Function at 0x18000d790
Capabilities:
Create thread
Link many functions at runtime
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2ae0
call fcn.18002add0
sub rsp, rax
mov qword [rsp + 0x278], 0xfffffffffffffffe
mov qword [rsp + 0x2b18], rbx
mov qword [rsp + 0x2b20], rsi
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x2ad0], rax
mov r15, rcx
mov qword [rsp + 0xf8], rcx
mov qword [rsp + 0x170], rcx
xor r13d, r13d
mov dword [rsp + 0x1a0], r13d
mov byte [rsp + 0x1ed0], r13b
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x1ed1]
call fcn.1800292e0
movsd xmm0, qword [str.None_Yet]
movsd qword [rsp + 0xa30], xmm0
movzx eax, byte [0x18006bd70]
mov byte [rsp + 0xa38], al
xor eax, eax
mov qword [rsp + 0xa39], rax
mov qword [rsp + 0xa41], rax
mov byte [rsp + 0xa49], al
mov word [rsp + 0x110], r13w
mov word [rsp + 0xf0], r13w
movsd xmm0, qword [0x18006bd78]
movsd qword [rsp + 0xed0], xmm0
movzx eax, word [0x18006bd80]
mov word [rsp + 0xed8], ax
xor edx, edx
mov r8d, 0x7f6
lea rcx, [rsp + 0xeda]
call fcn.1800292e0
mov dword [rsp + 0x1ac], r13d
mov qword [rsp + 0x180], r13
mov r14d, r13d
mov qword [rsp + 0x108], r13
mov qword [rsp + 0x1c8], r13
mov dword [rsp + 0x1c0], r13d
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x118], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
cmp dword [0x18009caf4], 1
jl 0x18000d942
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x164]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
jne 0x18000d91a
cmp dword [0x18009caf4], 1
jl 0x18000d942
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x18006bdc0]
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 1
jl 0x18000d942
mov r9d, dword [rsp + 0x168]
mov r8d, dword [rsp + 0x164]
lea rdx, [0x18006bde8]
mov rcx, r15
call fcn.18000cb60
mov dword [rsp + 0x168], 0xa00000
mov dword [rsp + 0x164], 0x159000
mov edx, 0x159000
mov r8d, 0xa00000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
test eax, eax
jne 0x18000d995
cmp dword [0x18009caf4], 1
jl 0x18000da04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.SetProcessWorkingSetSize_failed___d_
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 1
jl 0x18000da04
lea r8, [rsp + 0x168]
lea rdx, [rsp + 0x164]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
jne 0x18000d9dc
cmp dword [0x18009caf4], 1
jl 0x18000da04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetProcessWorkingSetSize_failed___d_
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 1
jl 0x18000da04
mov r9d, dword [rsp + 0x168]
mov r8d, dword [rsp + 0x164]
lea rdx, str.Working_Set:_Min__d_Max__d
mov rcx, r15
call fcn.18000cb60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x224], r13
mov dword [rsp + 0x22c], r13d
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov eax, 4
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [rsp + 0x1e8], rax
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov eax, 0x105
mul rcx
mov rcx, rax
cmovo rcx, r12
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [0x18009cab8], rax
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov eax, 0x105
mul rcx
mov rcx, rax
cmovo rcx, r12
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [0x18009cab0], rax
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov eax, 8
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [0x18009caa8], rax
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov eax, 8
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [r15 + 0x98], rax
mov r9, r12
lea r8, [0x18006be98]
mov edx, 0x105
mov rcx, qword [0x18009cab8]
call fcn.18002bfb0
mov rcx, qword [0x18009cab8]
add rcx, 0x20a
mov r9, r12
lea r8, [0x18006beb0]
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab8]
add rcx, 0x414
mov r9, r12
lea r8, str.Application
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab8]
add rcx, 0x61e
mov r9, r12
lea r8, str.Directory_Service
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab8]
add rcx, 0x828
mov r9, r12
lea r8, [0x18006bf00]
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab8]
add rcx, 0xa32
mov r9, r12
lea r8, str.DFS_Replication
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab8]
add rcx, 0xc3c
mov r9, r12
lea r8, str.File_Replication_Service
mov edx, 0x105
call fcn.18002bfb0
mov r9, r12
lea r8, [0x18006bf70]
mov edx, 0x105
mov rcx, qword [0x18009cab0]
call fcn.18002bfb0
mov rcx, qword [0x18009cab0]
add rcx, 0x20a
mov r9, r12
lea r8, [0x18006bf98]
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab0]
add rcx, 0x414
mov r9, r12
lea r8, str.LOG_TYPE_APPLICATION
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab0]
add rcx, 0x61e
mov r9, r12
lea r8, [0x18006bfe8]
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab0]
add rcx, 0x828
mov r9, r12
lea r8, str.LOG_TYPE_DNS
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab0]
add rcx, 0xa32
mov r9, r12
lea r8, [0x18006c020]
mov edx, 0x105
call fcn.18002bfb0
mov rcx, qword [0x18009cab0]
add rcx, 0xc3c
mov r9, r12
lea r8, [0x18006c040]
mov edx, 0x105
call fcn.18002bfb0
mov edx, r13d
cmp dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr], edx
jbe 0x18000dce8
nop dword [rax]
nop word [rax + rax]
mov ecx, edx
mov rax, qword [rsp + 0x1e8]
mov dword [rax + rcx*4], r13d
inc edx
cmp edx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
jb 0x18000dcd0
cmp dword [0x18009caf4], 1
jl 0x18000dd00
lea rdx, str.SNARE_is_Running
mov rcx, r15
call fcn.18000cb60
mov byte [0x18009ca30], r13b
mov r9d, 0x64
lea rbx, [0x18009ca30]
mov r8, rbx
lea rdx, [0x18006c3e8]
lea rcx, [0x18006c074]
call fcn.18001ab50
cmp byte [0x18009ca30], r13b
jne 0x18000dd40
mov edx, 0x64
mov rcx, rbx
call fcn.180013910
mov r8d, 0x1811
lea rdx, [0x18006c450]
lea rcx, [0x18006c468]
call fcn.18001abe0
mov dword [rsp + 0x160], eax
mov r8d, FreeADsMem
lea rdx, [0x18006c4f0]
lea rcx, [0x18006c510]
call fcn.18001abe0
mov dword [rsp + 0x190], eax
xor r8d, r8d
lea rdx, [0x18006c548]
lea rcx, [0x18006c570]
call fcn.18001abe0
mov dword [rsp + 0x1a8], eax
xor r8d, r8d
lea rdx, [0x18006c1d4]
lea rcx, [0x18006c580]
call fcn.18001abe0
mov dword [rsp + 0x148], eax
xor r8d, r8d
lea rdx, [0x18006c214]
lea rcx, [0x18006c21c]
call fcn.18001abe0
mov dword [0x18009ca20], eax
mov dword [rsp + 0x128], 0x1811
xor r8d, r8d
lea rdx, [0x18006c5d8]
lea rcx, [0x18006c28c]
call fcn.18001abe0
test eax, eax
je 0x18000de1b
mov r8d, 0x1811
lea rdx, [0x18006c600]
lea rcx, [0x18006c3cc]
call fcn.18001abe0
mov dword [rsp + 0x128], eax
mov r9, r12
lea r8, [0x18006c710]
mov edx, 0x800
lea rcx, [rsp + 0xed0]
call fcn.18002a5b4
mov r9d, 0x800
lea r8, [rsp + 0xed0]
lea rdx, [0x18006c720]
lea rcx, [0x18006c758]
call fcn.18001ab50
test eax, eax
jne 0x18000de77
lea r8, [rsp + 0xed0]
lea rdx, [0x18006c760]
lea rcx, [0x18006c7c0]
call fcn.18001a970
xor r8d, r8d
lea rdx, [0x18006c4c0]
lea rcx, [0x18006c134]
call fcn.18001abe0
mov dword [rsp + 0x1d8], eax
cmp dword [rsp + 0x148], r13d
je 0x18000dee9
xor r8d, r8d
lea rdx, str.SyslogAlt
lea rcx, [0x18006c5b0]
call fcn.18001abe0
mov dword [rsp + 0x1a0], eax
mov byte [reloc.OLEAUT32.dll_VariantCopy], 9
mov byte [0x180099089], r13b
mov r9d, 2
lea r8, [0x180099088]
lea rdx, [0x18006c870]
lea rcx, [0x18006c4cc]
call fcn.18001ab50
mov r9, r12
lea r8, [0x18006bd26]
mov edx, 0x100
lea rcx, [rsp + 0xab0]
call fcn.18002a5b4
xor r8d, r8d
lea rdx, [0x18006c9a8]
lea rcx, [0x18006c504]
call fcn.18001abe0
test eax, eax
je 0x18000df60
mov r9d, 0x100
lea r8, [rsp + 0xab0]
lea rdx, [0x18006c9b8]
lea rcx, [0x18006c564]
call fcn.18001ab50
test eax, eax
jne 0x18000df60
mov r9, r12
lea r8, [0x18006bd27]
mov edx, 0x100
lea rcx, [rsp + 0xab0]
call fcn.18002a5b4
mov r9, r12
lea r8, [0x18006bd35]
mov edx, 0x800
lea rcx, [rsp + 0x16d0]
call fcn.18002a5b4
xor r8d, r8d
lea rdx, [0x18006ca58]
lea rcx, [0x18006c5a4]
call fcn.18001abe0
test eax, eax
je 0x18000dfd7
mov r9d, 0x800
lea r8, [rsp + 0x16d0]
lea rdx, [0x18006ca68]
lea rcx, [0x18006ca7c]
call fcn.18001ab50
test eax, eax
jne 0x18000dfd7
mov r9, r12
lea r8, [0x18006cab0]
mov edx, 0x800
lea rcx, [rsp + 0x16d0]
call fcn.18002a5b4
xor r8d, r8d
lea rdx, str.ClearTabs
lea rcx, [0x18006cacc]
call fcn.18001abe0
xor r8d, r8d
lea rdx, str.Checksum
lea rcx, [0x18006c45c]
call fcn.18001abe0
mov dword [0x18009d218], eax
mov rcx, r15
call fcn.180012250
xor r8d, r8d
lea rdx, str.LeaveRetention
lea rcx, [0x18006c47c]
call fcn.18001abe0
mov dword [0x18009d21c], eax
call fcn.180015e80
mov qword [rsp + 0x188], rax
mov edx, 0xce05d9ad
mov ecx, 0x6a4abc5b
call fcn.1800055a0
mov qword [rsp + 0x250], rax
call fcn.180013a40
mov dword [rsp + 0x120], eax
test eax, eax
je 0x18000e099
mov ecx, eax
shl rcx, 3
call fcn.18002a67c
mov qword [rsp + 0x180], rax
test rax, rax
jne 0x18000e099
cmp dword [0x18009caf4], 9
jl 0x18000e091
lea rdx, [0x18006c080]
mov rcx, r15
call fcn.18000cb60
mov dword [rsp + 0x120], r13d
mov ecx, 0x230
call fcn.18002a67c
mov rbx, rax
test rax, rax
jne 0x18000e0b0
mov rbx, r13
jmp 0x18000e126
mov qword [rax + 0x220], r13
mov qword [rax + 0x228], r13
lea rcx, [rax + 0x18]
mov r9, r12
lea r8, [rsp + 0xed0]
mov edx, 0x1ff
call fcn.18002a5b4
mov dword [rsp + 0x20], r13d
mov r9d, 0x400
lea r8, [rsp + 0x22d0]
mov edx, dword [rsp + 0x160]
mov rcx, rbx
call fcn.1800134c0
mov qword [rbx], rax
cmp rax, r12
jne 0x18000e126
cmp dword [0x18009caf4], 9
jl 0x18000e126
lea r8, [rsp + 0x22d0]
lea rdx, [rsp + 0xed0]
lea rcx, str.Problem_opening_Socket_to__s:__s
call fcn.1800169b0
mov qword [0x18009d208], rbx
cmp dword [0x18009caf4], 9
jl 0x18000e15d
lea rdx, str.Sockets_opened_connected
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 9
jl 0x18000e15d
lea rdx, str.Opening_event_log_sources
mov rcx, r15
call fcn.18000cb60
mov esi, r13d
cmp dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr], r13d
jbe 0x18000e30a
mov r14d, 1
nop dword [rax]
nop word [rax + rax]
mov edi, esi
imul rbx, rdi, 0x20a
mov rcx, qword [0x18009cab8]
add rcx, rbx
mov edx, dword [0x18009d21c]
call fcn.1800136f0
test eax, eax
mov rax, qword [0x18009caa8]
mov qword [rax + rdi*8], r13
je 0x18000e2f0
mov r15, r13
mov rdx, qword [0x18009cab0]
add rdx, rbx
mov r9d, 0x400
lea r8, [rsp + 0x22d0]
lea rcx, [0x18006be8c]
call fcn.18001aa90
test eax, eax
je 0x18000e230
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000e209
lea rdx, str.EvtCreateBookmark
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e209
lea rcx, [rsp + 0x22d0]
call rax
mov rcx, rax
jmp 0x18000e20c
mov rcx, r13
mov rax, qword [0x18009caa8]
mov qword [rax + rdi*8], rcx
mov rax, qword [0x18009caa8]
mov rcx, qword [rax + rdi*8]
test rcx, rcx
je 0x18000e230
mov r15, rcx
mov r14d, 3
mov r12, qword [0x18009cab8]
add r12, rbx
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rcx + 0x90]
mov r13, qword [rax + rdi*8]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000e298
lea rdx, str.EvtSubscribe
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000e298
mov dword [rsp + 0x38], r14d
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
lea r9, [0x18006bd84]
mov r8, r12
mov rdx, r13
call rax
mov rcx, rax
xor r13d, r13d
jmp 0x18000e29e
xor r13d, r13d
mov ecx, r13d
mov r15, qword [rsp + 0xf8]
mov rax, qword [r15 + 0x98]
mov qword [rax + rdi*8], rcx
mov rax, qword [r15 + 0x98]
cmp qword [rax + rdi*8], 0
jne 0x18000e2ea
cmp dword [0x18009caf4], 9
jl 0x18000e2ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [0x18009cab8]
add r8, rbx
lea rdx, str.Failed_to_subscribe_to__S_events._Error__0x_lu
mov rcx, r15
call fcn.18000cb60
mov r14d, 1
inc esi
cmp esi, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
jb 0x18000e180
or r12, 0xffffffffffffffff
mov r14, qword [rsp + 0x108]
mov rax, qword [r15 + 0x98]
cmp qword [rax], 0
je 0x18000e325
cmp qword [rax + 8], 0
je 0x18000e325
cmp qword [rax + 0x10], 0
jne 0x18000e346
cmp dword [0x18009caf4], 9
jl 0x18000e346
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Couldnt_Subscribe_to_Core_Events__Error__0x_x
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009ca20], 0
je 0x18000e3f8
lea rdx, [rsp + 0x16d0]
movzx ecx, word [rsp + 0x128]
call fcn.180024c30
test eax, eax
jle 0x18000e3d9
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov rax, qword [r15 + 0x90]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, qword [rax + rcx*8]
lea r8, [0x180016150]
xor edx, edx
xor ecx, ecx
call fcn.18002c610
mov qword [0x18009cac8], rax
cmp dword [0x18009caf4], 5
jl 0x18000e3bd
mov rdx, rax
lea rcx, str.DEBUG:_Starting_web_thread...
call fcn.1800169b0
mov rax, qword [0x18009cac8]
test rax, rax
jne 0x18000e3f8
cmp dword [0x18009caf4], 5
jl 0x18000e3f8
lea rcx, str.Error_in_web_thread_creation
call fcn.1800169b0
jmp 0x18000e3f8
cmp dword [0x18009caf4], 5
jl 0x18000e3f1
lea rdx, str.Unable_to_start_web_server__1___disabling.
mov rcx, r15
call fcn.18000cb60
mov dword [0x18009ca20], r13d
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
inc ecx
mov eax, ecx
shr eax, 6
mov dword [rsp + 0x14c], eax
test cl, 0x3f
je 0x18000e418
inc dword [rsp + 0x14c]
mov dword [0x18009caa0], r13d
cmp dword [0x18009caf4], 9
jl 0x18000e437
lea rdx, str.Entering_main_loop.
mov rcx, r15
call fcn.18000cb60
mov dword [rsp + 0x154], r13d
nop
mov ecx, 0xbb8
cmp dword [r15 + 0x74], 0
je 0x180011ead
inc dword [rsp + 0x154]
cmp dword [0x18009caa0], 0
je 0x18000e469
mov dword [r15 + 0x74], r13d
jmp 0x180011ead
mov dword [rsp + 0x144], r13d
mov ebx, dword [rsp + 0x144]
cmp ebx, dword [rsp + 0x14c]
jae 0x180011d8e
shl ebx, 6
mov esi, ebx
mov edi, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
inc edi
lea eax, [rbx + 0x40]
cmp eax, edi
ja 0x18000e4a0
mov edi, 0x40
jmp 0x18000e4a3
and edi, 0x3f
mov r9d, r13d
mov ebx, dword [rsp + 0x144]
test ebx, ebx
cmove r9d, ecx
mov rax, qword [r15 + 0x90]
lea rdx, [rax + rsi*8]
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ecx, eax
cmp eax, 0xffffffff
je 0x180011d6a
mov dword [rsp + 0x114], r13d
mov dword [rsp + 0x100], 8
mov eax, dword [rsp + 0x14c]
dec eax
cmp ebx, eax
jae 0x18000e4f8
cmp ecx, edi
jb 0x18000e502
dec edi
cmp ecx, edi
jae 0x18000e5d7
lea edi, [rsi + rcx]
mov dword [rsp + 0x114], edi
mov rcx, qword [r15 + 0x90]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov word [rsp + 0x110], r13w
cmp dword [0x18009caf4], 1
jl 0x18000e541
mov r8d, edi
lea rdx, str.WAIT_OBJECT__d_Triggered.
mov rcx, r15
call fcn.18000cb60
test edi, edi
jne 0x18000e555
mov dword [rsp + 0x100], 0x20
jmp 0x18000e7ac
cmp edi, 1
jne 0x18000e56a
mov dword [rsp + SafeArrayGetElement0], 0x10
jmp 0x18000e7ac
cmp edi, 2
jne 0x18000e57f
mov dword [rsp + 0x100], 8
jmp 0x18000e7ac
cmp edi, 3
jne 0x18000e594
mov dword [rsp + 0x100], 4
jmp 0x18000e7ac
cmp edi, 4
jne 0x18000e5a9
mov dword [rsp + 0x100], 2
jmp 0x18000e7ac
cmp edi, 5
jne 0x18000e5be
mov dword [rsp + 0x100], 1
jmp 0x18000e7ac
cmp edi, 6
jne 0x18000e7ac
mov dword [rsp + 0x100], 0x80
jmp 0x18000e7ac
cmp ebx, eax
jne 0x18000e617
cmp ecx, edi
jne 0x18000e617
mov eax, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov rcx, qword [r15 + 0x90]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [0x18009caf4], 5
jl 0x18000e7a9
lea rdx, str.HandleWebThread:_WEB_Server_Reset_event_received
mov rcx, r15
call fcn.18000cb60
jmp 0x18000e7a9
cmp ecx, 0x102
jne 0x180011d50
cmp dword [0x18009caf4], 9
jl 0x18000e63b
lea rdx, str.Timeout_hit
mov rcx, r15
call fcn.18000cb60
mov eax, dword [rsp + 0x14c]
lea ecx, [rax*4]
movzx eax, word [rsp + 0x110]
cmp eax, ecx
jae 0x18000e662
inc word [rsp + 0x110]
jmp 0x180011d75
mov word [rsp + 0x110], r13w
mov ecx, r13d
mov r8, qword [r15 + 0x98]
movzx edx, word [rsp + 0xf0]
inc dx
mov word [rsp + 0xf0], dx
cmp dx, 6
jbe 0x18000e697
mov word [rsp + 0xf0], r13w
movzx eax, word [rsp + 0xf0]
cmp qword [r8 + rax*8], 0
jne 0x18000e6ad
inc ecx
cmp ecx, 6
jle 0x18000e675
cmp word [rsp + 0xf0], 0
jne 0x18000e6c8
mov dword [rsp + 0x100], 0x20
jmp 0x18000e762
cmp word [rsp + 0xf0], 1
jne 0x18000e6e3
mov dword [rsp + SafeArrayGetElement0], 0x10
jmp 0x18000e762
cmp word [rsp + 0xf0], 2
jne 0x18000e6fb
mov dword [rsp + 0x100], 8
jmp 0x18000e762
cmp word [rsp + 0xf0], 3
jne 0x18000e713
mov dword [rsp + 0x100], 4
jmp 0x18000e762
cmp word [rsp + 0xf0], 4
jne 0x18000e72b
mov dword [rsp + 0x100], 2
jmp 0x18000e762
cmp word [rsp + 0xf0], 5
jne 0x18000e743
mov dword [rsp + 0x100], 1
jmp 0x18000e762
mov eax, dword [rsp + 0x100]
cmp word [rsp + 0xf0], 6
mov ecx, 0x80
cmove eax, ecx
mov dword [rsp + 0x100], eax
cmp dword [0x18009caf4], 1
jl 0x18000e783
movzx r8d, word [rsp + 0xf0]
lea rdx, str.20_seconds_have_elapsed._Checking_a_log_file:__d
mov rcx, r15
call fcn.18000cb60
movzx edx, word [rsp + 0xf0]
mov rax, qword [r15 + 0x98]
cmp qword [rax + rdx*8], 0
je 0x180011d36
movzx edi, dx
mov dword [rsp + 0x114], edi
jmp 0x18000e7ac
mov edi, r13d
mov ebx, dword [0x18009d1b8]
test ebx, ebx
je 0x18000eecb
cmp dword [0x18009caf4], 5
jl 0x18000e7d8
lea rdx, str.HandleWebThread:_resetting_the_web_thread
mov rcx, r15
call fcn.18000cb60
mov ebx, dword [0x18009d1b8]
cmp ebx, 2
jne 0x18000ed87
call fcn.180014970
cmp dword [0x18009ca20], 0
je 0x18000e7f4
call fcn.1800259d0
call qword [sym.imp.WS2_32.dll_WSACancelBlockingCall]
mov rax, qword [0x18009d208]
mov qword [0x18009d210], rax
test rax, rax
je 0x18000e84e
nop dword [rax]
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18000e829
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [0x18009d210]
mov qword [rax], r12
mov rbx, qword [rax + 0x228]
mov rcx, rax
call fcn.180029620
mov rax, rbx
mov qword [0x18009d210], rbx
mov qword [0x18009d208], rbx
test rbx, rbx
jne 0x18000e810
mov qword [0x18009d208], r13
mov byte [0x18009ca30], 0
mov r9d, 0x64
lea rbx, [0x18009ca30]
mov r8, rbx
lea rdx, [0x18006c3e8]
lea rcx, [0x18006c074]
call fcn.18001ab50
cmp byte [0x18009ca30], 0
jne 0x18000e895
mov edx, 0x64
mov rcx, rbx
call fcn.180013910
mov r8d, 0x1811
lea rdx, [0x18006c450]
lea rcx, [0x18006c468]
call fcn.18001abe0
mov dword [rsp + 0x160], eax
mov r8d, FreeADsMem
lea rdx, [0x18006c4f0]
lea rcx, [0x18006c510]
call fcn.18001abe0
mov dword [rsp + 0x190], eax
xor r8d, r8d
lea rdx, [0x18006c548]
lea rcx, [0x18006c570]
call fcn.18001abe0
mov dword [rsp + 0x1a8], eax
xor r8d, r8d
lea rdx, [0x18006c1d4]
lea rcx, [0x18006c580]
call fcn.18001abe0
mov dword [rsp + 0x148], eax
xor r8d, r8d
lea rdx, [0x18006c214]
lea rcx, [0x18006c21c]
call fcn.18001abe0
mov dword [0x18009ca20], eax
mov dword [rsp + 0x128], 0x1811
xor r8d, r8d
lea rdx, [0x18006c5d8]
lea rcx, [0x18006c28c]
call fcn.18001abe0
test eax, eax
je 0x18000e970
mov r8d, 0x1811
lea rdx, [0x18006c600]
lea rcx, [0x18006c3cc]
call fcn.18001abe0
mov dword [rsp + 0x128], eax
xor r8d, r8d
lea rdx, str.Checksum
lea rcx, [0x18006c45c]
call fcn.18001abe0
mov dword [0x18009d218], eax
mov r9, r12
lea r8, [0x18006c710]
mov edx, 0x800
lea rcx, [rsp + 0xed0]
call fcn.18002a5b4
mov r9d, 0x800
lea r8, [rsp + 0xed0]
lea rdx, [0x18006c720]
lea rcx, [0x18006c758]
call fcn.18001ab50
test eax, eax
jne 0x18000e9e8
lea r8, [rsp + 0xed0]
lea rdx, [0x18006c760]
lea rcx, [0x18006c7c0]
call fcn.18001a970
cmp dword [rsp + 0x148], 0
je 0x18000ea3d
xor r8d, r8d
lea rdx, str.SyslogAlt
lea rcx, [0x18006c5b0]
call fcn.18001abe0
mov dword [rsp + 0x1a0], eax
mov byte [reloc.OLEAUT32.dll_VariantCopy], 9
mov byte [0x180099089], 0
mov r9d, 2
lea r8, [0x180099088]
lea rdx, [0x18006c870]
lea rcx, [0x18006c4cc]
call fcn.18001ab50
mov r9, r12
lea r8, [0x18006bd26]
mov edx, 0x100
lea rcx, [rsp + 0xab0]
call fcn.18002a5b4
xor r8d, r8d
lea rdx, [0x18006c9a8]
lea rcx, [0x18006c504]
call fcn.18001abe0
test eax, eax
je 0x18000eab4
mov r9d, 0x100
lea r8, [rsp + 0xab0]
lea rdx, [0x18006c9b8]
lea rcx, [0x18006c564]
call fcn.18001ab50
test eax, eax
jne 0x18000eab4
mov r9, r12
lea r8, [0x18006bd27]
mov edx, 0x100
lea rcx, [rsp + 0xab0]
call fcn.18002a5b4
mov r9, r12
lea r8, [0x18006bd35]
mov edx, 0x800
lea rcx, [rsp + 0x16d0]
call fcn.18002a5b4
xor r8d, r8d
lea rdx, [0x18006ca58]
lea rcx, [0x18006c5a4]
call fcn.18001abe0
test eax, eax
je 0x18000eb2b
mov r9d, 0x800
lea r8, [rsp + 0x16d0]
lea rdx, [0x18006ca68]
lea rcx, [0x18006ca7c]
call fcn.18001ab50
test eax, eax
jne 0x18000eb2b
mov r9, r12
lea r8, [0x18006cab0]
mov edx, 0x800
lea rcx, [rsp + 0x16d0]
call fcn.18002a5b4
xor r8d, r8d
lea rdx, str.ClearTabs
lea rcx, [0x18006cacc]
call fcn.18001abe0
mov rax, qword [rsp + 0x188]
test rax, rax
je 0x18000eb56
mov rcx, rax
call fcn.1800299e8
call fcn.180015e80
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x180]
test rax, rax
je 0x18000eb80
mov rcx, rax
call fcn.180029620
mov qword [rsp + 0x180], r13
call fcn.180013a40
mov dword [rsp + 0x120], eax
test eax, eax
je 0x18000ebc8
mov ecx, eax
shl rcx, 3
call fcn.18002a67c
mov qword [rsp + 0x180], rax
test rax, rax
jne 0x18000ebc8
cmp dword [0x18009caf4], 9
jl 0x18000ebc0
lea rdx, str.Cannot_allocate_memory_for_our_internal_Objective_match_list
mov rcx, r15
call fcn.18000cb60
mov dword [rsp + 0x120], r13d
mov rax, qword [0x18009caf8]
mov qword [0x18009d178], rax
cmp dword [0x18009caf4], 7
jl 0x18000ebeb
lea rcx, str.re_initialising_currentnode_to_head
call fcn.1800169b0
mov ecx, 0x230
call fcn.18002a67c
mov rbx, rax
test rax, rax
jne 0x18000ec05
mov rbx, r13
jmp 0x18000ec82
mov qword [rax + 0x220], r13
mov qword [rax + 0x228], r13
lea rcx, [rax + 0x18]
mov r9, r12
lea r8, [rsp + 0xed0]
mov edx, 0x1ff
call fcn.18002a5b4
mov eax, dword [rsp + 0x1ac]
mov dword [rsp + 0x20], eax
mov r9d, 0x400
lea r8, [rsp + 0x22d0]
mov edx, dword [rsp + 0x160]
mov rcx, rbx
call fcn.1800134c0
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
jne 0x18000ec82
cmp dword [0x18009caf4], 9
jl 0x18000ec82
lea r8, [rsp + 0x22d0]
lea rdx, [rsp + 0xed0]
lea rcx, str.Problem_opening_Socket_to__s:__s
call fcn.1800169b0
mov qword [0x18009d208], rbx
cmp dword [0x18009ca20], 0
je 0x18000eec2
cmp dword [0x18009caf4], 5
jl 0x18000ecae
lea rdx, str.Starting_web_thread.
mov rcx, r15
call fcn.18000cb60
lea rdx, [rsp + 0x16d0]
movzx ecx, word [rsp + 0x128]
call fcn.180024c30
test eax, eax
jg 0x18000eceb
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x16d0]
movzx ecx, word [rsp + 0x128]
call fcn.180024c30
test eax, eax
jle 0x18000ed63
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov rax, qword [r15 + 0x90]
mov qword [rsp + 0x28], r13
mov r9, qword [rax + rcx*8]
mov dword [rsp + 0x20], r13d
lea r8, [0x180016150]
xor edx, edx
xor ecx, ecx
call fcn.18002c610
cmp dword [0x18009caf4], 5
mov qword [0x18009cac8], rax
jl 0x18000ed3c
mov rdx, rax
lea rcx, str.DEBUG:_Starting_web_thread...
call fcn.1800169b0
mov rax, qword [0x18009cac8]
test rax, rax
jne 0x18000eec2
cmp dword [0x18009caf4], 5
jl 0x18000eec2
lea rcx, str.Error_in_web_thread_creation
call fcn.1800169b0
jmp 0x18000eec2
cmp dword [0x18009caf4], 5
jl 0x18000ed7b
lea rdx, [0x18006c490]
mov rcx, r15
call fcn.18000cb60
mov dword [0x18009ca20], r13d
jmp 0x18000eec2
cmp ebx, 1
jne 0x18000eec2
cmp dword [0x18009ca20], 0
je 0x18000ee83
cmp dword [0x18009caf4], 5
jl 0x18000edb5
lea rdx, str.Restarting_web_thread.
mov rcx, r15
call fcn.18000cb60
call fcn.1800259d0
lea rdx, [rsp + 0x16d0]
movzx ecx, word [rsp + 0x128]
call fcn.180024c30
test eax, eax
jg 0x18000edf7
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x16d0]
movzx ecx, word [rsp + 0x128]
call fcn.180024c30
test eax, eax
jle 0x18000ee64
mov ecx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
mov rax, qword [r15 + 0x90]
mov qword [rsp + 0x28], r13
mov r9, qword [rax + rcx*8]
mov dword [rsp + 0x20], r13d
lea r8, [0x180016150]
xor edx, edx
xor ecx, ecx
call fcn.18002c610
cmp dword [0x18009caf4], 5
mov qword [0x18009cac8], rax
jl 0x18000ee48
mov rdx, rax
lea rcx, str.DEBUG:_Starting_web_thread...
call fcn.1800169b0
mov rax, qword [0x18009cac8]
test rax, rax
jne 0x18000ee83
cmp dword [0x18009caf4], 5
jl 0x18000ee83
lea rcx, str.Error_in_web_thread_creation
call fcn.1800169b0
jmp 0x18000ee83
cmp dword [0x18009caf4], 5
jl 0x18000ee7c
lea rdx, str.Unable_to_start_web_server__2___disabling.
mov rcx, r15
call fcn.18000cb60
mov dword [0x18009ca20], r13d
mov rax, qword [0x18009d208]
mov qword [0x18009d210], rax
test rax, rax
je 0x18000eec2
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18000eeaf
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [0x18009d210]
mov qword [rax], r12
mov rax, qword [rax + 0x228]
mov qword [0x18009d210], rax
test rax, rax
jne 0x18000ee96
mov ebx, r13d
mov dword [0x18009d1b8], ebx
mov dword [rsp + 0x16c], 0x103
mov dword [rsp + 0x150], r13d
xor edx, edx
mov r8d, 0x640
lea rcx, [rsp + 0x3e0]
call fcn.1800292e0
mov ecx, edi
mov rax, qword [r15 + 0x98]
cmp qword [rax + rcx*8], 0
je 0x180011aa3
test ebx, ebx
jne 0x180011a90
cmp dword [0x18009caf4], 9
jl 0x18000ef27
lea rdx, str.Call_EvtNext
mov rcx, r15
call fcn.18000cb60
mov dword [rsp + 0x150], r13d
mov eax, edi
mov rcx, qword [r15 + 0x98]
lea rdx, [rsp + 0x150]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], r13d
mov r9d, 0x64
lea r8, [rsp + 0x3e0]
lea edx, [r9 + 0x64]
mov rcx, qword [rcx + rax*8]
call fcn.1800166c0
test eax, eax
jne 0x18000f00b
cmp dword [0x18009caf4], 9
jl 0x18000ef85
lea rdx, str.Error_EvtNext
mov rcx, r15
call fcn.18000cb60
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x16c], eax
cmp eax, 0x103
je 0x18000efe7
cmp eax, 0x10dd
je 0x18000efe7
cmp eax, 0xb7
je 0x18000efe7
cmp dword [0x18009caf4], 4
jl 0x18000efc2
mov r8d, eax
lea rdx, str.EvtNext_failed_with__lu
mov rcx, r15
call fcn.18000cb60
cmp dword [rsp + 0x16c], 0x5b4
jne 0x18000efe7
cmp dword [0x18009caf4], 3
jl 0x18000efe7
lea rdx, str.EvtNext_failed_due_to_a_TIMEOUT_ERROR_n
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 9
jl 0x18000f000
lea rdx, str.goto_EvtNextCleanup
mov rcx, r15
call fcn.18000cb60
nop
mov r14d, 1
jmp 0x180011aa9
mov esi, r13d
mov dword [rsp + 0x15c], esi
cmp esi, dword [rsp + 0x150]
jae 0x180011a65
mov dword [rsp + 0x138], r13d
mov dword [rsp + 0x140], r13d
mov dword [rsp + 0x1c4], r13d
mov dword [rsp + 0x178], r13d
mov eax, esi
lea r15, [rsp + 0x3e0]
lea r15, [r15 + rax*8]
mov qword [rsp + 0x198], r15
mov rbx, qword [r15]
mov rdi, qword [0x18009d1f0]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000f0bd
lea rdx, str.EvtRender
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f0bd
lea rcx, [rsp + 0x1c4]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x28], rcx
mov rsi, qword [rsp + 0x118]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call rax
test eax, eax
jne 0x18000f16b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18001197f
mov ecx, dword [rsp + 0x178]
mov eax, 0x10
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [rsp + 0x118], rax
mov ebx, dword [rsp + 0x178]
mov rdi, qword [r15]
mov rsi, qword [0x18009d1f0]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180011954
lea rdx, str.EvtRender
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011954
lea rcx, [rsp + 0x1c4]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x118]
mov qword [rsp + 0x20], rdx
mov r9d, ebx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
test eax, eax
je 0x180011954
mov rsi, qword [rsp + 0x118]
mov ecx, 0x4fb8
call fcn.18002a67c
mov r14, rax
mov qword [rsp + 0x108], rax
test rax, rax
jne 0x18000f1ae
mov r15, qword [rsp + 0xf8]
cmp dword [0x18009caf4], 9
jl 0x1800119ac
lea rdx, str.Unable_to_allocate_latest_VistaEvent_cache_n
mov rcx, r15
call fcn.18000cb60
jmp 0x1800119ac
xor edx, edx
mov r8d, 0x4fb8
mov rcx, rax
call fcn.1800292e0
mov r9, r12
lea r8, str.unknown
mov edx, 0x64
mov rcx, r14
call fcn.18002bfb0
lea r12, [r14 + 0xd0]
or rbx, 0xffffffffffffffff
mov r9, rbx
lea r8, str.not_yet
lea edx, [rbx + 0x1b]
mov rcx, r12
call fcn.18002a5b4
lea rcx, [r14 + 0x100]
mov r9, rbx
lea r8, [0x18006ca28]
mov edx, 0x100
call fcn.18002bfb0
lea r13, [r14 + 0x300]
mov r9, rbx
lea r8, str.System
mov edx, 0x100
mov rcx, r13
call fcn.18002bfb0
lea rcx, [r14 + 0x500]
mov r9, rbx
lea r8, [0x18006c234]
mov edx, 0x100
call fcn.18002a5b4
lea rcx, [r14 + 0x600]
mov r9, rbx
lea r8, [0x18006c294]
lea edx, [rbx + 0x65]
call fcn.18002a5b4
lea rcx, [r14 + 0x6a0]
mov r9, rbx
lea r8, str.None
mov edx, 0x100
call fcn.18002a5b4
movzx eax, word [rsi + 0x20]
mov dword [r14 + 0xec], eax
lea rcx, [rsi + 0x80]
lea rdx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x258]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0xa50]
mov qword [rsp + 0x20], rax
lea r9, str.ddd_MMM_dd
lea r8, [rsp + 0x3a0]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov r9, rbx
lea r8, [rsp + 0xa50]
lea edx, [rbx + 0x1b]
lea rcx, [rsp + 0xa30]
call fcn.18002a5b4
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0xa50]
mov qword [rsp + 0x20], rax
lea r9, [0x18006cb70]
lea r8, [rsp + 0x3a0]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTimeFormatA]
mov r9, rbx
lea r8, [rsp + 0xa50]
lea edx, [rbx + 0x1b]
lea rcx, [rsp + 0xa30]
call fcn.180029f1c
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0xa50]
mov qword [rsp + 0x20], rax
lea r9, str.yyyy
lea r8, [rsp + 0x3a0]
xor edx, edx
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov r9, rbx
lea r8, [rsp + 0xa50]
lea edx, [rbx + 0x1b]
lea rcx, [rsp + 0xa30]
call fcn.180029f1c
mov rdx, qword [rsi]
xor eax, eax
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], rax
mov qword [rsp + 0x2d8], 7
mov qword [rsp + 0x2d0], rax
mov word [rsp + 0x2c0], ax
cmp word [rdx], ax
jne 0x18000f3d2
mov r8d, eax
jmp 0x18000f3df
mov r8, rbx
inc r8
cmp word [rdx + r8*2], ax
jne 0x18000f3d5
lea rcx, [rsp + 0x2c0]
call fcn.180002d20
nop
mov r14, qword [0x18009d1d0]
mov r10, qword [r14 + 8]
mov rbx, r14
mov rdi, qword [rsp + 0x2d8]
mov r11, qword [rsp + 0x2d0]
mov rsi, qword [rsp + 0x2c0]
cmp byte [r10 + 0x19], 0
jne 0x18000f4bb
nop
lea rcx, [r10 + 0x20]
lea r8, [rsp + 0x2c0]
cmp rdi, 8
cmovae r8, rsi
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000f442
mov rcx, qword [rcx]
mov rdx, r11
cmp r9, r11
cmovb rdx, r9
test rdx, rdx
jmp 0x18000f47b
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x18000f467
add rcx, 2
add r8, 2
dec rdx
jmp 0x18000f47b
mov edx, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edx, ecx
jmp 0x18000f483
jne 0x18000f451
xor edx, edx
or rcx, 0xffffffffffffffff
movsxd rax, edx
test edx, edx
jne 0x18000f49b
cmp r9, r11
jae 0x18000f493
mov eax, ecx
jmp 0x18000f49b
xor eax, eax
cmp r9, r11
setne al
test eax, eax
sets al
test al, al
je 0x18000f4aa
mov r10, qword [r10 + 0x10]
jmp 0x18000f4b0
mov rbx, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x18000f420
cmp rbx, r14
je 0x18000f54f
lea rcx, [rbx + 0x20]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000f4d6
mov rcx, qword [rcx]
lea rdx, [rsp + 0x2c0]
cmp rdi, 8
cmovae rdx, rsi
mov r8, r9
cmp r11, r9
cmovb r8, r11
test r8, r8
jmp 0x18000f522
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18000f50a
add rdx, 2
add rcx, 2
dec r8
jmp 0x18000f522
mov r8d, 1
cmp word [rdx], ax
mov rdx, 0xffffffffffffffff
cmovb r8d, edx
xor ecx, ecx
jmp 0x18000f52d
jne 0x18000f4f5
xor ecx, ecx
or rdx, 0xffffffffffffffff
mov r8d, ecx
movsxd rax, r8d
test r8d, r8d
jne 0x18000f546
cmp r11, r9
jae 0x18000f53e
mov eax, edx
jmp 0x18000f546
mov eax, ecx
cmp r11, r9
setne al
test eax, eax
sets al
test al, al
je 0x18000f5aa
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x1b8], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0x1b8]
lea rdx, [0x18009d1cb]
lea rcx, [0x18009d1d0]
call fcn.180003930
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x270]
lea rcx, [0x18009d1d0]
call fcn.1800039d0
mov rbx, qword [rsp + 0x270]
cmp qword [rbx + 0x40], 0
sete bl
cmp qword [rsp + 0x2d8], 8
jb 0x18000f5ca
mov rcx, qword [rsp + 0x2c0]
call fcn.180027f2c
mov qword [rsp + 0x2d8], 7
xor edi, edi
mov qword [rsp + 0x2d0], rdi
mov word [rsp + 0x2c0], di
test bl, bl
je 0x18000fb31
mov rbx, qword [rsp + 0x118]
mov rdx, qword [rbx]
mov qword [rsp + 0x2f0], rdi
mov qword [rsp + 0x2f8], rdi
mov qword [rsp + 0x2f8], 7
mov qword [rsp + 0x2f0], rdi
mov word [rsp + 0x2e0], di
cmp word [rdx], di
jne 0x18000f631
mov r8d, edi
jmp 0x18000f63f
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], di
jne 0x18000f635
lea rcx, [rsp + 0x2e0]
call fcn.180002d20
nop
mov rbx, qword [rbx]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000f684
lea rdx, str.EvtOpenPublisherMetadata
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f684
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call rax
mov r15, rax
jmp 0x18000f687
mov r15, rdi
mov r14, qword [0x18009d1d0]
mov r10, qword [r14 + 8]
mov rbx, r14
mov rdi, qword [rsp + 0x2f8]
mov r11, qword [rsp + 0x2f0]
mov rsi, qword [rsp + 0x2e0]
cmp byte [r10 + 0x19], 0
jne 0x18000f75b
nop dword [rax + rax]
lea rcx, [r10 + 0x20]
lea r8, [rsp + 0x2e0]
cmp rdi, 8
cmovae r8, rsi
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000f6e2
mov rcx, qword [rcx]
mov rdx, r11
cmp r9, r11
cmovb rdx, r9
test rdx, rdx
jmp 0x18000f71b
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x18000f707
add rcx, 2
add r8, 2
dec rdx
jmp 0x18000f71b
mov edx, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edx, ecx
jmp 0x18000f723
jne 0x18000f6f1
xor edx, edx
or rcx, 0xffffffffffffffff
movsxd rax, edx
test edx, edx
jne 0x18000f73b
cmp r9, r11
jae 0x18000f733
mov eax, ecx
jmp 0x18000f73b
xor eax, eax
cmp r9, r11
setne al
test eax, eax
sets al
test al, al
je 0x18000f74a
mov r10, qword [r10 + 0x10]
jmp 0x18000f750
mov rbx, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x18000f6c0
cmp rbx, r14
je 0x18000f7ef
lea rcx, [rbx + 0x20]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000f776
mov rcx, qword [rcx]
lea rdx, [rsp + 0x2e0]
cmp rdi, 8
cmovae rdx, rsi
mov r8, r9
cmp r11, r9
cmovb r8, r11
test r8, r8
jmp 0x18000f7c2
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18000f7aa
add rdx, 2
add rcx, 2
dec r8
jmp 0x18000f7c2
mov r8d, 1
cmp word [rdx], ax
mov rdx, 0xffffffffffffffff
cmovb r8d, edx
xor ecx, ecx
jmp 0x18000f7cd
jne 0x18000f795
xor ecx, ecx
or rdx, 0xffffffffffffffff
mov r8d, ecx
movsxd rax, r8d
test r8d, r8d
jne 0x18000f7e6
cmp r11, r9
jae 0x18000f7de
mov eax, edx
jmp 0x18000f7e6
mov eax, ecx
cmp r11, r9
setne al
test eax, eax
sets al
test al, al
je 0x18000f84a
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x1b8], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0x1b8]
lea rdx, [0x18009d1cb]
lea rcx, [0x18009d1d0]
call fcn.180003930
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x268]
lea rcx, [0x18009d1d0]
call fcn.1800039d0
mov rbx, qword [rsp + 0x268]
mov qword [rbx + 0x40], r15
cmp qword [rsp + 0x2f8], 8
jb 0x18000f866
mov rcx, qword [rsp + 0x2e0]
call fcn.180027f2c
mov qword [rsp + 0x2f8], 7
xor r15d, r15d
mov qword [rsp + 0x2f0], r15
mov word [rsp + 0x2e0], r15w
mov rdx, qword [rsp + 0x118]
mov rdx, qword [rdx]
mov qword [rsp + 0x310], r15
mov qword [rsp + 0x318], r15
mov qword [rsp + 0x318], 7
mov qword [rsp + 0x310], r15
mov word [rsp + 0x300], r15w
cmp word [rdx], r15w
jne 0x18000f8c9
mov r8d, r15d
jmp 0x18000f8da
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], r15w
jne 0x18000f8d0
lea rcx, [rsp + 0x300]
call fcn.180002d20
nop
mov r14, qword [0x18009d1d0]
mov r10, qword [r14 + 8]
mov rbx, r14
mov rdi, qword [rsp + 0x318]
mov r11, qword [rsp + 0x310]
mov rsi, qword [rsp + 0x300]
cmp byte [r10 + 0x19], 0
jne 0x18000f9bd
nop dword [rax]
lea rcx, [r10 + 0x20]
lea r8, [rsp + 0x300]
cmp rdi, 8
cmovae r8, rsi
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000f942
mov rcx, qword [rcx]
mov rdx, r11
cmp r9, r11
cmovb rdx, r9
test rdx, rdx
jmp 0x18000f97b
movzx eax, word [r8]
cmp word [rcx], ax
jne 0x18000f967
add rcx, 2
add r8, 2
dec rdx
jmp 0x18000f97b
mov edx, 1
cmp word [rcx], ax
mov rcx, 0xffffffffffffffff
cmovb edx, ecx
jmp 0x18000f984
jne 0x18000f951
or rcx, 0xffffffffffffffff
mov edx, r15d
movsxd rax, edx
test edx, edx
jne 0x18000f99d
cmp r9, r11
jae 0x18000f994
mov eax, ecx
jmp 0x18000f99d
mov eax, r15d
cmp r9, r11
setne al
test eax, eax
sets al
test al, al
je 0x18000f9ac
mov r10, qword [r10 + 0x10]
jmp 0x18000f9b2
mov rbx, r10
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
je 0x18000f920
cmp rbx, r14
je 0x18000fa4e
lea rcx, [rbx + 0x20]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18000f9d8
mov rcx, qword [rcx]
lea rdx, [rsp + 0x300]
cmp rdi, 8
cmovae rdx, rsi
mov r8, r9
cmp r11, r9
cmovb r8, r11
test r8, r8
jmp 0x18000fa22
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x18000fa0c
add rdx, 2
add rcx, 2
dec r8
jmp 0x18000fa22
mov r8d, 1
cmp word [rdx], ax
mov rcx, 0xffffffffffffffff
cmovb r8d, ecx
jmp 0x18000fa2b
jne 0x18000f9f7
or rcx, 0xffffffffffffffff
mov r8d, r15d
movsxd rax, r8d
test r8d, r8d
jne 0x18000fa45
cmp r11, r9
jae 0x18000fa3c
mov eax, ecx
jmp 0x18000fa45
mov eax, r15d
cmp r11, r9
setne al
test eax, eax
sets al
test al, al
je 0x18000faa9
lea rax, [rsp + 0x300]
mov qword [rsp + 0x1b8], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0x1b8]
lea rdx, [0x18009d1cb]
lea rcx, [0x18009d1d0]
call fcn.180003930
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x200]
lea rcx, [0x18009d1d0]
call fcn.1800039d0
mov rbx, qword [rsp + 0x200]
cmp qword [rbx + 0x40], 0
sete bl
cmp qword [rsp + 0x318], 8
jb 0x18000fac9
mov rcx, qword [rsp + 0x300]
call fcn.180027f2c
mov qword [rsp + 0x318], 7
mov qword [rsp + 0x310], r15
mov word [rsp + 0x300], r15w
test bl, bl
je 0x18000fb27
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x18009caf4], 3
jl 0x180010b3b
mov r8d, eax
lea rdx, str.Bad_publisher:__lu
mov r15, qword [rsp + 0xf8]
mov rcx, r15
call fcn.18000cb60
xor r13d, r13d
mov r14, qword [rsp + 0x108]
jmp 0x1800119ac
mov r15, qword [rsp + 0x198]
xor edi, edi
cmp dword [0x18009caf4], 3
jl 0x18000fb4e
lea rdx, str.got_message
mov rcx, qword [rsp + 0xf8]
call fcn.18000cb60
or rbx, 0xffffffffffffffff
mov r9, rbx
mov rsi, qword [rsp + 0x118]
mov r8, qword [rsi + 0xf0]
lea edx, [rbx + 0x65]
mov r14, qword [rsp + 0x108]
mov rcx, r14
call fcn.18002bfb0
mov r9, rbx
lea r8, [rsp + 0xa30]
lea edx, [rbx + 0x1b]
mov rcx, r12
call fcn.18002a5b4
or r12, rbx
mov r9, r12
mov r8, qword [rsi + 0xe0]
mov edx, 0x100
mov rcx, r13
call fcn.18002bfb0
mov eax, dword [rsp + 0x114]
lea rbx, [rax*8]
mov rax, qword [0x18009caa8]
cmp qword [rbx + rax], 0
jne 0x18000fbf9
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000fbeb
lea rdx, str.EvtCreateBookmark
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000fbeb
xor ecx, ecx
call rax
mov rcx, rax
jmp 0x18000fbee
mov rcx, rdi
mov rax, qword [0x18009caa8]
mov qword [rbx + rax], rcx
mov rdi, qword [r15]
mov rax, qword [0x18009caa8]
mov rsi, qword [rbx + rax]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000fc8d
lea rdx, str.EvtUpdateBookmark
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000fc8d
mov rdx, rdi
mov rcx, rsi
call rax
test eax, eax
je 0x18000fc8d
mov rax, qword [0x18009caa8]
mov rbx, qword [rbx + rax]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000fcbb
lea rdx, str.EvtRender
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r13d, r13d
test rax, rax
je 0x18000fcbe
lea rcx, [r14 + 0x47a8]
mov qword [rsp + 0x30], r13
lea rdx, [0x18009ca94]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
lea r8d, [r13 + 2]
mov rdx, rbx
xor ecx, ecx
call rax
jmp 0x18000fcbe
cmp dword [0x18009caf4], 3
jl 0x18000fcbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Error_in_bookmark:__d
mov rsi, qword [rsp + 0xf8]
mov rcx, rsi
call fcn.18000cb60
xor r13d, r13d
jmp 0x18000fcc6
xor r13d, r13d
mov rsi, qword [rsp + 0xf8]
mov r9, r12
mov rbx, qword [rsp + 0x118]
mov r8, qword [rbx]
mov edx, 0x100
lea rcx, [r14 + 0x100]
call fcn.18002bfb0
mov qword [rsp + 0x1d0], r13
cmp dword [rbx + 0x10c], 0
je 0x18000fe66
mov rcx, qword [rbx + 0x100]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x18000fe28
mov byte [rsp + 0xbb0], 0
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0xbb1]
call fcn.1800292e0
mov byte [rsp + 0xcc0], 0
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0xcc1]
call fcn.1800292e0
mov dword [rsp + 0x1dc], 0x100
mov dword [rsp + 0x1e0], 0x100
lea rax, [rsp + 0x260]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1dc]
lea r8, [rsp + 0xbb0]
mov rdx, qword [rbx + 0x100]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
lea rcx, [rsp + 0xbb0]
mov rax, r12
inc rax
cmp byte [rcx + rax], 0
jne 0x18000fdb0
test rax, rax
je 0x18000fe41
lea rcx, [rsp + 0xcc0]
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18000fdd0
mov r8, r12
mov edx, 0x100
lea rcx, [r14 + 0x500]
test rax, rax
lea rax, [rsp + 0xbb0]
je 0x18000fe15
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcc0]
mov qword [rsp + 0x20], rax
lea r9, [0x18006d028]
call fcn.180029e64
jmp 0x18000fe41
mov qword [rsp + 0x20], rax
lea r9, [0x18006c3d4]
call fcn.180029e64
jmp 0x18000fe41
cmp dword [0x18009caf4], 9
jl 0x18000fe41
lea rdx, str.GetEventUserName:_IsValidSid_returned_FALSE__Not_much_I_can_do_with_an_invalid_SID._n
mov rcx, rsi
call fcn.18000cb60
nop
jmp 0x1800100eb
mov r9, r12
lea r8, [0x18006c3e4]
mov edx, 0x100
lea r12, [r14 + 0x500]
mov rcx, r12
call fcn.18002a5b4
mov dword [rsp + 0x158], r13d
mov dword [rsp + 0x1a4], r13d
mov rbx, qword [0x18009d200]
test rbx, rbx
jne 0x18000febd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.ERROR:_EvtCreateRenderContext__lu
mov rcx, rsi
call fcn.18000cb60
jmp 0x1800100e7
mov rdi, qword [r15]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18000ff13
lea rdx, str.EvtRender
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ff13
lea rcx, [rsp + 0x1a4]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x158]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call rax
test eax, eax
jne 0x1800100e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800100c5
mov ecx, dword [rsp + 0x158]
mov eax, 0x10
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180029908
mov rbx, rax
mov edi, dword [rsp + 0x158]
mov rsi, qword [r15]
mov r14, qword [0x18009d200]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18001007d
lea rdx, str.EvtRender
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001007d
lea rcx, [rsp + 0x1a4]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x158]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov r9d, edi
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call rax
test eax, eax
je 0x18001007d
cmp dword [rbx + 0xc], 0
je 0x180010017
cmp dword [rbx + 0x1c], 0
je 0x18000ffea
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x10]
lea r9, [0x18006d364]
mov qword [rsp + 0x20], rax
or r8, 0xffffffffffffffff
mov edx, 0x100
mov rcx, r12
call fcn.180029e64
jmp 0x180010067
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], r12
or r12, 0xffffffffffffffff
mov r9d, r12d
mov r8, qword [rbx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x18001006b
cmp dword [rbx + 0x2c], 0
je 0x180010067
cmp dword [rbx + 0x3c], 0
je 0x180010039
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x30]
lea r9, str._S_S
jmp 0x18000ffd2
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], r12
or r12, 0xffffffffffffffff
mov r9d, r12d
mov r8, qword [rbx + 0x20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x18001006b
or r12, 0xffffffffffffffff
mov rcx, rbx
call fcn.180029900
mov r14, qword [rsp + 0x108]
jmp 0x1800100eb
cmp dword [0x18009caf4], 6
jl 0x1800100a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Couldnt_Render_Event_2__._Error__0x_x
mov r15, qword [rsp + 0xf8]
mov rcx, r15
call fcn.18000cb60
jmp 0x1800100b0
mov r15, qword [rsp + 0xf8]
mov rcx, rbx
call fcn.180029900
mov r14, qword [rsp + 0x108]
jmp 0x1800119ac
cmp dword [0x18009caf4], 6
jl 0x1800100e0
mov r8d, eax
lea rdx, str.Couldnt_Render_User_._Error__0x_x
mov rcx, rsi
call fcn.18000cb60
xor ecx, ecx
call fcn.180029900
or r12, 0xffffffffffffffff
mov esi, 1
mov r15d, dword [rsp + 0x138]
mov rcx, qword [rsp + 0x118]
mov rax, qword [rcx + 0x70]
mov qword [r14 + 0xf8], rax
cmp dword [rcx + 0x4c], 0
mov ebx, r13d
je 0x180010118
movzx ebx, byte [rcx + 0x40]
mov dword [r14 + 0xf0], r13d
lea rdi, [r14 + 0x664]
mov r9, r12
lea r8, [0x18006d638]
mov edx, 0x3c
mov rcx, rdi
call fcn.18002a5b4
cmp ebx, 6
jne 0x180010159
mov dword [r14 + 0xf0], 0x80
lea r8, [0x18006d690]
jmp 0x18001024d
cmp ebx, 5
jne 0x180010175
mov dword [r14 + 0xf0], 0x40
lea r8, [0x18006d6b8]
jmp 0x18001024d
cmp ebx, 4
jne 0x180010191
mov dword [r14 + 0xf0], 2
lea r8, [0x18006d6c0]
jmp 0x18001024d
cmp ebx, 3
jne 0x1800101a9
mov dword [r14 + 0xf0], esi
lea r8, [0x18006d6d0]
jmp 0x18001024d
cmp ebx, 2
jne 0x1800101c5
mov dword [r14 + 0xf0], 4
lea r8, [0x18006d6d8]
jmp 0x18001024d
cmp ebx, 1
jne 0x1800101de
mov dword [r14 + 0xf0], 0x20
lea r8, [0x18006d6e0]
jmp 0x18001024d
test ebx, ebx
jne 0x18001025d
mov dword [r14 + 0xf0], 2
mov r9, r12
lea r8, [0x18006d6f0]
lea edx, [rbx + 0x3c]
mov rcx, rdi
call fcn.18002a5b4
mov rax, qword [r14 + 0xf8]
movabs rcx, 0x10000000000000
test rcx, rax
je 0x18001022c
mov dword [r14 + 0xf0], 8
lea r8, str.Failure_Audit
jmp 0x18001024d
movabs rcx, 0x20000000000000
test rcx, rax
je 0x18001025d
mov dword [r14 + 0xf0], SafeArrayGetElement
lea r8, str.Success_Audit
mov r9, r12
mov edx, 0x3c
mov rcx, rdi
call fcn.18002a5b4
mov rax, qword [rsp + 0x118]
cmp dword [rax + 0x5c], 0
je 0x1800106e9
cmp word [rax + 0x50], 0
je 0x1800106e9
mov rdx, qword [rax]
mov qword [rsp + 0x330], r13
mov qword [rsp + 0x338], r13
mov qword [rsp + 0x338], 7
mov qword [rsp + 0x330], r13
mov word [rsp + 0x320], r13w
cmp word [rdx], 0
jne 0x1800102b5
mov r8, r13
jmp 0x1800102cb
mov r8, r12
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800102c0
lea rcx, [rsp + 0x320]
call fcn.180002d20
nop
lea rdx, [rsp + 0x320]
lea rcx, [0x18009d1d0]
call fcn.180002f70
mov rbx, rax
cmp rax, qword [0x18009d1d0]
je 0x18001038a
lea rcx, [rax + 0x20]
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18001030f
mov rcx, qword [rcx]
lea rdx, [rsp + 0x320]
cmp qword [rsp + 0x338], 8
cmovae rdx, qword [rsp + 0x320]
mov r8, r10
mov r9, qword [rsp + 0x330]
cmp r9, r10
cmovb r8, r9
test r8, r8
jmp 0x180010361
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x180010355
add rdx, 2
add rcx, 2
dec r8
jmp 0x180010361
mov r8d, esi
cmp word [rdx], ax
cmovb r8d, r12d
jmp 0x180010366
jne 0x180010340
mov r8d, r13d
movsxd rax, r8d
test r8d, r8d
jne 0x180010381
cmp r9, r10
jae 0x180010378
mov eax, r12d
jmp 0x180010381
mov eax, r13d
cmp r9, r10
setne al
test eax, eax
sets al
test al, al
je 0x1800103e5
lea rax, [rsp + 0x320]
mov qword [rsp + 0x198], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0x198]
lea rdx, [0x18009d1cb]
lea rcx, [0x18009d1d0]
call fcn.180003930
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x248]
lea rcx, [0x18009d1d0]
call fcn.1800039d0
mov rbx, qword [rsp + 0x248]
mov eax, dword [rsp + 0x15c]
lea rsi, [rsp + 0x3e0]
lea rsi, [rsi + rax*8]
mov rdi, qword [rsi]
mov rbx, qword [rbx + 0x40]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18001045b
lea rdx, str.EvtFormatMessage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001045b
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x130]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call rax
mov ebx, eax
jmp 0x18001045e
mov ebx, r13d
cmp qword [rsp + 0x338], 8
jb 0x180010476
mov rcx, qword [rsp + 0x320]
call fcn.180027f2c
mov qword [rsp + 0x338], 7
mov qword [rsp + 0x330], r13
mov word [rsp + 0x320], r13w
test ebx, ebx
jne 0x1800106e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180010697
mov r15d, dword [rsp + 0x140]
mov ecx, r15d
add rcx, rcx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x118]
mov rdx, qword [rax]
mov qword [rsp + 0x370], r13
mov qword [rsp + 0x378], r13
mov qword [rsp + 0x378], 7
mov qword [rsp + 0x370], r13
mov word [rsp + 0x360], r13w
cmp word [rdx], bx
jne 0x180010516
mov r8, r13
jmp 0x18001052b
mov r8, r12
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180010520
lea rcx, [rsp + 0x360]
call fcn.180002d20
nop
lea rdx, [rsp + 0x360]
lea rcx, [0x18009d1d0]
call fcn.180002f70
mov rbx, rax
cmp rax, qword [0x18009d1d0]
je 0x18001056e
lea rdx, [rax + 0x20]
lea rcx, [rsp + 0x360]
call fcn.1800038a0
test eax, eax
jns 0x1800105c9
lea rax, [rsp + 0x360]
mov qword [rsp + 0x198], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0x198]
lea rdx, [0x18009d1cb]
lea rcx, [0x18009d1d0]
call fcn.180003930
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x208]
lea rcx, [0x18009d1d0]
call fcn.1800039d0
mov rbx, qword [rsp + 0x208]
mov rdi, qword [rsi]
mov rbx, qword [rbx + 0x40]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x18001062a
lea rdx, str.EvtFormatMessage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, qword [rsp + 0x130]
test rax, rax
je 0x180010632
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call rax
jmp 0x180010632
mov rsi, qword [rsp + 0x130]
cmp qword [rsp + 0x378], 8
jb 0x18001064a
mov rcx, qword [rsp + 0x360]
call fcn.180027f2c
mov qword [rsp + 0x378], 7
mov qword [rsp + 0x370], r13
mov word [rsp + 0x360], r13w
lea rax, [r14 + 0x6a0]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x100
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x1800106bf
cmp dword [0x18009caf4], 7
jl 0x1800106b7
mov r8d, eax
lea rdx, str.EvtFormatMessageTask_Error:__d
mov rcx, qword [rsp + 0xf8]
call fcn.18000cb60
mov rsi, qword [rsp + 0x130]
test rsi, rsi
je 0x1800106d7
mov rcx, rsi
call fcn.180029900
mov rsi, r13
mov qword [rsp + 0x130], r13
mov rax, qword [rsp + 0x118]
jmp 0x1800106f1
mov rax, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x130]
mov rdx, qword [rax]
mov qword [rsp + 0x350], r13
mov qword [rsp + 0x358], r13
mov qword [rsp + 0x358], 7
mov qword [rsp + 0x350], r13
mov word [rsp + 0x340], r13w
cmp word [rdx], 0
jne 0x18001072c
mov r8, r13
jmp 0x18001073b
mov r8, r12
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x180010730
lea rcx, [rsp + 0x340]
call fcn.180002d20
nop
lea rdx, [rsp + 0x340]
lea rcx, [0x18009d1d0]
call fcn.180002f70
mov rbx, rax
cmp rax, qword [0x18009d1d0]
je 0x1800107fd
lea rcx, [rax + 0x20]
mov r10, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x18001077f
mov rcx, qword [rcx]
lea rdx, [rsp + 0x340]
cmp qword [rsp + 0x358], 8
cmovae rdx, qword [rsp + 0x340]
mov r8, r10
mov r9, qword [rsp + 0x350]
cmp r9, r10
cmovb r8, r9
test r8, r8
jmp 0x1800107d4
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x1800107c5
add rdx, 2
add rcx, 2
dec r8
jmp 0x1800107d4
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r12d
jmp 0x1800107d9
jne 0x1800107b0
mov r8d, r13d
movsxd rax, r8d
test r8d, r8d
jne 0x1800107f4
cmp r9, r10
jae 0x1800107eb
mov eax, r12d
jmp 0x1800107f4
mov eax, r13d
cmp r9, r10
setne al
test eax, eax
sets al
test al, al
je 0x180010858
lea rax, [rsp + 0x340]
mov qword [rsp + 0x198], rax
lea r9, [rsp + 0xf4]
lea r8, [rsp + 0x198]
lea rdx, [0x18009d1cb]
lea rcx, [0x18009d1d0]
call fcn.180003930
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x210]
lea rcx, [0x18009d1d0]
call fcn.1800039d0
mov rbx, qword [rsp + 0x210]
mov eax, dword [rsp + 0x15c]
lea r14, [rsp + 0x3e0]
lea r14, [r14 + rax*8]
mov rdi, qword [r14]
mov rbx, qword [rbx + 0x40]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x1800108c6
lea rdx, str.EvtFormatMessage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800108c6
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call rax
mov ebx, eax
jmp 0x1800108c9
mov ebx, r13d
cmp qword [rsp + 0x358], 8
jb 0x1800108e1
mov rcx, qword [rsp + 0x340]
call fcn.180027f2c
mov qword [rsp + 0x358], 7
mov qword [rsp + 0x350], r13
mov word [rsp + 0x340], r13w
test ebx, ebx
jne 0x180010ae6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180010a7f
mov esi, dword [rsp + 0x140]
mov ecx, esi
add rcx, rcx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.180029908
mov r15, rax
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x118]
mov rdx, qword [rax]
mov qword [rsp + 0x390], r13
mov qword [rsp + 0x398], r13
mov qword [rsp + 0x398], 7
mov qword [rsp + 0x390], r13
mov word [rsp + 0x380], r13w
cmp word [rdx], bx
jne 0x180010982
mov r8, r13
jmp 0x180010990
mov r8, r12
inc r8
cmp word [rdx + r8*2], 0
jne 0x180010985
lea rcx, [rsp + 0x380]
call fcn.180002d20
nop
mov rbx, qword [r14]
lea rdx, [rsp + 0x380]
lea rcx, [0x18009d1d0]
call fcn.180017150
mov rdi, qword [rax]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180010a0b
lea rdx, str.EvtFormatMessage
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180010a0b
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call rax
mov ebx, eax
jmp 0x180010a0e
mov ebx, r13d
cmp qword [rsp + 0x398], 8
jb 0x180010a26
mov rcx, qword [rsp + 0x380]
call fcn.180027f2c
mov qword [rsp + 0x398], 7
mov qword [rsp + 0x390], r13
mov word [rsp + 0x380], r13w
mov r14, qword [rsp + 0x108]
lea rax, [r14 + 0x27a0]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2000
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
jne 0x180010aee
jmp 0x180010ab4
cmp dword [0x18009caf4], 7
jl 0x180010aac
mov r8d, eax
lea rdx, str.EvtFormatMessageEvent_Error:__d
mov r15, qword [rsp + 0xf8]
mov rcx, r15
call fcn.18000cb60
mov r14, qword [rsp + 0x108]
jmp 0x180010abc
mov r14, qword [rsp + 0x108]
mov r15, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x18009caf4], 7
jl 0x1800119ac
mov r8d, eax
lea rdx, str.EvtFormatMessageEvent_Error_2:__d
mov rcx, r15
call fcn.18000cb60
jmp 0x1800119ac
mov r14, qword [rsp + 0x108]
mov r15, qword [rsp + 0xf8]
cmp dword [0x18009caf4], 6
jl 0x180010b0e
lea rdx, str.VISTA:_Sending_VISTA_Event...
mov rcx, r15
call fcn.18000cb60
lea rax, [r14 + 0x300]
test rax, rax
jne 0x180010b4b
cmp dword [0x18009caf4], 3
jl 0x1800119c4
lea rdx, str.FAILED_message__
mov rcx, r15
call fcn.18000cb60
jmp 0x1800119ac
xor r13d, r13d
mov r14, qword [rsp + 0x108]
jmp 0x1800119c4
cmp dword [0x18009caf4], 6
jl 0x180010b63
lea rdx, str.VISTA:_Event_found__processing_data_for_VISTA_event
mov rcx, r15
call fcn.18000cb60
mov esi, dword [rsp + 0x120]
test esi, esi
je 0x180010cc1
mov edi, r13d
mov dword [rsp + 0x124], r13d
mov rbx, qword [rsp + 0x180]
mov qword [rsp + 0x138], rbx
mov rax, qword [0x18009caf8]
mov qword [0x18009d178], rax
cmp dword [0x18009caf4], 7
jl 0x180010bb0
lea rcx, str.re_initialising_currentnode_to_head
call fcn.1800169b0
cmp rbx, 0
jne 0x180010be0
cmp dword [0x18009caf4], 7
jl 0x1800119ac
lea rdx, str.Match_Pointer_has_gone_away
mov rcx, r15
call fcn.18000cb60
jmp 0x1800119ac
mov r8d, dword [rsp + 0x100]
mov edx, dword [r14 + 0xf0]
mov ecx, dword [r14 + 0xec]
call fcn.180014610
mov qword [rbx], rax
jmp 0x180010c35
cmp qword [rbx], 0
je 0x180010c5f
inc edi
mov dword [rsp + 0x124], edi
add rbx, 8
mov qword [rsp + 0x138], rbx
cmp edi, esi
jae 0x180010c5f
cmp dword [0x18009caa0], 0
je 0x180010be0
jmp 0x180010c68
cmp dword [0x18009caa0], 0
je 0x180010c71
mov dword [r15 + 0x74], r13d
jmp 0x180011aa3
mov ebx, dword [rsp + 0x124]
test ebx, ebx
jne 0x180010cc8
cmp dword [0x18009caf4], 7
jl 0x180010c94
lea rdx, str.Match_Checker:_No_matches_found
mov rcx, r15
call fcn.18000cb60
lea r8, [r14 + 0x47a8]
mov eax, dword [rsp + 0x114]
imul rdx, rax, 0x20a
add rdx, qword [0x18009cab0]
lea rcx, [0x18006d948]
call fcn.18001a8d0
jmp 0x1800119ac
mov ebx, dword [rsp + 0x124]
test r14, r14
je 0x1800119ac
cmp dword [0x18009caf4], 7
jl 0x180010cec
mov r8d, ebx
lea rdx, str.FastCheckObjective:_found_matches___d_
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 6
jl 0x180010d04
lea rdx, str.VISTA:_done
mov rcx, r15
call fcn.18000cb60
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2 + 0x300], 0
jne 0x180010d10
test rax, rax
je 0x180011876
mov rax, r12
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax + 0xd0], 0
jne 0x180010d30
test rax, rax
je 0x180011876
mov rax, r12
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2 + 0x100], 0
jne 0x180010d50
test rax, rax
je 0x180011876
cmp dword [r14 + 0xf0], 0
je 0x180011876
mov rax, r12
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x180010d80
test rax, rax
je 0x180011876
mov rax, r12
nop word [rax + rax]
inc rax
cmp byte [r14 + rax + 0x27a0], 0
jne 0x180010da0
test rax, rax
je 0x180011876
mov rax, r12
nop word [rax + rax]
inc rax
cmp byte [r14 + rax + 0x6a0], 0
jne 0x180010dc0
test rax, rax
je 0x180011876
cmp dword [0x18009caf4], 6
jl 0x180010e0e
lea rdx, str.Event_is_ready__checking_objectives
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 6
jl 0x180010e0e
mov r8d, dword [r14 + 0xec]
lea rdx, str.ShortEventID:__d
mov rcx, r15
call fcn.18000cb60
mov esi, r13d
mov ebx, dword [rsp + 0x120]
cmp dword [0x18009caf4], 6
jl 0x180010e33
mov r8d, ebx
lea rdx, str.dwObjectiveCount:__d
mov rcx, r15
call fcn.18000cb60
test ebx, ebx
jne 0x180010e3f
lea esi, [rbx + 1]
jmp 0x180010fdd
mov ebx, r13d
mov dword [rsp + 0x124], ebx
mov rdi, qword [rsp + 0x180]
mov qword [rsp + 0x138], rdi
call fcn.180014940
nop
cmp dword [0x18009caf4], 6
jl 0x180010e7c
mov r8d, ebx
lea rdx, str.begin_MatchCount:__d
mov rcx, r15
call fcn.18000cb60
nop
lea r9, [r14 + 0x27a0]
lea r8, [r14 + 0x500]
mov edx, dword [r14 + 0xec]
mov rcx, qword [rdi]
call fcn.180014730
mov ebx, eax
mov dword [rsp + 0x1b0], eax
test eax, eax
jns 0x180010ed9
jmp 0x180010f3b
mov ecx, 1
mov rax, qword [rdi]
cmp dword [rax + 0x14], 0
je 0x180010f07
cmp dword [0x18009caf4], 7
jl 0x180010eff
lea rdx, str.Excluding_this_event
mov rcx, r15
call fcn.18000cb60
mov esi, r13d
jmp 0x180010f93
mov esi, ecx
cmp dword [0x18009caf4], 7
jl 0x180010f21
lea rdx, str.Checkobjective:_node_found
mov rcx, r15
call fcn.18000cb60
cmp dword [r14 + 0xc8], ebx
jge 0x180010f31
mov dword [r14 + 0xc8], ebx
cmp dword [rsp + 0x1d8], 0
je 0x180010f93
add rdi, 8
mov qword [rsp + 0x138], rdi
mov ebx, dword [rsp + 0x124]
inc ebx
mov dword [rsp + 0x124], ebx
cmp dword [0x18009caf4], 6
jl 0x180010f72
mov r8d, ebx
lea rdx, str.end_MatchCount:__d
mov rcx, r15
call fcn.18000cb60
cmp qword [rdi], 0
je 0x180010f9a
cmp ebx, dword [rsp + 0x120]
jae 0x180010f9a
cmp dword [0x18009caa0], 0
je 0x180010e60
jmp 0x180011aa3
mov ebx, dword [rsp + 0x124]
cmp dword [0x18009caa0], 0
jne 0x180011aa3
cmp dword [0x18009caf4], 6
jl 0x180010ffe
cmp qword [rdi], 0
jne 0x180010fc5
lea rdx, str.Check_Objective_finished:_MatchPointer_has_gone_away
mov rcx, r15
call fcn.18000cb60
cmp ebx, dword [rsp + 0x120]
jb 0x180010fdd
lea rdx, str.Check_Objective_finished:_no_objectives_left_to_check
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 6
jl 0x180010ffe
mov r8d, r13d
test esi, esi
setne r8b
lea rdx, str.nodematch:__d
mov rcx, r15
call fcn.18000cb60
test esi, esi
je 0x18001192e
lea rcx, [rsp + 0x1c8]
call fcn.18002c388
cmp dword [rsp + 0x148], 0
jne 0x18001102c
cmp qword [rsp + 0x188], 0
je 0x1800110ba
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x3b0]
call fcn.18002c07c
mov rcx, qword [rsp + 0x188]
test rcx, rcx
je 0x1800110ba
mov eax, dword [rsp + 0x22c]
cmp dword [rsp + 0x3c4], eax
jne 0x18001107e
mov eax, dword [rsp + 0x228]
cmp dword [rsp + 0x3c0], eax
jne 0x18001107e
mov eax, dword [rsp + 0x224]
cmp dword [rsp + 0x3bc], eax
je 0x1800110ba
call fcn.1800299e8
call fcn.180015e80
mov qword [rsp + 0x188], rax
mov eax, dword [rsp + 0x3c4]
mov dword [rsp + 0x22c], eax
mov eax, dword [rsp + 0x3c0]
mov dword [rsp + 0x228], eax
mov eax, dword [rsp + 0x3bc]
mov dword [rsp + 0x224], eax
mov byte [rsp + 0xa20], 0
xor eax, eax
mov qword [rsp + 0xa21], rax
mov dword [rsp + 0xa29], eax
mov word [rsp + 0xa2d], ax
mov byte [rsp + 0xa2f], al
cmp dword [rsp + 0x148], eax
je 0x1800111d2
lea rdx, [rsp + 0x3b0]
lea rcx, [rsp + 0xa20]
call fcn.180012cc0
cmp dword [rsp + 0x1a8], 0
je 0x18001112b
or ecx, 0xffffffff
sub ecx, dword [r14 + 0xc8]
xor ecx, dword [rsp + 0x190]
and ecx, 7
xor ecx, dword [rsp + 0x190]
jmp 0x180011132
mov ecx, dword [rsp + 0x190]
mov eax, dword [r14 + 0xc8]
mov r8, r12
cmp dword [rsp + 0x1a0], 0
je 0x180011185
mov dword [rsp + 0x38], eax
lea rax, [0x18009ca30]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r9, str.__ld__s__s_MSWinEventLog__d_:
mov edx, 0x100
lea rcx, [rsp + 0xdd0]
call fcn.180029e64
jmp 0x18001121b
lea rdx, [0x180099088]
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rdx
lea rax, [0x18009ca30]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xa20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r9, str.__ld__s__s_MSWinEventLog_s_d_s
mov edx, 0x100
lea rcx, [rsp + 0xdd0]
call fcn.180029e64
jmp 0x18001121b
lea rbx, [0x180099088]
mov qword [rsp + 0x40], rbx
mov eax, dword [r14 + 0xc8]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [0x18009ca30]
mov qword [rsp + 0x20], rax
lea r9, str._s_sMSWinEventLog_s_d_s
mov r8, r12
mov edx, 0x100
lea rcx, [rsp + 0xdd0]
call fcn.180029e64
lea rsi, [r14 + 0x27a0]
mov rax, rsi
cmp byte [rsi], 0
je 0x180011240
nop word [rax + rax]
cmp byte [rax], 9
jne 0x180011238
mov byte [rax], 0x20
inc rax
cmp byte [rax], 0
jne 0x180011230
mov r15d, dword [rsp + 0x114]
mov rax, qword [rsp + 0x1e8]
lea r14, [rax + r15*4]
mov rax, qword [rsp + 0x108]
lea rdi, [rax + 0x7a0]
lea rcx, [rax + 0x6a0]
lea rdx, [rax + 0x664]
lea r8, [rax + 0x600]
lea r9, [rax + 0x500]
lea r10, [rax + 0x100]
lea r11, [rax + 0xd0]
lea rbx, [rax + 0x300]
mov eax, dword [r14]
mov dword [rsp + 0xe8], eax
lea rax, [0x180099088]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb8], rcx
lea rcx, [0x180099088]
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], rcx
mov eax, dword [rax + 0xec]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rcx
mov eax, dword [0x180099090]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xdd0]
mov qword [rsp + 0x20], rax
lea r9, str._s_S_s_d_s_s_s_ld_s_S_s_s_s_s_s_s_s_S_s_s_s_s_s_s_s_d_n
mov r8, r12
mov edx, 0x2000
lea rcx, [0x18009d220]
call fcn.180029e64
cmp dword [0x18009caf4], 3
jl 0x1800113d4
test rdi, rdi
je 0x1800113aa
mov r8, rdi
lea rdx, str.DataString:__s
mov rcx, qword [rsp + 0xf8]
call fcn.18000cb60
cmp dword [0x18009caf4], 3
jl 0x1800113d4
test rsi, rsi
je 0x1800113d4
mov r8, rsi
lea rdx, str.szTempString:__s
mov rsi, qword [rsp + 0xf8]
mov rcx, rsi
call fcn.18000cb60
jmp 0x1800113dc
mov rsi, qword [rsp + 0xf8]
lea rdi, [0x18009d220]
mov rax, rdi
cmp byte [0x18009d220], 0
je 0x180011408
nop
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x1800113fd
cmp cl, 0xd
jne 0x180011400
mov byte [rax], 0x20
inc rax
cmp byte [rax], 0
jne 0x1800113f0
cmp dword [0x18009d218], 0
je 0x180011466
mov rcx, rdi
call fcn.180008970
mov r8, rax
mov r9, r12
mov edx, 0x40
lea rcx, [rsp + 0xa70]
call fcn.18002a5b4
lea rax, [rsp + 0xa70]
mov qword [rsp + 0x30], rax
lea rax, [0x180099088]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str._s_s_s
mov r8, r12
mov edx, 0x2000
mov rcx, rdi
call fcn.180029e64
mov rax, r12
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x180011470
cmp rax, 0x2000
jb 0x180011488
mov byte [rax + rdi - 1], 0xa
jmp 0x18001149f
mov r9, r12
lea r8, [0x18006c5ac]
mov edx, 0x2000
mov rcx, rdi
call fcn.180029f1c
cmp dword [0x18009caf4], 3
jl 0x1800114d0
mov rax, r12
nop dword [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x1800114b0
test rax, rax
je 0x1800114d0
mov rbx, qword [rsp + 0x188]
test rbx, rbx
je 0x1800114f0
mov rdx, rbx
mov rcx, rdi
call fcn.18002b298
mov rcx, rbx
call fcn.18002b16c
mov ebx, r13d
cmp dword [0x18009caf4], 3
jl 0x18001150b
cmp dword [0x18009caf4], 3
jl 0x18001188e
lea rdx, str.ERROR:_Invalid_VISTA_event.
mov rcx, r15
call fcn.18000cb60
mov r10, r12
inc r10
cmp byte [r14 + r10 + 0x6a0], 0
jne 0x180011891
mov rdx, r12
inc rdx
cmp byte [r14 + rdx + 0x27a0], 0
jne 0x1800118a2
mov rax, r12
inc rax
cmp word [r14 + rax*2], 0
jne 0x1800118b3
mov rcx, r12
inc rcx
cmp word [r14 + rcx*2 + 0x100], 0
jne 0x1800118c1
mov r9, r12
nop dword [rax]
nop word [rax + rax]
inc r9
cmp byte [r14 + r9 + 0xd0], 0
jne 0x1800118e0
mov r8, r12
inc r8
cmp word [r14 + r8*2 + 0x300], 0
jne 0x1800118f1
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rax
mov eax, dword [r14 + 0xf0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea rdx, str._d__d__d__d__d__d__d
mov rcx, r15
call fcn.18000cb60
cmp dword [0x18009caf4], 9
jl 0x18000fb1a
lea rdx, str.Message_Complete
mov rcx, r15
call fcn.18000cb60
mov r14, qword [rsp + 0x108]
jmp 0x1800119ac
cmp dword [0x18009caf4], 6
jl 0x1800119a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x18006c730]
mov r15, qword [rsp + 0xf8]
mov rcx, r15
call fcn.18000cb60
jmp 0x1800119ac
mov r15, qword [rsp + 0xf8]
cmp dword [0x18009caf4], 6
jl 0x1800119ac
mov r8d, eax
lea rdx, str.Couldnt_Render_Event_._Error__0x_x
mov rcx, r15
call fcn.18000cb60
jmp 0x1800119ac
mov r15, qword [rsp + 0xf8]
cmp dword [0x18009caf4], 3
jl 0x1800119c4
lea rdx, str.DMM:_Message_Complete
mov rcx, r15
call fcn.18000cb60
test r14, r14
je 0x1800119dc
mov rcx, r14
call fcn.180029620
mov r14, r13
mov qword [rsp + 0x108], r13
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x1800119f9
mov rcx, rax
call fcn.180029900
mov qword [rsp + 0x130], r13
mov rdx, qword [rsp + 0x118]
test rdx, rdx
je 0x180011a16
mov rcx, rdx
call fcn.180029900
mov qword [rsp + 0x118], r13
mov esi, dword [rsp + 0x15c]
lea rbx, [rsp + 0x3e0]
lea rbx, [rbx + rsi*8]
mov rdi, qword [rbx]
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180011a4f
lea rdx, str.EvtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011a4f
mov rcx, rdi
call rax
mov qword [rbx], r13
inc esi
or r12, 0xffffffffffffffff
mov r15, qword [rsp + 0xf8]
jmp 0x18000f00e
mov ebx, dword [0x18009d1b8]
mov edi, dword [rsp + 0x114]
jmp 0x18000ef07
mov eax, edi
mov rcx, qword [r15 + 0x90]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r14d, 1
cmp dword [0x18009caf4], 9
jl 0x180011ac1
lea rdx, str.EvtNextCleanup...
mov rcx, r15
call fcn.18000cb60
mov ebx, r13d
cmp dword [rsp + 0x150], 0
jbe 0x180011b17
nop
mov eax, ebx
lea rsi, [rsp + 0x3e0]
lea rsi, [rsi + rax*8]
mov rdi, qword [rsi]
test rdi, rdi
je 0x180011b0c
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180011b09
lea rdx, str.EvtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011b09
mov rcx, rdi
call rax
mov qword [rsi], r13
inc ebx
cmp ebx, dword [rsp + 0x150]
jb 0x180011ad0
mov eax, dword [rsp + 0x16c]
cmp eax, 0x103
je 0x180011cdd
cmp eax, 0x10dd
je 0x180011cdd
cmp eax, 6
je 0x180011cdd
cmp eax, 0xb7
je 0x180011cdd
cmp dword [0x18009caf4], 5
jl 0x180011b75
mov eax, dword [rsp + 0x114]
imul r8, rax, 0x20a
add r8, qword [0x18009cab8]
lea rdx, str.ERROR:_Unable_to_collect_events__restarting_subscription_for__S
mov rcx, r15
call fcn.18000cb60
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rsp + 0x114]
mov rax, qword [r15 + 0x98]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
je 0x180011bba
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180011bba
lea rdx, str.EvtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011bba
mov rcx, rbx
call rax
mov rax, qword [r15 + 0x90]
mov rcx, qword [rax + rdi*8]
test rcx, rcx
je 0x180011bd0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov r8d, r14d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [r15 + 0x90]
mov qword [rcx + rdi*8], rax
imul rbx, rdi, 0x20a
mov rcx, qword [0x18009cab8]
add rcx, rbx
mov edx, dword [0x18009d21c]
call fcn.1800136f0
test eax, eax
je 0x180011cdd
mov esi, r14d
mov r14, r13
mov rax, qword [0x18009caa8]
mov qword [rax + rdi*8], r13
mov rdx, qword [0x18009cab0]
add rdx, rbx
mov r9d, 0x400
lea r8, [rsp + 0x22d0]
lea rcx, str.Status
call fcn.18001aa90
test eax, eax
je 0x180011c9c
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180011c76
lea rdx, str.EvtCreateBookmark
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011c76
lea rcx, [rsp + 0x22d0]
call rax
mov rcx, rax
jmp 0x180011c79
mov rcx, r13
mov rax, qword [0x18009caa8]
mov qword [rax + rdi*8], rcx
mov rax, qword [0x18009caa8]
mov rcx, qword [rax + rdi*8]
test rcx, rcx
je 0x180011c9c
mov r14, rcx
mov esi, 3
mov r8, qword [0x18009cab8]
add r8, rbx
mov rdx, qword [r15 + 0x90]
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
lea r9, [0x18006bd84]
mov rdx, qword [rdx + rdi*8]
xor ecx, ecx
call fcn.180016480
mov rcx, qword [r15 + 0x98]
mov qword [rcx + rdi*8], rax
mov rbx, qword [rsp + 0x108]
test rbx, rbx
je 0x180011cfa
mov rcx, rbx
call fcn.180029620
mov qword [rsp + 0x108], r13
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x180011d17
mov rcx, rax
call fcn.180029900
mov qword [rsp + 0x130], r13
mov rdi, qword [rsp + 0x118]
test rdi, rdi
je 0x180011d75
mov rcx, rdi
call fcn.180029900
mov qword [rsp + 0x118], r13
jmp 0x180011d75
cmp dword [0x18009caf4], 9
jl 0x180011d75
lea rdx, str.Oh_dear._I_cant_seem_to_find_the_next_open_log_file._Something_quite_strange_is_going_on_here.
mov rcx, r15
call fcn.18000cb60
jmp 0x180011d75
cmp dword [0x18009caf4], 9
jl 0x180011d75
lea rdx, str.Warning:_An_event_occured_that_I_am_not_programmed_to_deal_with._Continuing
mov rcx, r15
call fcn.18000cb60
jmp 0x180011d75
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [rsp + 0x144]
mov r14, qword [rsp + 0x108]
mov ecx, 0xbb8
jmp 0x18000e471
cmp dword [rsp + 0x154], 0xc8
jge 0x180011da9
cmp dword [r15 + 0xa0], 0
je 0x18000e445
cmp dword [rsp + 0x154], 0x190
jge 0x180011ead
cmp dword [r15 + 0xa4], 0
jne 0x18000e445
mov edx, 0x2710
mov rcx, qword [r15 + 0xa8]
call qword [rsp + 0x250]
cmp dword [rsp + 0x1c0], 0
je 0x180011df3
cmp dword [r15 + 0xa4], 0
jne 0x18000e440
mov edi, 1
mov dword [rsp + 0x1c0], edi
lea rcx, [rsp + 0x280]
call fcn.180046c14
nop
lea rax, vtable._SH_.0
mov qword [rsp + 0x280], rax
lea rdx, [0x180012180]
mov qword [rsp + 0x2a0], rdx
mov qword [rsp + 0x2a8], r15
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x280]
call fcn.180046d20
nop
lea rcx, [rsp + 0x280]
call fcn.180046cd4
nop
cmp dword [rsp + 0x1f8], 0
jne 0x180011e68
mov ecx, edi
call fcn.180046bd4
movaps xmm0, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x2b0], xmm0
lea rcx, [rsp + 0x2b0]
call fcn.180046a6c
test eax, eax
je 0x180011e91
mov ecx, eax
call fcn.180046b98
mov dword [rsp + 0x1f8], r13d
cmp dword [rsp + 0x1f8], 0
je 0x18000e440
call fcn.18002c408
int3
cmp dword [0x18009caf4], 1
jl 0x180011ec5
lea rdx, str.SNARE_Closing
mov rcx, r15
call fcn.18000cb60
mov rax, qword [rsp + 0x180]
test rax, rax
je 0x180011eda
mov rcx, rax
call fcn.180029620
call fcn.1800259d0
mov rdi, qword [rsp + 0x188]
test rdi, rdi
je 0x180011ef4
mov rcx, rdi
call fcn.1800299e8
mov rbx, qword [0x18009d208]
mov qword [0x18009d210], rbx
test rbx, rbx
je 0x180011f4d
mov rdi, qword [rbx]
cmp rdi, 0xffffffffffffffff
je 0x180011f32
call qword [sym.imp.WS2_32.dll_WSACancelBlockingCall]
cmp rdi, 0xffffffffffffffff
je 0x180011f25
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbx, qword [0x18009d210]
mov rcx, rbx
mov rbx, qword [rbx + 0x228]
mov qword [0x18009d210], rbx
call fcn.180029620
test rbx, rbx
jne 0x180011f07
mov qword [0x18009d208], r13
mov ebx, r13d
cmp dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr], 0
jbe 0x180011fbd
mov eax, ebx
lea rsi, [rax*8]
mov rax, qword [r15 + 0x98]
mov rdi, qword [rsi + rax]
test rdi, rdi
je 0x180011f9d
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180011f9d
lea rdx, str.EvtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180011f9d
mov rcx, rdi
call rax
mov rax, qword [r15 + 0x90]
mov rcx, qword [rsi + rax]
test rcx, rcx
je 0x180011fb3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [reloc.ACTIVEDS.dll_ADsBuildVarArrayStr]
jb 0x180011f60
mov rcx, qword [0x18009d1a0]
test rcx, rcx
je 0x180011fcf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x18009d1a8]
test rcx, rcx
je 0x180011fe1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x18009d1b0]
test rcx, rcx
je 0x180011ff3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x18009d1f0]
test rbx, rbx
je 0x180012029
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180012022
lea rdx, str.EvtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012022
mov rcx, rbx
call rax
mov qword [0x18009d1f0], r13
mov rbx, qword [0x18009d200]
test rbx, rbx
je 0x18001205f
mov rcx, qword [0x18009d1e0]
test rcx, rcx
je 0x180012058
lea rdx, str.EvtClose
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180012058
mov rcx, rbx
call rax
mov qword [0x18009d200], r13
call fcn.180014970
mov rcx, qword [rsp + 0x2ad0]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x2ae0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret