Function at 0x18001d530
Capabilities:
Create thread
Enumerate services

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rax, qword [0x1800bf580]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov qword [rbp - 0x70], r9
mov r14d, r8d
mov dword [rsp + 0x44], r8d
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x30], rcx
movdqa xmm0, xmmword [0x18009ec00]
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x290], 0
movdqa xmmword [rbp + 0x2c0], xmm0
mov byte [rbp + 0x2b0], 0
movdqa xmmword [rbp + 0x2e0], xmm0
mov byte [rbp + 0x2d0], 0
movdqa xmmword [rbp + 0x350], xmm0
mov byte [rbp + 0x340], 0
movdqa xmmword [rbp + 0x370], xmm0
mov byte [rbp + 0x360], 0
xor ecx, ecx
mov qword [rbp + 0xd0], rcx
mov word [rbp + 0xd8], cx
movdqu xmmword [rbp + 0xea], xmm0
mov byte [rbp + 0xda], cl
mov qword [rbp + 0xa0], rcx
mov word [rbp + 0xa8], cx
movdqu xmmword [rbp + 0xba], xmm0
mov byte [rbp + 0xaa], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
mov qword [rbp + 8], rcx
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rcx
mov qword [rbp + 0x110], rcx
mov ecx, 0x30
call fcn.1800930c8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x108], rax
xor r8d, r8d
mov qword [rbp + 0x118], r8
xorps xmm2, xmm2
movsd qword [rbp + 0x120], xmm2
mov qword [rbp + 0x128], r8
mov edi, 1
mov dword [rbp + 0x130], edi
mov qword [rbp + 0x138], r8
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r8
mov qword [rbp + 0x178], 0xffffffffffffffff
mov dword [rbp + 0x180], r8d
xor eax, eax
movups xmmword [rbp + 0x188], xmm0
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [0x18009ec00]
movdqa xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], al
mov word [rbp + 0x1f0], r8w
mov dword [rbp + 0x1f4], r8d
mov qword [rbp + 0x1f8], r8
xorps xmm0, xmm0
movaps xmmword [rbp + 0x200], xmm0
movsd qword [rbp + 0x210], xmm2
mov byte [rbp + 0x218], al
mov qword [rbp + 0x21c], r8
mov esi, r14d
lea eax, [r14 + 0x10]
lea r9, [0x180000000]
mov ebx, dword [rsp + 0x50]
cmp r14d, eax
jae 0x18001e26d
mov edx, 0x6d6f
mov r12, qword [rbp - 0x48]
mov r15, qword [rbp - 0x48]
mov r13, qword [rbp - 0x48]
mov r14, qword [rsp + 0x78]
mov ecx, esi
nop dword [rax]
nop dword [rax + rax]
lea eax, [rsi - 0xea]
cmp eax, 0x30
ja case.default.0x18001d7a3
movzx eax, byte [r9 + rax + 0x1ee3c]
mov ecx, dword [r9 + rax*4 + 0x1edf8]
add rcx, r9
jmp rcx
mov byte [rbp + 0x551], 0x63
jmp case.0x18001d7a3.250
test r12, r12
je 0x18001e350
mov byte [r12], 0
mov qword [rbp - 0x38], 0x80
lea rdx, [rbp - 0x38]
mov ecx, 0x73
call fcn.18000a480
mov r13, rax
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov qword [rbp + 0x50], r12
mov dword [rbp - 0x78], edi
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x78]
lea r8, [0x180003fd0]
mov edx, 0x65
lea rcx, [rsp + 0x68]
call fcn.18002b700
test eax, eax
jne 0x18001d7d8
mov edi, 0xb0
mov eax, edi
sub eax, 0xaf
je 0x18001e366
cmp eax, 1
jne 0x18001d89b
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
dec edi
cmp edi, 0xae
ja 0x18001d862
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov eax, dword [0x1800991ea]
mov dword [rbp + 0x548], eax
movzx eax, byte [0x1800991ee]
mov byte [rbp + 0x54c], al
mov byte [rbp + 0x54d], 0
jmp case.0x18001d7a3.250
mov rax, qword [rbp - 0x50]
mov qword [rbp + 0x40], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x60], r8d
jmp case.0x18001d7a3.250
cmp dword [rbp + 0x60], 0
je 0x18001d950
mov edi, 0xca
mov eax, edi
sub eax, 0xc9
je 0x18001e37d
cmp eax, 1
jne 0x18001d93b
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
dec edi
cmp edi, 0xc8
ja 0x18001d902
mov edi, 1
xor r8d, r8d
nop dword [rax]
mov esi, 0x33
mov dword [rbp - 0x78], esi
nop dword [rax + rax]
cmp esi, 0x33
je 0x18001deee
cmp esi, 0xc8d
jne 0x18001df9f
cmp dword [rbp - 0x40], 0
jne 0x18001d9cb
cmp dword [rbp - 0x3c], 0
jne 0x18001d9cb
cmp dword [rbp - 0x80], 0
je 0x18001dfd5
lea r9, [rbp - 0x60]
mov r8d, 0x120
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18004f5f0
mov r9d, 0xcc
mov r8, r13
mov rdx, r12
lea rcx, [rbp - 0x58]
call fcn.18007c650
mov eax, dword [rbp - 0x5c]
inc eax
mov dword [rsp + 0x70], eax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x60], eax
jmp 0x18001df9f
mov eax, 0xab
mov dword [rbp - 0x68], eax
sub eax, 0xab
je 0x18001dd85
sub eax, 1
je 0x18001dcc3
sub eax, 1
je 0x18001da0a
cmp eax, 1
jne 0x18001dece
xor r8d, r8d
mov rdx, r14
mov ecx, 0x93
call fcn.180011b80
jmp 0x18001dece
mov qword [rsp + 0x20], r12
mov r9, r13
mov r8d, 0x122
mov rsi, qword [rsp + 0x78]
mov rdx, rsi
lea rcx, [rbp - 0x58]
call fcn.18002acf0
mov qword [rsp + 0x20], rsi
mov r9d, 0x2e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18007d350
mov r14d, eax
test eax, eax
je 0x18001dc56
mov ecx, eax
and ecx, 0xfffffff
je 0x18001dc56
cmp ecx, 0xffffff7
je 0x18001dc56
cmp ecx, 0xfffffff
je 0x18001dc56
mov dword [rsp + 0x58], eax
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov r8d, 0x64
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.18001f840
test eax, eax
je 0x18001dc56
mov dword [rsp + 0x58], r14d
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
mov r9d, 0xe7
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x70]
call fcn.180019810
mov eax, dword [rax]
test eax, eax
je 0x18001dc56
mov esi, 0xc9
nop word [rax + rax]
cmp esi, 0xc9
je 0x18001dc2d
cmp esi, 0x4dbb
jne 0x18001dc35
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x58], r14d
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [0x180003fd0]
lea rdx, [rbp + 0x68]
mov ecx, 0x3a
call fcn.180036530
test eax, eax
jne 0x18001dbb7
mov edi, 0x1f
nop dword [rax]
mov eax, edi
sub eax, 0x1d
je case.0x18001e3ed.13
sub eax, 1
je 0x18001dba0
cmp eax, 1
jne 0x18001dbb0
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov ecx, 0x93
call fcn.180011b80
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
jmp 0x18001dbb0
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
xor ebx, ebx
dec edi
cmp edi, 0x1c
ja 0x18001db50
cmp dword [rbp + 0x60], 0
je 0x18001dc35
mov edi, 0x31
mov eax, edi
sub eax, 0x31
je 0x18001dc05
sub eax, 1
je 0x18001dbf3
sub eax, 1
je 0x18001dbde
cmp eax, 1
je case.0x18001e3ed.13
jmp 0x18001dc24
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
mov ebx, 1
jmp 0x18001dc24
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
jmp 0x18001dc1a
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov ecx, 0x93
call fcn.180011b80
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
inc edi
cmp edi, 0x35
jb 0x18001dbc2
jmp 0x18001dc35
mov dword [rsp + 0x70], 0
add esi, 0x4cf2
cmp esi, 0x99e4
mov edi, 1
jbe 0x18001dae0
mov r14, qword [rsp + 0x78]
jmp 0x18001dece
mov eax, dword [rbp - 0x80]
dec eax
test eax, eax
jle 0x18001dfc2
mov edi, 0xf1
cmp edi, 0xf1
jne 0x18001dca7
lea r9, [rbp - 0x60]
lea r8d, [rdi + 0x2f]
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.18004f5f0
lea r9d, [rdi - 0x25]
mov r8, r13
mov rdx, r12
lea rcx, [rbp - 0x58]
call fcn.18007c650
mov eax, dword [rbp - 0x5c]
inc eax
mov dword [rsp + 0x70], eax
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x60], eax
add edi, 0x35
cmp edi, 0x126
jb 0x18001dc68
xor edx, edx
mov ecx, 0xfb
call fcn.18001af40
jmp 0x18001decb
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x78]
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov ecx, 0xf1
call fcn.180012f80
test eax, eax
jne 0x18001decb
mov edi, 0xd9
mov eax, edi
sub eax, 0xd9
je 0x18001dd66
sub eax, 1
je 0x18001dd3d
sub eax, 1
je 0x18001dd2d
sub eax, 1
je 0x18001dd29
cmp eax, 1
je case.0x18001e3ed.13
jmp 0x18001dd76
xor ebx, ebx
jmp 0x18001dd76
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
jmp 0x18001dd76
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
jmp 0x18001dd76
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x93
call fcn.180011b80
inc edi
cmp edi, 0xde
jb 0x18001dd06
jmp 0x18001decb
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov r9d, 0xd6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18004a810
mov rsi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x18001de14
mov edi, 0x6e
cmp edi, 0x6e
je 0x18001dddf
cmp edi, 0x316a
je 0x18001ddcc
cmp edi, 0x6266
je case.0x18001e3ed.13
jmp 0x18001de06
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
mov ebx, r14d
jmp 0x18001de06
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
add edi, 0x30fc
cmp edi, 0x92f4
jbe 0x18001ddb1
cmp dword [rbp - 0x80], 0x80
jge 0x18001de4a
mov eax, dword [rsp + 0x60]
mov dword [rbp - 0x60], eax
mov eax, dword [rsp + 0x70]
mov dword [rbp - 0x5c], eax
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
mov ecx, 0x113
call fcn.18002d3b0
jmp 0x18001decb
mov edi, 0xc8
nop
mov eax, edi
sub eax, 0xc8
je 0x18001deb1
sub eax, 1
je 0x18001dea2
sub eax, 1
je 0x18001de78
sub eax, 1
je 0x18001de73
cmp eax, 1
je case.0x18001e3ed.13
jmp 0x18001dec1
mov ebx, r14d
jmp 0x18001dec1
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
jmp 0x18001dec1
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
jmp 0x18001dec1
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x93
call fcn.180011b80
inc edi
cmp edi, 0xcd
jb 0x18001de50
mov r14, rsi
mov eax, dword [rbp - 0x68]
inc eax
mov dword [rbp - 0x68], eax
cmp eax, 0xaf
mov edi, 1
jb 0x18001d9d3
mov esi, dword [rbp - 0x78]
jmp 0x18001df9f
mov qword [rbp - 0x40], 0
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x50]
mov r8d, 0x8b
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.180017b90
test eax, eax
jne 0x18001df9f
mov edi, 0xc8
cmp edi, 0xc8
je 0x18001df77
cmp edi, 0x9ab0
je 0x18001df64
cmp edi, 0x13498
jne 0x18001df91
xor eax, eax
mov ebx, eax
jmp case.0x18001e3ed.13
mov rdx, r13
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, qword [rbp + 0x58]
jmp 0x18001df87
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
add edi, 0x99e8
cmp edi, 0x1cdb8
jbe 0x18001df43
add esi, 0xc5a
mov dword [rbp - 0x78], esi
cmp esi, 0x18b4
mov edi, 1
lea r8d, [rdi - 1]
jbe 0x18001d960
jmp 0x18001d950
xor r8d, r8d
mov rdx, rsi
mov ecx, 0x93
call fcn.180011b80
mov r14, rsi
mov esi, pe_nt_image_headers64
mov rdx, r12
jmp 0x18001d7fc
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je case.0x18001d7a3.250
nop
mov rdi, qword [rcx + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
test rdi, rdi
jne 0x18001dff0
mov qword [rbp - 0x70], rcx
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
test r13, r13
jne 0x18001e05a
mov edi, 0x10e
mov eax, edi
sub eax, 0x10e
je 0x18001e043
sub eax, 1
je 0x18001e03e
cmp eax, 1
jne 0x18001e050
xor ebx, ebx
jmp case.0x18001e3ed.13
mov rdx, r12
jmp 0x18001e046
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
inc edi
cmp edi, 0x111
jb 0x18001e024
mov rax, qword [rbp - 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
xor edx, edx
lea r8d, [rdx + 0x51]
lea rcx, [rsp + 0x68]
call fcn.180015120
mov dword [rsp + 0x50], eax
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, 0xc1
call fcn.1800555b0
mov qword [rbp + 0x58], rax
test rax, rax
jne 0x18001d7d8
mov edi, 0x23
nop dword [rax]
mov eax, edi
sub eax, 0x23
je 0x18001e0c5
sub eax, 1
je 0x18001e0b3
cmp eax, 1
je 0x18001e037
jmp 0x18001e0d2
mov rdx, r12
mov ecx, 0xe8
call fcn.18000e8e0
mov rdx, r13
jmp 0x18001e0c8
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
inc edi
cmp edi, 0x26
jb 0x18001e0a0
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov r8d, 4
lea rdx, [0x18009924b]
lea rcx, [rbp + 0x540]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
lea rax, [rbp + 0x40]
mov qword [rbp + 0x68], rax
mov qword [rbp - 0x18], 0x400
lea rdx, [rbp - 0x18]
mov ecx, 0x73
call fcn.18000a480
mov r15, rax
test rax, rax
je 0x18001e037
mov qword [rbp - 0x20], 0x100
lea rdx, [rbp - 0x20]
mov ecx, 0x73
call fcn.18000a480
mov r12, rax
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov byte [rbp + 0x540], 0
mov r8d, 3
lea rdx, [0x180099261]
lea rcx, [rbp + 0x540]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [0x180099292]
mov dword [rbp + 0x543], eax
movzx eax, byte [0x180099296]
mov byte [rbp + 0x547], al
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov rcx, qword [rbp - 0x70]
mov eax, dword [rcx + 0x36]
mov rdx, qword [rbp - 0x50]
mov dword [rdx + 0x496], eax
movzx eax, word [rcx + 0x3a]
mov word [rdx + 0x49a], ax
mov edx, 0x6d6f
jmp case.0x18001d7a3.250
mov byte [rbp + 0x558], 0
mov r8d, 2
lea rdx, [0x1800992b4]
lea rcx, [rbp + 0x558]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x1800992b8]
mov word [rbp + 0x55a], ax
movzx eax, byte [0x1800992ba]
mov byte [rbp + 0x55c], al
xor r8d, r8d
mov edx, 0x6d6f
lea r9, [0x180000000]
jmp case.0x18001d7a3.250
mov word [rbp + 0x552], dx
mov byte [rbp + 0x554], 0
jmp case.0x18001d7a3.250
mov dword [rbp - 0x80], r8d
mov dword [rbp - 0x58], r8d
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x70], r8d
mov ecx, dword [rsp + 0x44]
inc esi
lea eax, [rcx + 0x10]
mov edi, 1
cmp esi, eax
jb 0x18001d780
mov r14d, dword [rsp + 0x44]
mov esi, r14d
mov eax, r14d
shl eax, 8
mov dword [rsp + 0x78], eax
cmp r14d, eax
ja case.0x18001e3ed.13
mov ecx, 0x1bb
mov edx, 0x40
movzx r14d, byte [rsp + 0x40]
movzx r12d, byte [rsp + 0x40]
mov r13, qword [rbp - 0x48]
movzx r15d, byte [rsp + 0x40]
lea rax, [0x18000bed0]
cmp esi, 0x6e5a
ja 0x18001e889
je 0x18001e849
cmp esi, 0x2fda
ja 0x18001e6d8
je 0x18001e6a9
mov eax, esi
sub eax, 0xfa
je 0x18001e656
sub eax, 0x10
je 0x18001ec13
sub eax, 0xf90
je 0x18001e397
cmp eax, 0xfa0
jne 0x18001ebf6
lea rax, [rbp + 0x540]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001e310
lea rdx, [rbp + 0x540]
lea rcx, [rbp + 0x270]
call fcn.180049ba0
mov byte [rsp + 0x40], 1
mov r8, rdi
lea rdx, [0x1800996a8]
lea rcx, [rbp + 0x290]
call fcn.180049ba0
xor r8d, r8d
jmp 0x18001ebec
mov rdx, r15
mov ecx, 0xe8
call fcn.18000e8e0
xor eax, eax
mov ebx, eax
jmp case.0x18001e3ed.13
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
xor eax, eax
mov ebx, eax
jmp case.0x18001e3ed.13
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
mov eax, 1
mov ebx, eax
jmp case.0x18001e3ed.13
movzx eax, word [0x1800992e4]
mov word [rbp + 0x56c], ax
movzx eax, byte [0x1800992e6]
mov byte [rbp + 0x56e], al
lea rdx, [0x1800bf478]
mov ecx, 0x95
call fcn.18001a210
test al, al
jne 0x18001e63d
xor r14d, r14d
mov edi, r14d
cmp edi, 0xd
ja case.default.0x18001e3ed
mov eax, edi
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x1ee70]
add rcx, rdx
jmp rcx
mov eax, dword [0x1800992fa]
mov dword [rbp + 0x594], eax
movzx eax, word [0x1800992fe]
mov word [rbp + 0x598], ax
jmp case.default.0x18001e3ed
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x78]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
mov ecx, r14d
movzx eax, byte [rsp + 0x48]
mov r14, qword [rbp - 0x48]
test r14, r14
cmovne ecx, eax
mov byte [rsp + 0x48], cl
cmp cl, 0
je 0x18001e496
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0x230]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
test eax, eax
je 0x18001e48d
mov r8d, 0x34
lea rdx, [rbp + 0x230]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r14d, r14d
jmp case.default.0x18001e3ed
mov byte [rsp + 0x48], 1
mov qword [rbp + 0x80], r14
mov dword [rsp + 0x50], 0xb
mov dword [rsp + 0x58], 1
jmp case.default.0x18001e3ed
mov r8d, 2
lea rdx, [0x180099326]
lea rcx, [rbp + 0x582]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x44
mov word [rbp + 0x586], ax
jmp case.default.0x18001e3ed
mov dword [rbp - 0x78], r14d
lea rax, [rbp + 0x570]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x48], rax
jmp case.default.0x18001e3ed
mov dword [rbp + 0x5a0], 0x4e004f
mov word [rbp + 0x5a4], r14w
jmp case.default.0x18001e3ed
mov word [rbp + 0x576], r14w
mov r8d, 1
lea rdx, [0x18009936c]
lea rcx, [rbp + 0x570]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movsd xmm0, qword [0x1800993d0]
movsd qword [rbp + 0x578], xmm0
movzx eax, word [0x1800993d8]
mov word [rbp + 0x580], ax
mov word [rbp + 0x582], r14w
jmp case.default.0x18001e3ed
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
mov dword [rbp + 0x260], eax
mov dword [rbp - 0x68], 0x100
mov dword [rsp + 0x70], r14d
jmp case.default.0x18001e3ed
mov word [rbp + 0x59a], r14w
mov r8d, 3
lea rdx, [0x18009940c]
lea rcx, [rbp + 0x570]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x18001e3ed
mov ebx, 1
jmp case.default.0x18001e3ed
mov word [rbp + 0x594], r14w
jmp case.default.0x18001e3ed
mov eax, dword [0x180099520]
mov dword [rbp + 0x570], eax
movzx eax, word [0x180099524]
mov word [rbp + 0x574], ax
jmp case.default.0x18001e3ed
mov word [rbp + 0x588], r14w
mov r8d, 5
lea rdx, [0x18009968e]
lea rcx, [rbp + 0x570]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x53
mov word [rbp + 0x592], ax
inc edi
lea eax, [rdi + 0x70]
cmp eax, 0x7e
jb 0x18001e3d1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r14b, 1
xor r8d, r8d
jmp 0x18001ebec
mov dword [rbp + 0x55c], 0x78646f
mov dword [rbp + 0x55f], 0x7a5259
movsd xmm0, qword [str.2YZXdKOf]
movsd qword [rbp + 0x562], xmm0
movzx eax, byte [0x1800992c8]
mov byte [rbp + 0x56a], al
mov r8d, 2
lea rdx, [0x1800992cc]
lea rcx, [rbp + 0x558]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor r8d, r8d
jmp 0x18001ebec
mov word [rbp + 0x2f0], cx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x2b0]
xor edx, edx
xor ecx, ecx
mov r8d, 0xec
call fcn.1800739c0
xor r8d, r8d
jmp 0x18001ebec
cmp esi, 0x3f7a
je 0x18001e800
cmp esi, 0x4f1a
je 0x18001e786
cmp esi, 0x5eba
jne 0x18001ebf6
mov word [rbp + 0x300], dx
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp]
je 0x18001e731
lea rcx, [rbp + 0xd0]
mov qword [rax], rcx
mov rdx, qword [rbp - 8]
add rdx, 8
mov qword [rbp - 8], rdx
jmp 0x18001e747
lea r8, [rsp + 0x60]
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x10]
call fcn.180001a80
mov rdx, qword [rbp - 8]
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x60], rax
cmp rdx, qword [rbp]
je 0x18001e770
lea rax, [rbp + 0xa0]
mov qword [rdx], rax
add qword [rbp - 8], 8
xor r8d, r8d
jmp 0x18001ebec
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x10]
call fcn.180001a80
xor r8d, r8d
jmp 0x18001ebec
xorps xmm0, xmm0
movups xmmword [rbp + 0x300], xmm0
movups xmmword [rbp + 0x310], xmm0
movups xmmword [rbp + 0x320], xmm0
movups xmmword [rbp + 0x330], xmm0
mov word [rsp + 0x60], cx
mov dword [rsp + 0x20], 0x39
lea r9, [rbp + 0xa0]
xor r8d, r8d
lea rdx, [0x1800bf4f8]
lea rcx, [rsp + 0x60]
call fcn.18002f7d0
movups xmm0, xmmword [str.USBGW:_GUID_COMM]
movups xmmword [rbp + 0x5a8], xmm0
movzx eax, byte [0x1800992e0]
mov byte [rbp + 0x5b8], al
xor r8d, r8d
lea edx, [r8 + 0x26]
lea rcx, [rbp - 0x10]
call fcn.180028140
xor r8d, r8d
jmp 0x18001ebec
mov r8d, 0xde
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x270]
call fcn.180019c60
mov eax, 0x1bb
mov word [rsp + 0x60], ax
lea r9, [0x1800bf4d8]
mov r8d, 0x7a
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xd0]
call fcn.180040b40
xor r8d, r8d
jmp 0x18001ebec
mov eax, dword [0x1800bf520]
mov dword [rsp + 0x60], eax
xor r9d, r9d
lea r8d, [r9 + 0x43]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x60]
call fcn.180090e30
lea r8, [rbp + 0x5a8]
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov qword [rsp + 0x68], rax
xor r8d, r8d
jmp 0x18001ebec
cmp esi, 0xacda
ja 0x18001eb26
je 0x18001eae9
cmp esi, 0x7dfa
je 0x18001eabe
cmp esi, 0x8d9a
je 0x18001ea90
cmp esi, 0x9d3a
jne 0x18001ebf6
cmp qword [rbp - 0x30], 0
jne 0x18001ebf6
mov edi, 0xc
nop
cmp edi, 0x117
ja 0x18001e950
je 0x18001e919
mov eax, edi
sub eax, 0xc
je 0x18001e911
sub eax, 0x59
je 0x18001e909
cmp eax, 0x59
jne 0x18001ea7c
mov dword [rbp - 0x20], 2
mov dword [rbp - 0x24], 0x40000
mov dword [rbp - 0x28], 1
jmp 0x18001ea7c
mov r12b, 1
jmp 0x18001ea7c
mov r15b, 1
jmp 0x18001ea7c
mov qword [rbp - 0x50], r8
xor edx, edx
mov r8d, 0x1c0
lea rcx, [rbp + 0x380]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x18], 0x208
lea rcx, [rbp + 0x380]
call qword [sym.imp.ADVAPI32.dll_OpenTraceW]
mov r13, rax
xor r8d, r8d
jmp 0x18001ea7c
mov eax, edi
sub eax, 0x170
je 0x18001ea78
sub eax, 0x59
je 0x18001e9ff
cmp eax, 0x59
jne 0x18001ea7c
test r12b, r12b
je 0x18001e97d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseTrace]
mov ebx, 1
lea rcx, [rbp + 0x178]
call fcn.180003b50
mov rdi, qword [rbp + 0x160]
test rdi, rdi
je 0x18001ec28
mov rsi, qword [rbp + 0x168]
cmp rdi, rsi
je 0x18001e9c8
nop word [rax + rax]
mov rcx, rdi
call fcn.18003a800
add rdi, 0x20
cmp rdi, rsi
jne 0x18001e9b0
mov rdi, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
sub r8, rdi
sar r8, 5
mov rdx, rdi
lea rcx, [rbp + 0x160]
call fcn.18004ec60
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x160], xmm0
xor r14d, r14d
mov qword [rbp + 0x170], r14
jmp 0x18001ec2b
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x50]
mov r8d, dword [rbp - 0x28]
mov edx, dword [rbp - 0x24]
mov ecx, dword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_SaferCreateLevel]
lea rax, [r13 + 1]
movabs rcx, 0xfffffffeffffffff
test rcx, rax
movzx r12d, r12b
mov r8d, 0
cmove r12d, r8d
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x18001ea45
xor r15b, r15b
jmp 0x18001ea7c
test r15b, r15b
je 0x18001ea7c
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0x18]
lea r8, [rbp + 0x5c0]
mov edx, 3
call qword [sym.imp.ADVAPI32.dll_SaferGetLevelInformation]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_SaferCloseLevel]
xor r8d, r8d
jmp 0x18001ea7c
mov dword [rbp - 0x70], r8d
add edi, 0x59
cmp edi, 0x27b
jb 0x18001e8d0
jmp 0x18001ebec
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r8d
lea r9, [rbp + 0x90]
lea r8, [0x180028ef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x30], rax
xor r8d, r8d
jmp 0x18001ebec
lea rax, [rbp - 0x10]
mov qword [rbp + 0x70], rax
mov eax, dword [0x1800bf520]
mov dword [rbp + 0x78], eax
mov eax, dword [0x1800bf524]
mov dword [rbp + 0x7c], eax
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x90], xmm0
jmp 0x18001ebf6
lea rax, [rbp + 0x558]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
jmp 0x18001ebec
cmp esi, 0xbc7a
je 0x18001eb92
cmp esi, 0xcc1a
je 0x18001eb47
cmp esi, 0xdbba
je case.0x18001e3ed.13
jmp 0x18001ebf6
lea rdx, [rbp + 0x100]
mov ecx, 0x7c
call fcn.18001af40
cmp byte [rsp + 0x40], 0
je 0x18001eb6a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x18001eb8a
lea rdx, [rbp + 0x300]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov ebx, r8d
jmp 0x18001ebec
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov ecx, 0xeb
call fcn.180082a20
lea r9, [rbp - 0x10]
mov r8d, 0x50
lea rdx, [rbp + 0x100]
lea rcx, [0x1800bf470]
call fcn.18003b770
xor r8d, r8d
mov ecx, r8d
movzx eax, byte [rsp + 0x40]
cmp qword [rsp + 0x68], rcx
cmovne ecx, eax
mov byte [rsp + 0x40], cl
mov ecx, r8d
movzx eax, r14b
cmp qword [rbp - 0x38], rcx
cmovne ecx, eax
movzx r14d, cl
mov edx, 0x40
mov ecx, 0x1bb
mov eax, dword [rsp + 0x44]
shl eax, 4
add esi, eax
cmp esi, dword [rsp + 0x78]
ja case.0x18001e3ed.13
mov edi, 1
jmp 0x18001e2a3
mov rdx, qword [rbp + 0x58]
mov ecx, 0xe8
call fcn.18000e8e0
mov ebx, edi
jmp case.0x18001e3ed.13
xor r14d, r14d
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x18001ec63
mov r8, qword [rbp + 0x158]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x148]
call fcn.18004ebc0
mov qword [rbp + 0x148], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp + 0x108]
call fcn.180003a80
nop
mov rdi, qword [rbp + 8]
test rdi, rdi
je 0x18001ecd1
mov rsi, qword [rbp + 0x10]
cmp rdi, rsi
je 0x18001ec97
mov rcx, rdi
call fcn.180003340
add rdi, 0x28
cmp rdi, rsi
jne 0x18001ec82
mov rdi, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.18004ec10
mov qword [rbp + 8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x18001ecfa
mov r8, qword [rbp]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x10]
call fcn.18004eb70
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov rdx, qword [rbp + 0xc2]
cmp rdx, 0x10
jb 0x18001ed3e
inc rdx
mov rcx, qword [rbp + 0xaa]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ed39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ed39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093104
movdqa xmm0, xmmword [0x18009ec00]
movdqu xmmword [rbp + 0xba], xmm0
mov byte [rbp + 0xaa], 0
mov rdx, qword [rbp + 0xf2]
cmp rdx, 0x10
jb 0x18001ed99
inc rdx
mov rcx, qword [rbp + 0xda]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ed94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ed94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093104
movdqa xmm0, xmmword [0x18009ec00]
movdqu xmmword [rbp + 0xea], xmm0
mov byte [rbp + 0xda], 0
lea rcx, [rbp + 0x340]
call fcn.1800036a0
nop
lea rcx, [rbp + 0x270]
call fcn.180003750
mov eax, ebx
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.1800938b0
mov rbx, qword [rsp + 0x930]
add rsp, 0x8e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret