Function at 0x18001c0a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x1800c17f8]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov r14, r9
mov r15d, r8d
mov dword [rsp + 0x40], r8d
mov rdi, rdx
mov rsi, rcx
movdqa xmm0, xmmword [0x1800bba00]
movdqa xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
xor ecx, ecx
mov qword [rbp + 0x90], rcx
mov word [rbp + 0x98], cx
movdqu xmmword [rbp + 0xaa], xmm0
mov byte [rbp + 0x9a], cl
mov qword [rbp + 0x60], rcx
mov word [rbp + 0x68], cx
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rcx
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd0], rcx
mov ecx, 0x30
call fcn.18004cb9c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xc8], rax
xor r8d, r8d
mov qword [rbp + 0xd8], r8
xorps xmm2, xmm2
movsd qword [rbp + 0xe0], xmm2
mov qword [rbp + 0xe8], r8
mov dword [rbp + 0xf0], 1
mov qword [rbp + 0xf8], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm1
movdqa xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r8
mov qword [rbp + 0x138], 0xffffffffffffffff
mov dword [rbp + 0x140], r8d
xor eax, eax
movups xmmword [rbp + 0x148], xmm0
movups xmmword [rbp + 0x158], xmm0
movups xmmword [rbp + 0x168], xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], rax
movdqa xmm0, xmmword [0x1800bba00]
movdqa xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x190], al
mov word [rbp + 0x1b0], r8w
mov dword [rbp + 0x1b4], r8d
mov qword [rbp + 0x1b8], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1c0], xmm0
movsd qword [rbp + 0x1d0], xmm2
mov byte [rbp + 0x1d8], al
mov qword [rbp + 0x1dc], r8
mov ecx, r15d
imul edx, r15d, 0x384
mov rbx, qword [rsp + 0x68]
cmp r15d, edx
ja 0x18001c41b
lea r10d, [r8 + 0x6d]
lea r11d, [r8 + 0x6c]
lea r8d, [rax + 0x65]
lea r9d, [rax + 0x63]
lea r13d, [rax + 0x6f]
mov r12d, 0x7361
mov eax, 0x61
cmp ecx, 0x48bc
ja 0x18001c359
je 0x18001c34c
mov eax, ecx
sub eax, 0x8f
je 0x18001c493
sub eax, 0x14
je 0x18001c33f
sub eax, 0x52
je 0x18001c314
sub eax, 0x2f6f
je 0x18001ce01
cmp eax, 0x390
jne 0x18001c40a
mov rbx, qword [rdi]
add rbx, 3
and rbx, 0xfffffffffffffffc
jmp 0x18001ce01
mov word [rbp + 0x2a0], r10w
mov eax, 0x69
mov word [rbp + 0x2a1], ax
mov dword [rbp + 0x2a2], 0x6c6464
mov word [rbp + 0x2a5], r8w
jmp 0x18001c40a
mov rbx, qword [rdi]
mov qword [rsp + 0x68], rbx
jmp 0x18001c40a
mov word [rbp + 0x2a6], r8w
jmp 0x18001c40a
cmp ecx, 0x9083
je 0x18001c402
cmp ecx, 0xd84a
je 0x18001c3ea
cmp ecx, 0x12011
je 0x18001c3c0
cmp ecx, 0x167d8
je 0x18001c3a3
cmp ecx, 0x1af9f
jne 0x18001c40a
mov word [rbp + 0x2b8], r9w
mov word [rbp + 0x2b9], r13w
mov word [rbp + 0x2ba], r10w
jmp 0x18001c40a
mov word [rbp + 0x2b5], ax
mov word [rbp + 0x2b6], r11w
mov eax, 0x2e
mov word [rbp + 0x2b7], ax
jmp 0x18001c40a
mov eax, 0x69
mov word [rbp + 0x2ad], ax
mov word [rbp + 0x2ae], r9w
mov dword [rbp + 0x2af], 0x706c61
mov dword [rbp + 0x2b2], 0x74726f
jmp 0x18001c40a
mov eax, 0x74
mov word [rbp + 0x2a9], ax
mov dword [rbp + 0x2aa], 0x64656d
jmp 0x18001c40a
mov word [rbp + 0x2a7], r12w
imul eax, r15d, 0x4b
add ecx, eax
cmp ecx, edx
jbe 0x18001c2c4
xor r8d, r8d
lea eax, [r15 + 0xc]
mov dword [rsp + 0x4c], eax
cmp r15d, eax
jae 0x18001ce01
lea r14d, [r15 - 0xf5]
mov dword [rsp + 0x50], r14d
lea rdx, [0x180000000]
mov r10d, 0x66
lea r11d, [r10 - 0x39]
mov r9d, 0x6e69
mov ebx, dword [rsp + 0x58]
mov qword [rbp - 0x60], rbx
mov r15d, dword [rsp + 0x58]
movzx r13d, byte [rsp + 0x49]
mov esi, dword [rsp + 0x58]
mov r12d, dword [rsp + 0x58]
mov qword [rbp + 0x30], r12
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x4c]
mov edi, 0x6174
cmp r14d, 0xb
ja case.default.0x18001c491
mov ecx, dword [rdx + r14*4 + 0x1d0a8]
add rcx, rdx
jmp rcx
mov rdx, qword [rdi]
test rdx, rdx
je 0x18001ce01
mov r9, r14
mov r8, rsi
mov ecx, 0x9d
call fcn.18000e060
jmp 0x18001ce01
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rax, [rbp + 0x2a0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18001c4d0
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x1f0]
call fcn.180010fc0
mov r8d, 1
lea rdx, [0x1800b6e04]
lea rcx, [rbp + 0x210]
call fcn.180010fc0
mov byte [rsp + 0x46], 1
xor r8d, r8d
lea rdx, [0x180000000]
mov r9d, 0x6e69
mov r10d, 0x66
lea r11d, [r10 - 0x39]
jmp 0x18001cdd9
mov edi, 0x1bb
mov word [rsp + 0x60], di
lea r9, [rsp + 0x60]
lea r8, [rbp + 0x90]
mov edx, 0xa6
lea rcx, [0x1800c0158]
call fcn.1800354e0
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp + 0x38], rbx
mov word [rsp + 0x60], di
mov qword [rsp + 0x30], rbx
lea rax, [0x1800c0178]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xfe
lea r9, [rbp + 0x60]
xor r8d, r8d
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.180024ae0
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 0x69]
lea r8, [rbp - 0x50]
xor edx, edx
xor ecx, ecx
call fcn.18002b240
jmp 0x18001c50b
lea rax, [rbp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x18001c5ce
lea rcx, [rbp + 0x90]
mov qword [rax], rcx
add qword [rbp - 0x48], 8
jmp 0x18001c5e0
lea r8, [rsp + 0x50]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.1800016e0
lea r9, [rbp - 0x68]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rsp + 0x70], eax
lea r9, [rbp + 0x38]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x78], eax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x50], rax
mov rdx, qword [rbp - 0x48]
cmp rdx, qword [rbp - 0x40]
je 0x18001c62b
lea rax, [rbp + 0x60]
mov qword [rdx], rax
add qword [rbp - 0x48], 8
jmp 0x18001c50b
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.1800016e0
jmp 0x18001c50b
mov eax, dword [0x1800c01a0]
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xfa
lea r8, [rbp - 0x50]
xor edx, edx
xor ecx, ecx
call fcn.180034250
lea rax, [rbp - 0x50]
mov qword [rbp + 0x40], rax
mov eax, dword [0x1800c01a0]
mov dword [rbp + 0x48], eax
mov eax, dword [0x1800c01a4]
mov dword [rbp + 0x4c], eax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x50], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x50]
lea r8, [0x18000c1c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x20], rax
jmp 0x18001c50b
cmp byte [rsp + 0x46], 0
je 0x18001c6e9
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x68]
call sub.RPCRT4.dll_MesIncrementalHandleReset
mov dword [rsp + 0x70], eax
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x18001c6e9
call sub.RPCRT4.dll_MesHandleFree
mov dword [rsp + 0x70], eax
cmp byte [rsp + 0x48], 0
je 0x18001c727
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rbp - 0x78], eax
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x18001c718
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001c727
call sub.RPCRT4.dll_MesHandleFree
xor r8d, r8d
mov dword [rsp + 0x68], r8d
jmp 0x18001c50e
lea r9, [0x1800c00f0]
mov r8d, 0x8d
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xc0]
call fcn.18004a740
lea rdx, [rbp + 0xc0]
mov ecx, 0x104
call fcn.180017370
jmp 0x18001c50b
mov eax, 0x1bb
mov word [rbp + 0x250], ax
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x230]
xor r8d, r8d
xor edx, edx
mov ecx, 0xaa
call fcn.180045db0
lea r8, [rbp + 0x1f0]
mov edx, 0x13a
lea rcx, [rbp + 0x260]
call fcn.180008030
jmp 0x18001c50b
mov rax, qword [rbp + 0x20]
test rax, rax
jne 0x18001cbac
mov r14d, r8d
mov dword [rsp + 0x60], r8d
cmp r14d, 7
ja case.default.0x18001c7d7
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0x1d0d8]
add rcx, rdx
jmp rcx
mov byte [rsp + 0x44], 1
mov byte [rsp + 0x45], 1
jmp case.default.0x18001c7d7
lea rax, [rbp + 0x2c0]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x18001c7f6
mov qword [rbp - 0x60], rbx
mov dword [rbp - 0x74], r8d
jmp case.default.0x18001c7d7
mov word [rbp + 0x2c0], r10w
jmp case.default.0x18001c7d7
movups xmm0, xmmword [str.Kerberos_4_ticket_expired]
movups xmmword [rbp + 0x300], xmm0
movsd xmm1, qword [0x1800b6e18]
movsd qword [rbp + 0x310], xmm1
movzx eax, word [0x1800b6e20]
mov word [rbp + 0x318], ax
lea rax, [rbp + 0x300]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x18001c853
jmp case.default.0x18001c7d7
mov dword [rbp + 0x2c1], 0x706d756a
mov word [rbp + 0x2c5], r11w
mov word [rbp + 0x2c6], di
mov dword [rbp + 0x2c8], 0x73656c62
mov byte [rbp + 0x2cc], 0
jmp case.default.0x18001c7d7
mov dword [rbp - 0x70], r8d
mov qword [rbp], r8
mov qword [rbp + 0x18], r8
lea r9, [rbp]
lea r8, [rbp - 0x74]
mov edx, r15d
lea rcx, [rbp + 0x300]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rsp + 0x74], eax
lea r9, [rbp + 0x18]
lea r8, [rbp - 0x70]
mov edx, ebx
lea rcx, [rbp + 0x2c0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x80], eax
jmp 0x18001cb6f
mov ecx, r8d
movzx eax, byte [rsp + 0x44]
cmp dword [rsp + 0x74], 0
cmove ecx, eax
mov byte [rsp + 0x44], cl
mov ecx, r8d
movzx eax, byte [rsp + 0x45]
cmp dword [rbp - 0x80], 0
cmove ecx, eax
mov byte [rsp + 0x45], cl
cmp byte [rsp + 0x44], 0
je 0x18001cb2b
mov ebx, 0xf
lea edi, [rbx + 1]
mov r14d, dword [rsp + 0x78]
xor r12d, r12d
nop dword [rax + rax]
cmp ebx, 0xf
ja case.default.0x18001c935
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0x1d0f8]
add rcx, rdx
jmp rcx
lea r8, [rbp + 8]
mov edx, r15d
lea rcx, [rbp + 0x300]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rsp + 0x74], eax
jmp 0x18001caf3
mov rcx, qword [rbp + 8]
test rcx, rcx
je case.default.0x18001c935
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001caf3
mov rcx, qword [rbp]
test rcx, rcx
je case.default.0x18001c935
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001caf3
mov byte [rbp + 0x2e5], r12b
mov r8d, 3
lea rdx, [0x1800b6e41]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov word [rbp + 0x2e8], 0x30
jmp 0x18001caf3
mov ecx, r12d
movzx eax, r13b
test r14d, r14d
cmove ecx, eax
movzx r13d, cl
jmp case.default.0x18001c935
lea rax, [rbp + 0x2d0]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], r12b
jne 0x18001c9d4
jmp case.default.0x18001c935
mov byte [rbp + 0x2d6], r12b
jmp case.default.0x18001c935
mov r8d, 5
lea rdx, [0x1800b6e5d]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 4
lea rdx, [0x1800b6e7c]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x2e0], 0x72
mov dword [rbp + 0x2e1], 0x5f70756f
jmp 0x18001caf3
mov word [rbp + 0x2d6], 0x64
jmp case.default.0x18001c935
mov word [rbp + 0x2d0], r9w
mov dword [rbp + 0x2d2], 0x69672074
jmp case.default.0x18001c935
test r13b, r13b
je case.default.0x18001c935
mov qword [rsp + 0x78], r12
lea r8, [rsp + 0x78]
mov edx, esi
lea rcx, [rbp + 0x2d0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov r14d, eax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x18001ca8f
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18001caf3
call sub.RPCRT4.dll_MesHandleFree
jmp 0x18001caf3
mov qword [rbp + 8], r12
jmp case.default.0x18001c935
mov qword [rbp + 0x10], r12
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x6c]
mov edx, esi
lea rcx, [rbp + 0x2d0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r14d, eax
jmp 0x18001caf3
mov word [rbp + 0x2ea], 0x3b
mov r13b, 1
jmp case.default.0x18001c935
mov dword [rbp - 0x6c], r12d
jmp case.default.0x18001c935
mov r8d, 1
lea rdx, [0x1800b6e9b]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
lea rdx, [0x180000000]
mov r9d, 0x6e69
dec ebx
sub rdi, 1
jne 0x18001c920
mov dword [rsp + 0x78], r14d
mov r14d, dword [rsp + 0x60]
mov r12, qword [rbp + 0x30]
mov rbx, qword [rbp - 0x60]
movzx ecx, byte [rsp + 0x45]
xor r8d, r8d
mov edi, 0x6174
test cl, cl
je 0x18001cb67
mov qword [rsp + 0x60], r8
lea r8, [rsp + 0x60]
mov edx, ebx
lea rcx, [rbp + 0x2c0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov dword [rbp - 0x80], eax
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x18001cb58
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18001cb67
call sub.RPCRT4.dll_MesHandleFree
mov dword [rsp + 0x68], 1
mov r11d, 0x2d
lea r10d, [r11 + 0x39]
mov r9d, 0x6e69
lea rdx, [0x180000000]
xor r8d, r8d
inc r14d
mov dword [rsp + 0x60], r14d
lea eax, [r14 + 0x127]
cmp eax, 0x12f
jb 0x18001c7c0
mov r14d, dword [rsp + 0x50]
mov rax, qword [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov ecx, r8d
movzx eax, byte [rsp + 0x46]
cmp dword [rsp + 0x70], r8d
cmove ecx, eax
mov byte [rsp + 0x46], cl
jmp 0x18001c50e
xor r8d, r8d
mov edx, 0xef
lea rcx, [0x1800c00f8]
call fcn.180026090
test al, al
jne 0x18001c50b
mov edi, 0x2f
mov eax, edi
sub eax, 0x2f
je 0x18001cd46
sub eax, 1
je 0x18001cd0b
sub eax, 1
je 0x18001cce7
sub eax, 1
je 0x18001cc25
cmp eax, 1
je case.0x18001c7d7.7
xor r8d, r8d
jmp 0x18001cd8e
lea r9, [rbp + 0x28]
lea r8, [rsp + 0x58]
mov edx, r12d
lea rcx, [rbp + 0x2f0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov ebx, eax
cmp byte [rsp + 0x47], 0
je 0x18001cc7d
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rbp - 0x7c], eax
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x18001cc6e
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001cc7d
call sub.RPCRT4.dll_MesHandleFree
test ebx, ebx
je 0x18001cc96
mov byte [rsp + 0x49], 0
mov dword [rsp + 0x68], 1
xor r8d, r8d
jmp 0x18001cd8e
cmp byte [rsp + 0x49], 0
je 0x18001ccd7
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov edx, r12d
lea rcx, [rbp + 0x2f0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x18001ccc8
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18001ccd7
call sub.RPCRT4.dll_MesHandleFree
mov dword [rsp + 0x68], 1
xor r8d, r8d
jmp 0x18001cd8e
xor r8d, r8d
mov dword [rsp + 0x58], r8d
mov qword [rbp + 0x28], r8
mov ecx, r8d
movzx eax, byte [rsp + 0x47]
cmp dword [rbp - 0x7c], r8d
cmove ecx, eax
mov byte [rsp + 0x47], cl
jmp 0x18001cd8e
lea rax, [rbp + 0x2f0]
mov r12, 0xffffffffffffffff
nop dword [rax]
inc r12
cmp byte [rax + r12], 0
jne 0x18001cd20
mov qword [rbp + 0x30], r12
lea r9, [rbp - 0x58]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x7c], eax
xor r8d, r8d
jmp 0x18001cd8e
mov byte [rsp + 0x49], 1
mov byte [rsp + 0x47], 1
movsd xmm0, qword [str.APPSIG_INVALID]
movsd qword [rbp + 0x2f0], xmm0
mov eax, dword [0x1800b6eb0]
mov dword [rbp + 0x2f8], eax
movzx eax, word [0x1800b6eb4]
mov word [rbp + 0x2fc], ax
movzx eax, byte [0x1800b6eb6]
mov byte [rbp + 0x2fe], al
xor r8d, r8d
mov qword [rbp - 0x58], r8
inc edi
cmp edi, 0x34
jb 0x18001cbf2
jmp 0x18001c50e
lea rax, [0x180005d00]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov ecx, 0xba
call fcn.180003ea0
xor r8d, r8d
mov ecx, r8d
movzx eax, byte [rsp + 0x48]
cmp dword [rbp - 0x78], r8d
cmove ecx, eax
mov byte [rsp + 0x48], cl
jmp 0x18001c50e
mov byte [rsp + 0x48], 1
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
inc r14d
mov dword [rsp + 0x50], r14d
cmp eax, ecx
jae case.0x18001c7d7.7
mov rbx, qword [rbp - 0x60]
jmp 0x18001c477
mov rbx, qword [rsp + 0x68]
lea rcx, [rbp + 0x138]
call fcn.180003760
mov rdi, qword [rbp + 0x120]
test rdi, rdi
je 0x18001ce8b
mov rsi, qword [rbp + 0x128]
cmp rdi, rsi
je 0x18001ce3d
mov rcx, rdi
call fcn.18000f720
add rdi, 0x20
cmp rdi, rsi
jne 0x18001ce25
mov rdi, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x130]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001ce6c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001cec9
mov rcx, rdi
call fcn.18004cbd8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
xor r14d, r14d
mov qword [rbp + 0x130], r14
jmp 0x18001ce8e
xor r14d, r14d
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x18001cee7
mov rdx, qword [rbp + 0x118]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ced0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ced0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004cbd8
mov qword [rbp + 0x108], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0xc8]
call fcn.180003690
nop
mov rdi, qword [rbp - 0x38]
test rdi, rdi
je 0x18001cf8b
mov rsi, qword [rbp - 0x30]
cmp rdi, rsi
je 0x18001cf25
nop word [rax + rax]
mov rcx, rdi
call fcn.180002fa0
add rdi, 0x28
cmp rdi, rsi
jne 0x18001cf10
mov rdi, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18001cf77
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001cf77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18004cbd8
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x18001cfb4
mov r8, qword [rbp - 0x40]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x50]
call fcn.1800145d0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp + 0x82]
cmp rdx, 0x10
jb 0x18001cff5
inc rdx
mov rcx, qword [rbp + 0x6a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cff0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001cff0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004cbd8
movdqa xmm0, xmmword [0x1800bba00]
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], 0
mov rdx, qword [rbp + 0xb2]
cmp rdx, 0x10
jb 0x18001d04a
inc rdx
mov rcx, qword [rbp + 0x9a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d045
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001d045
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004cbd8
movdqa xmm0, xmmword [0x1800bba00]
movdqu xmmword [rbp + 0xaa], xmm0
mov byte [rbp + 0x9a], 0
lea rcx, [rbp + 0x260]
call fcn.180003300
nop
lea rcx, [rbp + 0x1f0]
call fcn.1800033b0
mov rax, rbx
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.18004d0f0
mov rbx, qword [rsp + 0x480]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret