Function at 0x18003e670
Capabilities:
Access the windows event log
Create service
Delete service

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3f8]
sub rsp, 0x4c0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x1800923a0]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r10, r8
mov qword [rbp - 0x68], r8
mov r8d, edx
mov dword [rbp - 0x70], edx
mov r14, rcx
mov qword [rbp - 0x78], rcx
mov r12d, edx
lea eax, [rdx + rdx*2]
shl eax, 4
mov dword [rbp - 0x50], eax
xor r13d, r13d
lea edx, [r13 + 0x69]
cmp r12d, eax
ja 0x18003f124
lea ecx, [rdx - 0x23]
movsd xmm6, qword [0x18008c0c0]
movsd xmm8, qword [0x18008be80]
movsd xmm7, qword [0x18008bd50]
movsd xmm9, qword [0x18008bf70]
mov ebx, dword [rbp - 0x34]
mov qword [rbp - 0x48], rbx
mov r15, qword [rbp + 0x10]
mov r14d, dword [rbp - 0x34]
mov r13d, dword [rbp - 0x34]
mov rdi, qword [rbp - 0x78]
nop
cmp r12d, 0x240
ja 0x18003eed7
je 0x18003eecb
cmp r12d, 0xc9
ja 0x18003ee7e
je 0x18003ee58
mov eax, r12d
sub eax, 0x54
je 0x18003edc4
sub eax, 0x2c
je 0x18003e788
sub eax, 0x10
je 0x18003e77c
cmp eax, 0x13
jne 0x18003f10b
mov eax, dword [r10]
cmp dword [rdi], eax
je 0x18003f10b
xor r13d, r13d
mov dword [rbp - 0x58], r13d
jmp case.0x18003f18e.128
mov word [rbp + 0xc0], cx
jmp 0x18003f10b
mov r14d, 1
mov eax, dword [r10]
test eax, eax
js 0x18003e770
cmp eax, 0x80
jb 0x18003f190
cmp eax, 0x800
jae 0x18003e83b
mov dword [rsp + 0x70], 8
or eax, 0x3000
shr eax, 6
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0x3f
bts eax, 7
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov r14d, eax
and r14d, ebx
and r14d, 1
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x78]
jmp 0x18003f0f9
cmp eax, 0x10000
jae 0x18003e91c
mov dword [rsp + 0x70], 8
or eax, 0xe0000
shr eax, 0xc
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rsi, qword [rbp - 0x78]
mov rdx, rsi
xor ecx, ecx
call fcn.180039d10
mov edi, eax
mov dword [rsp + 0x70], 8
mov r14, qword [rbp - 0x68]
mov eax, dword [r14]
and eax, 0xfc0
bts eax, 0xd
shr eax, 6
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rsi
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov eax, dword [r14]
and eax, 0x3f
bts eax, 7
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rsi
xor ecx, ecx
call fcn.180039d10
mov r14d, eax
and r14d, ebx
and r14d, edi
and r14d, 1
mov rbx, qword [rbp - 0x48]
mov rdi, rsi
jmp 0x18003f0f9
cmp eax, 0x200000
jae 0x18003ea43
mov dword [rsp + 0x70], 8
or eax, 0x3c00000
shr eax, 0x12
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov r14, qword [rbp - 0x78]
mov rdx, r14
xor ecx, ecx
call fcn.180039d10
mov esi, eax
mov dword [rsp + 0x70], 8
mov rbx, qword [rbp - 0x68]
mov eax, dword [rbx]
and eax, 0x3f000
bts eax, 0x13
shr eax, 0xc
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, r14
xor ecx, ecx
call fcn.180039d10
mov edi, eax
mov dword [rsp + 0x70], 8
mov eax, dword [rbx]
and eax, 0xfc0
bts eax, 0xd
shr eax, 6
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, r14
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0x3f
bts eax, 7
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, r14
xor ecx, ecx
call fcn.180039d10
mov r14d, eax
and r14d, ebx
and r14d, edi
and r14d, esi
and r14d, 1
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x78]
jmp 0x18003f0f9
cmp eax, 0x4000000
jae 0x18003ebe1
mov esi, 0xd4
cmp esi, 0xd4
je 0x18003eaf2
cmp esi, 0x168
jne 0x18003ebc2
mov dword [rsp + 0x70], 8
mov eax, dword [r10]
and eax, 0xfc0
bts eax, 0xd
shr eax, 6
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0x3f
bts eax, 7
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
and eax, ebx
jmp 0x18003ebbb
mov dword [rsp + 0x70], 8
movzx eax, byte [r10 + 3]
or eax, 0xf8
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov edi, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0xfc0000
bts eax, 0x19
shr eax, 0x12
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0x3f000
bts eax, 0x13
shr eax, 0xc
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
and eax, ebx
and eax, edi
mov r10, qword [rbp - 0x68]
and r14d, eax
add esi, 0x94
cmp esi, 0x1fc
jb 0x18003ea53
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x78]
jmp 0x18003f0fd
mov esi, 0xe2
nop word [rax + rax]
mov eax, esi
sub eax, 0xe2
je 0x18003ed22
sub eax, 1
je 0x18003ecdd
cmp eax, 1
jne 0x18003eda9
mov dword [rsp + 0x70], 8
mov eax, dword [r10]
and eax, 0x3f000
bts eax, 0x13
shr eax, 0xc
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov edi, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0xfc0
bts eax, 0xd
shr eax, 6
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
and eax, 0x3f
bts eax, 7
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
and eax, ebx
and eax, edi
jmp 0x18003eda2
mov dword [rsp + 0x70], 8
mov eax, dword [r10]
and eax, 0xfc0000
bts eax, 0x19
shr eax, 0x12
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
jmp 0x18003eda2
mov dword [rsp + 0x70], 8
mov eax, dword [r10]
shr eax, 0x1e
or eax, 0xfc
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
mov ebx, eax
mov dword [rsp + 0x70], 8
mov rax, qword [rbp - 0x68]
movzx eax, byte [rax + 3]
and eax, 0x3f
bts eax, 7
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
and eax, ebx
and r14d, eax
mov r10, qword [rbp - 0x68]
inc esi
cmp esi, 0xe5
jb 0x18003ebf0
mov rbx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x78]
jmp 0x18003f0fd
movsd xmm0, qword [r10]
addsd xmm0, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_floor
mov rax, qword [rbp - 0x68]
movsd qword [rax], xmm0
cvttsd2si r13d, xmm0
cmp r13d, 0x64
jg 0x18003f1e4
mov dword [rbp - 0x40], 1
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x78], r13d
mov rax, qword [rbp - 0x78]
movsd xmm0, qword [rax]
movsd qword [rbp - 0x20], xmm0
lea rax, [rbp - 4]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xae
lea r9, [rsp + 0x78]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x40]
call fcn.180035ab0
cmp dword [rbp - 4], 0
jne 0x18003f1c6
mov rdi, qword [rbp - 0x78]
jmp 0x18003f0f9
mov rax, qword [rbp - 0x78]
mov rcx, qword [rax]
cmp dword [rcx], 1
jne 0x18003e770
mov eax, dword [r10]
mov dword [rcx + 4], eax
mov dword [rbp - 0x58], 1
mov rdi, qword [rbp - 0x78]
jmp 0x18003f106
mov eax, r12d
sub eax, 0xee
je 0x18003eeb3
sub eax, 0x62
je 0x18003eea1
cmp eax, 0xb0
jne 0x18003f10b
mov dword [rbp - 0x58], r14d
jmp 0x18003f10b
movsd xmm0, qword [rbp - 0x30]
xorps xmm0, xmm6
movsd qword [rbp - 0x30], xmm0
jmp 0x18003f10b
mov rax, qword [rbp - 0x78]
movsd xmm0, qword [rax]
addsd xmm0, xmm7
movsd qword [rax], xmm0
mov rdi, rax
jmp 0x18003f10b
mov word [rbp + 0xc1], dx
jmp 0x18003f10b
cmp r12d, 0x3b8
ja 0x18003f052
je 0x18003eff1
mov eax, r12d
sub eax, 0x24c
je 0x18003ef0d
sub eax, 0xd8
je case.0x18003f18e.128
cmp eax, 0x24
je case.0x18003f18e.128
jmp 0x18003f10b
mov edx, 1
cmp r13d, 8
jl 0x18003efb3
lea r8d, [r13 - 7]
mov ecx, 0xfffffffc
nop word [rax + rax]
lea eax, [rcx + 3]
xorps xmm2, xmm2
cvtsi2sd xmm2, eax
mulsd xmm2, qword [rbp - 0x30]
mov eax, edx
not eax
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm2, xmm0
lea eax, [rcx + 1]
xorps xmm1, xmm1
cvtsi2sd xmm1, eax
mulsd xmm2, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, ecx
mulsd xmm2, xmm0
lea eax, [rcx - 1]
xorps xmm1, xmm1
cvtsi2sd xmm1, eax
mulsd xmm2, xmm1
lea eax, [rcx - 2]
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm2, xmm0
lea eax, [rcx - 3]
xorps xmm1, xmm1
cvtsi2sd xmm1, eax
mulsd xmm2, xmm1
lea eax, [rcx - 4]
xorps xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm2, xmm0
movsd qword [rbp - 0x30], xmm2
add edx, 8
sub ecx, 8
cmp edx, r8d
jle 0x18003ef30
mov r8d, dword [rbp - 0x70]
cmp edx, r13d
jg 0x18003efe2
mov ecx, edx
neg ecx
mov eax, r13d
sub eax, edx
lea edx, [rax + 1]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movsd xmm1, qword [rbp - 0x30]
mulsd xmm1, xmm0
movsd qword [rbp - 0x30], xmm1
dec ecx
sub rdx, 1
jne 0x18003efc4
movsd xmm0, qword [rbp - 0x30]
movsd qword [rbp - 0x58], xmm0
jmp 0x18003f101
mov rax, qword [rbp - 0x78]
movsd xmm0, qword [rax]
cvttsd2si rcx, xmm0
mulsd xmm0, xmm9
cvttsd2si rbx, xmm0
mov eax, 0x51eb851f
mul ebx
shr edx, 5
imul eax, edx, 0x64
sub ebx, eax
mov qword [rbp - 0x48], rbx
mov r8d, 0xa
mov rdx, r10
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
mov r15, 0xffffffffffffffff
mov r10, qword [rbp - 0x68]
inc r15
cmp byte [r10 + r15], 0
jne 0x18003f035
add r15, r10
mov byte [r15], 0x2e
inc r15
mov rdi, qword [rbp - 0x78]
jmp 0x18003f0fd
cmp r12d, 0x3f0
je 0x18003f0ab
cmp r12d, 0x5a0
je 0x18003f090
cmp r12d, 0x682
jne 0x18003f10b
cmp ebx, 0xa
jae 0x18003f07d
mov byte [r15], 0x30
inc r15
mov r8d, 0xa
mov rdx, r15
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
jmp 0x18003f0f9
mov eax, dword [str.tion]
mov dword [rbp + 0xc7], eax
movzx eax, byte [0x180088ef4]
mov byte [rbp + 0xcb], al
jmp 0x18003f10b
mov r8d, 2
lea rdx, [0x180087d60]
lea rcx, [rbp + 0xc2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 3
lea rdx, [0x180088ef8]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x180084338]
lea rcx, [rbp + 0xc6]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r10, qword [rbp - 0x68]
mov r8d, dword [rbp - 0x70]
mov edx, 0x69
mov ecx, 0x46
lea eax, [r12 + r8]
lea r12d, [rax + r8*2]
cmp r12d, dword [rbp - 0x50]
jbe 0x18003e720
xor r13d, r13d
mov r14, qword [rbp - 0x78]
lea eax, [r8 - 0x10]
mov dword [rbp - 0x34], eax
cmp r8d, eax
jbe case.0x18003f18e.128
lea rdx, [0x180000000]
mov r9d, 0x20
lea r8d, [r9 + 0x59]
movzx ebx, byte [rbp - 0x7c]
mov dword [rbp - 0x50], ebx
movzx edi, word [rbp - 0x7c]
mov dword [rbp - 0x5c], edi
movzx esi, byte [rbp - 0x7c]
mov dword [rbp - 0x38], esi
movzx r12d, byte [rbp - 0x7c]
mov dword [rbp - 0x40], r12d
mov r15d, dword [rsp + 0x70]
mov eax, dword [rbp - 0x70]
nop dword [rax + rax]
add eax, 0xffffff80
cmp eax, 0x23
ja case.0x18003f18e.143
movzx eax, byte [rdx + rax + 0x400cc]
mov ecx, dword [rdx + rax*4 + 0x4008c]
add rcx, rdx
jmp rcx
mov dword [rsp + 0x70], 8
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x9c
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, qword [rbp - 0x78]
xor ecx, ecx
call fcn.180039d10
jmp 0x180040041
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x21
movsd xmm0, qword [0x18008bf80]
movsd qword [rbp - 0x58], xmm0
jmp case.0x18003f18e.128
mov r8d, 0x64
mov edx, r13d
lea rcx, str.EntityReferenceConstructor
call fcn.1800770a0
movsd xmm0, qword [0x18008bf80]
movsd qword [rbp - 0x58], xmm0
jmp case.0x18003f18e.128
mov r8d, 0xa
lea rdx, [rbp + 0x12c]
mov ecx, r9d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov bl, 1
mov dword [rbp - 0x50], ebx
movups xmm0, xmmword [rbp + 0x48]
movups xmmword [rbp + 0xa8], xmm0
movsd xmm1, qword [rbp + 0x58]
movsd qword [rbp + 0xb8], xmm1
mov qword [rbp - 0x28], r13
jmp 0x18003ff86
test bl, bl
je 0x18003f307
lea rdx, [rbp + 0x138]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenBackupEventLogA]
mov r14, rax
mov qword [rbp - 0x28], rax
movzx ebx, bl
test rax, rax
cmove ebx, r13d
mov dword [rbp - 0x50], ebx
test bl, bl
je 0x18003f307
mov edi, 0xa4
mov dword [rbp - 0x60], edi
movzx esi, byte [rbp - 0x80]
mov r12d, dword [rbp - 0x18]
nop word [rax + rax]
mov ecx, edi
sub ecx, 0xa0
je 0x18003f3a8
sub ecx, 1
je 0x18003f321
sub ecx, 1
je 0x18003f2d6
sub ecx, 1
je 0x18003f2ba
cmp ecx, 1
jne 0x18003f2e9
movzx esi, cl
mov byte [rbp - 0x80], cl
jmp 0x18003f2e9
call qword [sym.imp.WINMM.dll_waveOutGetNumDevs]
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
jmp 0x18003f2e9
mov ecx, r13d
movzx eax, sil
test r12d, r12d
cmovne ecx, eax
mov byte [rbp - 0x80], cl
movzx esi, cl
dec edi
mov dword [rbp - 0x60], edi
cmp edi, 0x9f
ja 0x18003f290
mov dword [rbp - 0x18], r12d
mov r12d, dword [rbp - 0x40]
mov esi, dword [rbp - 0x38]
mov edi, dword [rbp - 0x5c]
mov ebx, dword [rbp - 0x50]
lea r8, [rbp - 0x10]
mov edx, dword [rbp - 0x14]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
mov byte [rbp - 0x58], 1
jmp 0x18003ff86
xor edx, edx
lea rcx, [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_BuildTrusteeWithNameA]
movzx ecx, byte [rbp - 0x80]
test cl, cl
je 0x18003f2e6
mov ebx, 0x129
mov edi, dword [rbp + 4]
mov eax, ebx
sub eax, 0x127
je 0x18003f372
sub eax, 1
je 0x18003f367
cmp eax, 1
jne 0x18003f38f
mov dword [rbp], r13d
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.WINMM.dll_waveOutGetID]
mov edi, eax
jmp 0x18003f38b
test edi, edi
jne 0x18003f38f
xor cl, cl
mov byte [rbp - 0x80], cl
jmp 0x18003f38f
test cl, cl
je 0x18003f38f
mov r8d, 0x104
lea rdx, [rbp + 0x160]
mov ecx, edi
call qword [sym.imp.WINMM.dll_waveOutGetErrorTextW]
movzx ecx, byte [rbp - 0x80]
dec ebx
cmp ebx, 0x126
ja 0x18003f340
mov dword [rbp + 4], edi
mov edi, dword [rbp - 0x60]
movzx esi, byte [rbp - 0x80]
jmp 0x18003f2e9
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18003f2e9
mov dword [rbp + 0x112], 0x79
mov r8d, 0xa
lea rdx, [rbp + 0x114]
mov ecx, r9d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
mov r8d, 0x73
mov dword [rbp + 0x120], r8d
mov dword [rbp + 0x122], r8d
jmp 0x18003ff86
lea rdx, [rbp + 0xc0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov qword [rbp - 0x28], rax
jmp 0x18003ff86
lea rcx, [rbp + 0x108]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18003f412
movsd xmm0, qword [str.libea]
movsd qword [rcx], xmm0
mov eax, dword [0x180088f28]
mov dword [rcx + 8], eax
jmp case.0x18003f18e.143
mov word [rbp + 0xd0], r13w
jmp case.0x18003f18e.143
mov dword [rbp - 0x14], r13d
mov ecx, r13d
movzx eax, bl
test r15d, r15d
cmovne ecx, eax
movzx ebx, cl
mov dword [rbp - 0x50], ebx
jmp case.0x18003f18e.143
lea rcx, [rbp + 0x120]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18003f470
movsd xmm0, qword [str.leay]
movsd qword [rcx], xmm0
movzx eax, word [0x180088f38]
mov word [rcx + 8], ax
jmp case.0x18003f18e.143
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x18003f4af
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov rax, r13
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x10], r13d
lea rcx, [rbp + 0x120]
mov qword [rbp + 0xb8], rcx
lea rdx, [rbp + 0x138]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_BackupEventLogA]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], r13d
mov rax, r13
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r13w
mov ebx, 0x6c
mov dword [rbp - 0x60], ebx
cmp ebx, 0x274
ja 0x18003f7c2
je 0x18003f5a0
cmp ebx, 0x6c
je 0x18003f585
cmp ebx, 0xee
je 0x18003f574
cmp ebx, 0x170
je 0x18003f54f
cmp ebx, 0x1f2
jne 0x18003f734
mov dword [rbp + 0xfa], 0x640025
mov dword [rbp + 0xfe], 0x20003a
jmp 0x18003f734
mov ecx, 0x73
mov word [rbp + 0xf0], cx
mov dword [rbp + 0xf2], 0x730025
mov dword [rbp + 0xf6], 0x400020
jmp 0x18003f734
mov ecx, 0x25
mov word [rbp + 0xee], cx
jmp 0x18003f734
mov dword [rbp + 0xe8], 0x730025
mov ecx, 0x2e
mov word [rbp + 0xec], cx
jmp 0x18003f734
mov dword [rbp + 0x102], 0x730025
mov word [rbp + 0x106], r13w
mov rdi, qword [r14 + 0x10]
mov rbx, r14
cmp qword [r14 + 0x18], 8
jb 0x18003f5c3
mov rbx, qword [r14]
cmp rdi, 8
jae 0x18003f5db
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x68], xmm0
mov esi, 7
mov r15, qword [rbp + 0x68]
jmp 0x18003f61a
mov rsi, rdi
or rsi, 7
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
cmova rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x68]
call fcn.180038870
mov r15, rax
mov qword [rbp + 0x68], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x78], rdi
lea r14, [rbp + 0x68]
cmp rsi, 8
cmovae r14, r15
cmp rdi, 8
jae 0x18003f645
movups xmm6, xmmword [r14]
mov qword [rbp + 0x60], 7
jmp 0x18003f689
mov rbx, rdi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x48]
call fcn.180038870
mov qword [rbp + 0x48], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x60], rbx
movups xmm6, xmmword [rbp + 0x48]
mov qword [rbp + 0x58], rdi
mov rax, qword [rbp + 0xa0]
cmp rax, 8
jb 0x18003f6d3
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f6ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003ffb1
call fcn.180077464
movups xmmword [rbp + 0x88], xmm6
movups xmm0, xmmword [rbp + 0x58]
movups xmmword [rbp + 0x98], xmm0
cmp rsi, 8
jb 0x18003f720
lea rdx, [rsi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x18003f718
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003ffc2
mov rcx, r15
call fcn.180077464
mov sil, 1
mov dword [rbp - 0x38], esi
mov byte [rbp - 0x7c], sil
mov ebx, dword [rbp - 0x60]
mov edi, dword [rbp - 0x5c]
mov rax, qword [rbp - 0x48]
add ebx, 0x82
mov dword [rbp - 0x60], ebx
cmp ebx, 0x47c
mov r14, qword [rbp - 0x78]
jb 0x18003f503
mov rax, qword [rbp + 0xa0]
cmp rax, 8
jb 0x18003f793
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003f78e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003ffc9
call fcn.180077464
mov ecx, dword [rsp + 0x78]
inc ecx
mov dword [rsp + 0x78], ecx
mov rax, qword [rbp - 0x48]
inc rax
mov qword [rbp - 0x48], rax
cmp ecx, 3
mov r14, qword [rbp - 0x78]
jb 0x18003f4e1
mov ebx, dword [rbp - 0x50]
mov r15d, dword [rsp + 0x70]
jmp 0x18003ff86
cmp ebx, 0x2f6
je 0x18003fd18
cmp ebx, 0x378
je 0x18003fc89
cmp ebx, 0x3fa
jne 0x18003f734
cmp byte [rbp - 0x7c], 0
je 0x18003f9c0
mov ebx, r13d
mov edi, 0xc
mov esi, dword [rbp - 0xc]
lea r12d, [rdi + 0x22]
nop
cmp ebx, 0xb
ja case.default.0x18003f81c
mov eax, ebx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x400f0]
add rcx, rdx
jmp rcx
mov word [rbp + 0x68], 0x49
mov r8d, 3
lea rdx, [0x180088f41]
lea rcx, [rbp + 0x68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.default.0x18003f81c
mov eax, dword [0x180088f61]
mov dword [rbp + 0x7a], eax
movzx eax, byte [0x180088f65]
mov byte [rbp + 0x7e], al
mov byte [rbp + 0x7f], 0
mov r8d, 1
lea rdx, [0x180088f78]
lea rcx, [rbp + 0x7f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x80], 0x59
jmp case.default.0x18003f81c
mov dword [rbp + 0x56], 0x2e6e6f65
mov dword [rbp + 0x5a], 0x7831646c
jmp case.default.0x18003f81c
mov eax, 0x34
mov word [rbp + 0x53], ax
mov eax, 0x6e2e
mov word [rbp + 0x54], ax
jmp case.default.0x18003f81c
mov byte [rbp + 0x81], 0
mov eax, 0x6c6c
mov word [rbp + 0x48], ax
jmp case.default.0x18003f81c
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x160]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], esi
xor r9d, r9d
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.dbghelp.dll_SymFindFileInPath]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp case.default.0x18003f81c
mov eax, 0x33
mov word [rbp + 0x5e], ax
mov esi, r13d
jmp case.default.0x18003f81c
mov eax, 0x4d45
mov word [rbp + 0x76], ax
jmp case.default.0x18003f81c
mov dword [rbp + 0x6c], 0x534e495f
mov byte [rbp + 0x70], 0
mov r8d, 1
lea rdx, [0x180088fd5]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x71], 0
mov r8d, 5
lea rdx, [0x180089029]
lea rcx, [rbp + 0x71]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.default.0x18003f81c
mov eax, 0x3f
mov word [rbp + 0x4a], ax
mov eax, 0x6d
mov word [rbp + 0x4b], ax
jmp case.default.0x18003f81c
mov eax, 0x565f
mov word [rbp + 0x78], ax
mov byte [rbp + 0x7a], 0
jmp case.default.0x18003f81c
mov word [rbp + 0x4c], r12w
mov eax, 0x61
mov word [rbp + 0x4d], ax
mov word [rbp + 0x4e], ax
mov eax, 0x72
mov word [rbp + 0x4f], ax
mov dword [rbp + 0x50], 0x366863
inc ebx
sub rdi, 1
jne 0x18003f800
mov dword [rbp - 0xc], esi
mov r12d, dword [rbp - 0x40]
mov esi, dword [rbp - 0x38]
mov edi, dword [rbp - 0x5c]
test sil, sil
je 0x18003fa58
movsx rax, di
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov r14, qword [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x18003fa03
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor sil, sil
mov dword [rbp - 0x38], esi
jmp 0x18003fa58
mov ebx, 0x30
mov eax, ebx
sub eax, 0x30
je 0x18003fa2f
sub eax, 1
je 0x18003fa24
cmp eax, 1
jne 0x18003fa51
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18003fa51
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x18003fa51
mov qword [rbp + 0x20], r13
mov r8d, 9
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.dbghelp.dll_ImageDirectoryEntryToDataEx]
inc ebx
cmp ebx, 0x33
jb 0x18003fa08
cmp qword [rbp + 0x38], 0
jne 0x18003f72a
mov ebx, 0xaa
nop dword [rax + rax]
cmp ebx, 0x12e
ja 0x18003fbb9
je 0x18003fb39
mov eax, ebx
sub eax, 0xaa
je 0x18003fb10
sub eax, 0x2c
je 0x18003fac2
cmp eax, 0x2c
jne 0x18003fc75
lea r8d, [rax - 0x27]
lea rdx, str.atus
lea rcx, [rbp + 0x59]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp - 0x7f], 1
mov qword [rbp + 0x28], r13
mov r12b, 1
jmp 0x18003fc71
mov eax, 0x69
mov word [rbp + 0x52], ax
lea r8d, [rax - 0x67]
lea rdx, [0x18008433c]
lea rcx, [rbp + 0x53]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x6e
mov word [rbp + 0x54], ax
lea rcx, [rbp + 0x48]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18003faf0
mov eax, dword [str.ceSt]
mov dword [rcx], eax
movzx eax, byte [0x180089040]
mov byte [rcx + 4], al
jmp 0x18003fc75
mov eax, dword [str.queryC]
mov dword [rbp + 0x48], eax
movzx eax, word [0x180089048]
mov word [rbp + 0x4c], ax
mov eax, 0x6f
mov word [rbp + 0x4e], ax
mov dword [rbp + 0x4f], 0x6c706d
jmp 0x18003fc75
mov qword [rbp + 8], r13
movups xmm0, xmmword [str.tabloIncognitoParagraph3]
movups xmmword [rbp + 0x68], xmm0
movsd xmm1, qword [0x180089068]
movsd qword [rbp + 0x78], xmm1
movzx eax, byte [0x180089070]
mov byte [rbp + 0x80], al
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, [rbp + 0x68]
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rbp + 0x30], rax
jmp 0x18003fc75
mov eax, ebx
sub eax, 0x15a
je 0x18003fc64
sub eax, 0x2c
je 0x18003fc24
cmp eax, 0x2c
jne 0x18003fc75
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb case.0x18003f18e.128
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003ffb8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003ffb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, r13d
movzx eax, byte [rbp - 0x7f]
mov rdi, qword [rbp + 0x30]
test rdi, rdi
cmovne ecx, eax
mov byte [rbp - 0x7f], cl
cmp cl, 0
je 0x18003fc4f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test r12b, r12b
je 0x18003fc5e
mov rcx, qword [rbp + 8]
call qword [sym.imp.GDI32.dll_DeleteMetaFile]
mov byte [rbp - 0x58], 0
jmp 0x18003fc75
movzx r12d, r12b
cmp qword [rbp + 8], 0
cmove r12d, r13d
mov dword [rbp - 0x40], r12d
add ebx, 0x2c
cmp ebx, 0x1de
jb 0x18003fa70
jmp 0x18003f72a
mov r8d, 3
lea rdx, [0x180087fb0]
lea rcx, [rbp + 0x88]
call fcn.180038970
movsx eax, di
lea rcx, [rbp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x20], rax
mov edx, r13d
movzx ecx, byte [rbp - 0x7c]
cmp dword [rbp - 8], 0
cmovne edx, ecx
mov byte [rbp - 0x7c], dl
lea rcx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae rcx, qword [rbp + 0x88]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp + 0x38], rax
movzx esi, sil
cmp qword [rbp - 0x20], 0
cmove esi, r13d
mov dword [rbp - 0x38], esi
jmp 0x18003f730
mov rdx, qword [rbp + rax*8 + 0xa8]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x18003fd30
lea rcx, [rbp + 0x88]
call fcn.180038970
mov edi, pe_nt_image_headers64
mov dword [rbp - 0x5c], edi
mov qword [rbp + 0x40], 0xffffffffffffffff
mov rsi, qword [rbp + 0x98]
mov r14, qword [rbp + 0xa0]
cmp rsi, r14
jae 0x18003fd94
lea rax, [rsi + 1]
mov qword [rbp + 0x98], rax
lea rax, [rbp + 0x88]
cmp r14, 8
cmovae rax, qword [rbp + 0x88]
mov dword [rax + rsi*2], 0x2e
jmp 0x18003fe81
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x180040086
lea r15, [rsi + 1]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x18003fdc3
mov rbx, rdx
jmp 0x18003fde4
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x18003fdd9
mov rbx, rdx
jmp 0x18003fde4
lea rax, [r14 + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x88]
call fcn.180038870
mov rdi, rax
mov qword [rbp + 0x98], r15
mov qword [rbp + 0xa0], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x18003fe61
mov rbx, qword [rbp + 0x88]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x18003fe57
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18003ffc2
mov rbx, rcx
mov rcx, rbx
call fcn.180077464
jmp 0x18003fe74
lea rdx, [rbp + 0x88]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
mov qword [rbp + 0x88], rdi
mov edi, dword [rbp - 0x5c]
mov ebx, dword [rbp - 0x60]
xor r8d, r8d
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov dword [rbp - 8], eax
mov esi, dword [rbp - 0x38]
jmp 0x18003f730
mov qword [rbp + 0x10], r13
lea rax, [rbp + 0xd0]
mov qword [rbp + 0xa8], rax
movups xmm0, xmmword [str.IMAGE_REL_SH3_DIRECT8_LONG]
movups xmmword [rbp + 0x138], xmm0
movsd xmm1, qword [0x180089088]
movsd qword [rbp + 0x148], xmm1
movzx eax, word [0x180089090]
mov word [rbp + 0x150], ax
movzx eax, byte [0x180089092]
mov byte [rbp + 0x152], al
lea rax, [rbp + 0x108]
mov qword [rbp + 0xb0], rax
jmp case.0x18003f18e.143
mov dword [rbp + 0xde], 0x30
mov word [rbp + 0x108], r13w
jmp case.0x18003f18e.143
mov eax, dword [0x180089094]
mov dword [rbp + 0xd6], eax
movzx eax, word [0x180089098]
mov word [rbp + 0xda], ax
mov r8d, 0xa
lea rdx, [rbp + 0xda]
lea ecx, [r8 + 2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
jmp 0x18003ff86
lea rcx, [rbp + 0xd0]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18003ff50
mov eax, dword [0x18008909c]
mov dword [rcx], eax
mov r8d, 2
lea rdx, [0x180087cb0]
lea rcx, [rbp + 0xd2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov dword [rbp + 0xd4], 0x76
lea rdx, [0x180000000]
mov r9d, 0x20
lea r8d, [r9 + 0x59]
mov eax, dword [rbp - 0x70]
dec eax
mov dword [rbp - 0x70], eax
cmp eax, dword [rbp - 0x34]
jbe case.0x18003f18e.128
mov r14, qword [rbp - 0x78]
jmp 0x18003f170
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180077464
jmp case.0x18003f18e.128
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8, qword [r14 + 8]
mov r10, qword [rbp - 0x68]
test r8, r8
je 0x180040035
mov r9, qword [r10 + 8]
test r9, r9
je 0x180040035
mov edx, r13d
mov r10d, dword [r14]
test r10d, r10d
je 0x18004002c
mov eax, edx
lea rcx, [rax + rax*2]
mov rax, qword [r9 + rcx*8]
cmp qword [r8 + rcx*8], rax
jne 0x18003e773
mov rax, qword [r9 + rcx*8 + 8]
cmp qword [r8 + rcx*8 + 8], rax
jne 0x18003e773
mov eax, dword [r9 + rcx*8 + 0x10]
cmp dword [r8 + rcx*8 + 0x10], eax
jne 0x18003e773
inc edx
cmp edx, r10d
jb 0x18003fff1
mov dword [rbp - 0x58], 1
jmp case.0x18003f18e.128
cmp r8, qword [r10 + 8]
mov eax, 0
sete al
mov dword [rbp - 0x58], eax
mov rax, qword [rbp - 0x58]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.180077c10
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800357d0
nop
add byte [rax + rax], r8b
add eax, dword [rax]
hlt