Function at 0x180013180
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Query or enumerate registry value
Read .ini file
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3db0
call fcn.18004c5b0
sub rsp, rax
mov qword [rsp + 0x1878], 0xfffffffffffffffe
mov qword [rsp + 0x3e00], rbx
mov rax, qword [0x180067480]
xor rax, rsp
mov qword [rsp + 0x3da0], rax
mov r12, rdx
mov r14, rcx
mov qword [rsp + 0x88], rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
mov rcx, rdx
call fcn.180001e00
mov rbp, rax
test rax, rax
je 0x18001daa2
lea rcx, str.hai_long__set_policy_64_
call fcn.18000ac40
lea rdx, str.Class
lea rcx, [rsp + 0xcd8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.180001f40
nop
lea rdx, str.jjlpathsec
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
or rbx, 0xffffffffffffffff
test al, al
je 0x18001390c
xor edx, edx
mov r8d, 0xfa
lea rsi, [0x180068e60]
mov rcx, rsi
call fcn.180031f80
lea rdx, str.PolicyName
lea rcx, [rsp + 0x1850]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbc8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
mov rdx, rsi
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180013280
mov rdx, qword [rsp + 0xbc8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800132b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov edi, eax
mov dword [0x180148960], eax
xor edx, edx
lea r8d, [rdx + 0x48]
lea rbp, [0x18010bc40]
mov rcx, rbp
call fcn.180031f80
xor edx, edx
mov r8d, 0x1b6c
lea r14, [0x18010bc90]
mov rcx, r14
call fcn.180031f80
mov dword [0x18010bc90], edi
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rcx + r14 + 4], al
inc rcx
test al, al
jne 0x180013300
mov rdx, r13
lea rcx, [0x1800d9b70]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdx + r14 + 0xfe], al
inc rdx
test al, al
jne 0x180013320
mov edi, 1
mov dword [0x18010be94], edi
mov dword [0x18010be98], edi
mov dword [0x18010be9c], edi
mov dword [0x18010bea0], edi
mov dword [0x18010bea4], edi
mov dword [0x18010bea8], edi
mov dword [0x18010beac], edi
mov dword [0x18010beb0], r13d
lea rcx, [0x180000000]
mov eax, dword [rcx + 0x54878]
mov dword [rcx + 0x10beb4], eax
mov eax, dword [rcx + 0x5487c]
mov dword [rcx + 0x10beb8], eax
movzx eax, word [rcx + 0x54880]
mov word [rcx + 0x10bebc], ax
mov dword [0x18010bfb8], 2
mov eax, dword [rcx + 0x54868]
mov dword [rcx + 0x10bfbc], eax
mov eax, dword [rcx + 0x5486c]
mov dword [rcx + 0x10bfc0], eax
movzx eax, word [rcx + 0x54870]
mov word [rcx + 0x10bfc4], ax
mov rax, qword [rcx + 0x54858]
mov qword [rcx + 0x10c0c0], rax
movzx eax, word [rcx + 0x54860]
mov word [rcx + 0x10c0c8], ax
mov dword [0x18010c9e4], edi
mov eax, dword [rcx + 0x5484c]
mov dword [rcx + 0x10c9e8], eax
movzx eax, byte [rcx + 0x54850]
mov byte [rcx + 0x10c9ec], al
mov dword [0x18010cdd0], 5
mov eax, dword [rcx + 0x54840]
mov dword [rcx + 0x10d1e4], eax
mov eax, dword [rcx + 0x54844]
mov dword [rcx + 0x10d1e8], eax
movzx eax, byte [rcx + 0x54848]
mov byte [rcx + 0x10d1ec], al
mov eax, dword [rcx + 0x54838]
mov dword [rcx + 0x10d0e0], eax
movzx eax, byte [rcx + 0x5483c]
mov byte [rcx + 0x10d0e4], al
lea rdx, [0x18010cdd4]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [0x18010cdd4]
call fcn.180033c94
mov edx, 0x104
lea rcx, [0x18010ced8]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [0x18010ced8]
call fcn.180033c94
mov dword [rsp + 0xa0], 2
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r13d
lea r9, [0x180051c58]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsCachePaths
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea rsi, [0x18010cfdc]
test eax, eax
jne 0x180013529
mov dword [rsp + 0x9c], edi
mov dword [rsp + 0x98], 0x104
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.Directory
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
call fcn.180033c94
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1300]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6b8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010bc84], eax
mov rdx, qword [rsp + 0x6b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013588
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0xcf0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xe8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [rbp], al
inc rcx
inc rbp
test al, al
jne 0x1800135b2
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800135e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1610]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9a8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010bc80], eax
mov rdx, qword [rsp + 0x9a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001363b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0xd00]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xf8]
mov rcx, r12
call fcn.180001f40
mov edx, edi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010bc60], eax
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013694
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1310]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6c8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010bc64], eax
mov rdx, qword [rsp + 0x6c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800136ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0xd10]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x108]
mov rcx, r12
call fcn.180001f40
mov edx, edi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010bc68], eax
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013746
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x1828]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc28]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010bc6c], eax
mov rdx, qword [rsp + 0xc28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001379f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0xd20]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x118]
mov rcx, r12
call fcn.180001f40
mov edx, edi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010bc70], eax
mov rdx, qword [rsp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800137f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x1320]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6d8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010bc74], eax
mov rdx, qword [rsp + 0x6d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013851
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0xd30]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x128]
mov rcx, r12
call fcn.180001f40
mov edx, edi
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18010bc78], eax
mov rdx, qword [rsp + 0x128]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800138aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x1620]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9b8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18010bc7c], eax
mov rdx, qword [rsp + 0x9b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, [0x180052738]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001509a
lea rcx, [0x180054748]
call fcn.18000ac40
xor edx, edx
mov r8d, 0xfa
lea rsi, [0x180068e60]
mov rcx, rsi
call fcn.180031f80
lea rdx, str.PolicyName
lea rcx, [rsp + 0xd40]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x138]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
mov rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180013980
mov rdx, qword [rsp + 0x138]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800139b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov dword [0x180148960], eax
xor edx, edx
mov r8d, 0x2f7c
lea r15, [0x180108cc0]
mov rcx, r15
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea r14, [0x180108c70]
mov rcx, r14
call fcn.180031f80
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x1330]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6e8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010af34], eax
mov rdx, qword [rsp + 0x6e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013a42
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0xd50]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x148]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010af38], eax
mov rdx, qword [rsp + 0x148]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013a99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x180148960]
mov dword [0x180108cc0], eax
mov rcx, r13
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rcx + r15 + 4], al
inc rcx
test al, al
jne 0x180013ab0
mov rdx, r13
lea rcx, [0x1800d9b70]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdx + r15 + 0xfe], al
inc rdx
test al, al
jne 0x180013ad0
lea rdx, str.DisableOnTimeSoftSendFile
lea rcx, [rsp + 0x17a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb28]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b718], eax
mov rdx, qword [rsp + 0xb28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013b3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisableOnTimeSoftRecvFile
lea rcx, [rsp + 0xd60]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x158]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b71c], eax
mov rdx, qword [rsp + 0x158]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013b91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisabledCopyFileFromUDisk
lea rcx, [rsp + 0x1340]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6f8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b720], eax
mov rdx, qword [rsp + 0x6f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013be8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisabledCopyFileFromUDisk
lea rcx, [rsp + 0xd70]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x168]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b724], eax
mov rdx, qword [rsp + 0x168]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013c3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AppointPrintControl
lea rcx, [rsp + 0x1630]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9c8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b838], eax
mov rdx, qword [rsp + 0x9c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013c96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ProcessNameFileExtensions
lea rcx, [rsp + 0xd80]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x178]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3ff
mov rdx, qword [rax]
lea rcx, [0x18010b83c]
call fcn.180034120
mov rdx, qword [rsp + 0x178]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013cf4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010b83c]
call fcn.180033c94
lea rdx, str.DisablePrintFile
lea rcx, [rsp + 0x1350]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x708]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180109ecc], eax
mov rdx, qword [rsp + 0x708]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013d57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.BackupPrintFile
lea rcx, [rsp + 0xd90]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x188]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180109ed0], eax
mov rdx, qword [rsp + 0x188]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013dae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AllowPrintDayControl
lea rcx, [rsp + 0x1838]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbd8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
cmp dword [rcx - 0x10], 0
setg dil
mov rdx, qword [rsp + 0xbd8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013e02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, 1
test dil, dil
je 0x180014004
lea rcx, [0x180054640]
call fcn.18000ac40
lea rdx, str.AllowPrintDayControl
lea rcx, [rsp + 0xda0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x198]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b728], eax
mov rdx, qword [rsp + 0x198]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013e73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x18010b728], 0
je 0x180014004
lea rcx, str.PrintWeekDay
call fcn.18000ac40
lea rdx, str.PrintWeekDay
lea rcx, [rsp + 0x1360]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x718]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010b72c], eax
mov rdx, qword [rsp + 0x718]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013ee3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PrintTime
lea rcx, [rsp + 0xdb0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1b8]
mov rcx, rbp
call fcn.180001c30
nop
mov rax, qword [rax]
cmp dword [rax - 0x10], 0x104
jle 0x180013f1e
mov edi, 0x103
jmp 0x180013f50
lea rdx, str.PrintTime
lea rcx, [rsp + 0x1640]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9d8]
mov rcx, rbp
call fcn.180001c30
nop
mov dword [rsp + 0x50], esi
mov rax, qword [rax]
mov edi, dword [rax - 0x10]
lea rdx, str.PrintTime
lea rcx, [rsp + 0xdc0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1a8]
mov rcx, rbp
call fcn.180001c30
movsxd r8, edi
mov rdx, qword [rax]
lea rcx, [0x18010b734]
call fcn.180034120
mov rdx, qword [rsp + 0x1a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013fac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test byte [rsp + 0x50], 1
je 0x180013fd6
mov rdx, qword [rsp + 0x9d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013fd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180013ff8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010b734]
call fcn.18000ac40
lea rdx, str.EnableSpecExePrint
lea rcx, [rsp + 0x1370]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x728]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108ec8], eax
mov rdx, qword [rsp + 0x728]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001405b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PrintExeList
lea rcx, [rsp + 0xdd0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1c8]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x1001
mov rdx, qword [rax]
lea rcx, [0x180108ecc]
call fcn.180035130
mov rdx, qword [rsp + 0x1c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800140b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x180108ecc]
call fcn.180033c94
lea rdx, str.AuditPrintFile
lea rcx, [rsp + 0x17b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb38]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180109ed4], eax
mov rdx, qword [rsp + 0xb38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001411c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x180109ed4], 0
je 0x180014133
lea rcx, [0x1800545d0]
call fcn.18000ac40
jmp 0x18001413f
lea rcx, [0x1800545b0]
call fcn.18000ac40
lea rdx, str.RefusePrintExtName
lea rcx, [rsp + 0xde0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1d8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x180109edc]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180014170
mov rdx, qword [rsp + 0x1d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800141a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x180109edc]
call fcn.180033c94
lea rdx, str.AllowedPrinterServerIP
lea rcx, [rsp + 0x1380]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1e8]
mov rcx, rbp
call fcn.180001c30
mov rdi, rax
lea rdx, str.AllowedPrinterServerIP
lea rcx, [rsp + 0xdf0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x738]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rdi]
movsxd r8, dword [rcx - 0x10]
mov rdx, qword [rax]
lea rcx, [0x18010a06c]
call fcn.180035130
mov rdx, qword [rsp + 0x738]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014237
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x1e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014259
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [0x18010a06c]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rcx, [0x18010a06c]
call fcn.180033c94
lea rdx, str.AllowPrintFile
lea rcx, [rsp + 0x1650]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9e8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180109ed8], eax
mov rdx, qword [rsp + 0x9e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800142d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x180109ed8], 1
je 0x1800142ec
lea rcx, [0x180054558]
call fcn.18000ac40
jmp 0x1800142f8
lea rcx, [0x180054538]
call fcn.18000ac40
lea rdx, str.AllowPrintExtName
lea rcx, [rsp + 0xe00]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1f8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x18010a46c]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180014330
mov rdx, qword [rsp + 0x1f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014361
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010a46c]
call fcn.180033c94
lea rdx, str.DisableMailFile
lea rcx, [rsp + 0x1390]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x748]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010a5fc], eax
mov rdx, qword [rsp + 0x748]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800143c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ExceptSMTPServer
lea rcx, [rsp + 0xe10]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x208]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x1ff
mov rdx, qword [rax]
lea rcx, [0x18010a600]
call fcn.180034120
mov rdx, qword [rsp + 0x208]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014422
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010a600]
call fcn.18004c52c
lea rdx, [0x18010a600]
mov rcx, qword [rsp + 0x88]
call fcn.180003910
lea rdx, str.AuditMailFile
lea rcx, [rsp + 0x1848]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc58]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010a800], eax
mov rdx, qword [rsp + 0xc58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014499
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.RefuseMailExtName
lea rcx, [rsp + 0xe20]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x218]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x18010a804]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800144d0
mov rdx, qword [rsp + 0x218]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014501
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010a804]
call fcn.180033c94
lea rdx, str.DisableNetFile
lea rcx, [rsp + 0x13a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x758]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010a994], eax
mov rdx, qword [rsp + 0x758]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014564
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AuditNetFile
lea rcx, [rsp + 0xe30]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x228]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010a998], eax
mov rdx, qword [rsp + 0x228]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800145bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.RefuseNetFileExtName
lea rcx, [rsp + 0x1660]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9f8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x18010a99c]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800145f0
mov rdx, qword [rsp + 0x9f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014621
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010a99c]
call fcn.180033c94
lea rdx, str.AuditNetFileExtName
lea rcx, [rsp + 0xe40]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x238]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x18010ab9c]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180014660
mov rdx, qword [rsp + 0x238]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014691
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010ab9c]
call fcn.180033c94
lea rdx, str.DisableFTPFile
lea rcx, [rsp + 0x13b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x768]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010ad9c], eax
mov rdx, qword [rsp + 0x768]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800146f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AuditFTPFile
lea rcx, [rsp + 0xe50]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x248]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010ada0], eax
mov rdx, qword [rsp + 0x248]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001474b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.RefuseFTPFileExtName
lea rcx, [rsp + 0x17c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb48]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18010ada4]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180014780
mov rdx, qword [rsp + 0xb48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800147b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x18010ada4]
call fcn.180033c94
lea rdx, str.CheckKeyWorkInFile
lea rcx, [rsp + 0xe60]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x258]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010af3c], eax
mov rdx, qword [rsp + 0x258]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014814
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.FindKeyWorkHowToDeal
lea rcx, [rsp + 0x13c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x778]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010af40], eax
mov rdx, qword [rsp + 0x778]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001486b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.KeyWorkInFileString
lea rcx, [rsp + 0xe70]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x268]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [rsp + 0x2880]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800148a0
mov rdx, qword [rsp + 0x268]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800148d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x2880], 0
jne 0x1800148e7
mov dword [0x18010af3c], r13d
jmp 0x18001499f
lea rdi, [rsp + 0x2880]
mov esi, r13d
test rdi, rdi
je 0x18001499a
lea rdx, [0x180051e68]
mov rcx, rdi
call fcn.180032d74
mov r11, rax
test rax, rax
je 0x180014955
mov byte [rax], 0
movsxd rcx, esi
imul rcx, rcx, 0xc8
sub rcx, rdi
lea rdx, [rcx + r15 + 0x2288]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rdi + rdx], al
inc rdi
test al, al
jne 0x180014930
lea rdi, [r11 + 1]
inc esi
mov dword [0x18010af44], esi
cmp esi, 0xa
jl 0x1800148f2
mov esi, 1
jmp 0x18001499f
cmp byte [rdi], 0
je 0x18001498d
movsxd rax, esi
imul rax, rax, 0xc8
sub rax, rdi
lea rcx, [rax + r15 + 0x2288]
nop
movzx eax, byte [rdi]
mov byte [rdi + rcx], al
inc rdi
test al, al
jne 0x180014970
lea eax, [rsi + 1]
mov dword [0x18010af44], eax
mov esi, 1
jmp 0x18001499f
mov dword [0x18010af44], esi
mov esi, 1
jmp 0x18001499f
mov esi, 1
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1670]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa08]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108ec4], eax
mov rdx, qword [rsp + 0xa08]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800149f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x180108ec4], 1
jne 0x180014bc8
lea rdx, [0x180068f60]
lea rcx, [rsp + 0x80]
call fcn.180002050
nop
xor eax, eax
mov rcx, rbx
lea rdi, [0x180051d48]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180051d48]
lea rcx, [rsp + 0x80]
call fcn.180006a60
mov r8d, esi
lea rdx, str.authmail.flg
lea rcx, [rsp + 0xcb0]
call fcn.18000ab00
nop
cmp qword [rax + 0x20], 0x10
jb 0x180014a66
mov rdx, qword [rax + 8]
jmp 0x180014a6a
lea rdx, [rax + 8]
test rdx, rdx
jne 0x180014a74
mov ecx, r13d
jmp 0x180014a84
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x80]
call fcn.180006a60
nop
cmp qword [rsp + 0xcd0], 0x10
jb 0x180014aad
mov rcx, qword [rsp + 0xcb8]
call fcn.180021240
mov qword [rsp + 0xcd0], 0xf
mov qword [rsp + 0xcc8], r13
mov byte [rsp + 0xcb8], 0
lea rdx, [0x18005392c]
mov rcx, qword [rsp + 0x80]
call fcn.180035744
mov rdi, rax
test rax, rax
je 0x180014b8c
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x1954]
call fcn.180031f80
mov dword [rsp + 0x1950], 0x20c
cmp dword [0x18010a5fc], 1
jne 0x180014b35
mov dword [rsp + 0x1954], esi
mov r8d, 0x200
lea rdx, [0x18010a600]
lea rcx, [rsp + 0x195c]
call fcn.180034120
jmp 0x180014b4d
mov eax, dword [rsp + 0x1958]
cmp dword [0x18010a800], 0
cmovne eax, esi
mov dword [rsp + 0x1958], eax
lea rax, [rsp + 0x1950]
mov ecx, 0x20c
nop word [rax + rax]
xor byte [rax], 0xaa
inc rax
sub rcx, 1
jne 0x180014b60
mov r9, rdi
mov r8, rsi
mov edx, 0x20c
lea rcx, [rsp + 0x1950]
call fcn.180035568
mov rcx, rdi
call fcn.180035354
cmp dword [0x180109ed4], 0
je 0x180014b9d
mov ecx, esi
call fcn.18000eea0
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014cbf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180014cbf
lea rdx, [0x180068f60]
lea rcx, [rsp + 0x90]
call fcn.180002050
nop
xor eax, eax
mov rcx, rbx
lea rdi, [0x180051d48]
repne scasb al, byte [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x180051d48]
lea rcx, [rsp + 0x90]
call fcn.180006a60
mov r8d, esi
lea rdx, str.authmail.flg
lea rcx, [rsp + 0xc88]
call fcn.18000ab00
nop
cmp qword [rax + 0x20], 0x10
jb 0x180014c2b
mov rdx, qword [rax + 8]
jmp 0x180014c2f
lea rdx, [rax + 8]
test rdx, rdx
jne 0x180014c39
mov ecx, r13d
jmp 0x180014c49
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x90]
call fcn.180006a60
nop
cmp qword [rsp + 0xca8], 0x10
jb 0x180014c72
mov rcx, qword [rsp + 0xc90]
call fcn.180021240
mov qword [rsp + 0xca8], 0xf
mov qword [rsp + 0xca0], r13
mov byte [rsp + 0xc90], 0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014cbf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0xe80]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x278]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108cb4], eax
mov rdx, qword [rsp + 0x278]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014d16
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x13d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x788]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [r14], al
inc rcx
inc r14
test al, al
jne 0x180014d40
mov rdx, qword [rsp + 0x788]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014d72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0xe90]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x288]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108cb0], eax
mov rdx, qword [rsp + 0x288]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014dc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1858]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbe8]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180108c90], eax
mov rdx, qword [rsp + 0xbe8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014e22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0xea0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x298]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180108c94], eax
mov rdx, qword [rsp + 0x298]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014e7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x13e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x798]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180108c98], eax
mov rdx, qword [rsp + 0x798]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014ed4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0xeb0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2a8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180108c9c], eax
mov rdx, qword [rsp + 0x2a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014f2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1680]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa18]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180108ca0], eax
mov rdx, qword [rsp + 0xa18]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014f86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0xec0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2b8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180108ca4], eax
mov rdx, qword [rsp + 0x2b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180014fdf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x13f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7a8]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x180108ca8], eax
mov rdx, qword [rsp + 0x7a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015038
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0xed0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2c8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x180108cac], eax
mov rdx, qword [rsp + 0x2c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, [0x1800526c0]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x180016ac9
lea rcx, [0x1800543d8]
call fcn.18000ac40
xor edx, edx
mov r8d, 0x87b8
lea rcx, [0x1801004b0]
call fcn.180031f80
xor edx, edx
mov r8d, 0x14c
lea rcx, [0x180100360]
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x1801004b0], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x1868]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb58]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x1801004b4]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180015130
mov rdx, qword [rsp + 0xb58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015161
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov dword [0x180100360], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0xee0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2d8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x180100364]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800151a0
mov rdx, qword [rsp + 0x2d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800151d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1400]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7b8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1801004a0], eax
mov rdx, qword [rsp + 0x7b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015228
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0xef0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2e8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18010045e]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180015260
mov rdx, qword [rsp + 0x2e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015291
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1690]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa28]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010049c], eax
mov rdx, qword [rsp + 0xa28]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800152e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0xf00]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2f8]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010047c], eax
mov rdx, qword [rsp + 0x2f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015344
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1410]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7c8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180100480], eax
mov rdx, qword [rsp + 0x7c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001539d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0xf10]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x308]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180100484], eax
mov rdx, qword [rsp + 0x308]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800153f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x17e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc38]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180100488], eax
mov rdx, qword [rsp + 0xc38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015452
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0xf20]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x318]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18010048c], eax
mov rdx, qword [rsp + 0x318]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800154ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x1420]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7d8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x180100490], eax
mov rdx, qword [rsp + 0x7d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015507
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0xf30]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x328]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x180100494], eax
mov rdx, qword [rsp + 0x328]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015563
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x16a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa38]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x180100498], eax
mov rdx, qword [rsp + 0xa38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800155bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0xf40]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x338]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1801006b4], eax
mov rdx, qword [rsp + 0x338]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015613
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1801006b4], 0
je 0x180015628
lea rcx, [0x1800543c0]
call fcn.18000ac40
mov dword [0x1801006b8], r13d
mov r15d, 0x3b
nop word [rax + rax]
lea rdx, str.Kind
lea rcx, [rsp + 0x1430]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7e8]
mov rcx, rbp
call fcn.180001c30
lea rsi, str.ProcList
mov rdi, qword [rax]
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
sete dil
mov rdx, qword [rsp + 0x7e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001569e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x180015d83
lea rdx, str.UpRegionService
lea rcx, [rsp + 0xf50]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x348]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108c60], eax
mov rdx, qword [rsp + 0x348]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800156fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x17e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb68]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108c64], eax
mov rdx, qword [rsp + 0xb68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015755
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.UpRegionService
lea rcx, [rsp + 0xf60]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x358]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1801004a4], eax
mov rdx, qword [rsp + 0x358]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800157ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x1440]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7f8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1801004a8], eax
mov rdx, qword [rsp + 0x7f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015803
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov word [0x180107fd4], r15w
lea rdx, str.ValidProc
lea rcx, [rsp + 0xf70]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x368]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3e4
mov rdx, qword [rax]
lea rcx, [0x180107fd4]
call fcn.180035130
mov rdx, qword [rsp + 0x368]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015869
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
lea rdi, [0x180107fd4]
repne scasb al, byte [rdi]
not rcx
lea rsi, [0x1801004b0]
cmp byte [rcx + rsi + 0x7b22], 0x3b
je 0x1800158a2
lea rdi, [0x180107fd4]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rcx, [0x180107fd4]
call fcn.180033c94
lea rdx, str.ValidMode
lea rcx, [rsp + 0x16b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa48]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108420], eax
mov rdx, qword [rsp + 0xa48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015905
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AuditMode
lea rcx, [rsp + 0xf80]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x378]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x180108428]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180015940
mov rdx, qword [rsp + 0x378]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015971
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AuditValidMode
lea rcx, [rsp + 0x1450]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x808]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108424], eax
mov rdx, qword [rsp + 0x808]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800159c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AuditExtMode
lea rcx, [rsp + 0xf90]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x388]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010843c], eax
mov rdx, qword [rsp + 0x388]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015a1f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [0x180108440], 0x2e
je 0x180015a34
mov eax, 0x2e
mov word [0x180108440], ax
lea rdx, str.ExtensionFilter
lea rcx, [rsp + 0x1830]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbf8]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x1fe
mov rdx, qword [rax]
lea rcx, [0x180108440]
call fcn.180035130
mov rdx, qword [rsp + 0xbf8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015a92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x180108440]
call fcn.180033c94
xor eax, eax
mov rcx, rbx
lea rdi, [0x180108440]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi + 0x7f8e], 0x2e
je 0x180015ad0
lea rdi, [0x180108440]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180053218]
mov word [rdi - 1], ax
lea rdx, str.BackupMode
lea rcx, [rsp + 0xfa0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x398]
mov rcx, rbp
call fcn.180001c30
mov r8d, 5
mov rdx, qword [rax]
lea rcx, [0x180108648]
call fcn.180034120
mov rdx, qword [rsp + 0x398]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015b2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.BackupExtension
lea rcx, [rsp + 0x1460]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x818]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x1fe
mov rdx, qword [rax]
lea rcx, [0x18010864d]
call fcn.180034120
mov rdx, qword [rsp + 0x818]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015b8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
lea rdi, [0x18010864d]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi + 0x819b], 0x2e
je 0x180015bbe
lea rdi, [0x18010864d]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180053218]
mov word [rdi - 1], ax
lea rcx, [0x18010864d]
call fcn.180033c94
lea rdx, str.UsingProtect
lea rcx, [rsp + 0xfb0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3a8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108434], eax
mov rdx, qword [rsp + 0x3a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015c21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.UsingAudit
lea rcx, [rsp + 0x16c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa58]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108438], eax
mov rdx, qword [rsp + 0xa58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015c78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov word [0x180108855], r15w
lea rdx, str.AuditIgnorePath
lea rcx, [rsp + 0xfc0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3b8]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x1fc
mov rdx, qword [rax]
lea rcx, [0x180108855]
call fcn.180035130
mov rdx, qword [rsp + 0x3b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015cde
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
lea rdi, [0x180108855]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi + 0x83a3], 0x3b
je 0x180015d10
lea rdi, [0x180108855]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rcx, [0x180108855]
call fcn.180033c94
lea rdx, str.AuditModeEx
lea rcx, [rsp + 0x1470]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x828]
mov rcx, rbp
call fcn.180001c30
mov r8d, 5
mov rdx, qword [rax]
lea rcx, [0x180108a55]
call fcn.180034120
mov rdx, qword [rsp + 0x828]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016944
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180016944
lea rdx, str.Kind
lea rcx, [rsp + 0xfd0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3c8]
mov rcx, rbp
call fcn.180001c30
lea rsi, str.FileList
mov rdi, qword [rax]
mov ecx, 9
repe cmpsb byte [rsi], byte [rdi]
sete dil
mov rdx, qword [rsp + 0x3c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015de1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x18001681c
mov edx, 0x208
lea rcx, [rsp + 0x2fc0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rsp + 0x2fc0]
call fcn.180033c94
mov edx, 0x208
lea rcx, [rsp + 0x2db0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rsp + 0x2db0]
call fcn.180033c94
lea rdx, str.FilePath
lea rcx, [rsp + 0x17f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb78]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [rsp + 0x2560]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180015e60
mov rdx, qword [rsp + 0xb78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015e91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x2560]
call fcn.180033c94
call fcn.180021654
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
je 0x1800169c7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, str._WINDIR__
lea rcx, [rsp + 0x2560]
call fcn.180032d74
test rax, rax
je 0x1800160cb
mov edx, 0x208
lea rcx, [rsp + 0x2ba0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdi, [rsp + 0x2ba0]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x2568]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x180015f10
lea rdx, str.DisenableMode
lea rcx, [rsp + 0xfe0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3d8]
mov rcx, rbp
call fcn.180001c30
mov rdx, qword [rax]
movsxd rcx, dword [0x1801006b8]
imul rcx, rcx, 0x208
lea rsi, [0x1801006bc]
add rcx, rsi
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
inc rcx
test al, al
jne 0x180015f61
mov rdx, qword [rsp + 0x3d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015f92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ProtectPathExtensionFilter
lea rcx, [rsp + 0x1480]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x838]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x838]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180015fea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x68]
cmp dword [rdx - 0x10], 0
je 0x18001601f
mov rdi, rdx
movsxd rcx, dword [0x1801006b8]
imul rcx, rcx, 0x64
lea rax, [0x180106c4c]
add rcx, rax
nop dword [rax]
movzx eax, byte [rdi]
mov byte [rcx], al
inc rdi
inc rcx
test al, al
jne 0x180016010
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
lea r8, [0x1801004b0]
mov byte [rax + r8 + 0x20f], 0
movsxd rdi, dword [0x1801006b8]
imul rdi, rdi, 0x208
add rdi, rsi
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
lea rsi, [rsp + 0x2ba0]
xor ecx, ecx
nop
movzx eax, byte [rsi + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x180016060
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
mov byte [rax + r8 + 0x400], 0
movsxd rax, dword [0x1801006b8]
mov rcx, rax
imul rcx, rcx, 0x208
cmp byte [rcx + r8 + 0x20c], 0
je 0x180016782
cmp byte [rcx + r8 + 0x20f], 0
je 0x180016782
inc eax
mov dword [0x1801006b8], eax
cmp eax, 0x31
jg 0x180016959
jmp 0x180016782
lea rax, [rsp + 0x2560]
lea rdi, [rsp + 0x2db0]
sub rdi, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x1800160f2
inc rax
test ecx, ecx
jne 0x1800160e0
test edx, edx
je 0x180016769
lea rax, [rsp + 0x2560]
lea rdi, [rsp + 0x2fc0]
sub rdi, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + rdi]
sub edx, ecx
jne 0x180016122
inc rax
test ecx, ecx
jne 0x180016110
test edx, edx
je 0x180016769
lea rdx, str._PROGRAMFILES__
lea rcx, [rsp + 0x2560]
call fcn.180032d74
test rax, rax
je 0x18001636b
mov edx, 0x208
lea rcx, [rsp + 0x2990]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [rsp + 0x2993], 0
lea rdi, [rsp + 0x2990]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
mov rax, qword [str.Program_Files]
mov qword [rdi - 1], rax
mov eax, dword [0x180054270]
mov dword [rdi + 7], eax
movzx eax, word [0x180054274]
mov word [rdi + 0xb], ax
lea rdi, [rsp + 0x2990]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x256e]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x1800161b0
lea rdx, str.DisenableMode
lea rcx, [rsp + 0xff0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3e8]
mov rcx, rbp
call fcn.180001c30
mov rdx, qword [rax]
movsxd rcx, dword [0x1801006b8]
imul rcx, rcx, 0x208
lea rsi, [0x1801006bc]
add rcx, rsi
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
inc rcx
test al, al
jne 0x180016201
mov rdx, qword [rsp + 0x3e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016232
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ProtectPathExtensionFilter
lea rcx, [rsp + 0x16d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa68]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0xa68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001628a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x68]
cmp dword [rdx - 0x10], 0
je 0x1800162bf
mov rdi, rdx
movsxd rcx, dword [0x1801006b8]
imul rcx, rcx, 0x64
lea rax, [0x180106c4c]
add rcx, rax
nop dword [rax]
movzx eax, byte [rdi]
mov byte [rcx], al
inc rdi
inc rcx
test al, al
jne 0x1800162b0
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
lea r8, [0x1801004b0]
mov byte [rax + r8 + 0x20f], 0
movsxd rdi, dword [0x1801006b8]
imul rdi, rdi, 0x208
add rdi, rsi
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
lea rsi, [rsp + 0x2990]
xor ecx, ecx
nop
movzx eax, byte [rsi + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x180016300
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
mov byte [rax + r8 + 0x400], 0
movsxd rax, dword [0x1801006b8]
mov rcx, rax
imul rcx, rcx, 0x208
cmp byte [rcx + r8 + 0x20c], 0
je 0x180016782
cmp byte [rcx + r8 + 0x20f], 0
je 0x180016782
inc eax
mov dword [0x1801006b8], eax
cmp eax, 0x31
jg 0x18001697c
jmp 0x180016782
lea rdx, str._SHAREFOLDER_
lea rcx, [rsp + 0x2560]
call fcn.180032d74
test rax, rax
je 0x180016578
mov r8d, 0x208
lea rdi, [0x18010d800]
mov rdx, rdi
mov rcx, r14
call fcn.180004300
mov dword [0x180113d90], eax
mov esi, r13d
test eax, eax
jle 0x180016782
lea rdx, str.DisenableMode
lea rcx, [rsp + 0x1000]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3f8]
mov rcx, rbp
call fcn.180001c30
mov rdx, qword [rax]
movsxd rcx, dword [0x1801006b8]
imul rcx, rcx, 0x208
lea rax, [0x1801006bc]
add rcx, rax
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
inc rcx
test al, al
jne 0x1800163f3
mov rdx, qword [rsp + 0x3f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016424
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ProtectPathExtensionFilter
lea rcx, [rsp + 0x1490]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x848]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x848]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001647c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
je 0x1800164af
movsxd rdx, dword [0x1801006b8]
imul rdx, rdx, 0x64
lea rcx, [0x180106c4c]
add rdx, rcx
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x1800164a0
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
lea r8, [0x1801004b0]
mov byte [rax + r8 + 0x20f], 0
movsxd rdx, esi
imul rdx, rdx, 0x208
add rdx, rdi
movsxd rdi, dword [0x1801006b8]
imul rdi, rdi, 0x208
lea rax, [0x1801006bc]
add rdi, rax
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x180016500
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
mov byte [rax + r8 + 0x400], 0
movsxd rax, dword [0x1801006b8]
mov rcx, rax
imul rcx, rcx, 0x208
cmp byte [rcx + r8 + 0x20c], 0
je 0x18001655e
cmp byte [rcx + r8 + 0x20f], 0
je 0x18001655e
inc eax
mov dword [0x1801006b8], eax
cmp eax, 0x31
jg 0x180016782
inc esi
cmp esi, dword [0x180113d90]
lea rdi, [0x18010d800]
jl 0x1800163b1
jmp 0x180016782
lea rdx, str.DisenableMode
lea rcx, [rsp + 0x1010]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x408]
mov rcx, rbp
call fcn.180001c30
mov rdx, qword [rax]
movsxd rcx, dword [0x1801006b8]
imul rcx, rcx, 0x208
lea rsi, [0x1801006bc]
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
inc rcx
test al, al
jne 0x1800165c0
mov rdx, qword [rsp + 0x408]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800165f1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ProtectPathExtensionFilter
lea rcx, [rsp + 0x1870]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc78]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0xc78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016649
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
je 0x18001667f
movsxd rdx, dword [0x1801006b8]
imul rdx, rdx, 0x64
lea rcx, [0x180106c4c]
add rdx, rcx
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x180016670
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
lea rcx, [0x1801004b0]
mov byte [rax + rcx + 0x20f], 0
lea rdx, str.FilePath
lea rcx, [rsp + 0x1020]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x418]
mov rcx, rbp
call fcn.180001c30
mov rdx, qword [rax]
movsxd rdi, dword [0x1801006b8]
imul rdi, rdi, 0x208
add rdi, rsi
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x1800166e0
mov rdx, qword [rsp + 0x418]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016711
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movsxd rax, dword [0x1801006b8]
imul rax, rax, 0x208
lea r8, [0x1801004b0]
mov byte [rax + r8 + 0x400], 0
movsxd rax, dword [0x1801006b8]
mov rcx, rax
imul rcx, rcx, 0x208
cmp byte [rcx + r8 + 0x20c], 0
je 0x180016782
cmp byte [rcx + r8 + 0x20f], 0
je 0x180016782
inc eax
mov dword [0x1801006b8], eax
cmp eax, 0x31
jg 0x18001699f
jmp 0x180016782
lea rcx, [0x180054240]
call fcn.18000ac40
lea rcx, [rsp + 0x2560]
call fcn.18000ac40
lea rdx, str.CopyMode
lea rcx, [rsp + 0x14a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x858]
mov rcx, rbp
call fcn.180001c30
mov rdx, qword [rax]
mov eax, dword [0x1801006b8]
dec eax
movsxd rcx, eax
lea rax, [0x1801004b0]
lea rcx, [rax + rcx*2 + 0x7f0c]
mov r8d, 1
call fcn.180034120
mov rdx, qword [rsp + 0x858]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800167f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016944
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x180016944
lea rdx, str.Kind
lea rcx, [rsp + 0x1030]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x428]
mov rcx, rbp
call fcn.180001c30
lea rsi, str.AllDisk
mov rdi, qword [rax]
mov ecx, 8
repe cmpsb byte [rsi], byte [rdi]
sete dil
mov rdx, qword [rsp + 0x428]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001687a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x180016944
lea rdx, str.DeleteMark
lea rcx, [rsp + 0x16e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa78]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180108a5c], eax
mov rdx, qword [rsp + 0xa78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800168da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AuditExtension
lea rcx, [rsp + 0x1040]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x438]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x1fe
mov rdx, qword [rax]
lea rcx, [0x180108a60]
call fcn.180034120
mov rdx, qword [rsp + 0x438]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016938
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x180108a60]
call fcn.180033c94
mov rcx, r12
call fcn.180001de0
mov rbp, rax
test rax, rax
je 0x1800169d2
jmp 0x180015640
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800169d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x1801004b0]
jmp 0x1800169d9
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800169d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x1801004b0]
jmp 0x1800169d9
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800169d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x1801004b0]
jmp 0x1800169d9
mov ecx, 0x80004005
call fcn.180001750
int3
lea r8, [0x1801004b0]
cmp dword [0x1801006b8], 0
jle 0x18001da85
mov rbp, r13
lea r12, [0x1801006bb]
movsxd rax, r13d
imul rax, rax, 0x208
lea rsi, [rax + r8 + 0x20c]
mov rcx, rsi
call fcn.180033c94
mov rcx, rsi
call fcn.18000ac40
lea rdx, [0x180053218]
mov rcx, rsi
call fcn.180032d74
test rax, rax
jne 0x180016aa6
mov rcx, rbx
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
lea r8, [0x1801004b0]
lea rcx, [r8 + rbp + 0x20b]
cmp byte [rax + rcx], 0x20
jne 0x180016a6e
add rcx, rax
add rax, rbp
add rax, r12
nop dword [rax]
mov byte [rcx], 0
dec rax
mov rcx, rax
cmp byte [rax], 0x20
je 0x180016a60
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
add rax, rbp
cmp byte [rax + r8 + 0x20b], 0x5c
je 0x180016aad
mov rdi, rsi
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051d48]
mov word [rdi - 1], ax
jmp 0x180016aad
lea r8, [0x1801004b0]
inc r13d
add rbp, 0x208
cmp r13d, dword [0x1801006b8]
jl 0x1800169f0
jmp 0x18001da85
lea rdx, [0x180052690]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x180017165
lea rcx, [0x1800541e0]
call fcn.18000ac40
xor edx, edx
mov r8d, 0xfa
lea rsi, [0x180068e60]
mov rcx, rsi
call fcn.180031f80
lea rdx, str.PolicyName
lea rcx, [rsp + 0x14b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x868]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
mov rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180016b40
mov rdx, qword [rsp + 0x868]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016b71
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov dword [0x180148960], eax
xor edx, edx
mov r8d, 0x404
lea r14, [0x1800fff50]
mov rcx, r14
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea rdi, [0x1800fff00]
mov rcx, rdi
call fcn.180031f80
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x1050]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x448]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18010034c], eax
mov rdx, qword [rsp + 0x448]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016c02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x1800]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb88]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180100350], eax
mov rdx, qword [rsp + 0xb88]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016c59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x180148960]
mov dword [0x1800fff50], eax
mov rcx, r13
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rcx + r14 + 4], al
inc rcx
test al, al
jne 0x180016c70
lea rcx, [0x1800d9b70]
nop word [rax + rax]
movzx eax, byte [r13 + rcx]
mov byte [r13 + r14 + 0xfe], al
inc r13
test al, al
jne 0x180016c90
lea rdx, str.ProcName
lea rcx, [rsp + 0x1060]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x458]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x180100158]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180016ce0
mov rdx, qword [rsp + 0x458]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016d11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x180100158]
call fcn.180033c94
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x14c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x878]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180100154], eax
mov rdx, qword [rsp + 0x878]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016d74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1070]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x468]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800fff44], eax
mov rdx, qword [rsp + 0x468]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016dcb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x16f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa88]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdi], al
inc rcx
inc rdi
test al, al
jne 0x180016e00
mov rdx, qword [rsp + 0xa88]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016e31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1080]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x478]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800fff40], eax
mov rdx, qword [rsp + 0x478]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016e88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x14d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x888]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800fff20], eax
mov rdx, qword [rsp + 0x888]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016ee4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1090]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x488]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800fff24], eax
mov rdx, qword [rsp + 0x488]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016f3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1840]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc08]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800fff28], eax
mov rdx, qword [rsp + 0xc08]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016f99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x10a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x498]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800fff2c], eax
mov rdx, qword [rsp + 0x498]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180016ff2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x14e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x898]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800fff30], eax
mov rdx, qword [rsp + 0x898]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001704e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x10b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4a8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800fff34], eax
mov rdx, qword [rsp + 0x4a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800170a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x1700]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa98]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800fff38], eax
mov rdx, qword [rsp + 0xa98]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017103
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x10c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4b8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800fff3c], eax
mov rdx, qword [rsp + 0x4b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, [0x1800526f0]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x1800179b6
lea rcx, [0x1800541a8]
call fcn.18000ac40
xor edx, edx
mov r8d, 0xfa
lea rsi, [0x180068e60]
mov rcx, rsi
call fcn.180031f80
lea rdx, str.PolicyName
lea rcx, [rsp + 0x14f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8a8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
mov rdx, rsi
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800171d3
mov rdx, qword [rsp + 0x8a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017204
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov dword [0x180148960], eax
xor edx, edx
mov r8d, 0x9f0
lea r14, [0x1800ff510]
mov rcx, r14
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea rdi, [0x1800ff4c0]
mov rcx, rdi
call fcn.180031f80
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x10d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4c8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ffef8], eax
mov rdx, qword [rsp + 0x4c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017295
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x1810]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb98]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ffefc], eax
mov rdx, qword [rsp + 0xb98]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800172ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x180148960]
mov dword [0x1800ff510], eax
mov rcx, r13
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rcx + r14 + 4], al
inc rcx
test al, al
jne 0x180017300
lea rcx, [0x1800d9b70]
nop word [rax + rax]
movzx eax, byte [r13 + rcx]
mov byte [r13 + r14 + 0xfe], al
inc r13
test al, al
jne 0x180017320
lea rdx, str.ExecptProcessName
lea rcx, [rsp + 0x10e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4d8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x1800ff728]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180017370
mov rdx, qword [rsp + 0x4d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800173a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1800ff728]
call fcn.180033c94
lea rdx, str.ExecptFileName
lea rcx, [rsp + 0x1500]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8b8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x1800ffb10]
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800173e0
mov rdx, qword [rsp + 0x8b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017411
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1800ffb10]
call fcn.180033c94
lea rdx, str.DisableAddRegRun
lea rcx, [rsp + 0x10f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4e8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff718], eax
mov rdx, qword [rsp + 0x4e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017474
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisableAddRegServices
lea rcx, [rsp + 0x1710]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xaa8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff71c], eax
mov rdx, qword [rsp + 0xaa8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800174cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisableAddProgramRun
lea rcx, [rsp + 0x1100]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4f8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff720], eax
mov rdx, qword [rsp + 0x4f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017522
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisableAddProgramLink
lea rcx, [rsp + 0x1510]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8c8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff724], eax
mov rdx, qword [rsp + 0x8c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017579
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1110]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x508]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff714], eax
mov rdx, qword [rsp + 0x508]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800175d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1860]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc48]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff504], eax
mov rdx, qword [rsp + 0xc48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017627
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x1120]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x518]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [rdi], al
inc rcx
inc rdi
test al, al
jne 0x180017651
mov rdx, qword [rsp + 0x518]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017682
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1520]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8d8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800ff500], eax
mov rdx, qword [rsp + 0x8d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800176d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1130]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x528]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800ff4e0], eax
mov rdx, qword [rsp + 0x528]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017735
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1720]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xab8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800ff4e4], eax
mov rdx, qword [rsp + 0xab8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001778e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1140]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x538]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800ff4e8], eax
mov rdx, qword [rsp + 0x538]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800177ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x1530]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8e8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800ff4ec], eax
mov rdx, qword [rsp + 0x8e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017843
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1150]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x548]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800ff4f0], eax
mov rdx, qword [rsp + 0x548]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001789f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x1820]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xba8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800ff4f4], eax
mov rdx, qword [rsp + 0xba8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800178f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x1160]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x558]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800ff4f8], eax
mov rdx, qword [rsp + 0x558]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017954
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x1540]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8f8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800ff4fc], eax
mov rdx, qword [rsp + 0x8f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, [0x180052708]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001825b
lea rcx, [0x1800540f8]
call fcn.18000ac40
xor edx, edx
mov r8d, 0xfa
lea rsi, [0x180068e60]
mov rcx, rsi
call fcn.180031f80
lea rdx, str.PolicyName
lea rcx, [rsp + 0x1170]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x568]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
mov rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180017a30
mov rdx, qword [rsp + 0x568]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017a61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov dword [0x180148960], eax
mov ecx, 0x29a0
call fcn.1800211fc
mov rdi, rax
test rax, rax
je 0x18001da85
xor edx, edx
mov r8d, 0x2958
mov rcx, rax
call fcn.180031f80
lea r13, [rdi + 0x2958]
xor edx, edx
lea r8d, [rdx + 0x48]
mov rcx, r13
call fcn.180031f80
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x1730]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xac8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x2950], eax
mov rdx, qword [rsp + 0xac8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017b01
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x1180]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x578]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x2954], eax
mov rdx, qword [rsp + 0x578]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017b58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x180148960]
mov dword [rdi], eax
mov rcx, rdi
sub rcx, rsi
nop word [rax + rax]
movzx eax, byte [rsi]
mov byte [rcx + rsi + 4], al
inc rsi
test al, al
jne 0x180017b70
lea rcx, [0x1800d9b70]
mov rdx, rdi
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0xfe], al
inc rcx
test al, al
jne 0x180017b90
lea rdx, str.WEBList
lea rcx, [rsp + 0x1550]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.180001c30
nop
mov rax, qword [rsp + 0x70]
cmp dword [rax - 0x10], 0x1f40
jle 0x180017c1d
mov r8d, 0x1f3e
lea rdx, [rsp + 0x908]
lea rcx, [rsp + 0x70]
call fcn.180006120
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x908]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017c1d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x70]
lea rdx, [rdi + 0x20c]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180017c30
lea rcx, [rdi + 0x20c]
call fcn.180033c94
lea rdx, [rdi + 0x20c]
mov rcx, r14
call fcn.180003690
lea rdx, str.AccessMode
lea rcx, [rsp + 0x1190]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x588]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x208], eax
mov rdx, qword [rsp + 0x588]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017cb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.FindBlackWebPromt
lea rcx, [rsp + 0x17d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc18]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x214c], eax
mov rdx, qword [rsp + 0xc18]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017d08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.FindBlackWebPromtInfo
lea rcx, [rsp + 0x11a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x598]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x598]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017d60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x70]
cmp dword [rax - 0x10], 0x7ff
jle 0x180017da8
mov r8d, 0x7fe
lea rdx, [rsp + 0x918]
lea rcx, [rsp + 0x70]
call fcn.180006120
mov rdx, qword [rsp + 0x918]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017da8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x70]
lea rdx, [rdi + 0x2150]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180017dc0
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1560]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5a8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x204], eax
mov rdx, qword [rsp + 0x5a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017e26
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x11b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xad8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x299c], eax
mov rdx, qword [rsp + 0xad8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017e7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x1740]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5b8]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r13], al
inc rcx
inc r13
test al, al
jne 0x180017eb0
mov rdx, qword [rsp + 0x5b8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017ee3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x11c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x928]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [rdi + 0x2998], eax
mov rdx, qword [rsp + 0x928]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017f3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1570]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5c8]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [rdi + 0x2978], eax
mov rdx, qword [rsp + 0x5c8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017f96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x11d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbb8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [rdi + 0x297c], eax
mov rdx, qword [rsp + 0xbb8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180017fef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x17d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5d8]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [rdi + 0x2980], eax
mov rdx, qword [rsp + 0x5d8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001804b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x11e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x938]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [rdi + 0x2984], eax
mov rdx, qword [rsp + 0x938]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800180a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1580]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5e8]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [rdi + 0x2988], eax
mov rdx, qword [rsp + 0x5e8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018100
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x11f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xae8]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [rdi + 0x298c], eax
mov rdx, qword [rsp + 0xae8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018159
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x1750]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5f8]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [rdi + 0x2990], eax
mov rdx, qword [rsp + 0x5f8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800181b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x1200]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x948]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [rdi + 0x2994], eax
mov rdx, qword [rsp + 0x948]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001820e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, rdi
lea rcx, [0x180148968]
call fcn.180005540
mov r8d, 0x29a0
mov rdx, rdi
lea rcx, [0x1800fcb20]
call fcn.1800336d0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, str.INTERNET_MONITOR_AUDIT
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x180018a3e
xor edx, edx
mov r8d, 0x1c174
lea rdi, [0x1800dd0d0]
mov rcx, rdi
call fcn.180031f80
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1590]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x608]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd2d4], eax
mov rdx, qword [rsp + 0x608]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800182e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dd2d4], 0
je 0x1800182fc
lea rcx, str.HttpAccessMainPolicy_New_policy__is_run
call fcn.18000ac40
lea rdx, str.OtherState
lea rcx, [rsp + 0x1210]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc68]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd2d8], eax
mov rdx, qword [rsp + 0xc68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018353
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dd2d8], 0
je 0x180018368
lea rcx, str.HttpAccessMainPolicy_New_OtherState__is_run
call fcn.18000ac40
lea rdx, str.OtherAudit
lea rcx, [rsp + 0x17c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x618]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd2dc], eax
mov rdx, qword [rsp + 0x618]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800183bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dd2dc], 0
je 0x1800183d4
lea rcx, str.HttpAccessMainPolicy_New_OtherAudit__is_run
call fcn.18000ac40
lea rdx, str.Prompt
lea rcx, [rsp + 0x1220]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x958]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd2e0], eax
mov rdx, qword [rsp + 0x958]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001842b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dd2e0], 0
je 0x180018440
lea rcx, str.HttpAccessMainPolicy_New_Prompt__is_run
call fcn.18000ac40
mov eax, dword [0x1800dd2dc]
mov dword [0x1800f923c], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x15a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x628]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x1800dd0d4]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180018480
mov rdx, qword [rsp + 0x628]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800184b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, r13
lea rcx, [0x1800d9b70]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdx + rdi + 0xfe], al
inc rdx
test al, al
jne 0x1800184c0
cmp dword [0x1800dd2e0], 0
je 0x180018597
lea rdx, str.PromptInfo
lea rcx, [rsp + 0x1230]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xaf8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
mov edi, dword [rcx - 0x10]
mov rdx, qword [rsp + 0xaf8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001852e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PromptInfo
lea rcx, [rsp + 0x1760]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x638]
mov rcx, rbp
call fcn.180001c30
mov esi, 0x207
cmp edi, 0x208
cmovg edi, esi
movsxd r8, edi
mov rdx, qword [rax]
lea rcx, [0x1800dd2e4]
call fcn.180034120
mov rdx, qword [rsp + 0x638]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018597
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x1940], 0xf
mov qword [rsp + 0x1938], r13
mov byte [rsp + 0x1928], 0
lea r14, [0x1800dd4f1]
mov edi, dword [rsp + 0x50]
nop
cmp r13d, 0x258
jge 0x180018a2c
lea rdx, str.Type
lea rcx, [rsp + 0x1240]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x648]
mov rcx, rbp
call fcn.180001c30
nop
or edi, 2
mov dword [rsp + 0x50], edi
mov rdx, qword [rax]
lea rcx, str.Site
call fcn.18003a25c
test eax, eax
je 0x180018655
lea rdx, str.Type
lea rcx, [rsp + 0x15b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x968]
mov rcx, rbp
call fcn.180001c30
or edi, 4
mov dword [rsp + 0x50], edi
mov rdx, qword [rax]
lea rcx, str.group
call fcn.18003a25c
test eax, eax
je 0x180018655
xor sil, sil
jmp 0x180018658
mov sil, 1
test dil, 4
je 0x180018691
and edi, 0xfffffffb
mov dword [rsp + 0x50], edi
mov rdx, qword [rsp + 0x968]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001868d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x50]
jmp 0x180018691
mov edi, dword [rsp + 0x50]
test dil, 2
je 0x1800186ca
and edi, 0xfffffffd
mov dword [rsp + 0x50], edi
mov rdx, qword [rsp + 0x648]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800186c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x50]
jmp 0x1800186ca
mov edi, dword [rsp + 0x50]
test sil, sil
je 0x180018a18
lea rdx, str.Name
lea rcx, [rsp + 0x1250]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb08]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
mov edi, dword [rcx - 0x10]
mov rdx, qword [rsp + 0xb08]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018722
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [r14 - 5], 1
lea rdx, str.Name
lea rcx, [rsp + 0x17f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x658]
mov rcx, rbp
call fcn.180001c30
movsxd r15, r13d
imul r15, r15, 0xe4
lea rcx, [0x1800dd0d0]
lea rsi, [r15 + rcx + 0x424]
cmp edi, 0x64
mov ecx, 0x63
cmovg edi, ecx
movsxd r8, edi
mov rdx, qword [rax]
mov rcx, rsi
call fcn.180034120
mov rdx, qword [rsp + 0x658]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800187a5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x1920]
call fcn.1800072f0
mov r9d, 1
xor r8d, r8d
lea rdx, [0x180051d24]
lea rcx, [rsp + 0x1920]
call fcn.1800045a0
mov rdi, rax
cmp eax, 0xffffffff
je 0x1800188fc
lea ecx, [rax - 1]
movsxd rdx, ecx
lea rcx, [rsp + 0x1920]
call fcn.180004550
movsx ecx, byte [rax]
call fcn.180036944
test eax, eax
je 0x1800188fc
lea eax, [rdi + 1]
cdqe
mov qword [rsp + 0x88], rax
mov rdx, rax
lea rcx, [rsp + 0x1920]
call fcn.180004550
movsx ecx, byte [rax]
call fcn.180036944
test eax, eax
je 0x1800188fc
xor edx, edx
mov r8d, 0xc8
mov rcx, rsi
call fcn.180031f80
movsxd r9, edi
xor r8d, r8d
lea rdx, [rsp + 0x18d0]
lea rcx, [rsp + 0x1920]
call fcn.180008a80
cmp qword [rax + 0x20], 0x10
jb 0x180018877
mov rcx, qword [rax + 8]
jmp 0x18001887b
lea rcx, [rax + 8]
mov rdx, rsi
nop
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180018880
lea rcx, [rsp + 0x18d0]
call fcn.1800064d0
mov r9, rbx
mov r8, qword [rsp + 0x88]
lea rdx, [rsp + 0x18a8]
lea rcx, [rsp + 0x1920]
call fcn.180008a80
cmp qword [rax + 0x20], 0x10
jb 0x1800188c9
mov rcx, qword [rax + 8]
jmp 0x1800188cd
lea rcx, [rax + 8]
lea rax, [0x1800dd0d0]
lea rdx, [r15 + rax + 0x4ec]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x1800188e0
lea rcx, [rsp + 0x18a8]
call fcn.1800064d0
mov rcx, rsi
call fcn.180033c94
mov rcx, rsi
call fcn.18000ac40
lea rdx, str.State
lea rcx, [rsp + 0x1260]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x978]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov byte [r14], al
mov rdx, qword [rsp + 0x978]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018960
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Audit
lea rcx, [rsp + 0x15c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x668]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov byte [r14 + 2], al
mov rdx, qword [rsp + 0x668]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800189b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Realm
lea rcx, [rsp + 0x1270]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc8]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov byte [r14 + 1], al
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018a0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc r13d
add r14, 0xe4
mov edi, dword [rsp + 0x50]
mov rcx, r12
call fcn.180001de0
mov rbp, rax
test rax, rax
jne 0x1800185c0
lea rcx, [rsp + 0x1920]
call fcn.1800064d0
jmp 0x18001da85
lea rdx, str.HTTP_VISITED_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x1800194d6
xor edx, edx
mov r8d, 0xfa
lea rsi, [0x180068e60]
mov rcx, rsi
call fcn.180031f80
lea rdx, str.PolicyName
lea rcx, [rsp + 0x1770]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x678]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
mov rdx, rsi
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180018aa0
mov rdx, qword [rsp + 0x678]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018ad1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180002110
mov dword [0x180148960], eax
xor edx, edx
mov r8d, 0x38c8
lea rdi, [0x1800f9250]
mov rcx, rdi
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea r14, [0x1800dd080]
mov rcx, r14
call fcn.180031f80
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x1280]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x988]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800fa3fc], eax
mov rdx, qword [rsp + 0x988]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018b62
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x15d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x688]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800fa400], eax
mov rdx, qword [rsp + 0x688]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018bb9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x180148960]
mov dword [0x1800f9250], eax
mov rcx, r13
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rcx + rdi + 4], al
inc rcx
test al, al
jne 0x180018bd0
mov rdx, r13
lea rcx, [0x1800d9b70]
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdx + rdi + 0xfe], al
inc rdx
test al, al
jne 0x180018bf0
lea rdx, str.WEBList
lea rcx, [rsp + 0x1290]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180001c30
nop
mov rax, qword [rsp + 0x60]
mov r15d, 0x3b
cmp dword [rax - 0x10], 0xfa0
jle 0x180018ce8
mov r8d, 0xf9e
lea rdx, [rsp + 0xb10]
lea rcx, [rsp + 0x60]
call fcn.180006120
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0xb10]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018c88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, r15d
mov rcx, qword [rsp + 0x60]
call fcn.1800345e4
test rax, rax
jne 0x180018c9e
mov eax, ebx
jmp 0x180018ca2
sub eax, dword [rsp + 0x60]
mov r8d, eax
lea rdx, [rsp + 0x698]
lea rcx, [rsp + 0x60]
call fcn.180006120
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x698]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018ce8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x1800f945c]
mov rdx, rdi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180018d00
mov rcx, rdi
call fcn.180033c94
mov rdx, rdi
mov rcx, qword [rsp + 0x88]
call fcn.180003690
lea rcx, [rsp + 0x60]
call fcn.180001920
lea rdx, str.KeyWordList
lea rcx, [rsp + 0x1808]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x998]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x998]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018d89
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], 0x2328
jle 0x180018e44
mov r8d, 0x2327
lea rdx, [rsp + 0x6a8]
lea rcx, [rsp + 0x60]
call fcn.180006120
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0x6a8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018de4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, r15d
mov rcx, qword [rsp + 0x60]
call fcn.1800345e4
test rax, rax
jne 0x180018dfa
mov eax, ebx
jmp 0x180018dfe
sub eax, dword [rsp + 0x60]
mov r8d, eax
lea rdx, [rsp + 0xb18]
lea rcx, [rsp + 0x60]
call fcn.180006120
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180001b50
nop
mov rdx, qword [rsp + 0xb18]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018e44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
lea rdx, [0x1800fa7f0]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180018e50
lea rdx, str.KeyWordTipAllow
lea rcx, [rsp + 0x12a0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xd0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800fa404], eax
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018eb6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.KeyWordTip
lea rcx, [rsp + 0x15e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xe0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x1800fa408]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x180018ef0
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180018f21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1800fa7f0]
call fcn.18000ac40
mov rcx, rdi
call fcn.180033c94
lea rdx, [0x180051e7c]
mov rcx, rdi
call fcn.180032d74
mov rsi, rax
test rax, rax
je 0x180019000
lea r15, [0x1800f9250]
lea r14, [0x1800f945c]
nop
xor edx, edx
mov r8d, 0x7d0
lea rcx, [rsp + 0x35d0]
call fcn.180031f80
mov r8, rsi
sub r8, r14
mov rdx, r14
lea rcx, [rsp + 0x35d0]
call fcn.180034120
lea rdi, [rsp + 0x35d0]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rsi + rcx + 4]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x180018fa0
mov rdx, r13
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x35d0]
mov byte [rdx + r15 + 0x20c], al
inc rdx
test al, al
jne 0x180018fc0
lea rdx, [0x180051e7c]
mov rcx, r14
call fcn.180032d74
mov rsi, rax
test rax, rax
jne 0x180018f60
lea r14, [0x1800dd080]
lea rdi, [0x1800f945c]
mov rcx, rdi
call fcn.18000ac40
lea rdx, str.AuditMode
lea rcx, [rsp + 0x12b0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xf0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800f9458], eax
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001905f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1780]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x100]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800f9454], eax
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800190b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800f9454], 0
je 0x1800190cb
lea rcx, [0x180053f48]
call fcn.18000ac40
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x12c0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x110]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd0c4], eax
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019122
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x15f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x120]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [r14], al
inc rcx
inc r14
test al, al
jne 0x180019150
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019182
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x12d0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x130]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd0c0], eax
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800191d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1818]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x140]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dd0a0], eax
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019235
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x12e0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x150]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dd0a4], eax
mov rdx, qword [rsp + 0x150]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001928e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1600]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x160]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dd0a8], eax
mov rdx, qword [rsp + 0x160]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800192ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x12f0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x170]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dd0ac], eax
mov rdx, qword [rsp + 0x170]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019343
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1790]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x180]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dd0b0], eax
mov rdx, qword [rsp + 0x180]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001939f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0xce0]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x190]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dd0b4], eax
mov rdx, qword [rsp + 0x190]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800193f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0xce8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1a0]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800dd0b8], eax
mov rdx, qword [rsp + 0x1a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019454
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0xcf8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1b0]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800dd0bc], eax
mov rdx, qword [rsp + 0x1b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800194ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, [0x180052720]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x180019515
lea rcx, [0x180053f20]
call fcn.18000ac40
xor edx, edx
mov r8d, 0xfa
lea rcx, [0x180068e60]
call fcn.180031f80
jmp 0x18001da85
lea rdx, [0x1800526a8]
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x180019a9c
lea rcx, [0x180053ef8]
call fcn.18000ac40
xor edx, edx
mov r8d, 0x5cec
lea r13, [0x180113eb0]
mov rcx, r13
call fcn.180031f80
xor edx, edx
mov r8d, 0x14c
lea rcx, [0x180119ba0]
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x180113eb0], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0xd08]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1c0]
mov rcx, r12
call fcn.180001f40
mov r8d, 0xfa
mov rdx, qword [rax]
lea rcx, [0x180113eb4]
call fcn.180034120
mov rdx, qword [rsp + 0x1c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800195d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0xd18]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1d0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180113fb0], eax
mov rdx, qword [rsp + 0x1d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001962d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 0x104
lea rcx, [rsp + 0x2770]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esi, 0x207
lea r15, [0x180117d20]
nop dword [rax]
cmp dword [0x180113fb4], 0xf
jge 0x18001da85
mov byte [rsp + 0x2350], 0
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x2351]
call fcn.180031f80
lea rdx, str.WorkFolder
lea rcx, [rsp + 0xd28]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1e0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x206
mov rdx, qword [rax]
lea rcx, [rsp + 0x2350]
call fcn.180034120
mov rdx, qword [rsp + 0x1e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800196d6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
lea rdi, [rsp + 0x2350]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 4
jbe 0x180019a83
mov rcx, rbx
lea rdi, [rsp + 0x2770]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2770]
lea rcx, [rsp + 0x2350]
call fcn.1800473b0
test eax, eax
je 0x180019a83
mov r8d, 0xe
lea rdx, str.Program_files
lea rcx, [rsp + 0x2352]
call fcn.1800473b0
test eax, eax
je 0x180019a83
xor eax, eax
mov rcx, rbx
lea rdi, [rsp + 0x2350]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsp + 0x2350]
cmp byte [rcx + rax - 2], 0x5c
je 0x180019783
lea rdi, [rsp + 0x2350]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051d48]
mov word [rdi - 1], ax
cmp dword [0x180113fb4], 0
jne 0x18001988b
mov byte [rsp + 0x2140], 0
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x2141]
call fcn.180031f80
mov r8d, 0x1fe
lea rdx, [rsp + 0x2350]
lea rcx, [rsp + 0x2140]
call fcn.180034120
lea rdi, [rsp + 0x2140]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
mov eax, dword [str.temp]
mov dword [rdi - 1], eax
movzx eax, byte [0x180053ed0]
mov byte [rdi + 3], al
xor edx, edx
lea rcx, [rsp + 0x2140]
call fcn.1800357e0
test eax, eax
je 0x180019834
xor edx, edx
lea rcx, [rsp + 0x2140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdi, [rsp + 0x2140]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
mov eax, dword [0x180053ec8]
mov dword [rdi - 1], eax
xor edx, edx
lea rcx, [rsp + 0x2140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x18001988b
lea rdi, [rsp + 0x2140]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
mov eax, dword [0x180053ec8]
mov dword [rdi - 1], eax
xor edx, edx
lea rcx, [rsp + 0x2140]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor eax, eax
mov rcx, rbx
lea rdi, [rsp + 0x2140]
repne scasb al, byte [rdi]
not rcx
lea rax, [rsp + 0x2140]
mov byte [rcx + rax - 4], 0
lea rdx, [rsp + 0x2140]
mov rcx, r14
call fcn.180003440
lea rdx, [rsp + 0x2350]
mov rcx, r14
call fcn.180003190
movsxd rdx, dword [0x180113fb4]
imul rdx, rdx, 0x410
lea rax, [0x180114030]
add rdx, rax
xor eax, eax
mov rcx, rbx
lea rdi, [rsp + 0x2350]
repne scasb al, byte [rdi]
not rcx
lea r9, [rcx - 1]
mov dword [rsp + 0x28], 0x410
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x2350]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.FolderAllowProc
lea rcx, [rsp + 0xd38]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x1f0]
mov rcx, rbp
call fcn.180001c30
movsxd rcx, dword [0x180113fb4]
imul rcx, rcx, 0x208
add rcx, r15
mov r8d, 0x1ff
mov rdx, qword [rax]
call fcn.180034120
mov rdx, qword [rsp + 0x1f0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019950
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movsxd rcx, dword [0x180113fb4]
imul rcx, rcx, 0x208
add rcx, r15
call fcn.180033c94
lea rdx, str.AllowProcOutside
lea rcx, [rsp + 0xd48]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x200]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
movsxd rcx, dword [0x180113fb4]
mov dword [r13 + rcx*4 + 0x108], eax
mov rdx, qword [rsp + 0x200]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800199c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.OtherProcOperaterWorkFolder
lea rcx, [rsp + 0xd58]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x210]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
movsxd rcx, dword [0x180113fb4]
mov dword [r13 + rcx*4 + 0x144], eax
mov rdx, qword [rsp + 0x210]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019a26
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.AllowCopyWorkFolderFileToUsbStorage
lea rcx, [rsp + 0xd68]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x220]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180119b98], eax
mov rdx, qword [rsp + 0x220]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019a7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc dword [0x180113fb4]
mov rcx, r12
call fcn.180001de0
mov rbp, rax
test rax, rax
jne 0x180019650
jmp 0x18001da85
lea rdx, str.UDISK_WRITEONLY_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x180019f1f
xor edx, edx
mov r8d, 0x10c
lea rsi, [0x1800dcf70]
mov rcx, rsi
call fcn.180031f80
xor edx, edx
mov r8d, 0x144
lea rdi, [0x1800dce20]
mov rcx, rdi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x1800dcf70], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0xd78]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x230]
mov rcx, r12
call fcn.180001f40
mov r8d, 0xfa
mov rdx, qword [rax]
lea rcx, [0x1800dcf74]
call fcn.180034120
mov rdx, qword [rsp + 0x230]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019b54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0xd88]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x240]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd070], eax
mov rdx, qword [rsp + 0x240]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019bab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisabledCopyFileFromUDisk
lea rcx, [rsp + 0xd98]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x250]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dd074], eax
mov rdx, qword [rsp + 0x250]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019c02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1800dd074]
mov dword [0x1800dd078], eax
mov eax, dword [0x1800dcf70]
mov dword [0x1800dce20], eax
mov eax, dword [0x1800dd070]
mov dword [0x1800dcf3c], eax
nop word [rax + rax]
movzx eax, byte [r13 + rsi + 4]
mov byte [r13 + rdi + 4], al
inc r13
test al, al
jne 0x180019c30
lea rdx, str.DBT1
lea rcx, [rsp + 0xda8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x260]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dcf40], eax
mov rdx, qword [rsp + 0x260]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019c9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0xdb8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x270]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dcf44], eax
mov rdx, qword [rsp + 0x270]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019cf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0xdc8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x280]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dcf48], eax
mov rdx, qword [rsp + 0x280]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019d53
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0xdd8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x290]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dcf4c], eax
mov rdx, qword [rsp + 0x290]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019dac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0xde8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2a0]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dcf50], eax
mov rdx, qword [rsp + 0x2a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019e08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0xdf8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2b0]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dcf54], eax
mov rdx, qword [rsp + 0x2b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019e61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0xe08]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2c0]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800dcf58], eax
mov rdx, qword [rsp + 0x2c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019ebd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0xe18]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2d0]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800dcf5c], eax
mov rdx, qword [rsp + 0x2d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, str.ANTI_ROGUE_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001a85e
lea rcx, [0x1801489a0]
call fcn.180006e10
mov byte [rsp + 0x31d0], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x31d1]
call fcn.180031f80
lea rcx, [rsp + 0x78]
call fcn.18000bfa0
nop
mov esi, 1
mov r8d, esi
lea rdx, [0x180053e48]
lea rcx, [rsp + 0x18f8]
call fcn.18000ab00
mov rdi, rax
lea r8, [0x180051d48]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x2e0]
call fcn.1800076e0
nop
cmp qword [rdi + 0x20], 0x10
jb 0x180019fb7
mov r8, qword [rdi + 8]
jmp 0x180019fbb
lea r8, [rdi + 8]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1800076e0
nop
mov rdx, qword [rsp + 0x2e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180019fef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x18f8]
call fcn.1800064d0
mov r8d, esi
lea rdx, str.HostRegMon.ini
lea rcx, [rsp + 0x1880]
call fcn.18000ab00
nop
cmp qword [rax + 0x20], 0x10
jb 0x18001a021
mov rdx, qword [rax + 8]
jmp 0x18001a025
lea rdx, [rax + 8]
lea rcx, [rsp + 0x78]
call fcn.18000a070
nop
lea rcx, [rsp + 0x1880]
call fcn.1800064d0
xor edx, edx
mov r8d, 0x610
lea r15, [0x1800dc810]
mov rcx, r15
call fcn.180031f80
xor edx, edx
mov r8d, 0x144
lea rcx, [0x1800dce20]
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x1800dc810], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0xe28]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x2f0]
mov rcx, r12
call fcn.180001f40
mov r8d, 0xfa
mov rdx, qword [rax]
lea rcx, [0x1800dc814]
call fcn.180034120
mov rdx, qword [rsp + 0x2f0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a0d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0xe38]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x300]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dc910], eax
mov rdx, qword [rsp + 0x300]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a12b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1800dc810]
mov dword [0x1800dc6c0], eax
mov eax, dword [0x1800dc910]
mov dword [0x1800dc7dc], eax
mov rdx, r13
lea rcx, [0x180000000]
nop dword [rax]
movzx eax, byte [rdx + r15 + 4]
mov byte [rdx + rcx + 0xdc6c4], al
inc rdx
test al, al
jne 0x18001a150
lea rdx, str.DBT1
lea rcx, [rsp + 0xe48]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x310]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dc7e0], eax
mov rdx, qword [rsp + 0x310]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a1bd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0xe58]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x320]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dc7e4], eax
mov rdx, qword [rsp + 0x320]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a216
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0xe68]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x330]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dc7e8], eax
mov rdx, qword [rsp + 0x330]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a26f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0xe78]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x340]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dc7ec], eax
mov rdx, qword [rsp + 0x340]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a2c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0xe88]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x350]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dc7f0], eax
mov rdx, qword [rsp + 0x350]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a321
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0xe98]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x360]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800dc7f4], eax
mov rdx, qword [rsp + 0x360]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a37a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0xea8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x370]
mov rcx, r12
call fcn.180001f40
mov edx, esi
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800dc7f8], eax
mov rdx, qword [rsp + 0x370]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a3d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0xeb8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x380]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800dc7fc], eax
mov rdx, qword [rsp + 0x380]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a42c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15d, 0x3b
lea r13d, [r15 + 0x28]
nop word [rax + rax]
lea rdx, str.DefinedBy
lea rcx, [rsp + 0xec8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x390]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0xf9
mov rdx, qword [rax]
lea rcx, [0x1800dc918]
call fcn.180034120
mov rdx, qword [rsp + 0x390]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a49e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.IERegControl
lea rcx, [0x1800dc918]
call fcn.18003a25c
test eax, eax
jne 0x18001a5f6
lea rdx, str.IEModifyRegUsed
lea rcx, [rsp + 0xed8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3a0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dca14], eax
mov rdx, qword [rsp + 0x3a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a510
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.IEModifyRegMode
lea rcx, [rsp + 0xee8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3b0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dc914], eax
mov rdx, qword [rsp + 0x3b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a567
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dca14], 0
je 0x18001a5f6
mov dword [0x1800dce18], esi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x31d0]
lea r8, [0x180051c58]
lea rdx, str.MonitorProc
lea rcx, str.Global
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov word [0x1800dca18], r15w
mov r8d, 0x3fc
lea rdx, [rsp + 0x31d0]
lea rcx, [0x1800dca18]
call fcn.180035130
lea rdi, [0x1800dca18]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rcx, [0x1800dca18]
call fcn.180033c94
lea rdx, str.IEBHO
lea rcx, [0x1800dc918]
call fcn.18003a25c
test eax, eax
jne 0x18001a7af
mov dword [0x1800dce1c], esi
mov byte [rsp + 0x2060], al
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x2061]
call fcn.180031f80
mov byte [rsp + 0x20d0], 0
mov r8, r13
xor edx, edx
lea rcx, [rsp + 0x20d1]
call fcn.180031f80
lea rcx, [rsp + 0xa8]
call fcn.180001a00
nop
lea rdx, str.Mode
lea rcx, [rsp + 0xef8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3c0]
mov rcx, rbp
call fcn.180001c30
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0xa8]
call fcn.180001be0
nop
mov rdx, qword [rsp + 0x3c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a6b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [0x180053dc8]
lea rcx, [rsp + 0xf08]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3d0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x64
mov rdx, qword [rax]
lea rcx, [rsp + 0x2060]
call fcn.180034120
mov rdx, qword [rsp + 0x3d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a712
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DllName
lea rcx, [rsp + 0xf18]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x3e0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x64
mov rdx, qword [rax]
lea rcx, [rsp + 0x20d0]
call fcn.180034120
mov rdx, qword [rsp + 0x3e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a771
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0xa8]
mov r9, rdi
lea r8, [rsp + 0x20d0]
lea rdx, [rsp + 0x2060]
mov rcx, r14
call fcn.1800117d0
nop
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a7af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, r12
call fcn.180001de0
mov rbp, rax
test rax, rax
jne 0x18001a440
cmp dword [0x1800dce18], eax
mov r13, rax
jne 0x18001a7e5
cmp dword [0x1800dce1c], r13d
jne 0x18001a7e5
mov dword [0x1800dc910], r13d
mov dword [0x1800dc7dc], r13d
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
call fcn.180001780
add rax, 0x18
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0x3f0]
mov rcx, r14
call fcn.180008680
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a836
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, str.UDISK_ACTION_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001b3a7
lea rcx, str.PolicyClassNameUDISK_ACTION_CONTROL
call fcn.18000ac40
xor edx, edx
mov r8d, 0xc20
lea r14, [0x1800dbaa0]
mov rcx, r14
call fcn.180031f80
xor edx, edx
mov r8d, 0x1e14
lea rsi, [0x1800d9c80]
mov rcx, rsi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x1800d9c80], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0xf28]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x400]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x1800d9c84]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001a900
mov rdx, qword [rsp + 0x400]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a931
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1800d9c80]
mov dword [0x1800dbaa4], eax
mov rcx, r13
movzx eax, byte [rcx + rsi + 4]
mov byte [rcx + r14 + 8], al
inc rcx
test al, al
jne 0x18001a940
lea rdx, str.AuditCopyIn
lea rcx, [rsp + 0xf38]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x410]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbba4], eax
mov rdx, qword [rsp + 0x410]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001a9a8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InFileExtName
lea rcx, [rsp + 0xf48]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x420]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x1800dbba8]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001a9e0
mov rdx, qword [rsp + 0x420]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001aa11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1800dbba8]
call fcn.180033c94
lea rdx, str.AuditCopyOut
lea rcx, [rsp + 0xf58]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x430]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbec8], eax
mov rdx, qword [rsp + 0x430]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001aa74
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.OutFileExtName
lea rcx, [rsp + 0xf68]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x440]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
lea rdx, [0x1800dbd38]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001aab0
mov rdx, qword [rsp + 0x440]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001aae1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1800dbd38]
call fcn.180033c94
lea rdx, str.AuditCopyOut
lea rcx, [rsp + 0xf78]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x450]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbec8], eax
mov rdx, qword [rsp + 0x450]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ab44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisableUdiskRunApp
lea rcx, [rsp + 0xf88]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x460]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbecc], eax
mov rdx, qword [rsp + 0x460]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ab9b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dbecc], 0
je 0x18001abb0
lea rcx, [0x180053cf8]
call fcn.18000ac40
lea rdx, str.UpRegionService
lea rcx, [rsp + 0xf98]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x470]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800da674], eax
mov rdx, qword [rsp + 0x470]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ac07
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0xfa8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x480]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800da678], eax
mov rdx, qword [rsp + 0x480]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ac5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x1800da674]
mov dword [0x1800dbed0], eax
mov eax, dword [0x1800da678]
mov dword [0x1800dbed4], eax
lea rdx, str.BackupCopyOrCutFileToUDisk
lea rcx, [rsp + 0xfb8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x490]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbee0], eax
mov rdx, qword [rsp + 0x490]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001accd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0xfc8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4a0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbaa0], eax
mov rdx, qword [rsp + 0x4a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ad24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x1800dbaa0], 0
je 0x18001af5c
call fcn.18000eb50
test eax, eax
je 0x18001af5c
lea rdx, str.StartCheckSensitive
lea rcx, [rsp + 0xfd8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4b0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dbee4], eax
mov rdx, qword [rsp + 0x4b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ad95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.SensitiveWord
lea rcx, [rsp + 0xfe8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4e0]
mov rcx, rbp
call fcn.180001c30
nop
mov rdi, qword [rax]
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
not rcx
dec rcx
mov edi, 0x3e7
cmp rcx, rdi
ja 0x18001ae17
lea rdx, str.SensitiveWord
lea rcx, [rsp + 0xff8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4d0]
mov rcx, rbp
call fcn.180001c30
mov rdi, qword [rax]
mov dword [rsp + 0x50], 8
xor eax, eax
mov rcx, rbx
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
lea rdx, str.SensitiveWord
lea rcx, [rsp + 0x1008]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4c0]
mov rcx, rbp
call fcn.180001c30
mov r8, rdi
mov rdx, qword [rax]
lea rcx, [0x1800dbee8]
call fcn.180034120
mov rdx, qword [rsp + 0x4c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ae73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test byte [rsp + 0x50], 8
je 0x18001ae9d
mov rdx, qword [rsp + 0x4d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ae9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x4e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001aebf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x1b6c], 1
mov eax, dword [0x1800dbee4]
mov dword [rsp + 0x1b70], eax
mov eax, dword [0x1800d9c80]
mov dword [rsp + 0x1b60], eax
mov eax, dword [0x1800da674]
mov dword [rsp + 0x1b64], eax
mov eax, dword [0x1800da678]
mov dword [rsp + 0x1b68], eax
mov rcx, r13
movzx eax, byte [rcx + rsi + 4]
mov byte [rsp + rcx + 0x1b74], al
inc rcx
test al, al
jne 0x18001af01
mov rdx, r13
nop word [rax + rax]
movzx eax, byte [rdx + r14 + 0x448]
mov byte [rsp + rdx + 0x1c6e], al
inc rdx
test al, al
jne 0x18001af20
lea rcx, [rsp + 0x1b60]
call fcn.18000e9f0
lea rcx, [0x180053ca0]
call fcn.18000ac40
lea rcx, [0x1800dbee8]
call fcn.18000ac40
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1018]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x4f0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800da670], eax
mov rdx, qword [rsp + 0x4f0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001afb3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DvdAction
lea rcx, [rsp + 0x1028]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x500]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800dc6b8], eax
mov rdx, qword [rsp + 0x500]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b00a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [0x1800dc6bc], r13d
lea rdx, str.Class
lea rcx, [rsp + 0x1038]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x510]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x1800d9d7e]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001b042
mov rdx, qword [rsp + 0x510]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b073
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1048]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x520]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1800da66c], eax
mov rdx, qword [rsp + 0x520]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b0ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1058]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x530]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800d9d9c], eax
mov rdx, qword [rsp + 0x530]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b126
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1068]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x540]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800d9da0], eax
mov rdx, qword [rsp + 0x540]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b17f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1078]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x550]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800d9da4], eax
mov rdx, qword [rsp + 0x550]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b1db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x1088]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x560]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800d9da8], eax
mov rdx, qword [rsp + 0x560]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b234
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1098]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x570]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800d9dac], eax
mov rdx, qword [rsp + 0x570]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b290
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x10a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x580]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1800d9db0], eax
mov rdx, qword [rsp + 0x580]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b2e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x10b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x590]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800d9db4], eax
mov rdx, qword [rsp + 0x590]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b345
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x10c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5a0]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1800d9db8], eax
mov rdx, qword [rsp + 0x5a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, str.ONLINE_DEAL_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001b9c5
xor edx, edx
mov r8d, 0x508
lea rsi, [0x180119cf0]
mov rcx, rsi
call fcn.180031f80
xor edx, edx
mov r8d, 0x144
lea rdi, [0x18011a200]
mov rcx, rdi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x18011a200], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x10d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5b0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011a204]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001b432
mov rdx, qword [rsp + 0x5b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b463
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x18011a200]
mov dword [0x180119cf4], eax
nop
movzx eax, byte [r13 + rdi + 4]
mov byte [r13 + rsi + 8], al
inc r13
test al, al
jne 0x18001b470
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x10e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5c0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180119cf0], eax
mov rdx, qword [rsp + 0x5c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b4d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.OnlyAllowSpecCode
lea rcx, [rsp + 0x10f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5d0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180119df4], eax
mov rdx, qword [rsp + 0x5d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b530
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15d, 0x3b
mov word [0x180119df8], r15w
lea rdx, str.AllowDialCode
lea rcx, [rsp + 0x1108]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5e0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3fc
mov rdx, qword [rax]
lea rcx, [0x180119df8]
call fcn.180035130
mov rdx, qword [rsp + 0x5e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b59c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
lea rdi, [0x180119df8]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi + 0x106], r15b
je 0x18001b5ce
lea rdi, [0x180119df8]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1118]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x5f0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a33c], eax
mov rdx, qword [rsp + 0x5f0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b625
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x1128]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x600]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011a2fe]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001b660
mov rdx, qword [rsp + 0x600]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b691
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1138]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x610]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a340], eax
mov rdx, qword [rsp + 0x610]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b6e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1148]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x620]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a31c], eax
mov rdx, qword [rsp + 0x620]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b744
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1158]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x630]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a320], eax
mov rdx, qword [rsp + 0x630]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b79d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1168]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x640]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a324], eax
mov rdx, qword [rsp + 0x640]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b7f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x1178]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x650]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a328], eax
mov rdx, qword [rsp + 0x650]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b852
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1188]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x660]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a32c], eax
mov rdx, qword [rsp + 0x660]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b8ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x1198]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x670]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a330], eax
mov rdx, qword [rsp + 0x670]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b907
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x11a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x680]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011a334], eax
mov rdx, qword [rsp + 0x680]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001b963
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x11b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x690]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011a338], eax
mov rdx, qword [rsp + 0x690]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, str.OTHER_BEHAVIOR_MANAGE
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001bef8
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rsi, [0x18011a350]
mov rcx, rsi
call fcn.180031f80
xor edx, edx
mov r8d, 0x144
lea rdi, [0x18011a460]
mov rcx, rdi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x18011a460], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x11c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6a0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011a464]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001ba50
mov rdx, qword [rsp + 0x6a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001ba81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x18011a460]
mov dword [0x18011a354], eax
nop dword [rax]
movzx eax, byte [r13 + rdi + 4]
mov byte [r13 + rsi + 8], al
inc r13
test al, al
jne 0x18001ba90
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x11d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6b0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a59c], eax
mov rdx, qword [rsp + 0x6b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001baf9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x11e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6c0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011a55e]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001bb30
mov rdx, qword [rsp + 0x6c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bb61
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x11f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6d0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a5a0], eax
mov rdx, qword [rsp + 0x6d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bbb8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x18011a5a0]
mov dword [0x18011a350], eax
lea rdx, str.CanModifySystemTime
lea rcx, [rsp + 0x1208]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6e0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a454], eax
mov rdx, qword [rsp + 0x6e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bc1b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1218]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x6f0]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a57c], eax
mov rdx, qword [rsp + 0x6f0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bc77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1228]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x700]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a580], eax
mov rdx, qword [rsp + 0x700]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bcd0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1238]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x710]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a584], eax
mov rdx, qword [rsp + 0x710]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bd2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x1248]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x720]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a588], eax
mov rdx, qword [rsp + 0x720]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bd85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x1258]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x730]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a58c], eax
mov rdx, qword [rsp + 0x730]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bde1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x1268]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x740]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011a590], eax
mov rdx, qword [rsp + 0x740]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001be3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x1278]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x750]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011a594], eax
mov rdx, qword [rsp + 0x750]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001be96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x1288]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x760]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011a598], eax
mov rdx, qword [rsp + 0x760]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001da85
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x18001da85
lea rdx, str.ONLINE_DEAL_PROXY_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001c922
xor edx, edx
mov r8d, 0x1698
lea rsi, [0x18011a5b0]
mov rcx, rsi
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea rdi, [0x18011bc50]
mov rcx, rdi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x18011a5b4], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x1298]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x770]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011a5b8]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001bf81
mov rdx, qword [rsp + 0x770]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001bfb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x12a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x780]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011bc94], eax
mov rdx, qword [rsp + 0x780]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c009
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.Class
lea rcx, [rsp + 0x12b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x790]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
movzx eax, byte [rcx]
mov byte [rdi], al
inc rcx
inc rdi
test al, al
jne 0x18001c033
mov rdx, qword [rsp + 0x790]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c064
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x12c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7a0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a5b0], eax
mov rdx, qword [rsp + 0x7a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c0bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [0x18011a5b0]
mov dword [0x18011bc90], eax
lea rdx, str.Prompt
lea rcx, [rsp + 0x12d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7b0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a6b4], eax
mov rdx, qword [rsp + 0x7b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c11e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PromptInfo
lea rcx, [rsp + 0x12e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7c0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x63
mov rdx, qword [rax]
lea rcx, [0x18011a6b8]
call fcn.180034120
mov rdx, qword [rsp + 0x7c0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c17c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [0x18011a6b4], 0
je 0x18001c1f4
xor eax, eax
mov rcx, rbx
lea rdi, [0x18011a6b8]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18001c1f4
lea rcx, [0x180000000]
mov rax, qword [rcx + 0x53c18]
mov qword [rcx + 0x11a6b8], rax
mov rax, qword [rcx + 0x53c20]
mov qword [rcx + 0x11a6c0], rax
mov rax, qword [rcx + 0x53c28]
mov qword [rcx + 0x11a6c8], rax
mov eax, dword [rcx + 0x53c30]
mov dword [rcx + 0x11a6d0], eax
movzx eax, word [rcx + 0x53c34]
mov word [rcx + 0x11a6d4], ax
movzx eax, byte [rcx + 0x53c36]
mov byte [rcx + 0x11a6d6], al
lea rdx, str.AuditProxyServer
lea rcx, [rsp + 0x12f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7d0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011b728], eax
mov rdx, qword [rsp + 0x7d0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c24b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.ForbidProxyServer
lea rcx, [rsp + 0x1308]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7e0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011a71c], eax
mov rdx, qword [rsp + 0x7e0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c2a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.GateWayMode
lea rcx, [rsp + 0x1318]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x7f0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011b720], eax
mov rdx, qword [rsp + 0x7f0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c2f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.GateWayMode
lea rcx, [rsp + 0x1328]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x800]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011b724], eax
mov rdx, qword [rsp + 0x800]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c350
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.NetIPList
lea rcx, [rsp + 0x1338]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x810]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x7fe
mov rdx, qword [rax]
lea rcx, [0x18011af20]
call fcn.180034120
mov rdx, qword [rsp + 0x810]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c3ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, rbx
lea rdi, [0x18011af20]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi + 0x96e], 0x3b
je 0x18001c3e0
lea rdi, [0x18011af20]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rdx, str.NotAllowsList
lea rcx, [rsp + 0x1348]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x820]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3ff
mov rdx, qword [rax]
lea rcx, [0x18011ab20]
call fcn.180034120
mov rdx, qword [rsp + 0x820]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c43e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.OnlyAllowsList
lea rcx, [rsp + 0x1358]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x830]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3ff
mov rdx, qword [rax]
lea rcx, [0x18011a720]
call fcn.180034120
mov rdx, qword [rsp + 0x830]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c49c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT1
lea rcx, [rsp + 0x1368]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x840]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011bc70], eax
mov rdx, qword [rsp + 0x840]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c4f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET1
lea rcx, [rsp + 0x1378]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x850]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011bc74], eax
mov rdx, qword [rsp + 0x850]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c551
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT2
lea rcx, [rsp + 0x1388]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x860]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011bc78], eax
mov rdx, qword [rsp + 0x860]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c5ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET2
lea rcx, [rsp + 0x1398]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x870]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011bc7c], eax
mov rdx, qword [rsp + 0x870]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c606
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DBT3
lea rcx, [rsp + 0x13a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x880]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011bc80], eax
mov rdx, qword [rsp + 0x880]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c662
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DET3
lea rcx, [rsp + 0x13b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x890]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011bc84], eax
mov rdx, qword [rsp + 0x890]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c6bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x13c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8a0]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011bc88], eax
mov rdx, qword [rsp + 0x8a0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c717
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x13d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8b0]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011bc8c], eax
mov rdx, qword [rsp + 0x8b0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18001c770
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.DisableIEProxySeting
lea rcx, [rsp + 0x13e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8c0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011b72c], eax
lea rcx, [rsp + 0x8c0]
call fcn.180001a40
lea rdx, str.EnforceIEProxySeting
lea rcx, [rsp + 0x13f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8d0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011b730], eax
lea rcx, [rsp + 0x8d0]
call fcn.180001a40
lea rdx, str.IEProxyIPAddress
lea rcx, [rsp + 0x1408]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8e0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x103
mov rdx, qword [rax]
lea rcx, [0x18011b734]
call fcn.180034120
lea rcx, [rsp + 0x8e0]
call fcn.180001a40
lea rdx, str.IEProxyPort
lea rcx, [rsp + 0x1418]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x8f0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 9
mov rdx, qword [rax]
lea rcx, [0x18011b838]
call fcn.180034120
lea rcx, [rsp + 0x8f0]
call fcn.180001a40
lea rdx, str.IELOCALNOTPROXY
lea rcx, [rsp + 0x1428]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x900]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011b844], eax
lea rcx, [rsp + 0x900]
call fcn.180001a40
lea rdx, str.IEEXCEPTIONADDR
lea rcx, [rsp + 0x1438]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x910]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3ff
mov rdx, qword [rax]
lea rcx, [0x18011b848]
call fcn.180034120
lea rcx, [rsp + 0x910]
call fcn.180001a40
lea rcx, [0x18011b848]
call fcn.18004c52c
jmp 0x18001da85
lea rdx, str.CLIP_BOARD_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001d00f
xor edx, edx
mov r8d, 0x584
lea r13, [0x18011bca0]
mov rcx, r13
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea rsi, [0x18011c230]
mov rcx, rsi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x18011bca4], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x1448]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x920]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011bca8]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001c9b0
lea rcx, [rsp + 0x920]
call fcn.180001a40
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1458]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x930]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011bca0], eax
lea rcx, [rsp + 0x930]
call fcn.180001a40
lea rdx, str.IsCut
lea rcx, [rsp + 0x1468]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x940]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011be0c], eax
lea rcx, [rsp + 0x940]
call fcn.180001a40
lea rdx, str.IsPaste
lea rcx, [rsp + 0x1478]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x950]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011be10], eax
lea rcx, [rsp + 0x950]
call fcn.180001a40
lea rdx, str.IsOpenKeyWords
lea rcx, [rsp + 0x1488]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x960]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011be14], eax
lea rcx, [rsp + 0x960]
call fcn.180001a40
lea rdx, str.IsCanRun
lea rcx, [rsp + 0x1498]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x970]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011be18], eax
lea rcx, [rsp + 0x970]
call fcn.180001a40
lea rdx, str.Prompt
lea rcx, [rsp + 0x14a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x980]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011bda4], eax
lea rcx, [rsp + 0x980]
call fcn.180001a40
lea rdx, str.PromptInfo
lea rcx, [rsp + 0x14b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x990]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x62
mov rdx, qword [rax]
lea rcx, [0x18011bda8]
call fcn.180034120
lea rcx, [rsp + 0x990]
call fcn.180001a40
cmp dword [0x18011bda4], 0
je 0x18001cbfe
xor eax, eax
mov rcx, rbx
lea rdi, [0x18011bda8]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18001cbfe
lea rcx, [0x180000000]
mov rax, qword [rcx + 0x53ae0]
mov qword [rcx + 0x11bda8], rax
mov rax, qword [rcx + 0x53ae8]
mov qword [rcx + 0x11bdb0], rax
mov rax, qword [rcx + 0x53af0]
mov qword [rcx + 0x11bdb8], rax
mov eax, dword [rcx + 0x53af8]
mov dword [rcx + 0x11bdc0], eax
mov r15d, 0x3b
mov word [0x18011be1c], r15w
lea rdx, str.KeyWords
lea rcx, [rsp + 0x14c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9a0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3fc
mov rdx, qword [rax]
lea rcx, [0x18011be1c]
call fcn.180035130
lea rcx, [rsp + 0x9a0]
call fcn.180001a40
xor eax, eax
mov rcx, rbx
lea rdi, [0x18011be1c]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + r13 + 0x17a], r15b
je 0x18001cc87
lea rdi, [0x18011be1c]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x14d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9b0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011c21c], eax
lea rcx, [rsp + 0x9b0]
call fcn.180001a40
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x14e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9c0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011c220], eax
lea rcx, [rsp + 0x9c0]
call fcn.180001a40
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x14f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9d0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011c274], eax
lea rcx, [rsp + 0x9d0]
call fcn.180001a40
lea rdx, str.Class
lea rcx, [rsp + 0x1508]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9e0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rsi], al
inc rcx
inc rsi
test al, al
jne 0x18001cd80
lea rcx, [rsp + 0x9e0]
call fcn.180001a40
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x1518]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0x9f0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011c270], eax
lea rcx, [rsp + 0x9f0]
call fcn.180001a40
lea rdx, str.DBT1
lea rcx, [rsp + 0x1528]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa00]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011c250], eax
lea rcx, [rsp + 0xa00]
call fcn.180001a40
lea rdx, str.DET1
lea rcx, [rsp + 0x1538]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa10]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011c254], eax
lea rcx, [rsp + 0xa10]
call fcn.180001a40
lea rdx, str.DBT2
lea rcx, [rsp + 0x1548]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa20]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011c258], eax
lea rcx, [rsp + 0xa20]
call fcn.180001a40
lea rdx, str.DET2
lea rcx, [rsp + 0x1558]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa30]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011c25c], eax
lea rcx, [rsp + 0xa30]
call fcn.180001a40
lea rdx, str.DBT3
lea rcx, [rsp + 0x1568]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa40]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011c260], eax
lea rcx, [rsp + 0xa40]
call fcn.180001a40
lea rdx, str.DET3
lea rcx, [rsp + 0x1578]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa50]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011c264], eax
lea rcx, [rsp + 0xa50]
call fcn.180001a40
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x1588]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa60]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011c268], eax
lea rcx, [rsp + 0xa60]
call fcn.180001a40
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x1598]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa70]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011c26c], eax
lea rcx, [rsp + 0xa70]
call fcn.180001a40
jmp 0x18001da85
lea rdx, str.WEB_VISIT_CONTROL
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001d53d
xor edx, edx
mov r8d, 0x150c
lea r13, [0x18011c280]
mov rcx, r13
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea rsi, [0x18011d790]
mov rcx, rsi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x18011c284], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x15a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa80]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011c288]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001d0a0
lea rcx, [rsp + 0xa80]
call fcn.180001a40
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x15b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xa90]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011c280], eax
lea rcx, [rsp + 0xa90]
call fcn.180001a40
mov edx, dword [0x18011c280]
mov dword [0x18011d7d0], edx
lea rdx, str.Imperative
lea rcx, [rsp + 0x15c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xaa0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0xffa
mov rdx, qword [rax]
lea rcx, [0x18011c382]
call fcn.180034120
lea rcx, [rsp + 0xaa0]
call fcn.180001a40
lea rdx, [0x18011c382]
mov rcx, r14
call fcn.180003690
xor eax, eax
mov rcx, rbx
lea rdi, [0x18011c382]
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + r13 + 0x100], 0x3b
je 0x18001d195
lea rdi, [0x18011c382]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180051e68]
mov word [rdi - 1], ax
lea rcx, [0x18011c382]
call fcn.180033c94
lea rdx, str.FileObject
lea rcx, [rsp + 0x15d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xab0]
mov rcx, rbp
call fcn.180001c30
mov r8d, 0x3fe
mov rdx, qword [rax]
lea rcx, [0x18011d382]
call fcn.180034120
lea rcx, [rsp + 0xab0]
call fcn.180001a40
lea rcx, [0x18011d382]
call fcn.180033c94
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x15e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xac0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011d784], eax
lea rcx, [rsp + 0xac0]
call fcn.180001a40
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x15f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xad0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011d788], eax
lea rcx, [rsp + 0xad0]
call fcn.180001a40
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1608]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xae0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011d7d4], eax
lea rcx, [rsp + 0xae0]
call fcn.180001a40
lea rdx, str.Class
lea rcx, [rsp + 0x1618]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xaf0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rsi], al
inc rcx
inc rsi
test al, al
jne 0x18001d2f0
lea rcx, [rsp + 0xaf0]
call fcn.180001a40
lea rdx, str.DBT1
lea rcx, [rsp + 0x1628]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb00]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011d7b0], eax
lea rcx, [rsp + 0xb00]
call fcn.180001a40
lea rdx, str.DET1
lea rcx, [rsp + 0x1638]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb20]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011d7b4], eax
lea rcx, [rsp + 0xb20]
call fcn.180001a40
lea rdx, str.DBT2
lea rcx, [rsp + 0x1648]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb30]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011d7b8], eax
lea rcx, [rsp + 0xb30]
call fcn.180001a40
lea rdx, str.DET2
lea rcx, [rsp + 0x1658]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb40]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011d7bc], eax
lea rcx, [rsp + 0xb40]
call fcn.180001a40
lea rdx, str.DBT3
lea rcx, [rsp + 0x1668]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb50]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011d7c0], eax
lea rcx, [rsp + 0xb50]
call fcn.180001a40
lea rdx, str.DET3
lea rcx, [rsp + 0x1678]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb60]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x18011d7c4], eax
lea rcx, [rsp + 0xb60]
call fcn.180001a40
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x1688]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb70]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011d7c8], eax
lea rcx, [rsp + 0xb70]
call fcn.180001a40
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x1698]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb80]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x18011d7cc], eax
lea rcx, [rsp + 0xb80]
call fcn.180001a40
jmp 0x18001da85
lea rdx, str.SYSTEM_CONNECT_MONITOR
mov rcx, qword [rsp + 0x58]
call fcn.180034704
test eax, eax
sete al
test al, al
je 0x18001da85
xor edx, edx
mov r8d, 0x2b094
lea rcx, [0x18011d7e0]
call fcn.180031f80
xor edx, edx
lea r8d, [rdx + 0x48]
lea rdi, [0x180148880]
mov rcx, rdi
call fcn.180031f80
mov rcx, r12
call fcn.180002110
mov dword [0x18011d7e4], eax
lea rdx, str.PolicyName
lea rcx, [rsp + 0x16a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb90]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
lea rdx, [0x18011d7e8]
movzx eax, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
test al, al
jne 0x18001d5c3
lea rcx, [rsp + 0xb90]
call fcn.180001a40
lea rdx, str.StartPolicy
lea rcx, [rsp + 0x16b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xba0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011d7e0], eax
lea rcx, [rsp + 0xba0]
call fcn.180001a40
lea rdx, str.ControlMode
lea rcx, [rsp + 0x16c8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbb0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011d8e4], eax
lea rcx, [rsp + 0xbb0]
call fcn.180001a40
lea rdx, str.AuditMode
lea rcx, [rsp + 0x16d8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbc0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18011d8e8], eax
lea rcx, [rsp + 0xbc0]
call fcn.180001a40
lea rdx, str.White_List
lea rcx, [rsp + 0x16e8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc0]
mov rcx, rbp
call fcn.180001c30
nop
lea rdx, str.Black_List
lea rcx, [rsp + 0x16f8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xb0]
mov rcx, rbp
call fcn.180001c30
nop
mov edx, 1
lea rcx, [rsp + 0xc0]
call fcn.180008330
mov edx, 2
lea rcx, [rsp + 0xb0]
call fcn.180008330
lea rdx, str.UpRegionService
lea rcx, [rsp + 0x1708]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbd0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x18014886c], eax
lea rcx, [rsp + 0xbd0]
call fcn.180001a40
lea rdx, str.WriteLocalFile
lea rcx, [rsp + 0x1718]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbe0]
mov rcx, rbp
call fcn.180001c30
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x180148870], eax
lea rcx, [rsp + 0xbe0]
call fcn.180001a40
mov edx, dword [0x18011d7e0]
mov dword [0x1801488c0], edx
lea rdx, str.InvalidWeekDay
lea rcx, [rsp + 0x1728]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xbf0]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
call fcn.180032c44
mov dword [0x1801488c4], eax
lea rcx, [rsp + 0xbf0]
call fcn.180001a40
lea rdx, str.Class
lea rcx, [rsp + 0x1738]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc00]
mov rcx, r12
call fcn.180001f40
mov rcx, qword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdi], al
inc rcx
inc rdi
test al, al
jne 0x18001d820
lea rcx, [rsp + 0xc00]
call fcn.180001a40
lea rdx, str.DBT1
lea rcx, [rsp + 0x1748]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc10]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1801488a0], eax
lea rcx, [rsp + 0xc10]
call fcn.180001a40
lea rdx, str.DET1
lea rcx, [rsp + 0x1758]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc20]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1801488a4], eax
lea rcx, [rsp + 0xc20]
call fcn.180001a40
lea rdx, str.DBT2
lea rcx, [rsp + 0x1768]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc30]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1801488a8], eax
lea rcx, [rsp + 0xc30]
call fcn.180001a40
lea rdx, str.DET2
lea rcx, [rsp + 0x1778]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc40]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1801488ac], eax
lea rcx, [rsp + 0xc40]
call fcn.180001a40
lea rdx, str.DBT3
lea rcx, [rsp + 0x1788]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc50]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1801488b0], eax
lea rcx, [rsp + 0xc50]
call fcn.180001a40
lea rdx, str.DET3
lea rcx, [rsp + 0x1798]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc60]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002230
mov dword [0x1801488b4], eax
lea rcx, [rsp + 0xc60]
call fcn.180001a40
lea rdx, str.PolicyStartTime
lea rcx, [rsp + 0x17a8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc70]
mov rcx, r12
call fcn.180001f40
mov edx, 1
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1801488b8], eax
lea rcx, [rsp + 0xc70]
call fcn.180001a40
lea rdx, str.PolicyEndTime
lea rcx, [rsp + 0x17b8]
call fcn.180002050
mov r8, rax
lea rdx, [rsp + 0xc80]
mov rcx, r12
call fcn.180001f40
xor edx, edx
mov rcx, qword [rax]
call fcn.180002380
mov dword [0x1801488bc], eax
lea rcx, [rsp + 0xc80]
call fcn.180001a40
nop
lea rcx, [rsp + 0xb0]
call fcn.180001a40
nop
lea rcx, [rsp + 0xc0]
call fcn.180001a40
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18001daa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x3da0]
xor rcx, rsp
call fcn.180031f50
mov rbx, qword [rsp + 0x3e00]
add rsp, 0x3db0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret