Function at 0x100030ab0
Capabilities:
Get disk size
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1b8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rdi, qword [rsp + 0x220]
mov rbx, qword [rsp + 0x230]
mov r12, qword [rsp + 0x238]
mov r15, qword [rsp + 0x228]
xor eax, eax
mov ebp, r9d
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x160], r12
mov dword [rsp + 0xa8], ebp
mov qword [rsp + 0x148], r8
mov qword [rsp + 0x150], rdx
mov r14, rcx
mov dword [rsp + 0xc8], eax
mov dword [rsp + 0x94], eax
mov rsi, rax
mov qword [r11 - 0x140], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [r11 - 0x110], rax
mov r13, rax
mov qword [rsp + 0x80], rax
mov qword [r11 - 0x118], rax
mov dword [rsp + 0x74], eax
mov qword [r11 - 0x108], rax
mov byte [rsp + 0x7a], al
mov byte [rsp + 0x79], al
mov byte [rsp + 0x91], al
mov dword [rsp + 0xd8], eax
mov byte [rsp + 0x90], al
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100030bcc
test byte [rcx + 0x1c], 1
je 0x100030bcc
cmp byte [rcx + 0x19], 4
jb 0x100030bcc
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1bc
call fcn.10001c854
cmp ebp, dword [r14 + 0x170]
je 0x100030bed
lea r8, [0x100004ea8]
lea rcx, [0x100004680]
mov edx, 0x2934
call fcn.10009a050
mov byte [rbx], sil
and dword [r12], esi
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r14 + 0xe0]
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [r14 + 0xe0]
lea rcx, [rsp + 0x90]
mov dword [r15 + 0x10], r11d
call fcn.1000a2fe4
mov r12d, eax
test eax, eax
jns 0x100030c76
mov rcx, qword [0x1001653b8]
lea rbp, [0x1001653b8]
cmp rcx, rbp
je 0x100032721
test byte [rcx + 0x1c], 1
je 0x100032721
cmp byte [rcx + 0x19], 2
jb 0x100032721
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1bd
mov r9d, eax
call fcn.10001c878
jmp 0x100032721
mov rcx, qword [r14 + 0x158]
lea r8, [rsp + 0xb8]
lea rdx, [0x100002934]
call fcn.10009bb88
mov r12d, eax
mov dword [rsp + 0xa4], eax
test eax, eax
js 0x100032712
mov rbx, rbp
shl rbx, 4
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rsp + 0xf8], rax
test rax, rax
jne 0x100030ccb
mov r12d, 0x8007000e
jmp 0x100032712
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r11d, ebp
shl r11d, 4
mov ecx, r11d
mov ebx, r11d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rsp + 0x100], rax
test rax, rax
je 0x100030cc0
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
cmp dword [r15 + 8], ebp
jae 0x100032654
xor edi, edi
neg byte [rsp + 0x79]
mov byte [rsp + 0x71], dil
mov byte [rsp + 0x70], dil
sbb eax, eax
mov byte [rsp + 0x79], dil
mov edi, dword [r15 + 8]
and eax, dword [rsp + 0xd8]
mov rsi, rdi
lea rbx, [r14 + 0x58]
mov dword [rsp + 0xd8], eax
mov rax, qword [rsp + 0x148]
imul rsi, rsi, 0x160
add rsi, qword [r14 + 0xd8]
mov rbp, qword [rax + rdi*8]
mov rcx, rbx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
mov dword [r14 + 0x174], edi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x190]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test byte [rsi + 0x54], 1
je 0x100030dba
mov ecx, dword [r15 + 8]
mov rax, qword [rsp + 0x148]
lea rdx, [rsp + 0xe8]
mov rcx, qword [rax + rcx*8]
call fcn.10009ba10
xor edi, edi
jmp 0x100030eef
mov rax, qword [r14 + 0x1b0]
xor edi, edi
mov ebx, edi
cmp dword [rax + 0x50], edi
jbe 0x100030e07
mov rax, qword [rax + 0x58]
mov rdx, rbp
lea r13, [rdi + rax]
mov qword [rsp + 0x168], r13
mov rcx, qword [r13 + 0x10]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100030dfd
mov rax, qword [r14 + 0x1b0]
inc ebx
add rdi, 0x30
cmp ebx, dword [rax + 0x50]
jb 0x100030dca
mov r13, qword [rsp + 0x80]
xor edi, edi
mov rax, qword [r14 + 0x1b0]
cmp ebx, dword [rax + 0x50]
jne 0x100030e6e
mov ebp, dword [rsi + 0x20]
test ebp, ebp
js 0x100030e5b
mov ebp, 0x80780020
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100030e5b
test byte [rcx + 0x1c], 1
je 0x100030e5b
cmp byte [rcx + 0x19], 2
jb 0x100030e5b
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1be
call fcn.10001db08
mov bl, byte [rsp + 0x71]
mov byte [rsp + 0x70], 1
mov dil, byte [rsp + 0x70]
jmp 0x10003245b
mov rcx, qword [rsp + 0xe8]
cmp rcx, rdi
je 0x100030e89
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rsp + 0xe8], rdi
mov rax, qword [rsp + 0x168]
mov rcx, qword [rax + 0x18]
cmp rcx, rdi
jne 0x100030ee2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100030ed1
test byte [rcx + 0x1c], 1
je 0x100030ed1
cmp byte [rcx + 0x19], 2
jb 0x100030ed1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1bf
mov r9, rbp
call fcn.10001db08
mov bl, byte [rsp + 0x71]
mov ebp, 0x80780020
mov dil, 1
jmp 0x10003252a
lea rdx, [rsp + 0xe8]
call fcn.10009ba10
cmp eax, edi
mov ebp, eax
jl 0x100032454
test byte [rsi + 0x54], 0x40
je 0x100030f6b
mov rdx, rsi
mov rcx, r14
call fcn.10002f918
cmp eax, edi
mov r12d, eax
mov dword [rsp + 0xa4], eax
jl 0x1000326f4
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r14 + 0xe4]
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [r14 + 0xe4]
mov rcx, qword [rsp + 0xf8]
movdqu xmm0, xmmword [rsp + 0x190]
mov dword [r15 + 0xc], r11d
mov eax, dword [r14 + 0x174]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
inc dword [r15 + 8]
jmp 0x1000325dc
test byte [rsi + 0x54], 8
jne 0x100031016
test byte [rsi + 0x54], 0x20
jne 0x100030f93
lea r8, [0x100004ec8]
lea rcx, [0x100004680]
mov edx, 0x29d0
call fcn.10009a050
mov rax, qword [0x1001653b8]
lea rcx, [0x1001653b8]
cmp rax, rcx
je 0x100030fea
test byte [rax + 0x1c], 1
je 0x100030fea
cmp byte [rax + 0x19], 4
jb 0x100030fea
lea rdx, [rsi + 0x44]
lea rcx, [rsp + 0x158]
call fcn.100044104
mov rcx, qword [0x1001653b8]
or dword [rsp + 0xc8], 1
mov rcx, qword [rcx + 0x10]
mov r9, qword [rax]
lea r8, [0x100003cc8]
mov edx, 0x1c0
call fcn.10001db08
mov eax, dword [rsp + 0xc8]
test al, 1
je 0x100030f62
mov rcx, qword [rsp + 0x158]
and eax, 0xfffffffe
mov dword [rsp + 0xc8], eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x100030f62
mov r8b, 1
mov edx, 8
mov rcx, r14
call fcn.1000386ec
mov rdi, qword [rsp + 0xc0]
mov dword [r15 + 0x2c], 8
mov eax, dword [rdi + 8]
xor ebx, ebx
cmp dword [r15 + 8], eax
jne 0x100031050
cmp qword [rdi + 0x30], rbx
je 0x100031050
mov r13, qword [rdi + 0x30]
jmp 0x10003155f
cmp r13, rbx
je 0x100031069
cmp r13, qword [r15 + 0x30]
je 0x100031069
cmp r13, qword [rdi + 0x30]
je 0x100031069
mov rcx, r13
call fcn.1000d24b8
test byte [rsi + 0x54], 1
mov r13, rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0xb0], rbx
je 0x1000310d8
mov rcx, r14
call fcn.10003983c
cmp eax, ebx
mov ebp, eax
jge 0x1000310d8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100032454
test byte [rcx + 0x1c], 1
je 0x100032454
cmp byte [rcx + 0x19], 2
jb 0x100032454
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1c1
mov r9d, r12d
call fcn.10001c878
jmp 0x100032454
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r14 + 0x174]
lea rcx, [r14 + 0x58]
imul r11, r11, 0x160
add r11, qword [r14 + 0xd8]
mov qword [r11], rbx
mov qword [r11 + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test byte [r14 + 0x150], 0x10
jne 0x10003113c
cmp byte [r14 + 0x17c], bl
jne 0x100031124
cmp byte [r14 + 0x17d], bl
je 0x10003113c
lea r8, [0x100004f00]
lea rcx, [0x100004680]
mov edx, 0x2a0a
call fcn.10009a050
mov rcx, qword [0x1001653b8]
lea rbx, [0x1001653b8]
cmp rcx, rbx
je 0x10003118a
test byte [rcx + 0x1c], 1
je 0x10003118a
cmp byte [rcx + 0x19], 4
mov r13, qword [rsp + 0x98]
jb 0x100031192
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1c2
mov r9, r13
mov qword [rsp + 0x20], rax
call fcn.10001df74
jmp 0x100031192
mov r13, qword [rsp + 0x98]
mov ecx, dword [r14 + 0x174]
mov rax, qword [r14 + 0xd8]
imul rcx, rcx, 0x160
lea rcx, [rcx + rax + 0x8c]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, qword [r14 + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x1000311cc
or rcx, rcx
cmp qword [r14 + 0x30], 0xffffffffffffffff
cmovne rcx, qword [r14 + 0x30]
mov eax, dword [r14 + 0x150]
mov r9b, byte [r14 + 0x17d]
mov r8b, byte [r14 + 0x17c]
lea rdx, [rsp + 0x74]
shr eax, 4
mov qword [rsp + 0x58], rdx
lea rdx, [rsp + 0x108]
and al, 1
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x180]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
lea rcx, [fcn.10002d61c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0xe8]
mov dl, al
call fcn.1000ca8f4
mov edx, dword [r14 + 0x174]
mov rcx, qword [r14 + 0xd8]
imul rdx, rdx, 0x160
lea rcx, [rdx + rcx + 0x94]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x1001653b8]
cmp r10, rbx
je 0x10003131a
test byte [r10 + 0x1c], 1
je 0x10003131a
cmp byte [r10 + 0x19], 4
jb 0x10003131a
mov rcx, qword [r14 + 0xd8]
mov edx, dword [r14 + 0x174]
lea r8, [0x100003cc8]
imul rdx, rdx, 0x160
mov eax, dword [rdx + rcx + 0x8c]
mov dword [rsp + 0x128], eax
mov eax, dword [rdx + rcx + 0x90]
mov dword [rsp + 0x12c], eax
mov eax, dword [rdx + rcx + 0x94]
mov dword [rsp + 0x138], eax
mov eax, dword [rdx + rcx + 0x98]
mov dword [rsp + 0x13c], eax
movabs rax, 0x346dc5d63886594b
mov rcx, qword [rsp + 0x138]
sub rcx, qword [rsp + 0x128]
mul rcx
mov rcx, qword [r10 + 0x10]
mov r9, rdx
mov edx, 0x1c3
shr r9, 0xb
call fcn.10001d71c
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r14 + 0x174]
mov rdi, qword [rsp + 0x108]
imul r11, r11, 0x160
add r11, qword [r14 + 0xd8]
mov rbx, qword [rsp + 0x110]
lea rcx, [r14 + 0x58]
mov qword [r11], rdi
mov qword [r11 + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [r15 + 0x20], rbx
mov qword [r15 + 0x18], rdi
mov ecx, esi
test esi, esi
je 0x100031547
sub ecx, 1
je 0x10003150b
sub ecx, 3
je 0x10003148a
sub ecx, 1
je 0x100031413
sub ecx, 1
je 0x10003148a
sub ecx, 1
je 0x100031413
cmp ecx, 0xf
je 0x10003148a
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000313e1
test byte [rcx + 0x1c], 1
je 0x1000313e1
cmp byte [rcx + 0x19], 2
jb 0x1000313e1
mov eax, dword [rsp + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov dword [rsp + 0x28], eax
mov edx, 0x1c6
mov r9, r13
mov dword [rsp + 0x20], esi
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, esi
call fcn.10010de1c
mov r13, qword [rsp + 0xb0]
mov qword [rsp + 0x80], r13
mov rsi, qword [rsp + 0x88]
mov ebp, eax
jmp 0x100032454
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100031456
test byte [rcx + 0x1c], 1
je 0x100031456
cmp byte [rcx + 0x19], 2
jb 0x100031456
mov eax, dword [rsp + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov dword [rsp + 0x28], eax
mov edx, 0x1c5
mov r9, r13
mov dword [rsp + 0x20], esi
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, esi
call fcn.10010de1c
mov r13, qword [rsp + 0xb0]
mov qword [rsp + 0x80], r13
mov ebp, eax
mov bl, 1
mov rsi, qword [rsp + 0x88]
jmp 0x100030e64
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000314cd
test byte [rcx + 0x1c], 1
je 0x1000314cd
cmp byte [rcx + 0x19], 2
jb 0x1000314cd
mov eax, dword [rsp + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov dword [rsp + 0x28], eax
mov edx, 0x1c4
mov r9, r13
mov dword [rsp + 0x20], esi
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, esi
call fcn.10010de1c
mov r13, qword [rsp + 0xb0]
mov dil, 1
mov qword [rsp + 0x80], r13
mov rsi, qword [rsp + 0x88]
mov bl, byte [rsp + 0x71]
mov byte [rsp + 0x70], dil
mov ebp, eax
jmp 0x10003245b
mov rax, qword [r14 + 0x18]
lea rcx, [r14 + 0x18]
call qword [rax + 0x10]
mov r13, qword [rsp + 0xb0]
mov bl, byte [rsp + 0x71]
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x80], r13
mov dil, bl
test al, al
je 0x10003245b
mov ebp, 0x8078001d
jmp 0x10003245b
mov r13, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0xc0]
mov qword [r15 + 0x30], r13
mov eax, dword [rdi + 8]
mov qword [rsp + 0x80], r13
cmp dword [r15 + 8], eax
jne 0x1000315a4
cmp qword [rdi + 0x30], 0
jne 0x100031585
test byte [rsi + 0x54], 1
jne 0x100031585
mov qword [rdi + 0x30], r13
cmp dword [r15 + 8], eax
jne 0x1000315a4
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1000315a4
mov ebx, dword [rdi + 0x40]
mov qword [rsp + 0xe0], rcx
jmp 0x100031668
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x1000315c3
cmp rcx, qword [r15 + 0x38]
je 0x1000315c3
cmp rcx, qword [rdi + 0x38]
je 0x1000315c3
call qword [sym.imp.KERNEL32.dll_LocalFree]
and qword [rsp + 0xe0], 0
and dword [rsp + 0xd0], 0
lea r9, [rsp + 0x74]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xe0]
mov rcx, r13
call fcn.1000ce998
mov ebx, eax
test eax, eax
je 0x100031659
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003163f
test byte [rcx + 0x1c], 1
je 0x10003163f
cmp byte [rcx + 0x19], 2
jb 0x10003163f
mov edx, 0x1c7
mov eax, dword [rsp + 0x74]
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x100003cc8]
mov dword [rsp + 0x20], ebx
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, ebx
call fcn.10010de1c
mov ebp, eax
jmp 0x100032454
mov rcx, qword [rsp + 0xe0]
mov ebx, dword [rsp + 0xd0]
mov qword [r15 + 0x38], rcx
mov dword [r15 + 0x40], ebx
mov eax, dword [rdi + 8]
cmp dword [r15 + 8], eax
jne 0x10003168d
cmp qword [rdi + 0x38], 0
jne 0x10003168d
test byte [rsi + 0x54], 1
jne 0x10003168d
mov qword [rdi + 0x38], rcx
mov dword [rdi + 0x40], ebx
mov ebp, 9
mov r8b, 1
mov rcx, r14
mov edx, ebp
call fcn.1000386ec
mov edx, ebp
mov rcx, r15
call fcn.100021fd4
mov rdx, qword [rsp + 0xe0]
lea r9, [rsp + 0x74]
mov r8d, ebx
mov rcx, r13
call fcn.1000ceb58
mov ebx, eax
test eax, eax
je 0x1000316fc
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003163f
test byte [rcx + 0x1c], 1
je 0x10003163f
cmp byte [rcx + 0x19], 2
jb 0x10003163f
mov edx, 0x1c8
jmp 0x10003161b
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x10003171b
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rsp + 0xf0], 0
mov r8d, dword [rsi + 0x54]
mov rcx, qword [r14 + 0x1d8]
lea rdx, [rsi + 0x44]
lea r9, [rsp + 0xf0]
call fcn.100120c14
mov ebp, eax
test eax, eax
js 0x100032454
lea rcx, [r14 + 0x28]
xor edx, edx
call fcn.10010b1d8
mov r12d, eax
mov dword [rsp + 0xa4], eax
test eax, eax
js 0x1000325f7
mov edx, dword [r14 + 0x14c]
mov rcx, qword [r14 + 0x1d8]
xor r9d, r9d
xor r8d, r8d
call fcn.10010c79c
mov ebp, eax
test eax, eax
jns 0x10003178c
mov bl, 1
mov r13, qword [rsp + 0x80]
jmp 0x100030e64
mov r12, qword [rsp + 0xf0]
mov edx, dword [r14 + 0x14c]
mov r9b, 1
mov rcx, r12
xor r8d, r8d
call fcn.10010c79c
mov ebp, eax
test eax, eax
js 0x10003177d
lea rcx, [r14 + 0x28]
call fcn.10010b368
mov rdx, r12
mov rcx, r14
call fcn.10002d8a0
mov ebp, eax
test eax, eax
jns 0x10003180a
mov bl, 1
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003177f
test byte [rcx + 0x1c], bl
je 0x10003177f
cmp byte [rcx + 0x19], 2
jb 0x10003177f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1c9
mov r9, r12
mov dword [rsp + 0x20], ebp
call fcn.10001ddb0
jmp 0x10003177f
lea rcx, [r14 + 0x28]
xor edx, edx
call fcn.10010b1d8
mov r12d, eax
mov dword [rsp + 0xa4], eax
test eax, eax
js 0x1000325f7
mov rsi, qword [rsp + 0xb8]
lea r9, [rsp + 0x188]
lea r8, [rsp + 0x178]
lea rdx, [rsp + 0x170]
mov rcx, rsi
xor ebx, ebx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x100031864
mov rcx, rsi
call fcn.100134b20
mov ebp, eax
jmp 0x100031876
mov rbx, qword [rsp + 0x178]
mov rdi, qword [rsp + 0x170]
xor ebp, ebp
and qword [rsp + 0x118], 0
lea rax, [rsp + 0x118]
lea r12, [0x100004f50]
mov rdx, r12
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor sil, sil
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000319ad
and dword [rsp + 0xd0], eax
mov rcx, qword [rsp + 0x118]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
lea rdx, [0x100004fa8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0xb0], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100031926
mov eax, dword [rsp + 0xd0]
shl rax, 0x14
test rax, rax
je 0x10003191d
cmp rax, rdi
jae 0x10003191d
mov rdi, rax
mov sil, 1
lea r12, [0x1001653b8]
jmp 0x100031961
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10003199d
test byte [rcx + 0x1c], 1
je 0x100031968
cmp byte [rcx + 0x19], 5
jb 0x100031968
mov rcx, qword [rcx + 0x10]
lea r9, [0x100004f50]
lea r8, [0x100003cc8]
mov edx, 0x1ca
call fcn.10001db08
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10003199d
test byte [rcx + 0x1c], 1
je 0x10003199d
cmp byte [rcx + 0x19], 4
jb 0x10003199d
mov rcx, qword [rcx + 0x10]
lea rax, [0x100004f50]
lea r8, [0x100003cc8]
mov edx, 0x1cb
mov r9, rdi
mov qword [rsp + 0x20], rax
call fcn.10001ea30
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000319e4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000319f2
test byte [rcx + 0x1c], 1
je 0x1000319f2
cmp byte [rcx + 0x19], 5
jb 0x1000319f2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1cc
mov r9, r12
call fcn.10001db08
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
test ebp, ebp
jns 0x100031a05
mov bl, 1
mov r13, qword [rsp + 0x80]
jmp 0x10003147d
cmp rcx, rax
je 0x100031a33
test byte [rcx + 0x1c], 1
je 0x100031a33
cmp byte [rcx + 0x19], 4
jb 0x100031a33
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1cd
mov r9, rbx
mov qword [rsp + 0x20], rdi
call fcn.10001d7b0
lea rcx, [r14 + 0x28]
call fcn.10010b368
test byte [r14 + 0x150], 2
je 0x100031bd7
mov r12, qword [rsp + 0xc0]
mov eax, dword [r15 + 0xc]
cmp eax, dword [r12 + 0xc]
jne 0x100031a84
mov bl, 1
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x100031ae8
test byte [rcx + 0x1c], bl
je 0x100031ae8
cmp byte [rcx + 0x19], 4
jb 0x100031ae8
mov edx, 0x1ce
jmp 0x100031ac8
ja 0x100031a9e
lea r8, [0x100004fc0]
lea rcx, [0x100004680]
mov edx, 0x2b28
call fcn.10009a050
xor bl, bl
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100031aef
test byte [rcx + 0x1c], 1
je 0x100031aef
cmp byte [rcx + 0x19], 4
jb 0x100031aef
mov eax, dword [r15 + 0xc]
mov edx, 0x1cf
mov r9d, dword [r12 + 0xc]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov dword [rsp + 0x20], eax
call fcn.10001d914
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
mov edx, 0x1400000
cmp rdi, rdx
ja 0x100031b41
neg bl
mov bl, 1
sbb ebp, ebp
and ebp, 0x44
add ebp, 0x80780030
cmp rcx, rax
je 0x1000319f8
test byte [rcx + 0x1c], bl
je 0x1000319f8
cmp byte [rcx + 0x19], 3
jb 0x1000319f8
mov edx, 0x1d0
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov r9, rdi
call fcn.10001d71c
jmp 0x1000319f8
test sil, sil
jne 0x100031b96
mov r8d, 0x40000000
cmp rdi, r8
ja 0x100031b96
test bl, bl
je 0x100031b96
mov ebp, 0x80780080
mov bl, 1
cmp rcx, rax
je 0x100031b89
test byte [rcx + 0x1c], bl
je 0x100031b89
cmp byte [rcx + 0x19], 3
jb 0x100031b89
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], r8
lea r8, [0x100003cc8]
mov edx, 0x1d1
mov r9, rdi
call fcn.1000c2d48
mov rsi, qword [rsp + 0x88]
jmp 0x100032525
sub rdi, rdx
cmp rdi, 0x1100000
ja 0x100031bd7
neg bl
mov bl, 1
sbb ebp, ebp
and ebp, 0x44
add ebp, 0x80780030
cmp rcx, rax
je 0x1000319f8
test byte [rcx + 0x1c], bl
je 0x1000319f8
cmp byte [rcx + 0x19], 3
jb 0x1000319f8
mov edx, 0x1d2
jmp 0x100031b29
test byte [r14 + 0x150], 4
mov rsi, qword [rsp + 0x100]
mov bl, 1
mov byte [rsp + 0x78], bl
je 0x100031c28
mov r9d, dword [r14 + 0x174]
mov rdx, qword [rsp + 0x150]
lea r8, [rsp + 0x78]
shl r9d, 4
mov rcx, r14
add r9, rsi
call fcn.10002bd30
mov r12d, eax
mov dword [rsp + 0xa4], eax
test eax, eax
js 0x1000326ec
mov bl, byte [rsp + 0x78]
lea rcx, [r14 + 0x58]
mov byte [rsp + 0x78], bl
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r14 + 0x174]
lea rcx, [r14 + 0x58]
imul r11, r11, 0x160
add r11, qword [r14 + 0xd8]
and qword [r11], 0
and qword [r11 + 8], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100031cd1
test byte [rcx + 0x1c], 1
je 0x100031ca3
cmp byte [rcx + 0x19], 4
jb 0x100031ca3
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1d3
mov r9, rdi
call fcn.10001d71c
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100031cd1
test byte [rcx + 0x1c], 1
je 0x100031cd1
cmp byte [rcx + 0x19], 4
jb 0x100031cd1
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1d4
call fcn.10001db08
mov ecx, dword [r14 + 0x174]
mov rax, qword [r14 + 0xd8]
imul rcx, rcx, 0x160
lea rcx, [rcx + rax + 0x9c]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rdx, qword [r14 + 0x28]
cmp rdx, 0xffffffffffffffff
jne 0x100031d0b
or rdx, rdx
cmp qword [r14 + 0x30], 0xffffffffffffffff
cmovne rdx, qword [r14 + 0x30]
mov ecx, dword [r14 + 0x174]
mov r13, qword [rsp + 0x80]
lea rax, [rsp + 0x91]
mov qword [rsp + 0x68], rax
shl ecx, 4
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
add rcx, rsi
cmp dword [r14 + 0x14c], 4
lea rax, [rsp + 0x108]
mov r9, rdi
sete r8b
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov rcx, r13
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov rdx, qword [rsp + 0xf0]
lea rax, [fcn.10002d61c]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1000ccd38
mov edx, dword [r14 + 0x174]
mov rcx, qword [r14 + 0xd8]
imul rdx, rdx, 0x160
mov esi, eax
lea rcx, [rdx + rcx + 0xa4]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov r10, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp r10, rax
je 0x100031e7a
test byte [r10 + 0x1c], 1
je 0x100031e7a
cmp byte [r10 + 0x19], 4
jb 0x100031e7a
mov rcx, qword [r14 + 0xd8]
mov edx, dword [r14 + 0x174]
lea r8, [0x100003cc8]
imul rdx, rdx, 0x160
mov eax, dword [rdx + rcx + 0x9c]
mov dword [rsp + 0x140], eax
mov eax, dword [rdx + rcx + 0xa0]
mov dword [rsp + 0x144], eax
mov eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x130], eax
mov eax, dword [rdx + rcx + 0xa8]
mov dword [rsp + 0x134], eax
movabs rax, 0x346dc5d63886594b
mov rcx, qword [rsp + 0x130]
sub rcx, qword [rsp + 0x140]
mul rcx
mov rcx, qword [r10 + 0x10]
mov r9, rdx
mov edx, 0x1d5
shr r9, 0xb
call fcn.10001d71c
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [rsp + 0x91], 0
mov r11b, byte [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
je 0x100031eab
mov byte [rdi + 0x84], 1
test r11b, r11b
jne 0x100031eab
or dword [rdi + 0x54], 0x10
test bl, bl
jne 0x100031efa
test r11b, r11b
je 0x100031efa
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100031ee8
test byte [rcx + 0x1c], 1
je 0x100031ee8
cmp byte [rcx + 0x19], 4
jb 0x100031ee8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1d6
call fcn.10001c854
mov rax, qword [r14 + 0x188]
and dword [rdi + 0x80], 0
mov qword [rdi + 0x78], rax
lea rcx, [r14 + 0x58]
mov byte [rsp + 0x7a], 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [r14 + 0x174]
mov rdi, qword [rsp + 0x108]
imul r11, r11, 0x160
add r11, qword [r14 + 0xd8]
mov rbx, qword [rsp + 0x110]
lea rcx, [r14 + 0x58]
mov qword [r11], rdi
mov qword [r11 + 8], rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [r15 + 0x20], rbx
mov qword [r15 + 0x18], rdi
mov ecx, esi
test esi, esi
je 0x1000321da
mov edi, 1
sub ecx, edi
je 0x100032360
sub ecx, 3
je 0x100032300
sub ecx, edi
je 0x10003229b
sub ecx, edi
je 0x100032300
sub ecx, edi
je 0x100031fee
cmp ecx, 0xd
je 0x10003229b
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100031fd6
test byte [rcx + 0x1c], dil
je 0x100031fd6
cmp byte [rcx + 0x19], 2
jb 0x100031fd6
mov eax, dword [rsp + 0x74]
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x100003cc8]
mov edx, 0x1dd
mov dword [rsp + 0x20], esi
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, esi
call fcn.10010de1c
jmp 0x100031404
mov rcx, qword [0x1001653b8]
lea rsi, [0x1001653b8]
cmp rcx, rsi
je 0x10003203f
test byte [rcx + 0x1c], dil
je 0x10003203f
cmp byte [rcx + 0x19], 2
mov rbx, qword [rsp + 0x98]
jb 0x100032047
mov eax, dword [rsp + 0x74]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov dword [rsp + 0x28], eax
mov edx, 0x1d9
mov r9, rbx
mov dword [rsp + 0x20], 7
call fcn.10001e4b0
jmp 0x100032047
mov rbx, qword [rsp + 0x98]
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, 7
call fcn.10010de1c
mov byte [rsp + 0x7a], 0
mov ebp, eax
cmp eax, 0x8078002a
jne 0x1000321d2
cmp dword [rsp + 0x74], 0x70
jne 0x10003147b
mov rcx, qword [0x1001653b8]
cmp rcx, rsi
je 0x1000320b4
test byte [rcx + 0x1c], dil
je 0x1000320b4
cmp byte [rcx + 0x19], 4
mov rdi, qword [rsp + 0xb8]
jb 0x1000320bc
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1da
mov r9, rdi
call fcn.10001db08
jmp 0x1000320bc
mov rdi, qword [rsp + 0xb8]
mov esi, dword [rsp + 0xd8]
and qword [rsp + 0xd0], 0
and dword [rsp + 0xb0], 0
test esi, esi
je 0x1000320f0
lea r8, [0x100005000]
lea rcx, [0x100004680]
mov edx, 0x2bcb
call fcn.10009a050
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xb0]
mov rcx, r13
call fcn.1000cc6e0
test eax, eax
jne 0x10003147b
mov rdx, qword [rsp + 0xd0]
mov rcx, r14
call fcn.100028c60
test eax, eax
js 0x10003217f
inc esi
mov byte [rsp + 0x79], 1
mov dword [rsp + 0xd8], esi
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000325b2
test byte [rcx + 0x1c], 1
je 0x1000325b2
cmp byte [rcx + 0x19], 4
jb 0x1000325b2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1db
mov r9, rbx
mov qword [rsp + 0x20], rdi
call fcn.10001df74
jmp 0x1000325b2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003147b
test byte [rcx + 0x1c], 1
je 0x10003147b
cmp byte [rcx + 0x19], 2
jb 0x10003147b
mov eax, dword [rsp + 0xa4]
mov r9, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1dc
mov dword [rsp + 0x20], eax
call fcn.10001d758
test ebp, ebp
js 0x10003147b
lea rdi, [r14 + 0x18]
lea rcx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rsi, qword [rsp + 0x88]
lea rcx, [rdi + 0x40]
inc dword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [rsi + 0x10]
lea rbx, [rdi + 0x40]
mov dword [r15 + 0x28], r11d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [r14 + 0xe4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r11d, dword [r14 + 0xe4]
mov rcx, qword [rsp + 0xf8]
movdqu xmm0, xmmword [rsp + 0x190]
mov dword [r15 + 0xc], r11d
mov eax, dword [r14 + 0x174]
add rax, rax
cmp byte [rsp + 0xa0], 0
movdqu xmmword [rcx + rax*8], xmm0
jne 0x100032388
mov rax, qword [rsp + 0xe0]
cmp qword [r15 + 0x38], rax
je 0x100032281
lea r8, [0x100005018]
lea rcx, [0x100004680]
mov edx, 0x2c13
call fcn.10009a050
and qword [r15 + 0x38], 0
and dword [r15 + 0x40], 0
mov r12d, 0x80780030
mov ebp, r12d
mov bl, 1
jmp 0x10003247d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000322e3
test byte [rcx + 0x1c], dil
je 0x1000322e3
cmp byte [rcx + 0x19], 2
jb 0x1000322e3
mov eax, dword [rsp + 0x74]
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x100003cc8]
mov edx, 0x1d8
mov dword [rsp + 0x20], esi
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, esi
call fcn.10010de1c
mov bl, dil
mov ebp, eax
jmp 0x10003147d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100032348
test byte [rcx + 0x1c], dil
je 0x100032348
cmp byte [rcx + 0x19], 2
jb 0x100032348
mov eax, dword [rsp + 0x74]
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
lea r8, [0x100003cc8]
mov edx, 0x1d7
mov dword [rsp + 0x20], esi
call fcn.10001e4b0
mov edx, dword [rsp + 0x74]
lea r8, [rsp + 0x94]
mov ecx, esi
call fcn.10010de1c
jmp 0x1000314f3
lea rcx, [r14 + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rsi, qword [rsp + 0x88]
mov bl, byte [rsp + 0x71]
test al, al
je 0x100030e64
mov ebp, 0x8078001d
jmp 0x100032458
and qword [rsp + 0x88], 0
lea rdx, [rsp + 0x88]
mov rcx, r13
call fcn.1000d3990
test eax, eax
je 0x1000323bd
lea r8, [0x100005040]
lea rcx, [0x100004680]
mov edx, 0x2c21
call fcn.10009a050
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x10003240e
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003240e
test byte [rcx + 0x1c], 1
je 0x10003240e
cmp byte [rcx + 0x19], 2
jb 0x10003240e
mov rax, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1de
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.10001ea30
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsi + 0x28], rbx
test rbx, rbx
jle 0x100032431
xor r8d, r8d
mov edx, 0x8078007d
mov rcx, rsi
call fcn.1000203b0
mov ebx, 0xe
mov rcx, rsi
mov edx, ebx
call fcn.10002040c
mov edx, ebx
mov rcx, r15
call fcn.100021fd4
lea rcx, [r14 + 0x58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov bl, byte [rsp + 0x71]
mov dil, bl
mov r12d, 0x80780030
cmp ebp, r12d
je 0x10003247d
cmp ebp, 0x8078002a
jne 0x1000324f9
cmp dword [rsp + 0x74], 0x70
jne 0x10003252a
mov r9, qword [r14 + 0x188]
mov r8, qword [r14 + 0x160]
mov edx, dword [r14 + 0x14c]
mov rcx, qword [r14 + 0x158]
lea rax, [0x1000eb284]
mov qword [rsp + 0x20], rax
call fcn.10011cc08
test eax, eax
jns 0x1000324f9
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000324f9
test byte [rcx + 0x1c], 1
je 0x1000324f9
cmp byte [rcx + 0x19], 2
jb 0x1000324f9
mov r9, qword [r14 + 0x158]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov rax, qword [r14 + 0x160]
lea r8, [0x100003cc8]
mov edx, 0x1df
mov qword [rsp + 0x20], rax
call fcn.10001e39c
cmp ebp, r12d
jne 0x10003251d
test byte [r14 + 0x150], 2
je 0x100032525
mov rdi, qword [rsp + 0xc0]
mov eax, dword [rdi + 0xc]
cmp dword [r15 + 0xc], eax
ja 0x100032604
test ebp, ebp
jns 0x1000325a6
mov dil, byte [rsp + 0x70]
mov edx, 0xc
mov rcx, r15
call fcn.100021fd4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x100032577
test byte [rcx + 0x1c], 1
je 0x100032577
cmp byte [rcx + 0x19], 2
jb 0x100032577
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1e1
mov dword [rsp + 0x20], ebp
call fcn.10001ddb0
mov r8d, dword [rsp + 0x94]
mov edx, ebp
mov rcx, rsi
call fcn.1000204fc
test dil, dil
je 0x1000326ce
cmp byte [rsp + 0x90], 0
je 0x1000325a6
cmp byte [rsi + 0x68], 0
jne 0x1000326ce
inc dword [r15 + 8]
mov r13, qword [rsp + 0x80]
mov r12d, dword [rsp + 0xa4]
xor edi, edi
mov dword [r15 + 0x2c], 0xf
mov qword [r15 + 0x18], rdi
mov qword [r15 + 0x20], rdi
mov dword [r15 + 0x28], edi
mov qword [r15 + 0x30], rdi
mov qword [r15 + 0x38], rdi
mov dword [r15 + 0x40], edi
mov ebp, dword [rsp + 0xa8]
cmp dword [r15 + 8], ebp
jb 0x100030d11
mov rdi, qword [rsp + 0xc0]
jmp 0x100032654
mov r13, qword [rsp + 0x80]
jmp 0x1000326fc
mov edx, 4
mov rcx, r15
call fcn.100021fd4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10003264d
test byte [rcx + 0x1c], 1
je 0x10003264d
cmp byte [rcx + 0x19], 4
jb 0x10003264d
mov r9, qword [rsp + 0x98]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1e0
call fcn.10001db08
mov ebp, dword [rsp + 0xa8]
mov rdx, qword [rsp + 0x120]
mov rcx, r14
call fcn.10002df70
mov r12d, eax
test eax, eax
js 0x1000326fc
lea rcx, [r14 + 0x28]
xor edx, edx
call fcn.10010b1d8
mov r12d, eax
test eax, eax
js 0x1000326fc
mov esi, dword [rdi + 0xc]
xor ebx, ebx
test ebp, ebp
je 0x100032912
xor edi, edi
xor ebp, ebp
mov rcx, qword [rsp + 0xf8]
mov r11d, ebx
mov edx, ebx
shl r11, 4
add r11, rcx
lea rcx, [0x10000f0f8]
mov r8, qword [r11]
cmp r8, qword [rcx]
jne 0x10003287e
mov r8, qword [r11 + 8]
cmp r8, qword [rcx + 8]
jne 0x10003287e
xor eax, eax
jmp 0x100032883
mov rax, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x160]
mov r12d, ebp
mov byte [rax], bl
mov eax, dword [rsp + 0x94]
mov dword [rcx], eax
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x100032712
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rsi, qword [rsp + 0xb8]
lea rbp, [0x1001653b8]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x100032740
cmp rcx, qword [r15 + 0x38]
je 0x100032740
cmp rcx, qword [rdi + 0x38]
je 0x100032740
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x100032759
cmp r13, qword [r15 + 0x30]
je 0x100032759
cmp r13, qword [rdi + 0x30]
je 0x100032759
mov rcx, r13
call fcn.1000d24b8
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x10003276c
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x100032782
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0xf8]
test rax, rax
je 0x100032798
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test rsi, rsi
je 0x1000327a6
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rcx, [r14 + 0x28]
call fcn.10010b368
test r12d, r12d
jns 0x10003297e
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x100032811
test byte [rcx + 0x1c], 1
je 0x100032811
cmp byte [rcx + 0x19], 2
jb 0x100032811
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100005a10]
cmp byte [rdx], 0
lea rax, [0x100005078]
mov r9d, r12d
cmovne rax, r8
lea r8, [0x100003cc8]
mov edx, 0x1e2
mov qword [rsp + 0x20], rax
call fcn.10001da7c
mov rcx, qword [0x1001653b8]
cmp byte [rsp + 0x7a], 0
jne 0x100032985
test byte [r14 + 0x150], 4
je 0x100032985
lea rcx, [r14 + 0x28]
xor edx, edx
call fcn.10010b1d8
test eax, eax
jns 0x100032939
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000329ab
test byte [rcx + 0x1c], 1
je 0x100032985
cmp byte [rcx + 0x19], 2
jb 0x100032985
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1e3
mov r9d, eax
call fcn.10001c878
jmp 0x10003297e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000328f1
mov r10, qword [r14 + 0xd8]
imul rdx, rdx, 0x160
mov r8d, ebp
mov eax, dword [r10 + rdi + 0x80]
add r8, qword [rsp + 0x100]
lea rcx, [rdx + r10 + 0x78]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rax
mov eax, dword [r10 + rdi + 0x54]
lea r9, [rdx + r10 + 0x44]
mov r8d, esi
mov rdx, r11
mov rcx, r14
mov dword [rsp + 0x20], eax
call fcn.10002c13c
inc esi
mov r12d, eax
test eax, eax
js 0x1000326f4
inc ebx
add ebp, 0x10
add rdi, 0x160
cmp ebx, dword [rsp + 0xa8]
jb 0x100032692
mov rdi, qword [rsp + 0xc0]
cmp esi, dword [r15 + 0xc]
je 0x1000326fc
lea r8, [0x100005058]
lea rcx, [0x100004680]
mov edx, 0x2cb2
call fcn.10009a050
jmp 0x1000326fc
mov rcx, r14
call fcn.100029b10
test eax, eax
jns 0x100032975
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x100032975
test byte [rcx + 0x1c], 1
je 0x100032975
cmp byte [rcx + 0x19], 2
jb 0x100032975
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1e4
mov r9d, eax
call fcn.10001c878
lea rcx, [r14 + 0x28]
call fcn.10010b368
mov rcx, qword [0x1001653b8]
cmp rcx, rbp
je 0x1000329ab
test byte [rcx + 0x1c], 1
je 0x1000329ab
cmp byte [rcx + 0x19], 4
jb 0x1000329ab
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003cc8]
mov edx, 0x1e5
call fcn.10001c854
mov eax, r12d
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.10014e600
add rsp, 0x1b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret