02
je 0x18004c368
cmp edi, 0x134d
je 0x18004c362
cmp edi, 0x1c98
je 0x18004c332
cmp edi, 0x25e3
jne 0x18004c3a5
test ebx, ebx
jne 0x18004bef8
jmp 0x18004c3a5
mov rax, qword [r13]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xdf
call fcn.180036cc0
jmp 0x18004c3a3
dec qword [rbp - 0x20]
jmp 0x18004c3a5
test ebx, ebx
jne 0x18004bef8
inc dword [rbp - 0x10]
dec qword [rbp - 0x18]
jmp 0x18004c3a5
mov rax, qword [r13]
lea r8, [rsp + 0x40]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], 7
lea rcx, [rbp - 0x20]
call fcn.1800b14b0
mov ebx, eax
add edi, 0x94b
cmp edi, 0x2e77
jbe 0x18004c300
jmp 0x18004c3e4
mov rax, qword [r13]
lea r9, [rbp - 8]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov ecx, 0x102
call fcn.1800a7120
mov ebx, eax
test ebx, ebx
jne 0x18004bef8
mov r8d, dword [rsp + 0x58]
mov r9, qword [rsp + 0x78]
mov r11d, dword [rsp + 0x4c]
mov r10, qword [rbp - 0x80]
inc esi
cmp esi, 0xe9
jb 0x18004c263
mov rax, qword [r13]
lea r8, [rbp - 0x38]
dec dword [rbp - 0x28]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rax
xor r9d, r9d
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
mov edx, 0xdf
mov qword [rsp + 0x20], rax
call fcn.180036cc0
mov r11d, dword [rsp + 0x4c]
mov ebx, eax
mov r9, qword [rsp + 0x78]
mov r8d, dword [rsp + 0x58]
add r14d, 0x8a
cmp r14d, 0x14a
jae 0x18004bef8
mov r10, qword [rbp - 0x80]
jmp 0x18004c234
cmp rdx, qword [rbp - 0x30]
jne 0x18004c68f
mov r14d, 0x107
nop dword [rax]
mov eax, r14d
sub eax, 0x107
je 0x18004c4d0
cmp eax, 1
jne 0x18004c66c
mov rax, qword [r13]
lea r8, [rbp - 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xdf
call fcn.180036cc0
mov ebx, eax
test eax, eax
jne 0x18004bef8
jmp 0x18004c66c
cmp qword [r10], 0
je 0x18004c661
mov esi, 0xfc
nop
cmp esi, 0xfc
je 0x18004c501
cmp esi, 0xa464
jne 0x18004c64f
test ebx, ebx
jne 0x18004bef8
jmp 0x18004c64f
cmp dword [rsp + 0x70], 0
je 0x18004c5e5
mov r8d, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x18]
add rcx, r8
cmp qword [r9], rcx
jne 0x18004c5e5
mov rcx, qword [rbp + 0x10]
add rcx, r8
cmp qword [r10], rcx
jne 0x18004c5e5
cmp r11d, dword [rbp - 0x58]
jne 0x18004c5e5
lea eax, [r12 - 1]
cmp r8d, eax
jge 0x18004c5e5
mov edi, 0x117
nop dword [rax]
cmp edi, 0x117
je 0x18004c5a5
cmp edi, 0x7c3e
je 0x18004c598
cmp edi, 0xf765
jne 0x18004c5d1
mov rax, qword [r13]
lea r8, [rbp + 0x10]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xdf
call fcn.180036cc0
jmp 0x18004c5cf
test ebx, ebx
jne 0x18004bef8
inc dword [rbp + 0x20]
jmp 0x18004c5d1
mov rax, qword [r13]
lea r8, [rsp + 0x40]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], 8
lea rcx, [rbp + 0x10]
call fcn.1800b14b0
mov ebx, eax
add edi, 0x7b27
cmp edi, 0x17175
jbe 0x18004c550
jmp 0x18004c60d
mov rax, qword [r13]
lea r9, [rbp - 8]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
mov ecx, 0x102
call fcn.1800a7120
mov ebx, eax
test ebx, ebx
jne 0x18004bef8
mov rax, qword [r13]
lea r8, [rsp + 0x40]
mov r9d, 0x136
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x40], 7
lea rcx, [rbp - 0x38]
call fcn.1800b14b0
mov r10, qword [rbp - 0x80]
mov ebx, eax
mov r11d, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x78]
add esi, 0xa368
cmp esi, 0x146d0
jbe 0x18004c4e0
inc qword [rbp - 0x38]
inc qword [rbp - 0x30]
dec dword [rbp - 0x28]
inc r14d
cmp r14d, 0x109
jae 0x18004bef8
mov r10, qword [rbp - 0x80]
mov r11d, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x78]
jmp 0x18004c480
mov edi, 0x3f
mov eax, edi
sub eax, 0x3f
je 0x18004c78d
sub eax, 1
je 0x18004c74a
sub eax, 1
je 0x18004c6f8
sub eax, 1
je 0x18004c6c8
cmp eax, 1
jne 0x18004c790
test ebx, ebx
jne 0x18004b8df
jmp 0x18004c790
mov rax, qword [r13]
lea r9, [rbp - 0x38]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov ecx, 0x102
call fcn.1800a7120
mov ebx, eax
jmp 0x18004c790
cmp qword [r10], 0
je 0x18004c731
mov rax, qword [r13]
lea r9, [rbp - 8]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov ecx, 0x102
call fcn.1800a7120
mov ebx, eax
test eax, eax
jne 0x18004b8df
mov edx, dword [rbp - 0x28]
mov eax, esi
sub eax, edx
lea ecx, [rdx + 1]
add qword [rbp - 0x38], rcx
add qword [rbp - 0x30], rcx
dec eax
mov dword [rbp - 0x28], eax
jmp 0x18004c790
mov eax, dword [r9]
lea r8, [rbp - 0x38]
sub eax, dword [rbp - 0x30]
lea rcx, [rsp + 0x40]
mov dword [rbp - 0x28], eax
xor r9d, r9d
mov rax, qword [r13]
mov edx, 0xdf
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r15d
call fcn.180036cc0
mov ebx, eax
test eax, eax
jne 0x18004b8df
jmp 0x18004c790
mov esi, dword [rbp - 0x28]
inc edi
cmp edi, 0x44
jae 0x18004b8df
mov r10, qword [rbp - 0x80]
mov r9, qword [rsp + 0x78]
jmp 0x18004c694
mov eax, dword [r9]
movzx ecx, word [r10]
mov dword [rbp + 0x2c], eax
call qword [rbp - 0x48]
mov rcx, qword [r13]
lea rdx, [rbp + 0x28]
mov r8d, 0x10
mov word [rbp + 0x2a], ax
call qword [rbp - 0x40]
mov dword [rbp - 0x78], eax
jmp 0x18004c837
mov rax, qword [r13]
mov ecx, dword [rax + 0xa8]
cmp edx, ecx
cmovle ecx, edx
mov dword [rsp + 0x48], ecx
jmp 0x18004c837
cmp edi, 0x135e1
je 0x18004c809
cmp edi, 0x16977
je 0x18004c803
cmp edi, 0x19d0d
je 0x18004c9c8
jmp 0x18004c837
mov dword [rsp + 0x60], ebx
jmp 0x18004c837
mov rax, qword [rbp - 0x60]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], rax
lea rcx, [rbp - 0x50]
mov rax, qword [r13]
mov r8d, 0xac
mov dword [rsp + 0x40], edx
lea rdx, [rsp + 0x40]
mov qword [rbp - 0x50], rax
call fcn.18007ca70
imul eax, dword [rsp + 0x30], 0x8e
mov r10, qword [rbp - 0x80]
mov r11d, dword [rsp + 0x4c]
mov r9, qword [rsp + 0x78]
mov r12d, dword [rbp - 0x68]
mov r8d, dword [rsp + 0x58]
add edi, eax
mov r14d, dword [rsp + 0x68]
xor r15d, r15d
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x30]
jmp 0x18004bba3
cmp dword [rbp - 0x78], 0xffffffff
jne 0x18004c9c3
mov esi, dword [rbp - 0x78]
mov ebx, r15d
movzx edi, byte [rbp - 0x54]
mov edx, 0x745f
mov r14d, 0x5473
mov r12d, 0x7070
cmp ebx, 0xa
ja case.default.0x18004c8af
lea r8, [0x180000000]
mov eax, ebx
mov ecx, dword [r8 + rax*4 + 0x4ca98]
add rcx, r8
jmp rcx
mov byte [rbp + 0x4d], 0x41
jmp case.default.0x18004c8af
lea r8, [rbp - 0x60]
mov dword [rbp - 0x78], r15d
lea rdx, [rbp - 0x78]
mov qword [rbp - 0x60], r15
lea rcx, [rbp - 0x50]
call sub.RPCRT4.dll_MesEncodeDynBufferHandleCreate
mov esi, eax
mov edx, 0x745f
jmp case.default.0x18004c8af
lea rax, [rbp + 0x40]
mov dil, 1
mov qword [rbp - 0x50], rax
jmp case.default.0x18004c8af
mov r8d, 1
mov byte [rbp + 0x59], 0
lea rdx, [0x1800cb7ba]
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1800cb7d6]
lea rcx, [rbp + 0x5a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 0x745f
mov byte [rbp + 0x5c], 0
jmp case.default.0x18004c8af
mov dword [rbp + 0x4e], 0x745f3131
jmp case.default.0x18004c8af
mov r8d, 3
mov byte [rbp + 0x45], 0
lea rdx, [0x1800cb814]
lea rcx, [rbp + 0x45]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x1800cb838]
mov edx, 0x745f
mov dword [rbp + 0x48], eax
movzx eax, byte [0x1800cb83c]
mov byte [rbp + 0x4c], al
jmp case.default.0x18004c8af
mov byte [rbp + 0x4e], 0
jmp case.default.0x18004c8af
mov r8d, 3
mov dword [rbp + 0x52], 0x6e696d69
lea rdx, [0x1800cb879]
mov byte [rbp + 0x56], 0
lea rcx, [rbp + 0x56]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edx, 0x745f
jmp case.default.0x18004c8af
mov word [rbp + 0x43], r14w
jmp case.default.0x18004c8af
mov byte [rbp + 0x40], 0x69
mov word [rbp + 0x41], r12w
mov byte [rbp + 0x43], 0
inc ebx
lea eax, [rbx + 0x9c]
cmp eax, 0xa7
jb 0x18004c892
mov byte [rsp + 0x60], 1
mov eax, dword [rsp + 0x60]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1800c0ae0
mov rbx, qword [rsp + 0x200]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test esi, esi
movzx eax, dil
cmove r15d, eax
test r15b, r15b
je 0x18004ca0e
mov rcx, qword [rbp - 0x60]
call sub.RPCRT4.dll_MesHandleFree
mov byte [rsp + 0x60], 0
jmp 0x18004c9c8