Function at 0x18004bf5c
Capabilities:
Check for peb beingdebugged flag
Link many functions at runtime
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e8
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov rax, qword [rsp + 0x560]
xor esi, esi
mov dword [rbp + 8], r9d
mov r12, r8
mov qword [rbp + 0xf0], rax
mov r14, rdx
mov qword [rbp + 0x48], rsi
mov edi, esi
mov qword [rbp + 0x70], rsi
mov r15d, esi
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x38], rsi
mov dword [rbp + 0x28], esi
mov dword [rbp + 0x24], esi
mov qword [rbp + 0x68], rsi
mov dword [rbp + 0x40], esi
mov qword [rbp + 0xb8], rsi
mov dword [rbp], esi
mov dword [rbp + 0x80], esi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0xa8], rsi
mov dword [rbp + 0x128], 0xf750e6c3
mov dword [rbp + 0x12c], 0x11d138ee
mov dword [rbp + 0x130], 0xc000e585
mov dword [rbp + 0x134], 0xee95c24f
test r9d, 0xfffffffe
jne 0x18004c0ad
movzx ebx, cl
lea edx, [rsi + 2]
mov eax, ebx
mov dword [rbp + 0x2c], ebx
sub eax, 1
je 0x18004c3ec
sub eax, 1
je 0x18004c37b
sub eax, edx
je 0x18004c37b
sub eax, 4
je 0x18004c095
sub eax, 8
je 0x18004c079
cmp eax, 0x10
jne 0x18004c0ad
test r14, r14
jne 0x18004c0ad
test r8, r8
jne 0x18004c0ad
lea r13, str.OnUserProfileChanged
jmp 0x18004c4a4
test r14, r14
jne 0x18004c0ad
test r12, r12
je 0x18004c0ad
cmp word [r8], si
je 0x18004c0ad
lea r13, str.OnMachineUILanguageClear
jmp 0x18004c462
test r12, r12
jne 0x18004c0ad
test r14, r14
je 0x18004c2ae
cmp word [r14], si
jne 0x18004c36f
mov ebx, 0xc000000d
xor r8d, r8d
mov eax, 1
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x18004c0c8
mov dword [rcx], eax
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x18004c0ea
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x18004c106
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0x38], r8
test r15, r15
je 0x18004c12c
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r8d, r8d
mov rax, qword [rbp + 0x68]
test rax, rax
je 0x18004c156
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r8d, r8d
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x18004c18d
cmp rax, r14
je 0x18004c18d
mov rcx, qword gs:[0x60]
cmp rdi, rax
cmove rdi, r8
mov r8, qword [rbp + 0x48]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r8d, r8d
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x18004c1c4
cmp rax, r14
je 0x18004c1c4
mov rcx, qword gs:[0x60]
cmp rdi, rax
cmove rdi, r8
mov r8, qword [rbp + 0x50]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r8d, r8d
mov rax, qword [rbp + 0x70]
test rax, rax
je 0x18004c1fb
cmp rax, r12
je 0x18004c1fb
mov rcx, qword gs:[0x60]
cmp rdi, rax
cmove rdi, r8
mov r8, qword [rbp + 0x70]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
xor r8d, r8d
mov rax, qword [rbp + 0x78]
test rax, rax
je 0x18004c22f
cmp rax, r12
je 0x18004c22f
mov rcx, qword gs:[0x60]
cmp rdi, rax
cmove rdi, r8
mov r8, qword [rbp + 0x78]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test rdi, rdi
je 0x18004c252
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x18004c26d
mov rax, qword [rbp + 0xc8]
xor edx, edx
call qword [case.0x1800532bc.0]
mov rax, qword [rbp + 0xa0]
test rax, rax
je 0x18004c288
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.180024680
add rsp, 0x4e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rbp + 0x20]
mov word [rbp + 0x20], si
call qword [sym.imp.ntdll.dll_NtQueryInstallUILanguage]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18004c0b2
mov rcx, qword gs:[0x60]
mov edx, 8
mov r8d, 0xac
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x18004c302
mov ebx, 0xc0000017
jmp 0x18004c0b2
movzx ecx, word [rbp + 0x20]
lea rdx, [rbp + 0xe0]
mov qword [rbp + 0xe8], rax
mov dword [rbp + 0xe0], 0xaa0000
call qword [sym.imp.ntdll.dll_RtlLCIDToCultureName]
nop dword [rax + rax]
test al, al
jne 0x18004c338
mov ebx, 0xc00000e5
jmp 0x18004c0b2
mov rcx, qword [rbp + 0xe8]
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x48], rcx
call qword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18004c0b2
mov ecx, dword [rsp + 0x530]
bts ecx, 8
mov dword [rsp + 0x530], ecx
lea r13, str.OnMachineUILanguageInit
jmp 0x18004c419
test r12, r12
jne 0x18004c0ad
test r14, r14
je 0x18004c0ad
cmp word [r14], si
je 0x18004c0ad
mov rdx, r14
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea edx, [r12 + 2]
cmp word [rbp + 0x58], dx
jb 0x18004c0ad
movzx ecx, word [rbp + 0x58]
mov rax, qword [rbp + 0x60]
shr rcx, 1
cmp word [rax + rcx*2 + 2], si
jne 0x18004c0ad
mov ecx, dword [rsp + 0x530]
lea rax, str.OnUILanguageRemove
cmp ebx, edx
lea r13, str.OnUILanguageAdd
cmovne r13, rax
jmp 0x18004c419
test r14, r14
je 0x18004c0ad
test r12, r12
je 0x18004c0ad
cmp word [r14], si
je 0x18004c0ad
cmp word [r8], si
je 0x18004c0ad
lea r13, str.OnMachineUILanguageSwitch
test r14, r14
je 0x18004c462
bt ecx, 8
mov rcx, r14
jae 0x18004c43d
lea rdx, [rbp + 0x48]
mov qword [rbp + 0x50], r14
call qword [sym.imp.ntdll.dll_RtlpConvertLCIDsToCultureNames]
nop dword [rax + rax]
jmp 0x18004c451
lea rdx, [rbp + 0x50]
mov qword [rbp + 0x48], r14
call qword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18004c0b2
mov ecx, dword [rsp + 0x530]
test r12, r12
je 0x18004c4a4
bt ecx, 8
mov rcx, r12
jae 0x18004c486
lea rdx, [rbp + 0x70]
mov qword [rbp + 0x78], r12
call qword [sym.imp.ntdll.dll_RtlpConvertLCIDsToCultureNames]
nop dword [rax + rax]
jmp 0x18004c49a
lea rdx, [rbp + 0x78]
mov qword [rbp + 0x70], r12
call qword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18004c0b2
mov rsi, qword [rsp + 0x550]
xor ebx, ebx
test rsi, rsi
je 0x18004c61d
lea rdx, [0x180088668]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
test al, al
je 0x18004c61d
lea rdx, [rbp + 0xb0]
mov qword [rbp + 0xb0], rbx
mov rcx, r14
mov qword [rbp + 0x88], rbx
call fcn.18004d33c
mov r15, qword [rbp + 0xb0]
test eax, eax
js 0x18004c5c4
lea rdx, [rbp + 0x88]
mov rcx, r12
call fcn.18004d33c
xor ecx, ecx
test eax, eax
js 0x18004c5bd
lea rax, [rsp + 0x530]
or rdx, 0xffffffffffffffff
lea r8d, [rbx + 4]
mov qword [rbp + 0x230], rax
mov rax, rdx
mov qword [rbp + 0x238], r8
inc rax
cmp word [r15 + rax*2], cx
jne 0x18004c53b
mov rbx, qword [rbp + 0x88]
lea eax, [rax*2 + 2]
mov dword [rbp + 0x248], eax
mov rax, rdx
mov qword [rbp + 0x240], r15
mov dword [rbp + 0x24c], ecx
inc rax
cmp word [rbx + rax*2], cx
jne 0x18004c569
lea eax, [rax*2 + 2]
mov dword [rbp + 0x25c], ecx
mov dword [rbp + 0x258], eax
lea r9, [rbp + 0x230]
lea rax, [rbp + 8]
mov qword [rbp + 0x250], rbx
lea rdx, [0x180088668]
mov qword [rbp + 0x260], rax
mov rcx, rsi
mov qword [rbp + 0x268], r8
call qword [sym.imp.ntdll.dll_EtwEventWrite]
nop dword [rax + rax]
jmp 0x18004c5c4
mov rbx, qword [rbp + 0x88]
test r15, r15
je 0x18004c5f2
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0xb0]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rbx, qword [rbp + 0x88]
test rbx, rbx
je 0x18004c619
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x88]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov r15, qword [rbp + 0x30]
lea rcx, str.wintrust.dll
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0xa0], rax
test rax, rax
jne 0x18004c64c
mov ebx, 0xc00000e5
mov eax, r8d
jmp 0x18004c0ba
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xa0]
lea rdx, str.CryptCATAdminReleaseContext
mov rbx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0xc8], rax
test rbx, rbx
je 0x18004c63f
test rax, rax
je 0x18004c63f
lea rdx, [rbp + 0x128]
mov rax, rbx
lea rcx, [rbp + 0xa8]
call qword [case.0x1800532bc.0]
xor r8d, r8d
test eax, eax
je 0x18004c63f
lea rdx, str.RegistryMachineSystemCurrentControlSetControlMUICallbackDlls
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp + 0x58]
mov dword [rbp + 0xf8], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x108], rax
xor ebx, ebx
mov dword [rbp + 0x110], 0x40
lea r8, [rbp + 0xf8]
mov qword [rbp + 0x100], rbx
mov edx, 0x20019
lea rcx, [rbp + 0x90]
movdqu xmmword [rbp + 0x118], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
jns 0x18004c739
cmp eax, 0xc0000034
mov eax, r8d
jne 0x18004c0ba
mov ebx, r8d
jmp 0x18004c0ba
mov rcx, qword gs:[0x60]
mov eax, 0x216
mov ebx, 8
mov qword [rbp + 0x98], rax
mov r8d, eax
mov edx, ebx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, 0x20a
mov edx, ebx
mov qword [rbp + 0x30], rax
mov r15, rax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0x68], rax
test r15, r15
je 0x18004d0cd
test rax, rax
je 0x18004d0cd
mov qword [rbp + 0x18], rax
mov eax, r8d
mov dword [rbp + 0x84], eax
mov dword [rbp + 0x10], 0x2080000
lea rcx, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rbp + 0x280]
mov rcx, qword [rbp + 0x90]
mov edx, eax
mov dword [rsp + 0x20], 0x1fe
call qword [sym.imp.ntdll.dll_NtEnumerateKey]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
js 0x18004d056
mov ecx, dword [rbp + 0x28c]
lea eax, [rcx + 1]
cmp eax, 0x1e8
jbe 0x18004c814
mov ebx, 0xc0000017
jmp 0x18004d05d
mov rax, rcx
lea rdx, [rbp + 0x290]
shr rax, 1
lea rcx, [rbp + 0x58]
mov word [rbp + rax*2 + 0x290], r8w
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rax, qword [rbp + 0x90]
lea r8, [rbp + 0xf8]
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x38]
lea rax, [rbp + 0x58]
mov dword [rbp + 0xf8], 0x30
xorps xmm0, xmm0
mov qword [rbp + 0x108], rax
mov edx, 0x20019
mov dword [rbp + 0x110], 0x40
movdqu xmmword [rbp + 0x118], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
js 0x18004d05d
lea rdx, str.Type
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x58]
mov rax, qword [rbp + 0x98]
mov r9, r15
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
js 0x18004d05d
cmp dword [r15 + 4], 4
jne 0x18004d05d
mov eax, dword [r15 + 0xc]
mov dword [rbp + 0x24], eax
test dword [rbp + 0x2c], eax
je 0x18004d065
lea rdx, str.DllPath
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x58]
mov rax, qword [rbp + 0x98]
mov r9, r15
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
jns 0x18004ca61
cmp eax, 0x80000005
jne 0x18004ca59
mov eax, dword [r15 + 8]
test eax, eax
je 0x18004d05d
mov rcx, qword gs:[0x60]
lea ebx, [rax + 2]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x68]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
lea eax, [rbx + 0xc]
mov r8d, eax
mov edx, 8
mov qword [rbp + 0x98], rax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov edx, 8
mov r8d, ebx
mov r15, rax
mov qword [rbp + 0x30], rax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0x68], rax
test r15, r15
je 0x18004c80a
test rax, rax
je 0x18004c80a
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, [rbp + 0x58]
mov rax, qword [rbp + 0x98]
mov r9, r15
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
xor r8d, r8d
test ebx, ebx
js 0x18004d05d
cmp dword [r15 + 4], 2
jne 0x18004d05d
mov eax, dword [r15 + 8]
lea rdx, [r15 + 0xc]
shr rax, 1
lea rcx, [rbp + 0x58]
mov word [rdx + rax*2], r8w
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea r9, [rbp + 0x40]
xor ecx, ecx
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x58]
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
nop dword [rax + rax]
xor r8d, r8d
mov ebx, eax
test eax, eax
jns 0x18004cb26
cmp eax, 0xc0000023
jne 0x18004cb1e
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp + 0x68]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov edx, 8
mov r8d, dword [rbp + 0x40]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
lea r9, [rbp + 0x40]
xor ecx, ecx
lea r8, [rbp + 0x10]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x58]
mov qword [rbp + 0x18], rax
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
nop dword [rax + rax]
mov ebx, eax
xor r8d, r8d
test ebx, ebx
js 0x18004d05d
movzx ecx, word [rbp + 0x10]
mov rax, qword [rbp + 0x18]
shr rcx, 1
mov word [rax + rcx*2], r8w
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntdll.dll__wcslwr]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
nop dword [rax + rax]
xor r8d, r8d
test al, al
jne 0x18004cbd1
test rsi, rsi
je 0x18004d05d
lea rdx, [0x180088678]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d05d
mov rax, qword [rbp + 0x18]
lea r9, [rbp + 0x138]
mov qword [rbp + 0x138], rax
lea rdx, [0x180088678]
movzx eax, word [rbp + 0x10]
add eax, 2
mov dword [rbp + 0x144], r8d
mov dword [rbp + 0x140], eax
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventWrite]
nop dword [rax + rax]
xor r8d, r8d
jmp 0x18004d05d
mov r9b, byte [rsp + 0x558]
mov r8, qword [rbp + 0x18]
mov rdx, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xa0]
call fcn.18004d778
xor r8d, r8d
test al, al
jne 0x18004cc70
bts dword [rbp], 0xc
test rsi, rsi
je 0x18004d065
lea rdx, [0x180088688]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d065
mov rax, qword [rbp + 0x18]
lea r9, [rbp + 0x148]
mov qword [rbp + 0x148], rax
lea rdx, [0x180088688]
movzx eax, word [rbp + 0x10]
mov rcx, rsi
add eax, 2
mov dword [rbp + 0x154], r8d
mov r8d, 1
mov dword [rbp + 0x150], eax
call qword [sym.imp.ntdll.dll_EtwEventWrite]
nop dword [rax + rax]
xor r8d, r8d
jmp 0x18004d065
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_1.dll_LoadLibraryW]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0xb8], rax
mov rcx, rax
test rax, rax
jne 0x18004ccee
test rsi, rsi
je 0x18004d05d
lea rdx, [0x1800886a8]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d05d
movzx eax, word [rbp + 0x10]
lea r9, [rbp + 0x158]
mov rcx, qword [rbp + 0x18]
lea rdx, [0x1800886a8]
add eax, 2
mov qword [rbp + 0x158], rcx
mov dword [rbp + 0x160], eax
mov dword [rbp + 0x164], r8d
jmp 0x18004cbb4
mov eax, dword [rbp + 0x2c]
mov rdx, r13
mov r15d, eax
and r15d, 1
je 0x18004cdb7
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
xor r8d, r8d
mov r9, rax
test rax, rax
jne 0x18004cf13
test rsi, rsi
je 0x18004d05d
lea rdx, [0x180088698]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d05d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x168], rax
movzx eax, word [rbp + 0x10]
add eax, 2
mov dword [rbp + 0x174], r8d
mov dword [rbp + 0x170], eax
lea rax, [rbp + 0x24]
mov qword [rbp + 0x178], rax
or rax, 0xffffffffffffffff
mov qword [rbp + 0x180], 4
mov qword [rbp + 0x188], r13
inc rax
cmp byte [rax + r13], r8b
jne 0x18004cd86
inc eax
mov dword [rbp + 0x194], r8d
mov dword [rbp + 0x190], eax
lea r9, [rbp + 0x168]
mov r8d, 3
lea rdx, [0x180088698]
jmp 0x18004cbba
test al, 0x20
je 0x18004ce68
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
xor r8d, r8d
mov rcx, rax
test rax, rax
jne 0x18004cf0e
test rsi, rsi
je 0x18004d05d
lea rdx, [0x180088698]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d05d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x198], rax
movzx eax, word [rbp + 0x10]
add eax, 2
mov dword [rbp + 0x1a4], r8d
mov dword [rbp + 0x1a0], eax
lea rax, [rbp + 0x24]
mov qword [rbp + 0x1a8], rax
or rax, 0xffffffffffffffff
mov qword [rbp + 0x1b0], 4
mov qword [rbp + 0x1b8], r13
inc rax
cmp byte [rax + r13], r8b
jne 0x18004ce44
inc eax
mov dword [rbp + 0x1c4], r8d
mov dword [rbp + 0x1c0], eax
lea r9, [rbp + 0x198]
jmp 0x18004cda5
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
xor r8d, r8d
test rax, rax
jne 0x18004cf1b
test rsi, rsi
je 0x18004d05d
lea rdx, [0x180088698]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d05d
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1c8], rax
movzx eax, word [rbp + 0x10]
add eax, 2
mov dword [rbp + 0x1d4], r8d
mov dword [rbp + 0x1d0], eax
lea rax, [rbp + 0x24]
mov qword [rbp + 0x1d8], rax
or rax, 0xffffffffffffffff
mov qword [rbp + 0x1e0], 4
mov qword [rbp + 0x1e8], r13
inc rax
cmp byte [rax + r13], r8b
jne 0x18004ceea
inc eax
mov dword [rbp + 0x1f4], r8d
mov dword [rbp + 0x1f0], eax
lea r9, [rbp + 0x1c8]
jmp 0x18004cda5
mov rax, r8
jmp 0x18004cf1e
mov rax, r8
mov rcx, r8
jmp 0x18004cf21
mov rcx, r8
mov r9, r8
test ebx, ebx
js 0x18004d05d
test dword [rbp + 0x24], 0x100
je 0x18004cf56
test r15d, r15d
je 0x18004cf41
mov rdx, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x50]
jmp 0x18004cf63
test byte [rbp + 0x2c], 0x10
mov edx, dword [rbp + 8]
je 0x18004cf50
mov rcx, qword [rbp + 0x78]
jmp 0x18004cf97
mov rcx, qword [rbp + 0x50]
jmp 0x18004cf97
test r15d, r15d
je 0x18004cf72
mov rdx, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x48]
mov r8d, dword [rbp + 8]
mov rax, r9
call qword [case.0x1800532bc.0]
jmp 0x18004cf9d
mov edx, dword [rbp + 0x2c]
test dl, 0x10
je 0x18004cf80
mov rcx, qword [rbp + 0x70]
jmp 0x18004cf94
test dl, 0x20
je 0x18004cf90
mov rax, rcx
call qword [case.0x1800532bc.0]
jmp 0x18004cf9d
mov rcx, qword [rbp + 0x48]
mov edx, dword [rbp + 8]
call qword [case.0x1800532bc.0]
or dword [rbp], eax
xor r8d, r8d
mov dword [rbp + 0x80], eax
test rsi, rsi
je 0x18004d061
lea rdx, [0x180088658]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventEnabled]
nop dword [rax + rax]
xor r8d, r8d
test al, al
je 0x18004d061
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x1f8], rax
movzx eax, word [rbp + 0x10]
add eax, 2
mov dword [rbp + 0x204], r8d
mov dword [rbp + 0x200], eax
or rax, 0xffffffffffffffff
mov qword [rbp + 0x208], r13
inc rax
cmp byte [rax + r13], r8b
jne 0x18004cffd
inc eax
mov dword [rbp + 0x214], r8d
mov dword [rbp + 0x210], eax
lea r9, [rbp + 0x1f8]
lea rax, [rbp + 0x80]
mov qword [rbp + 0x220], 4
mov r8d, 3
mov qword [rbp + 0x218], rax
lea rdx, [0x180088658]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_EtwEventWrite]
nop dword [rax + rax]
xor r8d, r8d
jmp 0x18004d061
cmp eax, 0x8000001a
je 0x18004d0c2
or dword [rbp], 1
mov r15, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x18004d081
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
xor r8d, r8d
mov qword [rbp + 0x38], r8
mov rax, qword [rbp + 0xb8]
test rax, rax
je 0x18004d09f
mov rcx, rax
call qword [sym.imp.ntdll.dll_LdrUnloadDll]
nop dword [rax + rax]
xor r8d, r8d
mov eax, dword [rbp + 0x84]
inc eax
mov qword [rbp + 0xb8], r8
mov dword [rbp + 0x84], eax
cmp ebx, 0x8000001a
jne 0x18004c7bd
jmp 0x18004d0c5
mov ebx, r8d
mov eax, dword [rbp]
jmp 0x18004c0ba
mov ebx, 0xc0000017
jmp 0x18004c0b5