Function at 0x180066470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1800ab9c8]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rax, qword [rbp + 0x418]
mov r10, r8
mov r13, qword [rbp + 0x410]
mov r11, rcx
movzx r14d, byte [rsp + 0x4c]
mov ebx, 1
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x400]
mov edi, eax
mov r15, qword [rbp - 0x48]
mov qword [rbp - 0x58], r8
mov r8, rdx
mov qword [rbp - 0x20], r9
mov r9, qword [rbp - 0x48]
lea esi, [rax + 0x354]
mov qword [rbp - 0x30], rdx
mov rdx, qword [rbp + 0x408]
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x80], r9
mov byte [rsp + 0x48], r14b
cmp eax, esi
jae 0x1800668b9
movzx ecx, byte [rsp + 0x4c]
lea eax, [rbx + 0x32]
mov byte [rsp + 0x50], cl
lea edx, [rbx + 0x63]
lea r12d, [rbx + 0x6b]
nop
cmp edi, 0x104
ja 0x18006667f
je 0x18006666b
lea eax, [rdi - 0x13]
cmp eax, 0xaa
ja case.0x18006655b.20
lea r8, [0x180000000]
movzx eax, byte [r8 + rax + 0x676c0]
mov ecx, dword [r8 + rax*4 + 0x676a4]
add rcx, r8
jmp rcx
mov qword [rbp - 8], 0
mov rax, qword [rbp - 8]
mov qword [rbp + 8], rax
xor eax, eax
mov dword [0x180cadc68], eax
jmp case.0x18006655b.20
mov dword [rsp + 0x78], 0x60
mov eax, dword [rsp + 0x78]
mov dword [rbp - 0x68], eax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x10]
mov qword [rbp], rax
jmp case.0x18006655b.20
xor eax, eax
mov byte [rsp + 0x50], 0
mov r15d, eax
xor r14b, r14b
mov eax, dword [r10]
sub eax, 0x60
mov byte [rsp + 0x48], r14b
cmp eax, ebx
jbe case.0x18006655b.20
lea eax, [r15 + 5]
jmp 0x18006688f
mov r8d, 2
mov byte [rbp + 0x37], 0
lea rdx, [0x1800a3a6f]
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r9, qword [rbp - 0x80]
mov eax, 0x77
mov r10, qword [rbp - 0x58]
mov word [rbp + 0x40], ax
mov eax, 0x5f
mov dword [rbp + 0x42], 0x320073
mov word [rbp + 0x46], ax
lea edx, [rax + 5]
jmp case.0x18006655b.20
mov eax, dword [str.WSAEnOMORE]
lea rdx, [0x1800a3ab9]
mov dword [rbp + 0x28], eax
lea rcx, [rbp + 0x28]
movzx eax, byte [0x1800a3a8c]
mov r8d, 5
mov byte [rbp + 0x2c], al
mov byte [rbp + 0x2d], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x1800a3adc]
lea rcx, [rbp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r9, qword [rbp - 0x80]
mov eax, 0x6c6f
mov r10, qword [rbp - 0x58]
mov edx, 0x64
mov word [rbp + 0x35], ax
jmp case.0x18006655b.20
mov word [rbp + 0x48], ax
mov dword [rbp + 0x4a], 0x2e0032
mov word [rbp + 0x4e], dx
jmp 0x1800667b9
mov eax, edi
sub eax, 0x14b
je 0x180066792
sub eax, 0x47
je 0x180066746
sub eax, 0x47
je 0x180066702
sub eax, 0x47
je 0x1800666d7
cmp eax, 0x47
jne case.0x18006655b.20
xor eax, eax
lea r8, [rbp - 0x64]
xor edx, edx
mov dword [rbp - 0x64], eax
xor ecx, ecx
call r9
cmp dword [rbp - 0x64], 0x274
jb 0x180066888
mov r9, qword [rbp - 0x80]
mov edx, 0x64
mov r10, qword [rbp - 0x58]
jmp case.0x18006655b.20
mov r9d, 0xc4
lea rdx, [rbp + 0x28]
xor r8d, r8d
lea rcx, [rbp + 0x40]
call fcn.18004d250
mov r10, qword [rbp - 0x58]
mov r9, rax
mov qword [rbp - 0x80], rax
mov edx, 0x64
jmp case.0x18006655b.20
mov r8d, 3
lea rdx, [0x18009bd78]
lea rcx, [rbp + 0x1f]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [str.uction]
mov edx, 0x64
mov r9, qword [rbp - 0x80]
mov r10, qword [rbp - 0x58]
mov dword [rbp + 0x21], eax
movzx eax, word [0x1800a3a84]
mov word [rbp + 0x25], ax
movzx eax, byte [0x1800a3a86]
mov byte [rbp + 0x27], al
jmp case.0x18006655b.20
mov eax, dword [str.ders:]
mov dword [rbp + 0x12], eax
movzx eax, word [0x1800a3a54]
mov word [rbp + 0x16], ax
movzx eax, word [0x1800a3a58]
mov word [rbp + 0x17], ax
movzx eax, word [0x1800a3a5c]
mov word [rbp + 0x19], ax
movzx eax, word [0x1800a3a60]
mov word [rbp + 0x1b], ax
movzx eax, word [0x1800a2058]
mov word [rbp + 0x1d], ax
movzx eax, byte [0x1800a205a]
mov byte [rbp + 0x1f], al
jmp case.0x18006655b.20
xor eax, eax
mov dword [rbp + 0x50], 0x6c006c
mov word [rbp + 0x54], ax
movzx eax, word [0x1800a3a64]
mov word [rbp + 0x10], ax
movzx eax, byte [0x1800a3a66]
mov byte [rbp + 0x12], al
mov eax, 0x33
add edi, 0x47
cmp edi, esi
jb 0x180066520
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
mov r11, qword [rbp - 0x78]
mov eax, dword [rbp + 0x400]
lea ecx, [rax + 0xd]
mov dword [rsp + 0x60], ecx
cmp eax, ecx
jae case.0x180066836.120
movzx ecx, byte [rsp + 0x4c]
movzx r12d, byte [rsp + 0x58]
mov esi, dword [rbp - 0x10]
mov byte [rsp + 0x4c], cl
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x78], r12d
mov dword [rbp - 0x70], esi
add eax, 0xffffffed
lea rdi, [0x1800abac0]
cmp eax, 0x65
ja case.default.0x180066836
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x677a4]
mov ecx, dword [rcx + rax*4 + 0x6776c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov r9, qword [rbp - 0x78]
movzx eax, byte [r9]
test al, al
je 0x180067695
mov ecx, dword [r13]
nop dword [rax]
test ecx, ecx
je 0x180067695
movsx ecx, al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isgraph]
test eax, eax
je 0x18006769c
dec dword [r13]
mov r11, qword [rbp - 0x78]
mov ecx, dword [r13]
inc r11
mov qword [rbp - 0x78], r11
movzx eax, byte [r11]
test al, al
jne 0x180066850
mov eax, ebx
jmp 0x18006688f
mov byte [rbp - 0x60], 0
mov eax, dword [rbp - 0x60]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.180089600
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movzx edi, byte [rsp + 0x4c]
mov byte [rsp + 0x50], dil
jmp 0x1800667d6
mov dword [rsp + 0x38], reloc.SHELL32.dll_SHTestTokenMembership
lea rax, [rbp]
mov qword [rsp + 0x30], r11
lea r9, [rbp + 0x60]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 8]
lea rax, [rbp - 0x10]
mov qword [rbp - 8], 0x40
lea rdx, [rbp - 8]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x280]
call fcn.18005a3e0
mov dword [rbp - 8], eax
test eax, eax
js 0x18006764f
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
jmp case.0x180066836.29
test r15, r15
jne 0x180066a0c
mov edi, IUnknown_GetWindow
lea rsi, [0x1800abac0]
mov eax, edi
sub eax, 0xa9
je 0x1800669a6
sub eax, 0x67
je 0x180066967
sub eax, 0x67
je 0x18006695d
cmp eax, 0x67
jne 0x1800669fb
mov dword [r15 + 0x1c], 0xffffffff
jmp 0x1800669fb
mov byte [r15 + 0x18], 0
jmp 0x1800669fb
mov r8d, dword [0x1800abaac]
lea rax, [0x1800493f0]
mov r9d, 0xc0
mov qword [rsp + 0x20], rax
mov rdx, rsi
lea rcx, [0x180cadc68]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_bsearch]
mov r15, rax
mov byte [rax + 4], bl
mov dword [rax + 0x10], 0xdeadbeef
mov dword [rax + 0x14], 0xfacecafe
jmp 0x1800669fb
mov edx, dword [0x1800abaac]
cmp edx, 0x10000
jae 0x180067668
mov eax, dword [0x180cadc68]
lea r10, [0x1800abac0]
lea rcx, [rdx + rdx*2]
mov r8d, 0xc0
shl rcx, 6
lea r9, [0x1800493f0]
inc edx
mov dword [0x1800abaac], edx
mov dword [rcx + r10], eax
mov dword [rcx + r10 + 8], ebx
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
lea rsi, [0x1800abac0]
add edi, 0x67
cmp edi, 0x245
jb 0x180066934
jmp 0x180066a6a
inc dword [r15 + 8]
movsxd rax, dword [r15 + 0x1c]
cmp eax, 8
jge 0x180066a25
test eax, eax
js 0x180066a6a
cmp byte [rax + r15 + 0x20], 0x20
jb 0x180066a6a
mov ecx, 0xdf
nop word [rax + rax]
mov eax, ecx
sub eax, 0xdf
je 0x180066a47
cmp eax, ebx
jne 0x180066a60
mov eax, 2
jmp 0x18006688f
inc dword [r15 + 0x10]
mov dword [r15 + 0x14], 0xfacecafe
mov byte [r15 + 0x18], 0
mov dword [r15 + 0x1c], 0xffffffff
inc ecx
cmp ecx, 0xe1
jb 0x180066a30
movzx eax, byte [r15 + 4]
lea r8, [rbp - 0x50]
mov byte [rsp + 0x50], al
xor edx, edx
mov rax, qword [rbp - 0x48]
xor r9d, r9d
lea ecx, [rdx + 7]
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
call fcn.180069290
mov r8, rax
mov qword [rbp - 0x50], rax
xor eax, eax
lea rsi, [rbp + 0x60]
mov dword [rsp + 0x70], eax
mov edi, eax
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r13]
mov ecx, 0x18
sub ecx, edi
mov r9, r8
shr edx, cl
mov r8d, 0x45
xor dl, byte [rsi]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x58], dl
lea rdx, [rsp + 0x58]
call fcn.18005d470
mov r8, qword [rbp - 0x50]
lea rsi, [rsi + 1]
add edi, 8
cmp edi, 0x20
jb 0x180066ab0
movzx r12d, byte [rsp + 0x50]
xor eax, eax
mov r14d, eax
mov dword [rsp + 0x70], eax
mov byte [rsp + 0x58], al
mov esi, eax
mov byte [rsp + 0x40], al
mov edi, eax
mov r13, r8
nop dword [rax]
mov r9, r13
lea rdx, [rsp + 0x58]
mov r8d, 0x45
lea rcx, [rsp + 0x70]
call fcn.18005d470
mov byte [rbp + rdi], al
lea rcx, [rsp + 0x68]
mov eax, dword [r13]
mov edx, 0xf9
mov dword [rsp + 0x68], eax
call fcn.18006e390
mov edx, 0x88
nop dword [rax + rax]
mov ecx, edx
sub ecx, 0x88
je 0x180066bbb
sub ecx, 0x2f
je 0x180066bbf
sub ecx, 0xb
je 0x180066bca
cmp ecx, 0x2f
jne 0x180066bbf
xor r9d, r9d
lea r8, [rsp + 0x40]
mov edx, r9d
lea r10, str.AUTO
nop dword [rax + rax]
movzx ecx, byte [r8 + rdx]
inc rdx
cmp cl, byte [r10 + rdx - 1]
jne 0x180066c04
cmp rdx, 5
jne 0x180066b80
mov word [0x188], bx
mov ecx, dword [SHChangeNotifyDeregister]
inc ecx
mov word [rsp + 0x4c], bx
mov dword [0], ecx
movzx ecx, bl
mov byte [rsp + 0x4c], bl
jmp 0x180066bcf
mov byte [rsp + 0x4c], bl
add edx, 0x3a
cmp edx, 0x170
jb 0x180066b50
movzx ecx, byte [rsp + 0x4c]
xor al, cl
mov byte [rbp + rdi + 8], al
test r12b, r12b
je 0x180066c41
movsxd rax, dword [r15 + 0x1c]
mov ecx, 0x18
sub ecx, esi
test eax, eax
jns 0x180066c14
mov eax, dword [r15 + 0x10]
shr eax, cl
mov ecx, 7
mov byte [rbp + rdi], al
sub cl, r14b
movzx edx, byte [r15 + 0x18]
shr dl, cl
jmp 0x180066c3b
movzx ecx, r9b
mov word [rsp + 0x4c], r9w
mov byte [rsp + 0x4c], cl
jmp 0x180066bcf
mov edx, dword [r15 + rax*4 + 0x28]
shr edx, cl
mov ecx, 7
mov byte [rbp + rdi], dl
sub ecx, r14d
movsxd rax, dword [r15 + 0x1c]
movzx edx, byte [rax + r15 + 0x78]
movzx eax, byte [rax + r15 + 0x20]
add edx, eax
sar edx, cl
and dl, bl
mov byte [rbp + rdi + 8], dl
inc r14d
inc rdi
add esi, 8
cmp esi, 0x20
jb 0x180066b10
mov r12d, dword [rsp + 0x78]
movzx r14d, byte [rsp + 0x48]
mov r13, qword [rbp - 0x40]
mov esi, dword [rbp - 0x70]
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
jmp case.0x180066836.29
mov rdx, qword [r11]
lea r8, [rbp - 0x64]
xor ecx, ecx
call r9
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
movsxd rcx, eax
cmp rcx, qword [rbp - 0x18]
sete byte [rbp - 0x60]
jmp case.0x180066836.29
mov ecx, dword [rbp - 0x6c]
lea r9, [rsp + 0x68]
mov dword [rsp + 0x70], ecx
xor r8d, r8d
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x68], 0x20
mov edx, 0x127
call fcn.180046310
mov r13, qword [rbp - 0x50]
mov esi, 4
mov r9d, eax
xor eax, eax
mov dword [rbp - 0x10], eax
mov r14d, eax
mov byte [rsp + 0x40], al
lea edi, [rsi + 0x1c]
nop word [rax + rax]
mov dword [rsp + 0x70], r9d
lea rcx, [rsp + 0x70]
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], 8
xor r8d, r8d
mov edx, 0x127
call fcn.180046310
mov r9, r13
mov dword [rbp - 0x6c], eax
mov r8d, 0x45
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.18005d470
mov ecx, dword [rbp - 0x6c]
mov edx, 0xf9
xor al, cl
lea rcx, [rsp + 0x68]
mov byte [rbp + r14 + 4], al
mov eax, dword [r13]
mov dword [rsp + 0x68], eax
call fcn.18006e390
mov r9d, dword [rbp - 0x6c]
mov r8d, 0x88
mov byte [rsp + 0x58], r9b
nop
mov ecx, r8d
sub ecx, 0x88
je 0x180066db4
sub ecx, 0x2f
je 0x180066dd3
sub ecx, 0xb
je 0x180066df2
cmp ecx, 0x2f
jne 0x180066dd3
xor r10d, r10d
lea r8, [rsp + 0x58]
mov edx, r10d
lea r11, str.AUTO
movzx ecx, byte [r8 + rdx]
inc rdx
cmp cl, byte [r11 + rdx - 1]
jne 0x180066de6
cmp rdx, 5
jne 0x180066d80
mov word [0x188], bx
mov ecx, dword [SHChangeNotifyDeregister]
inc ecx
mov word [rsp + 0x58], bx
mov dword [0], ecx
jmp 0x180066dec
movzx edx, r9b
mov r12d, 0x9669
mov ecx, edx
shr ecx, 4
xor ecx, edx
and ecx, 0xf
sar r12d, cl
and r12b, bl
mov dword [rsp + 0x78], r12d
add r8d, 0x3a
cmp r8d, 0x170
jb 0x180066d50
jmp 0x180066df2
mov word [rsp + 0x58], r10w
movzx r12d, byte [rsp + 0x58]
xor al, r12b
cmp byte [rsp + 0x50], 0
mov byte [rbp + r14 + 0xc], al
je 0x180066e67
movsxd rax, dword [r15 + 0x1c]
test eax, eax
jns 0x180066e2c
mov edx, dword [r15 + 0x14]
mov ecx, 0x38
sub ecx, edi
shr edx, cl
mov ecx, 7
mov byte [rbp + r14 + 4], dl
sub cl, sil
movzx edx, byte [r15 + 0x18]
shr dl, cl
jmp 0x180066e60
mov edx, dword [r15 + rax*4 + 0x48]
mov r8d, 7
sub r8d, esi
lea ecx, [r8*8]
shr edx, cl
mov ecx, r8d
mov byte [rbp + r14 + 4], dl
movsxd rax, dword [r15 + 0x1c]
movzx edx, byte [rax + r15 + 0x78]
movzx eax, byte [rax + r15 + 0x20]
add edx, eax
sar edx, cl
and dl, bl
mov byte [rbp + r14 + 0xc], dl
inc esi
inc r14
add edi, 8
cmp edi, 0x40
jb 0x180066ce0
mov dword [rsp + 0x78], r12d
jmp 0x180066c58
mov r9, r11
mov byte [rsp + 0x40], 0
mov r8d, 0x5c
mov dword [rbp - 0x10], 3
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.180060ec0
mov r9, qword [rbp - 0x78]
lea rdx, [rsp + 0x40]
mov r8d, 0x5c
mov byte [rsp + 0x40], 0
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], ILRemoveLastID
call fcn.180060ec0
mov edi, 0x104
nop
mov eax, edi
sub eax, 0x104
je 0x180066f32
sub eax, 2
je 0x180066f74
cmp eax, ebx
jne 0x180066f26
xor eax, eax
mov dword [rsp + 0x70], 3
mov dword [rsp + 0x68], eax
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x10], eax
xor r9d, r9d
lea rax, [rbp - 0x10]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0x42]
call fcn.180068a40
mov qword [rbp - 0x10], rax
mov esi, eax
mov dword [rbp - 0x70], eax
dec edi
cmp edi, 0x101
ja 0x180066ed0
jmp 0x180066f74
mov r11, qword [rbp - 0x78]
xor ecx, ecx
mov rax, qword [r11 + 8]
mov dword [r11 + 0x528], ecx
mov r10, qword [rax + 0x5c]
test r10, r10
je 0x180066f86
lea r8d, [rcx + 4]
mov dword [rsp + 0x28], 0xffffffff
mov rcx, r11
mov qword [rsp + 0x20], 0x108
lea r9, [rbp + 0x60]
lea rdx, [rbp - 0x68]
call r10
mov esi, eax
mov dword [rbp - 0x70], eax
test esi, esi
jns 0x180066c65
mov eax, 8
jmp 0x18006688f
mov r9, qword [rbp - 0x80]
mov esi, ecx
mov dword [r11 + 0x528], 0xfffffffd
mov dword [rbp - 0x70], ecx
jmp case.0x180066836.29
mov r9, r11
mov byte [rsp + 0x40], bl
mov r8d, 0x5c
mov dword [rbp - 0x10], ILRemoveLastID
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.180060ec0
mov r8d, 0x25
lea rdx, [rbp + 0x60]
xor ecx, ecx
call fcn.1800341e0
mov r8d, dword [0x1800abaac]
lea rcx, [0x180cadc68]
mov dword [rbp - 0x6c], eax
mov r9d, 0xc0
mov dword [0x180cadc68], eax
mov rdx, rdi
lea rax, [0x1800493f0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_bsearch]
mov r11, qword [rbp - 0x78]
mov r15, rax
mov r9, qword [rbp - 0x80]
jmp case.0x180066836.29
movsxd rax, dword [r15 + 0x1c]
test eax, eax
js 0x180067021
inc byte [rax + r15 + 0x20]
mov r9, r11
mov byte [rsp + 0x40], 0
mov r8d, 0x5c
mov dword [rbp - 0x10], 4
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.180060ec0
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
jmp case.0x180066836.29
mov rax, qword [rbp - 0x20]
movzx ecx, byte [rax]
lea eax, [rcx - 8]
test al, 0x6f
jne 0x180067672
mov eax, dword [r8]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x40], cl
mov r8d, 0x77
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], eax
call fcn.1800340f0
test al, al
jne 0x180066c65
mov eax, 6
jmp 0x18006688f
movzx eax, byte [r10]
lea rdx, [rbp - 0x10]
mov byte [rbp - 0x68], al
mov ecx, 0xb8
movzx eax, byte [r8]
lea r8, [rbp - 0x68]
mov byte [rbp - 0x67], al
mov qword [rbp - 0x10], 2
call fcn.18003d2c0
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
jmp case.0x180066836.29
mov ecx, dword [rbp - 0x64]
movabs rdi, 0x342da7f2f4960343
mov rsi, qword [r11 + 8]
mov rax, rdi
mov r9, qword [r11]
mul rcx
mov rcx, rsi
mov byte [rsp + 0x40], 0
sub rcx, r9
mov r10, rdx
shr r10, 7
mov rax, rdi
imul rcx
mov qword [rbp - 0x18], r10
mov r8, rdx
sar r8, 7
mov rax, r8
shr rax, 0x3f
add r8, rax
cmp r10, r8
jae 0x180067143
imul rax, r10, 0x274
lea rdx, [rbp + 0x10]
add rax, r9
lea rcx, [rbp + 0x170]
mov qword [r11 + 8], rax
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
mov esi, dword [rbp - 0x70]
jmp case.0x180066836.29
jbe 0x1800671bd
mov rcx, qword [r11 + 0x10]
mov rax, rdi
sub rcx, r9
imul rcx
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp r10, rdx
jbe 0x180067196
lea r8, [rsp + 0x40]
mov rdx, r10
mov rcx, r11
call fcn.18002d460
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
mov esi, dword [rbp - 0x70]
jmp case.0x180066836.29
mov rax, r10
sub rax, r8
je 0x1800671b9
imul rdi, rax, 0x274
xor edx, edx
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov r11, qword [rbp - 0x78]
add rsi, rdi
mov qword [r11 + 8], rsi
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
mov esi, dword [rbp - 0x70]
jmp case.0x180066836.29
mov r8d, dword [rbp - 8]
cmp r8d, 4
jne 0x18006760c
movsxd rax, dword [r15 + 0x1c]
test eax, eax
jns 0x180067341
mov r8d, 0xfe
nop
cmp r8d, 0xfe
je 0x180067221
cmp r8d, 0x3e82
jne 0x180067328
xor eax, eax
mov dword [r15 + 0x1c], eax
jmp 0x180067328
movzx eax, byte [rbp + 0x60]
mov edx, dword [r15 + 0x10]
and al, 0xf
mov byte [r15 + 0x19], al
and edx, 0xffffff1f
mov dword [r15 + 0xc], edx
xor al, 5
mov byte [r15 + 0x1a], al
mov dword [r15 + 0x28], edx
or edx, 0x20
mov ecx, dword [r15 + 0x14]
mov dword [r15 + 0x48], ecx
movzx eax, byte [r15 + 0x18]
mov qword [r15 + 0x20], 0
and al, 0xe0
mov byte [r15 + 0x78], al
mov dword [r15 + 0x2c], edx
mov dword [r15 + 0x4c], ecx
mov byte [r15 + 0x79], al
mov eax, dword [r15 + 0xc]
or eax, 0x40
mov dword [r15 + 0x30], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x50], eax
movzx eax, byte [r15 + 0x18]
and al, 0xe0
mov byte [r15 + 0x7a], al
mov eax, dword [r15 + 0xc]
or eax, 0x60
mov dword [r15 + 0x34], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x54], eax
movzx eax, byte [r15 + 0x18]
and al, 0xe0
mov byte [r15 + 0x7b], al
mov eax, dword [r15 + 0xc]
bts eax, 7
mov dword [r15 + 0x38], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x58], eax
movzx eax, byte [r15 + 0x18]
and al, 0xe0
mov byte [r15 + 0x7c], al
mov eax, dword [r15 + 0xc]
or eax, 0xa0
mov dword [r15 + 0x3c], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x5c], eax
movzx eax, byte [r15 + 0x18]
and al, 0xe0
mov byte [r15 + 0x7d], al
mov eax, dword [r15 + 0xc]
or eax, 0xc0
mov dword [r15 + 0x40], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x60], eax
movzx eax, byte [r15 + 0x18]
and al, 0xe0
mov byte [r15 + 0x7e], al
mov eax, dword [r15 + 0xc]
or eax, 0xe0
mov dword [r15 + 0x44], eax
mov eax, dword [r15 + 0x14]
mov dword [r15 + 0x64], eax
movzx eax, byte [r15 + 0x18]
and al, 0xe0
mov byte [r15 + 0x7f], al
add r8d, 0x3d84
cmp r8d, 0x7b08
jbe 0x180067200
jmp case.0x180066836.29
movzx ecx, byte [rbp + 0x60]
and cl, 0xf
mov byte [rax + r15 + 0x70], cl
movsxd rcx, dword [r15 + 0x1c]
movzx eax, byte [rcx + r15 + 0x70]
xor al, 5
mov byte [rcx + r15 + 0x68], al
inc dword [r15 + 0x1c]
cmp dword [r15 + 0x1c], 8
jne case.0x180066836.29
mov r13d, 0x58
cmp r13d, 0x58
je 0x1800673dc
cmp r13d, 0x2c0
jne 0x1800675e2
test r14b, r14b
jne 0x1800675e2
mov ecx, 0xcf
mov eax, ecx
sub eax, 0xcf
je 0x1800673c1
sub eax, ebx
je 0x1800673ab
cmp eax, ebx
je case.0x180066836.120
jmp 0x1800673cd
mov byte [r15 + 0x18], 0
mov dword [r15 + 0x1c], 0xffffffff
mov dword [rbp - 0x60], 3
jmp 0x1800673cd
inc dword [r15 + 0x10]
mov dword [r15 + 0x14], 0xfacecafe
inc ecx
cmp ecx, 0xd2
jb 0x180067394
jmp 0x1800675e2
lea r8, [r15 + 0x20]
mov r10d, 8
lea r9, [r15 + 0x82]
nop dword [rax]
movzx ecx, byte [r8 + 0x58]
lea r9, [r9 + 8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
dec ecx
add edx, ecx
sar edx, 7
and dl, bl
mov byte [r9 - 0xa], dl
movzx ecx, byte [r8 + 0x57]
movzx edx, byte [r8 - 1]
dec ecx
add edx, ecx
sar edx, 6
and dl, bl
mov byte [r9 - 9], dl
movzx ecx, byte [r8 + 0x57]
movzx edx, byte [r8 - 1]
dec ecx
add edx, ecx
sar edx, 5
and dl, bl
mov byte [r9 - 8], dl
movzx ecx, byte [r8 + 0x57]
movzx edx, byte [r8 - 1]
dec ecx
add edx, ecx
sar edx, 4
and dl, bl
mov byte [r9 - 7], dl
movzx ecx, byte [r8 + 0x57]
movzx edx, byte [r8 - 1]
dec ecx
add edx, ecx
sar edx, 3
and dl, bl
mov byte [r9 - 6], dl
movzx ecx, byte [r8 + 0x57]
movzx edx, byte [r8 - 1]
dec ecx
add edx, ecx
sar edx, 2
and dl, bl
mov byte [r9 - 5], dl
movzx edx, byte [r8 - 1]
movzx ecx, byte [r8 + 0x57]
dec edx
add edx, ecx
sar edx, 1
and dl, bl
mov byte [r9 - 4], dl
movzx eax, byte [r8 + 0x57]
dec al
add al, byte [r8 - 1]
and al, bl
mov byte [r9 - 3], al
sub r10, rbx
jne 0x1800673f0
mov eax, dword [r15 + 0x14]
lea rdx, [r15 + 0x68]
mov dword [rsp + 0x68], eax
lea rcx, [r15 + 0x80]
mov eax, dword [r15 + 0xc]
lea r9d, [r10 + 0x51]
mov dword [rbp - 0x10], eax
lea r8, [rsp + 0x68]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.18005d640
xor ecx, ecx
mov r12, rax
mov r14d, ecx
test rax, rax
je 0x1800675c9
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
cmp dword [r12 + rax*8], 0
lea rsi, [r12 + rax*8]
jne 0x180067518
cmp dword [rsi + 4], 0
je 0x1800675c9
cmp r14d, 0x100000
jae 0x1800675c9
mov edi, 0x5b
nop word [rax + rax]
mov eax, edi
sub eax, 0x5b
je 0x180067548
cmp eax, ebx
jne 0x1800675b6
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x28]
mov qword [rcx], rax
jmp 0x1800675b4
mov eax, dword [r15]
lea r9, [rsp + 0x68]
mov dword [rsp + 0x70], ecx
lea r8, [rsp + 0x70]
mov rcx, qword [rbp - 0x40]
mov rdx, rsi
xor eax, dword [rcx]
mov ecx, SHSetFolderPathW
mov dword [rsp + 0x68], eax
call fcn.1800392a0
mov r9, rsi
mov dword [rsp + 0x20], 0x20
xor r8d, r8d
lea rdx, [rbp - 0x28]
xor ecx, ecx
call fcn.1800499b0
cmp byte [0x180cabb46], 0
je 0x1800675b0
cmp byte [0x180cabac4], bl
jbe 0x1800675b0
mov rax, qword [rbp - 0x30]
lea rcx, str.3d6f5f61_7538_11d3_8d5b_00104b35e7ef
mov r8, qword [rbp - 0x28]
mov edx, dword [rax]
call fcn.180088f50
mov byte [rsp + 0x48], bl
xor ecx, ecx
inc edi
cmp edi, 0x5d
jb 0x180067530
inc r14d
jmp 0x180067500
mov r9d, 0x66
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1800498e0
movzx r14d, byte [rsp + 0x48]
add r13d, 0x268
cmp r13d, 0x4d0
jbe 0x180067373
mov r12d, dword [rsp + 0x78]
mov r13, qword [rbp - 0x40]
mov esi, dword [rbp - 0x70]
mov r11, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
jmp case.0x180066836.29
cmp r8d, 0x20
jne case.0x180066836.29
mov rax, qword [rbp - 0x48]
movzx r14d, bl
mov byte [rsp + 0x48], bl
mov rax, qword [rax]
mov qword [rdx], rax
mov ecx, dword [rsp + 0x60]
mov eax, dword [rbp + 0x400]
inc eax
mov dword [rbp + 0x400], eax
cmp eax, ecx
jae case.0x180066836.120
mov rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x30]
mov r10, qword [rbp - 0x58]
jmp 0x180066803
cmp byte [rsp + 0x50], 0
je 0x180066a3d
inc byte [r15 + 0x18]
mov eax, 2
jmp 0x18006688f
mov eax, 9
jmp 0x18006688f
mov eax, 4
jmp 0x18006688f
mov rcx, qword [rbp - 0x50]
mov r9d, 0x66
xor r8d, r8d
xor edx, edx
call fcn.1800498e0
test r14b, r14b
je 0x18006769c
mov eax, ebx
jmp 0x18006688f
xor eax, eax
jmp 0x18006688f