Function at 0x18002cff0
Capabilities:
Create directory
Create thread
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x180070310]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov dword [rsp + 0x54], r9d
mov rdi, r8
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x18], rdx
mov r14, rcx
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp + 0x500]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x510]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x518]
mov qword [rbp + 0x50], rax
movdqa xmm0, xmmword [0x18006a460]
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
movdqa xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], 0
movdqa xmmword [rbp + 0x2d0], xmm0
mov byte [rbp + 0x2c0], 0
xor ecx, ecx
mov qword [rbp + 0xb0], rcx
mov word [rbp + 0xb8], cx
movdqu xmmword [rbp + 0xca], xmm0
mov byte [rbp + 0xba], cl
mov qword [rbp + 0x80], rcx
mov word [rbp + 0x88], cx
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rcx
mov qword [rbp + 0x110], rcx
mov ecx, 0x30
call fcn.180063980
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x108], rax
xor r10d, r10d
mov qword [rbp + 0x118], r10
xorps xmm2, xmm2
movsd qword [rbp + 0x120], xmm2
mov qword [rbp + 0x128], r10
mov dword [rbp + 0x130], 1
mov qword [rbp + 0x138], r10
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r10
mov qword [rbp + 0x178], 0xffffffffffffffff
mov dword [rbp + 0x180], r10d
xor eax, eax
movups xmmword [rbp + 0x188], xmm0
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [0x18006a460]
movdqa xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], al
mov word [rbp + 0x1f0], r10w
mov dword [rbp + 0x1f4], r10d
mov qword [rbp + 0x1f8], r10
xorps xmm0, xmm0
movaps xmmword [rbp + 0x200], xmm0
movsd qword [rbp + 0x210], xmm2
mov byte [rbp + 0x218], al
mov qword [rbp + 0x21c], r10
mov r11d, dword [rsp + 0x54]
mov edx, r11d
mov dword [rsp + 0x50], edx
lea eax, [r11 + 0x54]
movzx r8d, byte [rsp + 0x48]
mov byte [rsp + 0x40], r8b
cmp r11d, eax
jae 0x18002dc34
mov r9d, 0x632e
movzx ecx, byte [rsp + 0x48]
mov byte [rsp + 0x41], cl
mov r13d, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x70]
mov esi, dword [rsp + 0x68]
mov qword [rbp - 0x38], rsi
movzx eax, byte [rsp + 0x48]
mov dword [rsp + 0x58], eax
mov r15, qword [rsp + 0x70]
nop dword [rax + rax]
lea eax, [rdx - 0x3d]
cmp eax, 0xed
ja case.0x18002d2a5.62
lea r8, [0x180000000]
movzx eax, byte [r8 + rax + 0x2e704]
mov ecx, dword [r8 + rax*4 + 0x2e6c8]
add rcx, r8
jmp rcx
mov byte [rbp + 0x400], 0
mov r8d, 2
lea rdx, [0x1800693ef]
lea rcx, [rbp + 0x400]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x402], 0x74656d69
xor r10d, r10d
mov r11d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
mov r9d, 0x632e
movzx r8d, byte [rsp + 0x40]
add edx, 6
mov dword [rsp + 0x50], edx
lea eax, [r11 + 0x54]
cmp edx, eax
jae 0x18002dc3f
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
jmp 0x18002d280
mov rcx, qword [rbp + 0x50]
mov qword [rbp - 0x50], rcx
mov rax, qword [rbp - 0x18]
cmp qword [rax], 0
je 0x18002dc1c
movzx eax, byte [rcx]
mov qword [rbp - 0x60], rax
jmp case.0x18002d2a5.62
mov r8d, 1
lea rdx, [0x1800693fc]
lea rcx, [rbp + 0x250]
call fcn.180061b60
mov byte [rsp + 0x41], 1
mov r8b, 1
mov byte [rsp + 0x40], r8b
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
xor r10d, r10d
mov r9d, 0x632e
jmp 0x18002d2ea
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rax, [rbp + 0x400]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x18002d380
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0x230]
call fcn.180061b60
jmp 0x18002d2d2
mov rax, qword [rbp - 0x60]
inc rax
mov qword [rsp + 0x78], rax
jmp case.0x18002d2a5.62
mov r14d, 0x33
nop dword [rax]
mov eax, r14d
sub eax, 0x32
je 0x18002d40e
cmp eax, 1
jne 0x18002d4d7
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbd
lea rcx, [rsp + 0x60]
call fcn.18005e2f0
inc eax
mov dword [rbp - 0x28], eax
cmp eax, 0xc
ja 0x18002d560
mov rcx, qword [rbp + 0x58]
mov dword [rcx], eax
jmp 0x18002d4d7
mov esi, 0x11b
mov eax, esi
sub eax, 0x11b
je 0x18002d4b8
sub eax, 2
je 0x18002d44a
sub eax, 2
je 0x18002d442
cmp eax, 2
jne 0x18002d4c8
mov eax, dword [rbp - 0x74]
mov rcx, qword [rbp - 0x30]
inc dword [rcx + rax*4]
jmp 0x18002d4c8
mov eax, dword [rbp - 0x74]
mov byte [rdi + rbx], al
jmp 0x18002d4c8
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbd
lea rcx, [rsp + 0x60]
call fcn.18005e2f0
mov ecx, eax
mov edi, 1
shl edi, cl
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x60], eax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbd
lea rcx, [rsp + 0x60]
call fcn.18005e2f0
inc eax
mov dword [rbp - 0x74], eax
cmp edi, dword [rbp - 0x78]
jne 0x18002d560
mov rdi, qword [rbp - 0x40]
xor r10d, r10d
jmp 0x18002d4c8
mov ecx, dword [rbp - 0x28]
mov eax, 1
shl eax, cl
sub eax, r13d
mov dword [rbp - 0x78], eax
add esi, 2
cmp esi, 0x123
jb 0x18002d413
dec r14d
cmp r14d, 0x31
mov r10d, 0
ja 0x18002d3c0
mov r14, qword [rbp - 0x30]
mov eax, dword [r14 + 4]
cmp eax, 2
jb 0x18002d560
test al, 1
jne 0x18002d560
lea eax, [rbx + 1]
mov rcx, qword [rbp + 0x60]
mov dword [rcx], eax
jmp 0x18002d2d5
mov r8d, r10d
test rbx, rbx
je 0x18002d557
mov edx, 0x5f
cmp edx, 0x5f
jne 0x18002d53a
mov ecx, r8d
movzx eax, byte [rcx + rdi]
cmp al, 0xc
jae 0x18002d560
inc dword [r14 + rax*4]
movzx ecx, byte [rcx + rdi]
mov eax, 1
shl eax, cl
sar eax, 1
add r13d, eax
add edx, 0xb8
cmp edx, 0x117
jb 0x18002d516
inc r8d
mov eax, r8d
cmp rax, rbx
jb 0x18002d511
mov edx, dword [rsp + 0x50]
test r13d, r13d
jne case.0x18002d2a5.62
mov rbx, 0xfffffffffffffff1
jmp 0x18002e16f
mov word [rbp + 0x409], 0x6d
mov edx, 0x6a
lea rcx, [0x180070208]
call fcn.18002ee30
test al, al
jne 0x18002d2d2
mov r14d, 0x112
nop dword [rax]
nop dword [rax + rax]
cmp r14d, 0x3bc
ja 0x18002d795
je 0x18002d76b
cmp r14d, 0x248
ja 0x18002d6b1
je 0x18002d687
mov eax, r14d
sub eax, 0x112
je 0x18002d664
sub eax, 0x3e
je 0x18002d639
sub eax, 0x3e
je 0x18002d61e
sub eax, 0x3e
je 0x18002d5fd
xor r10d, r10d
cmp eax, 0x3e
jne 0x18002da1b
mov word [rbp + 0x3fc], 0x53
jmp 0x18002da1b
mov eax, dword [str.213P]
mov dword [rbp + 0x3f8], eax
movzx eax, byte [0x180069404]
mov byte [rbp + 0x3fc], al
xor r10d, r10d
jmp 0x18002da1b
mov dword [rbp + 0x3f4], 0x44414d
mov word [rbp + 0x3f7], 0x44
xor r10d, r10d
jmp 0x18002da1b
mov r8d, 1
lea rdx, [0x1800677dc]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp + 0x3f3], 0x4e
xor r10d, r10d
jmp 0x18002da1b
movzx eax, word [0x180069408]
mov word [rbp + 0x3f0], ax
movzx eax, byte [0x18006940a]
mov byte [rbp + 0x3f2], al
xor r10d, r10d
jmp 0x18002da1b
mov eax, 0x4f
mov word [rbp + 0x410], ax
mov dword [rbp + 0x412], 0x44006e
mov eax, 0x72
mov word [rbp + 0x416], ax
xor r10d, r10d
jmp 0x18002da1b
mov eax, r14d
sub eax, 0x286
je 0x18002d74d
sub eax, 0x3e
je 0x18002d739
sub eax, 0x3e
je 0x18002d71d
sub eax, 0x3e
je 0x18002d6ff
xor r10d, r10d
cmp eax, 0x3e
jne 0x18002da1b
mov eax, 0x75
mov word [rbp + 0x42e], ax
mov dword [rbp + 0x430], 0x650074
mov dword [rbp + 0x434], 0x430073
jmp 0x18002da1b
mov eax, 0x72
mov word [rbp + 0x428], ax
mov dword [rbp + 0x42a], 0x620069
xor r10d, r10d
jmp 0x18002da1b
mov dword [rbp + 0x420], 0x410067
mov dword [rbp + 0x424], 0x740074
xor r10d, r10d
jmp 0x18002da1b
mov eax, 0x6e
mov word [rbp + 0x41e], ax
xor r10d, r10d
jmp 0x18002da1b
mov eax, 0x61
mov word [rbp + 0x418], ax
mov dword [rbp + 0x41a], 0x690077
xor r10d, r10d
jmp 0x18002da1b
mov eax, 0x68
mov word [rbp + 0x438], ax
mov dword [rbp + 0x43a], 0x6e0061
mov eax, 0x67
mov word [rbp + 0x43e], ax
xor r10d, r10d
jmp 0x18002da1b
cmp r14d, 0x530
ja 0x18002d87d
je 0x18002d85c
mov eax, r14d
sub eax, 0x3fa
je 0x18002d84a
sub eax, 0x3e
je 0x18002d830
sub eax, 0x3e
je 0x18002d825
sub eax, 0x3e
je 0x18002d7fb
xor r10d, r10d
cmp eax, 0x3e
jne 0x18002da1b
mov dword [rbp - 0x80], 1
mov dword [rsp + 0x68], r10d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
mov dword [rbp + 0xf8], eax
jmp 0x18002da1b
lea rax, [rbp + 0x3f0]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18002d810
mov qword [rbp - 0x38], rsi
xor r10d, r10d
jmp 0x18002da1b
xor r10d, r10d
mov r12d, r10d
jmp 0x18002da1b
xor r10d, r10d
mov word [rbp + 0x444], r10w
mov al, 1
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x48], al
jmp 0x18002da1b
mov dword [rbp + 0x440], 0x640065
xor r10d, r10d
jmp 0x18002da1b
mov qword [rbp - 0x58], 0
mov r8d, dword [rbp - 0x80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
xor r10d, r10d
jmp 0x18002da1b
mov eax, r14d
sub eax, 0x56e
je 0x18002d9e9
sub eax, 0x3e
je 0x18002d8b6
sub eax, 0x3e
je 0x18002d8a6
cmp eax, 0x3e
je case.0x18002dcad.12
xor r10d, r10d
jmp 0x18002da1b
mov dword [rsp + 0x78], 1
xor r10d, r10d
jmp 0x18002da1b
xor edx, edx
mov ecx, edx
movzx eax, byte [rsp + 0x48]
cmp dword [rbp - 0x70], edx
cmove ecx, eax
mov byte [rsp + 0x48], cl
mov eax, dword [rsp + 0x58]
test al, al
je 0x18002d983
mov esi, 0x122
nop word [rax + rax]
cmp esi, 0x122
je 0x18002d949
cmp esi, 0x2c2e
jne 0x18002d966
test r15, r15
jne 0x18002d906
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov dword [rsp + 0x58], eax
jmp 0x18002d966
test al, al
je 0x18002d966
mov edi, 0x37
nop
mov eax, edi
sub eax, 0x37
je 0x18002d930
cmp eax, 1
jne 0x18002d940
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18002d940
lea rdx, [rbp + 0xe0]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc edi
cmp edi, 0x39
jb 0x18002d910
jmp 0x18002d962
mov r8d, 0xf01ff
lea rdx, [rbp + 0x410]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov r15, rax
mov eax, dword [rsp + 0x58]
add esi, 0x2b0c
cmp esi, 0x5618
jbe 0x18002d8e0
mov rsi, qword [rbp - 0x38]
movzx ecx, byte [rsp + 0x48]
xor edx, edx
test cl, cl
je 0x18002d9e4
mov edi, 0xc2
nop dword [rax]
mov eax, edi
sub eax, 0xc2
je 0x18002d9bc
cmp eax, 1
jne 0x18002d9d5
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18002d9ac
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18002d9d5
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18002d9d5
mov qword [rbp - 0x68], rdx
lea r8, [rbp - 0x68]
mov edx, esi
lea rcx, [rbp + 0x3f0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rbp - 0x70], eax
inc edi
cmp edi, 0xc4
mov edx, 0
jb 0x18002d990
xor r10d, r10d
jmp 0x18002da1b
lea r9, [rbp - 0x58]
lea r8, [rsp + 0x68]
mov edx, esi
lea rcx, [rbp + 0x3f0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x70], eax
mov ecx, dword [rsp + 0x58]
movzx ecx, cl
test r12, r12
mov r10d, 0
cmove ecx, r10d
mov dword [rsp + 0x58], ecx
add r14d, 0x3e
cmp r14d, 0x666
jb 0x18002d5a0
mov r14, qword [rbp - 0x30]
jmp 0x18002d2d5
mov rcx, qword [rbp - 0x60]
cmp rcx, 0x80
jb 0x18002daff
mov r9d, 0xe2
nop dword [rax]
mov eax, r9d
sub eax, 0xe2
je 0x18002dadb
sub eax, 1
je 0x18002dabb
sub eax, 1
je 0x18002dab5
cmp eax, 1
jne 0x18002daea
mov r8d, r10d
test rbx, rbx
je 0x18002daea
mov rdx, r10
mov r10, qword [rbp - 0x50]
mov rcx, rdx
shr rcx, 1
movzx eax, byte [rcx + r10]
shr al, 4
mov byte [rdi + rdx], al
movzx edx, byte [rcx + r10]
and dl, 0xf
lea eax, [r8 + 1]
mov byte [rax + rdi], dl
add r8d, 2
mov edx, r8d
cmp rdx, rbx
jb 0x18002da80
mov rcx, qword [rbp - 0x60]
xor r10d, r10d
jmp 0x18002daea
inc qword [rbp - 0x50]
jmp 0x18002daea
lea rax, [rcx + 1]
mov rdx, qword [rbp - 0x18]
cmp rax, qword [rdx]
ja 0x18002dc1c
mov rax, qword [rbp - 0x48]
cmp rbx, qword [rax]
jae 0x18002d560
jmp 0x18002daea
lea rbx, [rcx - 0x7f]
lea rcx, [rbx + 1]
shr rcx, 1
mov qword [rbp - 0x60], rcx
inc r9d
cmp r9d, 0xe6
jb 0x18002da50
jmp 0x18002dbbd
mov edi, 0x10d
mov rsi, qword [rbp - 0x40]
nop dword [rax + rax]
cmp edi, 0x10d
jne 0x18002dba6
lea rax, [rcx + 1]
mov rdx, qword [rbp - 0x18]
cmp rax, qword [rdx]
ja 0x18002dc1c
mov dword [rsp + 0x60], 6
mov qword [rbp - 0x20], rcx
mov rax, qword [rbp - 0x48]
mov rax, qword [rax]
dec rax
mov qword [rsp + 0x70], rax
mov rdx, qword [rbp - 0x50]
inc rdx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xa7
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2e0]
lea r8, [rsp + 0x70]
mov rcx, rsi
call fcn.18005fa70
mov rbx, rax
mov qword [rsp + 0x70], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea ecx, [r9 + 0x2c]
call fcn.180055530
test eax, eax
jne 0x18002e16f
mov rcx, qword [rbp - 0x60]
add edi, 0x17
cmp edi, 0x124
jb 0x18002db10
mov r11d, dword [rsp + 0x54]
xor r10d, r10d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm0
movups xmmword [r14 + 0x20], xmm0
mov dword [r14 + 0x30], eax
mov r13d, r10d
jmp 0x18002d2da
xor r8d, r8d
mov edx, 0xc5
mov rcx, rdi
call fcn.18002e830
mov rax, qword [rbp - 0x48]
mov eax, dword [rax]
add dword [rdi + 4], eax
jmp 0x18002d2d2
mov word [rbp + 0x406], r9w
mov byte [rbp + 0x408], 0
jmp case.0x18002d2a5.62
mov word [rbp + 0x408], 0x6f
jmp case.0x18002d2a5.62
mov rbx, 0xfffffffffffffff2
jmp 0x18002e16f
mov eax, dword [rdi + 4]
mov dword [rsp + 0x78], eax
jmp case.0x18002dcad.12
movzx ebx, byte [rsp + 0x48]
mov byte [rsp + 0x41], bl
jmp 0x18002dc44
movzx ebx, byte [rsp + 0x41]
lea edx, [r11 + 0xd]
mov dword [rsp + 0x58], edx
cmp r11d, edx
jae case.0x18002dcad.12
lea edx, [r11 - 0x6c]
mov dword [rsp + 0x50], edx
mov r12d, dword [rsp + 0x68]
mov r13d, dword [rsp + 0x68]
movzx r15d, byte [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x70]
mov eax, dword [rsp + 0x58]
mov rdi, qword [rbp - 0x80]
lea r10, [0x180022320]
mov r9d, 0x1bb
cmp edx, 0xc
ja case.default.0x18002dcad
lea rcx, [0x180000000]
mov ecx, dword [rcx + rdx*4 + 0x2e7f4]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rax, [rbp + 0x80]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp]
je 0x18002dcd6
lea rcx, [rbp + 0x80]
mov qword [rax], rcx
add qword [rbp - 8], 8
jmp 0x18002dce8
lea r8, [rsp + 0x70]
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x10]
call fcn.18001a770
mov eax, dword [0x1800702b0]
mov dword [rsp + 0x68], eax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x68]
xor edx, edx
mov ecx, 0xde
call fcn.18004dc70
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
mov word [rbp + 0x290], r9w
xor r9d, r9d
xor edx, edx
mov r8d, 0xf6
lea rcx, [rbp + 0x270]
call fcn.18003a140
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
mov r8d, 0xc2
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.180035700
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x70], rax
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp]
je 0x18002ddac
lea rax, [rbp + 0xb0]
mov qword [rdx], rax
add qword [rbp - 8], 8
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.18001a770
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
mov qword [rsp + 0x70], r10
xor r9d, r9d
xor edx, edx
mov r8d, 0x89
lea rcx, [rsp + 0x70]
call fcn.18001ec90
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x40]
test r12d, r12d
cmove ecx, eax
movzx r8d, cl
mov byte [rsp + 0x40], cl
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
jmp 0x18002e4d8
lea r9, [rbp + 0x40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r13d, eax
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
lea rax, [rbp - 0x10]
mov qword [rbp + 0x3f0], rax
mov eax, dword [0x1800702b0]
mov dword [rbp + 0x3f8], eax
mov eax, dword [0x1800702b4]
mov dword [rbp + 0x3fc], eax
movaps xmm0, xmmword [rbp + 0x3f0]
movdqa xmmword [rbp + 0x70], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x70]
lea r8, [0x180038120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x80], rax
cmp rax, 0
jne 0x18002e3f8
mov edi, 0x46
nop word [rax + rax]
cmp edi, 0x44c
ja 0x18002e01b
je 0x18002dff3
cmp edi, 0x249
ja 0x18002df81
je 0x18002df66
mov eax, edi
sub eax, 0x46
je 0x18002df41
sub eax, 0x67
je 0x18002df32
sub eax, 0x67
je 0x18002df21
sub eax, 0x67
je 0x18002df08
cmp eax, 0x67
jne 0x18002e295
mov eax, 0x65
mov word [rbp + 0x428], ax
mov dword [rbp + 0x42a], 0x6f0046
mov dword [rbp + 0x42e], 0x410072
jmp 0x18002e295
mov dword [rbp + 0x420], 0x720063
mov dword [rbp + 0x424], 0x620069
jmp 0x18002e295
mov eax, 0x73
mov word [rbp + 0x41e], ax
jmp 0x18002e295
mov dword [rbp + 0x41a], 0x620075
jmp 0x18002e295
mov dword [rbp + 0x410], 0x6d0065
mov dword [rbp + 0x414], 0x3a0069
mov eax, 0x53
mov word [rbp + 0x418], ax
jmp 0x18002e295
mov dword [rbp + 0x432], 0x65006c
mov eax, 0x72
mov word [rbp + 0x436], ax
jmp 0x18002e295
mov eax, edi
sub eax, 0x2b0
je 0x18002dfe2
sub eax, 0x67
je 0x18002dfc7
sub eax, 0x67
je 0x18002dfac
cmp eax, 0x67
jne 0x18002e295
mov dword [rbp + 0x446], 0x3f0073
jmp 0x18002e295
mov eax, 0x70
mov word [rbp + 0x440], ax
mov dword [rbp + 0x442], 0x6e006f
jmp 0x18002e295
mov eax, 0x52
mov word [rbp + 0x43a], ax
mov dword [rbp + 0x43c], 0x730065
jmp 0x18002e295
mov eax, 0x74
mov word [rbp + 0x438], ax
jmp 0x18002e295
xor eax, eax
mov word [rbp + 0x44a], ax
mov eax, dword [0x180069448]
mov dword [rbp + 0x450], eax
movzx eax, word [0x18006944c]
mov word [rbp + 0x454], ax
jmp 0x18002e295
cmp edi, 0x64f
ja 0x18002e13a
je 0x18002e0f7
mov eax, edi
sub eax, 0x4b3
je 0x18002e0ca
sub eax, 0x67
je 0x18002e0ab
sub eax, 0x67
je 0x18002e085
cmp eax, 0x67
jne 0x18002e295
lea r8d, [rax - 0x65]
lea rdx, [0x180069444]
lea rcx, [rbp + 0x470]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
movabs rax, 0x7900790061
mov qword [rbp + 0x472], rax
mov dword [rbp + 0x478], 0x2c
jmp 0x18002e295
movsd xmm0, qword [str.teCu]
movsd qword [rbp + 0x462], xmm0
movabs rax, 0x6300690062
mov qword [rbp + 0x46a], rax
jmp 0x18002e295
mov r8d, 5
lea rdx, [0x180069410]
lea rcx, [rbp + 0x450]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18002e295
mov eax, 0x74
mov dword [rbp + 0x454], eax
lea rcx, [rbp + 0x450]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x18002e0e0
mov eax, dword [0x18006940c]
mov dword [rcx], eax
jmp 0x18002e295
lea rax, [rbp + 0x450]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18002e102
movsd xmm0, qword [0x180069420]
movsd qword [rax], xmm0
mov r8d, 6
lea rdx, str.b1y__
lea rcx, [rbp + 0x480]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r15b, 1
jmp 0x18002e295
mov eax, edi
sub eax, 0x6b6
je 0x18002e271
sub eax, 0x67
je 0x18002e202
sub eax, 0x67
je 0x18002e1e6
cmp eax, 0x67
jne 0x18002e295
mov dword [rsp + 0x78], 1
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp + 0x178]
call fcn.18001c7f0
mov rdi, qword [rbp + 0x160]
test rdi, rdi
je 0x18002e4f8
mov rsi, qword [rbp + 0x168]
cmp rdi, rsi
je 0x18002e1af
mov rcx, rdi
call fcn.180061610
add rdi, 0x20
cmp rdi, rsi
jne 0x18002e197
mov rdi, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
sub r8, rdi
sar r8, 5
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.1800635c0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xor r14d, r14d
mov qword [rbp + 0x170], r14
jmp 0x18002e4fb
xor r8d, r8d
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x18002e295
test r15b, r15b
je 0x18002e295
mov ebx, 0x45
mov eax, ebx
sub eax, 0x45
je 0x18002e260
sub eax, 1
je 0x18002e24d
cmp eax, 1
jne 0x18002e268
mov dword [rbp + 0xe0], 0x20
lea r9, [rbp + 0xe0]
lea r8, [rbp - 0x20]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymGetSymFromAddr64]
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymCleanup]
jmp 0x18002e268
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
jmp 0x18002e268
xor eax, eax
mov esi, eax
mov qword [rbp - 0x20], rax
inc ebx
cmp ebx, 0x48
jb 0x18002e210
jmp 0x18002e295
mov r14, 0xffffffffffffffff
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.dbghelp.dll_SymInitialize]
movzx r15d, r15b
test eax, eax
mov eax, 0
cmove r15d, eax
add edi, 0x67
cmp edi, 0x852
jb 0x18002dea0
mov edx, dword [rsp + 0x50]
mov rdi, qword [rbp - 0x80]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d3
xor r9d, r9d
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x2a0]
mov ecx, 0xad
call fcn.180035350
mov eax, 0x1bb
mov word [rsp + 0x48], ax
lea r9, [rbp + 0xb0]
lea r8, [0x180070268]
lea rdx, [rsp + 0x48]
mov ecx, 0xc4
call fcn.180046330
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov word [rsp + 0x48], r9w
lea r9d, [rax + 0x4a]
lea r8, [rbp + 0x80]
lea rdx, [rsp + 0x48]
lea rcx, [0x180070288]
call fcn.180039690
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, 0xfc
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [0x180070200]
call fcn.18001fe20
xor r9d, r9d
lea r8, [rbp + 0x100]
xor edx, edx
mov ecx, 0xbb
call fcn.18005bcc0
test bl, bl
je 0x18002e3fb
mov ebx, 0xac
xor edi, edi
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xac
je 0x18002e3b4
cmp eax, 1
jne 0x18002e3d6
mov rcx, qword [rbp - 0x58]
jmp 0x18002e3cc
mov qword [rbp - 0x58], rdi
lea r8, [rbp - 0x58]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov r13d, eax
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18002e3d6
call sub.RPCRT4.dll_MesHandleFree
inc ebx
cmp ebx, 0xae
jb 0x18002e3a0
mov rdi, qword [rbp - 0x80]
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d3
mov rdi, rax
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov r12d, eax
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, eax
movzx eax, bl
test r13d, r13d
cmove ecx, eax
movzx ebx, cl
mov byte [rsp + 0x41], cl
mov edx, dword [rsp + 0x50]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
jmp 0x18002e4d8
test r8b, r8b
je 0x18002e4cd
mov ebx, 0xf6
xor edi, edi
mov eax, ebx
sub eax, 0xf6
je 0x18002e49c
cmp eax, 1
jne 0x18002e4b0
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x18002e48c
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18002e4b0
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18002e4b0
mov qword [rbp - 0x68], rdi
lea r8, [rbp - 0x68]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov r12d, eax
inc ebx
cmp ebx, 0xf8
jb 0x18002e470
mov edx, dword [rsp + 0x50]
mov rdi, qword [rbp - 0x80]
mov r11d, dword [rsp + 0x54]
movzx r8d, byte [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x78], eax
movzx ebx, byte [rsp + 0x41]
mov eax, dword [rsp + 0x58]
inc r11d
mov dword [rsp + 0x54], r11d
inc edx
mov dword [rsp + 0x50], edx
cmp r11d, eax
jae case.0x18002dcad.12
jmp 0x18002dc7f
xor r14d, r14d
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x18002e533
mov r8, qword [rbp + 0x158]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x148]
call fcn.180063520
mov qword [rbp + 0x148], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp + 0x108]
call fcn.18001c720
nop
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x18002e5a1
mov rsi, qword [rbp + 0x10]
cmp rdi, rsi
je 0x18002e567
mov rcx, rdi
call fcn.18001c030
add rdi, 0x28
cmp rdi, rsi
jne 0x18002e552
mov rdi, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.180063570
mov qword [rbp + 8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x18002e5ca
mov r8, qword [rbp]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x10]
call fcn.1800634d0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov rdx, qword [rbp + 0xa2]
cmp rdx, 0x10
jb 0x18002e60e
inc rdx
mov rcx, qword [rbp + 0x8a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e609
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002e609
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800639bc
movdqa xmm0, xmmword [0x18006a460]
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], 0
mov rdx, qword [rbp + 0xd2]
cmp rdx, 0x10
jb 0x18002e669
inc rdx
mov rcx, qword [rbp + 0xba]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e664
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002e664
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800639bc
movdqa xmm0, xmmword [0x18006a460]
movdqu xmmword [rbp + 0xca], xmm0
mov byte [rbp + 0xba], 0
lea rcx, [rbp + 0x2a0]
call fcn.18001c390
nop
lea rcx, [rbp + 0x230]
call fcn.18001c440
mov rax, rbx
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.1800643d0
mov rbx, qword [rsp + 0x5e8]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret