Function at 0x18005aa90
Capabilities:
Access the windows event log
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30b0]
mov eax, 0x31b0
call fcn.18006b110
sub rsp, rax
movaps xmmword [rsp + 0x31a0], xmm6
mov rax, qword [0x18008a300]
xor rax, rsp
mov qword [rbp + 0x3090], rax
mov r14, qword [rbp + 0x3110]
xor r10d, r10d
imul r15d, edx, 0x798
mov ebx, r10d
mov qword [rbp - 0x58], rcx
mov eax, edx
mov dword [rsp + 0x5c], edx
mov rsi, r8
mov dword [rsp + 0x78], edx
mov r13, rcx
mov qword [rsp + 0x68], r9
mov edi, r10d
cmp edx, r15d
mov dword [rsp + 0x60], r15d
mov r15d, dword [rsp + 0x40]
mov rdx, qword [rbp - 0x58]
mov dword [rsp + 0x7c], r15d
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x70], r10
mov qword [rbp - 0x68], rbx
ja 0x18005b10a
mov ecx, dword [rsp + 0x40]
lea r8d, [r10 + 0x72]
movsd xmm6, qword [0x180082030]
movabs r12, 0x6c006c0064
mov dword [rbp - 0x7c], ecx
movzx ecx, byte [rsp + 0x58]
mov byte [rsp + 0x48], cl
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x50], rcx
mov ecx, dword [rsp + 0x60]
mov qword [rbp - 0x50], rdx
nop dword [rax]
cmp eax, 0x8ba6
ja 0x18005ae42
je 0x18005ad14
cmp eax, 0x2ed6
ja 0x18005ac46
je 0x18005ac11
sub eax, 0x6e
je 0x18005abdd
sub eax, 0x3a
je 0x18005abcd
sub eax, 0x17
je 0x18005abbc
cmp eax, 0x18
jne 0x18005b075
mov rdx, qword [r9]
mov rcx, r14
call fcn.1800469c0
mov r9, qword [rsp + 0x68]
mov r8d, 0x72
mov ecx, dword [rsp + 0x60]
xor r10d, r10d
jmp 0x18005b075
mov word [rbp - 0x38], r8w
mov dword [rbp - 0x37], 0x766365
jmp 0x18005b075
mov eax, dword [r13]
mov dword [rsi + 0x14], eax
mov dword [rbp - 0x78], r10d
jmp 0x18005b075
cmp dword [rsi + 0xf0], 0
mov r15d, dword [rsi + 0xc]
mov dword [rsp + 0x7c], r15d
je 0x18005b0e6
mov dword [rsp + 0x28], SHTestTokenMembership
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0x20], r10
xor edx, edx
xor ecx, ecx
call fcn.180046e80
jmp 0x18005aba5
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x1080
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsp + 0x68]
xor r10d, r10d
mov ecx, dword [rsp + 0x60]
mov dword [rsi + 0x12fc], r10d
mov r8d, dword [r13 + 0xc]
mov dword [rbp - 0x7c], r8d
lea r8d, [r10 + 0x72]
jmp 0x18005b075
cmp eax, 0x4788
je case.0x18005b0e4.127
cmp eax, 0x5153
je 0x18005ad0a
cmp eax, 0x5b8b
je 0x18005acd6
cmp eax, 0x5d3e
jne 0x18005b075
mov rdx, rsi
mov ecx, 0x28
call fcn.18001d720
movd xmm1, dword [rsi + 0x24]
cvtdq2pd xmm1, xmm1
mov dword [rbp - 0x80], eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm6
comisd xmm1, xmm0
jbe 0x18005aba5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._ECS_:_OnTimer:_SendRequestAsync___fails._Probably_HttpClientManager_is_busy.
call fcn.18006a5b0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Configure_backtrace_variables_such_as_the_backtrace_limit
call fcn.18006a5b0
jmp 0x18005aba5
cmp qword [rsi + 0x18], 0x10
mov rdi, rsi
mov qword [rbp - 0x70], rsi
jb 0x18005aceb
mov rdi, qword [rsi]
mov qword [rbp - 0x70], rdi
cmp qword [r13 + 0x18], 0x10
mov rbx, r13
mov qword [rbp - 0x68], rbx
jb 0x18005b075
mov rbx, qword [r13]
mov qword [rbp - 0x68], rbx
jmp 0x18005b075
mov word [rbp - 0x30], r10w
jmp 0x18005b075
mov eax, dword [rsi + 0x24]
mov rdx, r10
sub dword [rbp - 0x80], eax
mov edi, r10d
mov qword [rbp - 0x60], rdx
mov dword [rsp + 0x70], r10d
nop dword [rax]
mov rcx, r10
mov ebx, r10d
mov qword [rbp - 0x48], rcx
nop word [rax + rax]
mov r14d, r10d
test r15d, r15d
jle 0x18005adc8
lea eax, [rdi + rbx]
mov edi, dword [rsp + 0x7c]
shl eax, 5
lea r12, [rdx + rcx]
movsxd r15, eax
lea r13, [rsi + 0x1fd8]
add r15, r15
shl r12, 8
nop dword [rax + rax]
mov rcx, qword [rsi + 0x1f90]
lea rdx, [rsi + 0xf4]
add rdx, r15
mov dword [rsp + 0x40], r14d
add rcx, r12
mov qword [rsp + 0x20], r13
mov r9d, 0xf7
lea r8, [rsp + 0x40]
call fcn.180067c40
inc r14d
add r15, 0x900
add r12, 0x2400
cmp r14d, edi
jl 0x18005ad70
mov rcx, qword [rbp - 0x48]
xor r10d, r10d
mov edi, dword [rsp + 0x70]
mov rdx, qword [rbp - 0x60]
mov r15d, dword [rsp + 0x7c]
inc rcx
inc ebx
mov qword [rbp - 0x48], rcx
cmp ebx, 0xc
jl 0x18005ad40
add edi, 0xc
add rdx, 0xc
mov dword [rsp + 0x70], edi
mov qword [rbp - 0x60], rdx
cmp edi, 0x24
jl 0x18005ad30
mov eax, dword [rsi + 0x501c]
lea rdx, [rsi + 0x1500]
mov r9, qword [rsi + 0x1f90]
lea r8, [rsp + 0x70]
mov rbx, qword [rbp - 0x68]
mov ecx, 0xeb
mov rdi, qword [rbp - 0x70]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], r15d
call fcn.180015100
mov r9, qword [rsp + 0x68]
mov r14, qword [rbp - 0x40]
mov r13, qword [rbp - 0x58]
jmp 0x18005b060
cmp eax, 0x1430f
ja 0x18005aec8
je 0x18005aea8
cmp eax, 0xa1e7
je 0x18005ae8c
cmp eax, 0xb63f
je 0x18005ae82
mov rdx, qword [rsp + 0x50]
cmp eax, 0xf27b
jne 0x18005b07a
mov eax, dword [0x18007b694]
mov dword [rbp - 0x2e], eax
movzx eax, word [0x18007b698]
mov word [rbp - 0x2a], ax
jmp 0x18005b07a
mov byte [rsp + 0x58], 0
jmp 0x18005b075
mov r8d, 1
lea rdx, [0x18007a92c]
lea rcx, [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18005aba5
mov r8d, 0xa
mov dword [rbp - 0x2a], 0x5f
lea rdx, [rbp - 0x28]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
jmp 0x18005aba5
cmp eax, 0x16ba7
je 0x18005af3e
cmp eax, 0x193a3
je 0x18005af1a
cmp eax, 0x1e437
jne 0x18005b075
mov r8d, 0x114
mov byte [rsp + 0x48], 1
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.180006550
mov r9, qword [rsp + 0x68]
xor r10d, r10d
mov ecx, dword [rsp + 0x60]
mov edx, r10d
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x50], rdx
lea r8d, [r10 + 0x72]
jmp 0x18005b07a
mov r8d, 0xa
lea rdx, [rbp - 0x26]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultow]
mov dword [rbp - 0x24], 0x2e
mov qword [rbp - 0x22], r12
jmp 0x18005aba5
cmp qword [r9], 0
mov qword [rbp - 0x60], r10
jbe 0x18005b06b
nop dword [rax]
movzx r12d, byte [rsp + 0x58]
mov r15d, 0xa2
nop dword [rax]
mov eax, r15d
sub eax, 0xa2
je 0x18005afa5
cmp eax, 0x31
jne 0x18005b024
mov rdx, qword [rsi + 0x18]
mov rcx, rsi
cmp rdx, 0x10
jb 0x18005af83
mov rcx, qword [rsi]
add rcx, qword [rsi + 0x10]
inc rdi
cmp rdi, rcx
jne 0x18005b024
mov rdi, rsi
cmp rdx, 0x10
jb 0x18005b024
mov rdi, qword [rsi]
jmp 0x18005b024
movzx r9d, byte [rdi]
mov rcx, qword [r14 + 0x10]
add r9b, r12b
add r9b, byte [rbx]
mov rdx, qword [r14 + 0x18]
and r9b, 0xf
cmp rcx, rdx
jae 0x18005afdf
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x18005afd4
mov rax, qword [r14]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18005afee
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180002020
mov rcx, r14
call fcn.18001f940
mov rdx, qword [r13 + 0x18]
mov rcx, r13
movzx r12d, byte [rax]
cmp rdx, 0x10
jb 0x18005b00b
mov rcx, qword [r13]
add rcx, qword [r13 + 0x10]
inc rbx
cmp rbx, rcx
jne 0x18005b024
mov rbx, r13
cmp rdx, 0x10
jb 0x18005b024
mov rbx, qword [r13]
add r15d, 0x31
cmp r15d, 0x104
jb 0x18005af60
mov r9, qword [rsp + 0x68]
mov byte [rsp + 0x58], r12b
mov r12, qword [rbp - 0x60]
inc r12
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], r12
cmp r12, qword [r9]
jb 0x18005af50
mov r15d, dword [rsp + 0x7c]
mov ecx, dword [rsp + 0x60]
xor r10d, r10d
lea r8d, [r10 + 0x72]
movabs r12, 0x6c006c0064
mov rdx, qword [rsp + 0x50]
imul eax, dword [rsp + 0x5c], 0x6c
add dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x78]
cmp eax, ecx
jbe 0x18005ab60
movzx r10d, byte [rsp + 0x48]
mov rdi, qword [rbp - 0x50]
mov r9d, dword [rsp + 0x5c]
lea r12d, [r9 + 0x12]
mov dword [rsp + 0x60], r12d
cmp r9d, r12d
jae case.0x18005b0e4.127
mov ebx, dword [rsp + 0x40]
movsxd r8, r15d
mov qword [rsp + 0x68], r8
lea eax, [r9 - 0x6e]
lea r11, [0x180000000]
cmp eax, 0x57
ja case.0x18005b0e4.128
movzx eax, byte [r11 + rax + 0x5bc58]
mov ecx, dword [r11 + rax*4 + 0x5bc0c]
add rcx, r11
jmp rcx
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str._Header:_NSS_3.14.3.0_Basic_ECC_Beta__Aug__1_2014_06:14:54__
call fcn.18006a5b0
mov eax, 0xffffffff
jmp 0x18005b4a9
movzx r10d, byte [rsp + 0x58]
mov rdi, qword [rbp - 0x58]
mov eax, dword [rsp + 0x40]
mov byte [rsp + 0x48], r10b
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x7c], eax
mov qword [rsp + 0x50], rdx
jmp 0x18005b099
mov r14, qword [r13 + 0x10]
xor ecx, ecx
movsxd rdi, dword [rsp + 0x78]
test rdx, rdx
movzx eax, r10b
cmovne ecx, eax
mov byte [rsp + 0x48], cl
mov rcx, qword [r13 + 0x18]
mov rax, rcx
sub rax, r14
cmp rdi, rax
ja 0x18005b18c
lea rax, [rdi + r14]
mov r15, r13
mov qword [r13 + 0x10], rax
cmp rcx, 0x10
jb 0x18005b16b
mov r15, qword [r13]
lea rcx, [r15 + r14]
mov r8, rdi
lea rdx, [rbp + 0x1090]
call sub.VCRUNTIME140.dll_memmove
lea rax, [r15 + rdi]
mov byte [rax + r14], 0
jmp 0x18005bba6
lea r9, [rbp + 0x1090]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.180002180
jmp 0x18005bba6
lea rdx, [rbp - 0x18]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
cmp dword [rsp + 0x78], 0
mov rdx, rax
mov qword [rsp + 0x50], rax
je 0x18005b4a2
mov r8, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x5c]
jmp case.0x18005b0e4.128
mov rdx, qword [rsi + 0x1f80]
lea r9, [rsi + 0x1300]
mov r8, r13
mov qword [rsp + 0x20], rsi
mov ecx, 0x17
call fcn.180051980
jmp 0x18005bba6
xor edx, edx
mov r8d, 0x10b
mov rcx, rsi
call fcn.18005cf70
test al, al
je 0x18005b4a2
movups xmm0, xmmword [str.seconds_flag]
lea rdx, [rbp + 0x1090]
movzx eax, word [0x18007b788]
movsd xmm1, qword [0x18007b780]
xor r9d, r9d
mov rcx, qword [rsi]
mov r8d, 0x2000
movups xmmword [rbp - 0x18], xmm0
mov word [rbp], ax
movsd qword [rbp - 8], xmm1
call rdi
mov dword [rsp + 0x78], eax
jmp 0x18005bba6
cmp dword [rsi + 0x68], 0
je 0x18005b285
mov r9d, 0x90
mov dword [rsp + 0x40], 0x10
lea r8, [rsp + 0x40]
mov dword [rsp + 0x70], 0
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.180022360
lea r8, [rsi + 0x1300]
mov r9, rsi
mov edx, 0x130
mov rcx, r13
call fcn.180062950
jmp 0x18005bba6
mov byte [rbp - 0x78], 1
jmp case.0x18005b0e4.128
test r10b, r10b
je case.0x18005b0e4.128
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18005bba6
mov rax, qword [rsi + 0x1f88]
lea rcx, [rsi + 0x1500]
mov r9, qword [rsi + 0x1f80]
lea rdx, [rsi + 0x1800]
mov qword [rsp + 0x38], rax
lea r8, [rsi + 0x1300]
mov dword [rsp + 0x30], 0xb4
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsi + 0x1f90]
mov qword [rsp + 0x20], rdx
mov rdx, rsi
call fcn.18001dee0
jmp 0x18005bba6
lea rdx, [rsi + 0x1500]
mov r9d, 0xb5
lea r8, [rsi + 0x1400]
mov rcx, rsi
call fcn.180048fb0
lea rax, [rsi + 0x1b80]
mov r9d, 0xc2
mov qword [rsp + 0x28], rax
lea r8, [rsi + 0x1300]
lea rax, [rbp - 0x80]
mov rdx, rsi
lea rcx, [rsi + 0x1400]
mov qword [rsp + 0x20], rax
call fcn.1800078c0
mov r9, r13
xor edx, edx
mov r8d, 0x12a
mov rcx, rsi
call fcn.180033bb0
jmp 0x18005bba6
xor edi, edi
cmp dword [rbp - 0x80], edi
jle case.0x18005b0e4.128
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x40]
mov edx, 0x8e
mov rcx, r13
call fcn.180025090
inc edi
cmp edi, dword [rbp - 0x80]
jl 0x18005b383
jmp 0x18005bba6
mov r15d, ebx
and r15d, 7
je 0x18005b44d
mov r14d, 0x36
cmp r14d, 0x36
je 0x18005b3f5
cmp r14d, 0xd6
je 0x18005b3d2
cmp r14d, 0x176
je 0x18005b100
jmp 0x18005b439
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.support
lea rdx, str.const_int_gl_MaxTessEvaluationAtomicCounterBuffers___d_
call fcn.18006a5b0
jmp 0x18005b439
mov edi, ebx
mov ecx, 2
shr edi, 3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, edi
mov dword [rsp + 0x20], r15d
mov rcx, rax
lea rdx, str.AFEFFFBFFFFFFFCFFFFFFFFFFFFFFFDtext
mov r8d, ebx
call fcn.18006a5b0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.pending_render_frame_host___IsRenderFrameLive__
call fcn.18006a5b0
add r14d, 0xa0
cmp r14d, 0x216
jb 0x18005b3b4
cmp dword [rsi + 0x20], 0
je 0x18005b463
mov r8, r13
mov rdx, rsi
mov ecx, 0x123
call fcn.180011920
cmp dword [rsi + 0x68], 0
je 0x18005bba6
mov eax, dword [rsi + 0x12fc]
lea rdx, [rsp + 0x40]
mov ecx, dword [rbp - 0x7c]
mov r8d, 0xdb
shr rcx, 3
add rcx, qword [r13]
mov dword [rsp + 0x40], eax
call fcn.18002ea60
jmp 0x18005bba6
cmp dword [rsp + 0x78], 0
jge case.0x18005b0e4.128
mov byte [rbp - 0x78], 0
mov eax, dword [rbp - 0x78]
mov rcx, qword [rbp + 0x3090]
xor rcx, rsp
call fcn.18006b180
mov rbx, qword [rsp + 0x31f8]
movaps xmm6, xmmword [rsp + 0x31a0]
add rsp, 0x31b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [rsi + 0x4ff8], 0
je 0x18005b512
cmp dword [rsi + 0x1c], 0
je 0x18005b512
mov r9d, 0x90
mov dword [rsp + 0x40], 8
lea r8, [rsp + 0x40]
mov dword [rsp + 0x70], 0
mov rdx, r13
lea rcx, [rsp + 0x70]
call fcn.180022360
cmp dword [rsi + 0x6c], 0
je 0x18005b57a
mov ebx, dword [rsi + 0x70]
sub ebx, 1
js 0x18005b57a
movsxd rdi, ebx
shl rdi, 2
nop word [rax + rax]
lea rax, [rsi + 0x74]
mov dword [rsp + 0x40], ebx
add rax, rdi
lea r9, [rsi + 0x1300]
mov qword [rsp + 0x30], rax
lea r8, [rsi + 0x1400]
mov qword [rsp + 0x28], rsi
lea rdx, [rsi + 0x1500]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xcd
call fcn.18000b550
add rdi, 0xfffffffffffffffc
sub ebx, 1
jns 0x18005b530
mov r12d, dword [rsp + 0x60]
xor ebx, ebx
cmp dword [rsi + 0x24], ebx
jle 0x18005b5a9
mov dword [rsp + 0x40], ebx
nop word [rax + rax]
lea r8, [rsp + 0x40]
mov edx, 0x8e
mov rcx, r13
call fcn.180025090
inc ebx
cmp ebx, dword [rsi + 0x24]
jl 0x18005b590
mov ebx, dword [r13 + 0xc]
sub ebx, dword [rbp - 0x7c]
jmp 0x18005bba6
cmp dword [rsi + 0x38], 1
jne 0x18005b795
inc dword [rsi + 0x12f8]
xor edx, edx
mov eax, dword [rsi + 0x12f8]
div dword [rsi + 0x3c]
test edx, edx
je 0x18005b795
test r8, r8
jle 0x18005bbb0
lea rcx, [rsi + 0x1b80]
mov rdx, r8
nop dword [rax + rax]
mov rax, qword [rcx - 0x200]
mov qword [rcx], rax
mov rax, qword [rcx - 0x1f8]
mov qword [rcx + 8], rax
mov rax, qword [rcx - 0x1f0]
mov qword [rcx + 0x10], rax
mov rax, qword [rcx - 0x1e8]
mov qword [rcx + 0x18], rax
mov rax, qword [rcx - 0x1e0]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx - 0x1d8]
mov qword [rcx + 0x28], rax
mov rax, qword [rcx - 0x1d0]
mov qword [rcx + 0x30], rax
mov rax, qword [rcx - 0x1c8]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx - 0x1c0]
mov qword [rcx + 0x40], rax
mov rax, qword [rcx - 0x1b8]
mov qword [rcx + 0x48], rax
mov rax, qword [rcx - 0x1b0]
mov qword [rcx + 0x50], rax
mov rax, qword [rcx - 0x1a8]
mov qword [rcx + 0x58], rax
mov rax, qword [rcx - 0x1a0]
mov qword [rcx + 0x60], rax
mov rax, qword [rcx - 0x198]
mov qword [rcx + 0x68], rax
mov rax, qword [rcx - 0x190]
mov qword [rcx + 0x70], rax
mov rax, qword [rcx - 0x188]
mov qword [rcx + 0x78], rax
mov rax, qword [rcx - 0x180]
mov qword [rcx + 0x80], rax
mov rax, qword [rcx - 0x178]
mov qword [rcx + 0x88], rax
mov rax, qword [rcx - 0x170]
mov qword [rcx + 0x90], rax
mov rax, qword [rcx - 0x168]
mov qword [rcx + 0x98], rax
mov rax, qword [rcx - 0x160]
mov qword [rcx + 0xa0], rax
mov rax, qword [rcx - 0x158]
mov qword [rcx + 0xa8], rax
mov rax, qword [rcx - 0x150]
mov qword [rcx + 0xb0], rax
mov rax, qword [rcx - 0x148]
mov qword [rcx + 0xb8], rax
mov rax, qword [rcx - 0x140]
mov qword [rcx + 0xc0], rax
mov rax, qword [rcx - 0x138]
mov qword [rcx + 0xc8], rax
mov rax, qword [rcx - 0x130]
mov qword [rcx + 0xd0], rax
mov rax, qword [rcx - 0x128]
mov qword [rcx + 0xd8], rax
mov rax, qword [rcx - 0x120]
mov qword [rcx + 0xe0], rax
mov rax, qword [rcx - 0x118]
mov qword [rcx + 0xe8], rax
mov rax, qword [rcx - 0x110]
mov qword [rcx + 0xf0], rax
mov rax, qword [rcx - 0x108]
mov qword [rcx + 0xf8], rax
lea rcx, [rcx + 0x100]
sub rdx, 1
jne 0x18005b5f0
jmp 0x18005bbb0
mov edx, 0xb7
nop word [rax + rax]
cmp edx, 0xb7
je 0x18005b977
cmp edx, 0x43e9
jne 0x18005bad6
cmp dword [rsi + 0x38], 1
jne 0x18005bad6
test r8, r8
jle 0x18005bad6
lea rcx, [rsi + 0x1980]
mov rax, qword [rcx + 0x200]
mov qword [rcx], rax
mov rax, qword [rcx + 0x208]
mov qword [rcx + 8], rax
mov rax, qword [rcx + 0x210]
mov qword [rcx + 0x10], rax
mov rax, qword [rcx + 0x218]
mov qword [rcx + 0x18], rax
mov rax, qword [rcx + 0x220]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x228]
mov qword [rcx + 0x28], rax
mov rax, qword [rcx + 0x230]
mov qword [rcx + 0x30], rax
mov rax, qword [rcx + 0x238]
mov qword [rcx + 0x38], rax
mov rax, qword [rcx + 0x240]
mov qword [rcx + 0x40], rax
mov rax, qword [rcx + 0x248]
mov qword [rcx + 0x48], rax
mov rax, qword [rcx + 0x250]
mov qword [rcx + 0x50], rax
mov rax, qword [rcx + 0x258]
mov qword [rcx + 0x58], rax
mov rax, qword [rcx + 0x260]
mov qword [rcx + 0x60], rax
mov rax, qword [rcx + 0x268]
mov qword [rcx + 0x68], rax
mov rax, qword [rcx + 0x270]
mov qword [rcx + 0x70], rax
mov rax, qword [rcx + 0x278]
mov qword [rcx + 0x78], rax
mov rax, qword [rcx + 0x280]
mov qword [rcx + 0x80], rax
mov rax, qword [rcx + 0x288]
mov qword [rcx + 0x88], rax
mov rax, qword [rcx + 0x290]
mov qword [rcx + 0x90], rax
mov rax, qword [rcx + 0x298]
mov qword [rcx + 0x98], rax
mov rax, qword [rcx + 0x2a0]
mov qword [rcx + 0xa0], rax
mov rax, qword [rcx + 0x2a8]
mov qword [rcx + 0xa8], rax
mov rax, qword [rcx + 0x2b0]
mov qword [rcx + 0xb0], rax
mov rax, qword [rcx + 0x2b8]
mov qword [rcx + 0xb8], rax
mov rax, qword [rcx + 0x2c0]
mov qword [rcx + 0xc0], rax
mov rax, qword [rcx + 0x2c8]
mov qword [rcx + 0xc8], rax
mov rax, qword [rcx + 0x2d0]
mov qword [rcx + 0xd0], rax
mov rax, qword [rcx + 0x2d8]
mov qword [rcx + 0xd8], rax
mov rax, qword [rcx + 0x2e0]
mov qword [rcx + 0xe0], rax
mov rax, qword [rcx + 0x2e8]
mov qword [rcx + 0xe8], rax
mov rax, qword [rcx + 0x2f0]
mov qword [rcx + 0xf0], rax
mov rax, qword [rcx + 0x2f8]
mov qword [rcx + 0xf8], rax
lea rcx, [rcx + 0x100]
sub r8, 1
jne 0x18005b7d2
jmp 0x18005bad6
mov edi, dword [rsi + 0x28]
lea eax, [rdi + 1]
cmp eax, 5
ja case.default.0x18005b993
cdqe
mov ecx, dword [r11 + rax*4 + 0x5bcb0]
add rcx, r11
jmp rcx
lea r9, [rsi + 0x1b80]
mov dword [rsp + 0x40], r15d
lea r8, [rsp + 0x40]
mov rdx, rsi
mov ecx, SHSetFolderPathW
call fcn.1800421b0
lea r11, [0x180000000]
jmp 0x18005bacd
lea r9, [rsi + 0x1b80]
mov rdx, rsi
lea r8, [rsi + 0x1500]
mov ecx, 0xef
call fcn.18003ee30
lea r11, [0x180000000]
jmp 0x18005bacd
lea r9, [rsi + 0x1d80]
mov qword [rsp + 0x20], rsi
lea rdx, [rsi + 0x1b80]
mov r8d, 0x12d
lea rcx, [rsi + 0xf4]
call fcn.18003b000
lea r11, [0x180000000]
jmp 0x18005bacd
lea rdx, [rsi + 0xf4]
mov dword [rsp + 0x20], 0xda
lea rcx, [rsi + 0x1b80]
mov r8, rsi
lea r9, [rbp + 0x10]
call fcn.18003c130
lea r11, [0x180000000]
jmp 0x18005bacd
lea rax, [rsi + 0x1b80]
mov r9d, 0x71
lea rdx, [rsi + 0xf4]
mov qword [rsp + 0x20], rax
lea rcx, [rsi + 0x1d80]
mov r8, rsi
call fcn.18004a1b0
lea r11, [0x180000000]
jmp 0x18005bacd
lea rax, [rsi + 0xf4]
mov r9, rsi
lea rdx, [rsi + 0x1b80]
mov qword [rsp + 0x20], rax
mov r8d, 0xa4
lea rcx, [rbp + 0x10]
call fcn.18004d040
lea r11, [0x180000000]
jmp 0x18005bacd
mov ecx, 0xdc
nop dword [rax]
mov eax, ecx
sub eax, 0xdc
je 0x18005bbda
cmp eax, 0x34
je 0x18005bacd
add ecx, 0x34
cmp ecx, 0x144
jb 0x18005bab0
mov edx, 0xb7
lea r9d, [rdx - 0x48]
mov r8, qword [rsp + 0x68]
add edx, 0x4332
cmp edx, 0x8664
jbe 0x18005b7a0
jmp 0x18005bbb0
lea r9, [rsi + 0x1d80]
mov edx, 0x50
lea r8, [rsi + 0x1500]
mov rcx, rsi
call fcn.18005c300
cmp dword [rsi + 0x18], 1
jne 0x18005bba6
mov eax, dword [rsi + 0x501c]
lea r9, [rsp + 0x40]
mov r8, qword [rsi + 0x1f88]
mov ecx, 0x2d
mov rdx, qword [rsi + 0x1f90]
mov dword [rsp + 0x40], eax
call fcn.180053c10
mov eax, dword [rsi + 0x501c]
lea rdx, [rsi + 0x1800]
mov r9, qword [rsi + 0x1f88]
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], eax
mov ecx, 0xeb
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], rax
call fcn.180015100
jmp 0x18005bba6
lea rax, [rsi + 0x1300]
mov dword [rsp + 0x28], 0x3f
lea r9, [rsi + 0x1400]
mov qword [rsp + 0x20], rax
lea rcx, [rsi + 0x1500]
mov r8, rsi
mov rdx, r13
call fcn.180046e80
mov r8, qword [rsp + 0x68]
mov r9d, dword [rsp + 0x5c]
mov rdx, qword [rsp + 0x50]
inc r9d
mov dword [rsp + 0x5c], r9d
cmp r9d, r12d
jae case.0x18005b0e4.127
mov r15d, dword [rsp + 0x7c]
movzx r10d, byte [rsp + 0x48]
mov rdi, qword [rbp - 0x50]
jmp 0x18005b0bc
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.Failed_to_get_current_mutator_value.
mov rcx, rax
call fcn.18006a5b0
mov eax, 0xffffffff
jmp 0x18005b4a9
shr ebx, 3
mov eax, ebx
jmp 0x18005b4a9