Function at 0x180006f80
Capabilities:
Check for software breakpoints
Check http status code
Copy file
Create service
Delete service
Get common file path
Get geographical location
Get session user name
Get user security identifier
Move file
Parse pe header
Set environment variable

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3368]
mov eax, 0x3468
call fcn.180073080
sub rsp, rax
mov ebx, dword [rbp + 0x33c0]
lea eax, [r8 + 0x11]
xor r14d, r14d
mov dword [rsp + 0x78], ebx
mov r15d, r8d
lea r10, [0x180000000]
mov r9d, r8d
mov r11, rcx
lea edx, [r14 + 0x65]
lea edi, [rdx - 0x5b]
lea r8d, [r14 + 9]
cmp r15d, eax
jae 0x18000a000
movzx esi, byte [rbp + 0x33c0]
mov r12, qword [rbp + 0x128]
movzx r13d, byte [rbp + 0x33c8]
mov dword [rbp - 0x80], esi
mov r14, qword [rbp + 0x33c8]
lea eax, [r15 - 0x2f]
movabs r10, 0x65006d0061004e
cmp eax, 0x2b
ja case.0x180007041.64
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0xe230]
mov ecx, dword [rcx + rax*4 + 0xe1e8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rcx, qword [r11]
lea rdx, [rbp + 0x328]
mov r8d, 0x52
movsx eax, word [rcx + 0x158]
mov qword [rbp + 0x678], rcx
lea rcx, [rbp + 0x678]
mov dword [rbp + 0x328], eax
call fcn.18005bea0
mov rsi, qword [rbp + 0x33b0]
lea r9, [rbp + 0x680]
xor r14d, r14d
lea rdx, [rbp + 0x368]
mov qword [rsp + 0x20], r14
mov rcx, qword [rsi]
lea r8d, [r14 + 0x14]
mov eax, dword [rcx + 0x15c]
mov qword [rbp + 0x680], rcx
xor ecx, ecx
mov dword [rbp + 0x368], eax
call fcn.180011aa0
mov rcx, qword [rsi]
lea r9, [rbp + 0x688]
lea r8d, [r14 + 0x14]
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x360]
mov eax, dword [rcx + 0x160]
mov qword [rbp + 0x688], rcx
xor ecx, ecx
mov dword [rbp + 0x360], eax
call fcn.180011aa0
mov r9d, dword [rbp + 0x33c0]
jmp 0x180008f90
mov rax, qword [r11]
lea rdx, [rbp + 0x358]
xor r14d, r14d
mov qword [rbp + 0x690], rax
lea rcx, [rbp + 0x690]
mov dword [rbp + 0x358], r14d
lea r8d, [r14 + 0x52]
call fcn.18005bea0
mov r9d, dword [rbp + 0x33c0]
jmp 0x180008f90
mov eax, dword [r11]
cmp eax, 0x1b
ja case.0x18000a0e7.100
lea r15, [0x180000000]
mov ecx, dword [r15 + rax*4 + 0xe25c]
add rcx, r15
jmp rcx
xor r9d, r9d
mov esi, r9d
nop
cmp esi, 7
ja case.default.0x180007166
mov eax, esi
mov ecx, dword [r15 + rax*4 + 0xe2cc]
add rcx, r15
jmp rcx
mov eax, dword [0x1800aa37c]
mov dword [rbp + 0x58a], eax
movzx eax, word [0x1800aa380]
mov word [rbp + 0x58e], ax
mov word [rbp + 0x590], r9w
jmp case.default.0x180007166
mov qword [rbp + 0x200], 0xffffffffffffffff
jmp case.default.0x180007166
mov dword [rbp + 0x51c], 0x65006d
mov dword [rbp + 0x520], 0x650053
mov dword [rbp + 0x524], 0x760072
jmp case.default.0x180007166
movsd xmm0, qword [0x1800aa452]
movzx eax, word [0x1800aa45a]
movsd qword [rbp + 0x590], xmm0
mov word [rbp + 0x598], ax
mov word [rbp + 0x59a], r9w
mov dword [rbp + 0x518], 0x61004e
jmp case.default.0x180007166
mov dword [rbp + 0x528], 0x630069
mov dword [rbp + 0x52c], 0x65
jmp case.default.0x180007166
mov r8d, 4
mov dword [rbp + 0x580], 0x4e
lea rdx, [0x1800aa4ac]
lea rcx, [rbp + 0x580]
call fcn.180076a10
xor r9d, r9d
inc esi
lea eax, [rsi + 0x6d]
cmp eax, 0x75
jb 0x180007150
mov r11, qword [rbp + 0x33b0]
jmp case.0x180007146.4
mov r8, qword [rbp + 0x200]
lea r9, [rbp + 0x7e8]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 1
xor eax, eax
lea rdx, [rbp + 0x518]
lea rcx, [rbp + 0x580]
mov dword [rbp + 0x7f8], eax
movups xmmword [rbp + 0x7e8], xmm0
call qword [sym.imp.ADVAPI32.dll_PrivilegedServiceAuditAlarmW]
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x54
jmp case.0x180007041.64
mov eax, 0x29
nop word [rax + rax]
cmp eax, 0x29
je 0x1800072b8
cmp eax, 0x30
je 0x1800072b8
cmp eax, 0x37
je 0x18000844f
cmp eax, 0x3e
je case.0x180007376.0
add eax, 7
cmp eax, 0x45
jb 0x1800072a0
mov ecx, 0xf0
mov eax, ecx
sub eax, 0xee
je 0x18000732f
sub eax, 1
je 0x1800072e3
cmp eax, 1
jne 0x1800072ec
mov dword [rbp + 0xc8], eax
jmp 0x18000851d
xor eax, eax
mov qword [rbp + 0x698], rax
dec ecx
cmp ecx, 0xed
ja 0x1800072c5
mov r15d, 0x59
mov r14d, 0xa7
mov eax, r14d
sub eax, 0xa7
je 0x180008d94
cmp eax, 1
jne 0x180008f76
mov eax, ebx
add rsp, 0x3468
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, dword [rbp + 0xc8]
lea rdx, [rbp + 0x698]
call qword [sym.imp.ole32.dll_CoGetMalloc]
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x54
jmp case.0x180007041.64
mov esi, 7
nop dword [rax]
cmp esi, 7
ja case.default.0x180007376
mov eax, esi
mov ecx, dword [r15 + rax*4 + 0xe2ec]
add rcx, r15
jmp rcx
xor eax, eax
mov word [rbp + 0x454], ax
jmp case.default.0x180007376
xor eax, eax
mov dword [rbp + 0x150], 0x730073
mov word [rbp + 0x154], ax
mov byte [rbp - 0x64], 1
jmp case.default.0x180007376
mov eax, 0x53
mov dword [rbp + 0x44a], 0x6d0061
mov word [rbp + 0x448], ax
mov eax, 0x65
mov word [rbp + 0x452], ax
mov dword [rbp + 0x44e], 0x6c0070
jmp case.default.0x180007376
mov eax, 0x69
mov dword [rbp + 0x140], 0x61004d
mov word [rbp + 0x144], ax
jmp case.default.0x180007376
mov eax, 0x6e
mov dword [rbp + 0x148], 0x430057
mov word [rbp + 0x146], ax
mov dword [rbp + 0x14c], 0x61006c
jmp case.default.0x180007376
cmp byte [rbp - 0x64], 0
je case.default.0x180007376
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_DestroyWindow]
dec esi
lea eax, [rsi + 0x3e]
cmp eax, 0x3d
ja 0x180007360
mov r11, qword [rbp + 0x33b0]
mov rcx, qword [rbp + 0x6a0]
mov eax, 0x6f
xor edx, edx
cmp eax, 0x234
jae case.0x180007146.12
cmp eax, 0x6f
je 0x18000747f
cmp eax, 0x106
je 0x1800090ce
cmp eax, 0x19d
jne 0x180007489
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x54
jmp case.0x180007041.64
mov rcx, rdx
mov qword [rbp + 0x6a0], rdx
add eax, 0x97
jmp 0x180007445
mov eax, 0x69
cmp eax, 0x97c2
ja case.0x180007146.14
cmp eax, 0x69
je 0x18000919a
cmp eax, 0x4c4a
je 0x1800074b7
add eax, 0x4be1
jmp 0x180007495
mov edx, dword [rbp + 0x33c0]
lea rcx, [rbp + 0xab0]
call qword [sym.imp.ADVAPI32.dll_CredWriteW]
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x54
jmp case.0x180007041.64
mov esi, 0x6d
mov eax, esi
sub eax, 0x6a
je case.0x180007376.0
sub eax, 1
je 0x180007529
sub eax, 1
je 0x180009286
cmp eax, 1
jne 0x180007547
lea r8d, [rax + 4]
lea rdx, [0x1800aa544]
lea rcx, [rbp + 0x798]
call fcn.18007b4a8
movabs rax, 0x3f0065006c0069
mov qword [rbp + 0x7a2], rax
jmp 0x180007547
xorps xmm0, xmm0
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x798]
movups xmmword [rbp + 0x240], xmm0
call qword [sym.imp.ADVAPI32.dll_RemoveUsersFromEncryptedFile]
dec esi
cmp esi, 0x69
ja 0x1800074e1
mov esi, 0x129
mov eax, esi
sub eax, 0x127
je case.0x180007376.0
sub eax, 1
je 0x18000935c
cmp eax, 1
jne 0x180007582
xor edx, edx
lea rcx, [rbp + 0xc10]
mov r8d, 0xdc
call fcn.1800746e0
dec esi
cmp esi, 0x126
ja 0x180007553
mov esi, 0xa2
cmp esi, 0xb640
ja case.0x180007146.22
cmp esi, 0xa2
je 0x1800075d8
cmp esi, 0x3d62
je 0x180009428
cmp esi, 0x7a22
jne 0x1800075ec
lea rcx, [rbp + 0xb50]
call qword [sym.imp.oledlg.dll_OleUIConvertW]
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x54
jmp case.0x180007041.64
xor edx, edx
lea rcx, [rbp + 0xb50]
mov r8d, 0xc0
call fcn.1800746e0
add esi, 0x3cc0
jmp 0x180007591
mov ecx, 0x58
nop dword [rax]
cmp ecx, 0x5a
jae case.0x180007146.26
mov eax, ecx
sub eax, 0x58
je 0x1800094f5
cmp eax, 1
je 0x18000761d
inc ecx
jmp 0x180007600
xor eax, eax
lea r8, [rbp + 0xb00]
mov qword [rsp + 0x38], rax
mov r9d, 0x1c
lea rax, [rbp + 0x650]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb00]
mov dword [rsp + 0x28], 0x1c
lea edx, [r9 - 0x1b]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x54
jmp case.0x180007041.64
mov r11, qword [rbp + 0x33b0]
mov r8d, 9
jmp 0x18000768d
xor r9d, r9d
lea r15, [0x180000000]
mov edx, 0xb2
mov eax, edx
sub eax, 0xae
je case.0x18000cbc8.17
sub eax, 1
je 0x18000777e
sub eax, 1
je 0x180007787
sub eax, 1
je 0x18000775d
cmp eax, 1
jne 0x180007787
movsx eax, byte [r9]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x1800076e9.49
cdqe
movzx eax, byte [r15 + rax + 0xe314]
mov ecx, dword [r15 + rax*4 + 0xe30c]
add rcx, r15
jmp rcx
cmp dword [r11 + 4], 0
jne 0x180007756
mov rcx, qword [r11 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9d, 0x48
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffb
jae 0x180007740
mov rax, qword [rbp + 0x33b0]
lea rcx, [rbp + 0x40]
mov edx, 0xb5
mov byte [rbp + 0x40], 0x75
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
jmp 0x18000774f
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
xor r9d, r9d
lea r8d, [r9 + 9]
mov dword [r11], 4
mov edx, 0xb1
jmp 0x180007787
mov eax, r8d
cmp eax, 9
je 0x180009efe
add eax, 0x38d
cmp eax, 0x38d
jbe 0x180007767
jmp 0x180007787
mov ebx, 1
mov dword [rsp + 0x78], ebx
dec edx
cmp edx, 0xad
ja 0x180007692
mov eax, 0x66
nop word [rax + rax]
cmp eax, 0x66
je 0x1800077b8
cmp eax, 0x396
je 0x1800082df
xor r14d, r14d
jmp 0x180007855
xor r14d, r14d
movsx eax, byte [r14]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18000c73e.14
cdqe
movzx eax, byte [r15 + rax + 0xe354]
mov ecx, dword [r15 + rax*4 + 0xe34c]
add rcx, r15
jmp rcx
cmp dword [r11 + 4], r14d
jne 0x180007849
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffc
jae 0x18000783a
movzx eax, byte [r14]
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x48], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
jmp 0x180007849
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
mov dword [r11], 5
mov eax, 0x66
add eax, 0x330
cmp eax, 0x660
jbe 0x1800077a0
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x57
jmp 0x180008f90
mov rax, qword [r11]
lea r8, [rbp + 0x338]
mov edx, 0x18
mov qword [rbp + 0x6a8], rax
lea rcx, [rbp + 0x6a8]
mov dword [rbp + 0x338], 0xe0
call fcn.18003ae20
jmp 0x180008f86
mov eax, 0x2b
nop dword [rax]
cmp eax, 0x2b
je 0x1800078c3
cmp eax, 0x7b
je case.0x18000cbc8.17
jmp 0x180007d56
xor esi, esi
movsx eax, byte [rsi]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18000c73e.14
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0xe3c8]
mov ecx, dword [rdx + rax*4 + 0xe38c]
add rcx, rdx
jmp rcx
mov ebx, 5
cmp ebx, 5
ja case.default.0x18000790b
mov eax, ebx
mov ecx, dword [rdx + rax*4 + 0xe440]
add rcx, rdx
jmp rcx
mov byte [rbp + 0x27c], sil
jmp case.default.0x18000790b
mov r9, qword [rbp + 0x1e8]
lea rdx, [rbp + 0x270]
mov r8, qword [rbp + 0x1f0]
mov rcx, qword [rbp + 0x1f8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.USER32.dll_DialogBoxParamA]
lea rdx, [0x180000000]
jmp case.default.0x18000790b
mov byte [rbp + 0x270], sil
jmp case.default.0x18000790b
mov r8d, 2
lea rdx, [0x1800aa572]
lea rcx, [rbp + 0x270]
call fcn.18007c4e0
mov r8d, 1
lea rdx, [0x1800aa593]
lea rcx, [rbp + 0x270]
call fcn.18007c4e0
mov r8d, 5
lea rdx, [0x1800aa59b]
lea rcx, [rbp + 0x270]
call fcn.18007c4e0
lea rdx, [0x180000000]
mov dword [rbp + 0x278], 0x656d614e
jmp case.default.0x18000790b
mov qword [rbp + 0x1f8], rsi
mov qword [rbp + 0x1f0], rsi
mov qword [rbp + 0x1e8], rsi
dec ebx
lea eax, [rbx + 0x67]
cmp eax, 0x66
ja 0x1800078f6
mov r11, qword [rbp + 0x33b0]
mov qword [r11], 1
jmp 0x180007d48
mov rax, qword [rsi]
test rax, rax
je 0x1800079f7
call rax
mov r11, qword [rbp + 0x33b0]
mov dword [r11], 0x19
jmp 0x180007d48
mov rax, qword [OleUIPromptUserA]
test rax, rax
je 0x180007a19
call rax
mov r11, qword [rbp + 0x33b0]
mov dword [r11], 0x1a
jmp 0x180007d48
mov rax, qword [0x10]
test rax, rax
je 0x180007d48
call rax
jmp case.0x18000790b.0
mov rax, qword [0x18]
jmp 0x180007a0b
mov dword [r11], 7
jmp 0x180007d48
mov dword [r11], edi
jmp 0x180007d48
mov dword [r11], 0xe
jmp 0x180007d48
mov rax, qword [0x48]
test rax, rax
je 0x180007d48
call rax
jmp case.0x18000790b.0
mov rax, qword [0x50]
test rax, rax
je 0x180007a95
call rax
mov r11, qword [rbp + 0x33b0]
mov dword [r11], 0x1b
jmp 0x180007d48
mov ecx, 0x11a
mov eax, ecx
sub eax, 0x11a
je 0x180007af2
cmp eax, 1
jne 0x180007af9
lea rdx, [rbp + 0x6b0]
mov qword [rbp + 0x6b0], 5
lea ecx, [rax + 0x7c]
call fcn.180036d40
mov rcx, qword [rbp + 0x33b0]
mov qword [rcx + 8], rax
test rax, rax
je 0x18000d698
mov byte [rbp + 0x50], 0x30
lea rcx, [rbp + 0x50]
mov r8, rax
jmp 0x180007d2e
mov qword [r11], 0x11
inc ecx
cmp ecx, 0x11c
jb 0x180007aa6
mov r15d, 0x99
mov r14d, 6
nop
cmp r14d, 6
ja case.default.0x180007b27
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0xe458]
add rcx, rdx
jmp rcx
mov dword [r11 + 4], esi
mov dword [rbp + 0xcc], esi
jmp case.default.0x180007b27
mov qword [rbp + 0x1e0], rsi
jmp case.default.0x180007b27
lea rdx, [rbp + 0x6b8]
mov dword [r11], 0x18
mov ecx, 0x7d
mov dword [rbp - 0x74], 5
mov qword [rbp + 0x6b8], 5
call fcn.180036d40
mov r11, qword [rbp + 0x33b0]
mov qword [r11 + 8], rax
test rax, rax
je 0x18000d698
mov dword [rbp + 0xb8], esi
lea rdx, [0x180000000]
jmp case.default.0x180007b27
mov dword [rbp + 0xd0], esi
jmp case.default.0x180007b27
mov qword [rbp + 0x6c0], rsi
jmp case.default.0x180007b27
movzx eax, byte [rsi]
lea rcx, [rbp + 0x58]
mov r8, qword [r11 + 8]
mov edx, 0xb5
mov byte [rbp + 0x58], al
mov dword [rbp + 0xd4], esi
call fcn.18005fbe0
cmp eax, 1
je 0x180007d8e
mov esi, 8
nop word [rax + rax]
lea rdx, [0x180000000]
cmp esi, 8
ja case.default.0x180007bfc
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0xe474]
add rcx, rdx
jmp rcx
mov eax, 0x794d
mov byte [rbp + 0x15a], 0
mov word [rbp + 0x158], ax
jmp case.default.0x180007bfc
mov byte [rsp + 0x7d], 1
jmp case.default.0x180007bfc
movzx eax, word [0x1800aa5be]
mov word [rbp + 0x15a], ax
movzx eax, byte [0x1800aa5c0]
mov byte [rbp + 0x15c], al
mov eax, 0x7250
mov word [rbp + 0x15d], ax
mov byte [rbp + 0x15f], 0
jmp case.default.0x180007bfc
mov byte [rbp + 0x164], 0
jmp case.default.0x180007bfc
xor r8d, r8d
mov qword [rbp + 0x510], 0xffffffffffffffff
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x158]
call qword [sym.imp.WINSPOOL.DRV_OpenPrinterA]
lea rdx, [0x180000000]
test eax, eax
jne case.default.0x180007bfc
mov byte [rsp + 0x7d], al
jmp case.default.0x180007bfc
mov ebx, 6
jmp case.default.0x180007bfc
mov eax, dword [0x1800aa5de]
mov dword [rbp + 0x15f], eax
movzx eax, byte [0x1800aa5e2]
mov byte [rbp + 0x163], al
jmp case.default.0x180007bfc
cmp byte [rsp + 0x7d], 0
je case.default.0x180007bfc
mov rcx, qword [rbp + 0x510]
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
lea rdx, [0x180000000]
dec esi
lea eax, [rsi + 0x10a]
cmp eax, 0x109
ja 0x180007be0
xor esi, esi
mov r11, qword [rbp + 0x33b0]
dec r15d
dec r14d
cmp r15d, 0x92
ja 0x180007b10
mov ebx, 0x87
nop dword [rax]
cmp ebx, 0xd9
jae case.0x18000c73e.14
mov eax, ebx
sub eax, 0x87
je 0x180007de8
cmp eax, 0x29
jne 0x180007e23
mov r8, qword [r11 + 8]
lea rcx, [rbp + 0x60]
mov byte [rbp + 0x60], 0x2d
mov edx, 0xb5
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
mov ebx, 1
mov eax, 0x2b
mov dword [rsp + 0x78], ebx
add eax, 0x50
cmp eax, 0xcb
jb 0x1800078b0
movabs r10, 0x65006d0061004e
mov ecx, 0xe3
mov eax, ecx
sub eax, 0xe3
je 0x180007e2b
cmp eax, 0x51
je case.0x18000cbc8.17
jmp 0x180008296
lea rdx, [0x180000000]
jmp 0x180007cde
mov r9d, dword [rbp + 0xcc]
lea rax, [rbp + 0x6c0]
mov r8, qword [rbp + 0x1e0]
xor edx, edx
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov eax, dword [rbp + 0xd4]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp + 0xb8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp - 0x74]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0xd0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.oledlg.dll_OleUIAddVerbMenuA]
jmp case.0x18000790b.0
lea rdx, [rbp + 0x6c8]
mov qword [r11], 0x17
mov ecx, 0x7d
mov qword [r11 + 8], rsi
mov qword [rbp + 0x6c8], 5
call fcn.180036d40
mov r11, qword [rbp + 0x33b0]
mov qword [r11 + 8], rax
test rax, rax
je 0x18000d698
add ebx, 0x29
jmp 0x180007d00
xor r15d, r15d
movzx eax, byte [r15]
cmp al, 0x22
je 0x1800081d4
cmp al, 0x5c
je 0x18000815b
mov esi, 6
mov r14d, 0xb5
nop dword [rax]
cmp esi, 6
ja case.default.0x180007e6c
lea rdx, [0x180000000]
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0xe498]
add rcx, rdx
jmp rcx
mov r8d, 2
lea rdx, [0x1800aa5fc]
lea rcx, [rbp + 0x5a6]
call fcn.18007b4a8
mov eax, dword [0x1800aa600]
lea rdx, str.isting
mov dword [rbp + 0x5a8], eax
lea rcx, [rbp + 0x5a0]
movzx eax, word [0x1800aa604]
mov word [rbp + 0x5ac], ax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [0x1800aa618]
mov dword [rbp + 0x5b8], eax
movzx eax, word [0x1800aa61c]
mov word [rbp + 0x5bc], ax
jmp case.default.0x180007e6c
mov r8d, 1
mov word [rbp + 0x50c], r15w
lea rdx, [0x1800aa634]
lea rcx, [rbp + 0x50c]
call fcn.18007b4a8
jmp case.default.0x180007e6c
mov qword [rbp + 0x4f8], r10
mov word [rbp + 0x500], r15w
jmp case.default.0x180007e6c
mov r8d, 2
lea rdx, [0x1800aa67e]
lea rcx, [rbp + 0x500]
call fcn.18007b4a8
mov r8d, 4
mov word [rbp + 0x504], r15w
lea rdx, [0x1800aa728]
lea rcx, [rbp + 0x504]
call fcn.18007b4a8
jmp case.default.0x180007e6c
mov eax, 0x4e
mov word [rbp + 0x50e], r15w
mov dword [rbp + 0x5a0], eax
mov eax, dword [0x1800aa7bc]
mov dword [rbp + 0x5a2], eax
movzx eax, word [0x1800aa7c0]
mov word [rbp + 0x5a6], ax
jmp case.default.0x180007e6c
mov eax, 0x6c
mov dword [rbp + 0x5bc], eax
mov eax, 0x65
mov dword [rbp + 0x5be], eax
cmp dword [r11 + 4], r15d
jne 0x180008111
mov ebx, 0x123
cmp ebx, 0x6408
ja 0x180008048
je 0x180008026
cmp ebx, 0x123
je 0x180008009
cmp ebx, 0x221a
je 0x180007fe4
cmp ebx, 0x4311
jne 0x1800080ae
mov dword [rbp + 0x1c1], 0x75517265
mov byte [rbp + 0x1c5], r15b
jmp 0x1800080ae
mov r8d, 4
lea rdx, [0x1800aa7d9]
lea rcx, [rbp + 0x1bd]
call fcn.18007b500
mov byte [rbp + 0x1c1], r15b
jmp 0x1800080ae
mov byte [rbp + 0x1b8], 0x44
mov dword [rbp + 0x1b9], 0x74656c65
mov byte [rbp + 0x1bd], r15b
jmp 0x1800080ae
mov r8d, 5
lea rdx, [0x1800aa82d]
lea rcx, [rbp + 0x1c5]
call fcn.18007b500
mov byte [rbp + 0x1ca], r15b
jmp 0x1800080ae
cmp ebx, 0x84ff
je 0x1800080a7
cmp ebx, 0xa5f6
je 0x18000809e
cmp ebx, 0xc6ed
jne 0x1800080ae
mov r8d, 1
lea rdx, [0x1800aa7cf]
lea rcx, [rbp + 0x1b8]
call fcn.18007c4e0
mov r8, qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x1120]
mov word [rbp + 0x1cc], 0x70
call fcn.180001130
jmp 0x1800080ae
mov byte [rbp + 0x1cb], r15b
jmp 0x1800080ae
mov byte [rbp + 0x1ca], 0x20
add ebx, 0x20f7
cmp ebx, 0xe6c1
jbe 0x180007fa4
mov rbx, qword [rbp + 0x33b0]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rcx, qword [rbx + 8]
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffe
jae 0x18000810a
movzx eax, byte [r15]
lea rcx, [rbp + 0x68]
mov r8, qword [rbx + 8]
mov edx, 0xb5
mov byte [rbp + 0x68], al
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
jmp 0x180008111
mov dword [rbx + 4], 1
xor r9d, r9d
mov dword [rsp + 0x20], 2
xor r8d, r8d
lea rdx, [rbp + 0x4f8]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov r11, qword [rbp + 0x33b0]
dec r14d
dec esi
movabs r10, 0x65006d0061004e
cmp r14d, 0xae
ja 0x180007e50
jmp case.0x180007e6c.0
cmp dword [r11 + 4], r15d
jne 0x1800081c8
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffd
jae 0x1800081b9
mov rax, qword [rbp + 0x33b0]
lea rcx, [rbp + 0x78]
mov edx, 0xb5
mov byte [rbp + 0x78], 0x5c
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
mov dword [r11], 2
jmp case.0x180007e6c.0
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
mov dword [r11], 2
jmp case.0x180007e6c.0
mov rcx, qword [r11 + 8]
lea rbx, [r11 + 8]
test rcx, rcx
je 0x180008208
mov dword [r11], r15d
mov rax, qword [0x20]
test rax, rax
je 0x1800081f6
mov rcx, qword [rcx]
call rax
mov rdx, rbx
mov ecx, 0x117
call fcn.180020110
jmp case.0x180007e6c.0
mov ebx, 0x25
nop dword [rax]
mov eax, ebx
sub eax, 0x25
je 0x180008223
cmp eax, 0x78
jne 0x18000827d
mov eax, edi
jmp 0x18000731b
xorps xmm0, xmm0
mov dword [rbp + 0x900], 0x88
xor eax, eax
lea rcx, [rbp + 0x900]
movups xmmword [rbp + 0x904], xmm0
mov dword [rbp + 0x984], eax
movups xmmword [rbp + 0x914], xmm0
movups xmmword [rbp + 0x924], xmm0
movups xmmword [rbp + 0x934], xmm0
movups xmmword [rbp + 0x944], xmm0
movups xmmword [rbp + 0x954], xmm0
movups xmmword [rbp + 0x964], xmm0
movups xmmword [rbp + 0x974], xmm0
call qword [sym.imp.oledlg.dll_OleUIPasteSpecialA]
add ebx, 0x78
cmp ebx, 0x115
jb 0x180008210
mov ebx, 1
mov ecx, 0xe3
mov dword [rsp + 0x78], ebx
mov r11, qword [rbp + 0x33b0]
add ecx, 0x51
movabs r10, 0x65006d0061004e
cmp ecx, 0x185
jb 0x180007d73
mov r9d, dword [rbp + 0x33c0]
mov r15d, 0x55
jmp case.0x180007041.64
mov ecx, 0x69
nop dword [rax]
mov eax, ecx
sub eax, 0x69
je 0x1800082e9
cmp eax, 1
jne 0x1800082f4
mov dword [r11], r8d
mov eax, 1
jmp 0x18000731b
xor eax, eax
cmp byte [rax], 0x75
jne case.0x18000c73e.14
inc ecx
cmp ecx, 0x6b
jb 0x1800082d0
mov r15d, 0x5a
jmp case.0x180007041.64
mov rax, qword [r11]
lea r9, [rbp + 0x6d0]
xor r14d, r14d
mov dword [rbp + 0x340], 0x10
lea rdx, [rbp + 0x340]
mov qword [rbp + 0x6d0], rax
xor ecx, ecx
mov qword [rsp + 0x20], r14
lea r8d, [r14 + 0x14]
call fcn.180011aa0
mov rax, qword [rbp + 0x33b0]
lea r8d, [r14 + 0x52]
lea rdx, [rbp + 0x310]
mov dword [rbp + 0x310], 0x4a
lea rcx, [rbp + 0x6d8]
mov rax, qword [rax]
mov qword [rbp + 0x6d8], rax
call fcn.18005bea0
mov r9d, dword [rbp + 0x33c0]
jmp 0x180008f90
mov rax, qword [r11]
lea rdx, [rbp + 0x308]
mov r8d, 0x52
mov qword [rbp + 0x6e0], rax
lea rcx, [rbp + 0x6e0]
mov dword [rbp + 0x308], 0x46
call fcn.18005bea0
jmp 0x180008f86
mov rax, qword [r11]
lea rdx, [rbp + 0x300]
mov r8d, 0x52
mov qword [rbp + 0x6e8], rax
lea rcx, [rbp + 0x6e8]
mov dword [rbp + 0x300], 0x46
call fcn.18005bea0
mov rax, qword [rbp + 0x33b0]
lea rdx, [rbp + 0x2f8]
mov r8d, 0x52
mov dword [rbp + 0x2f8], 0x49
lea rcx, [rbp + 0x6f0]
mov rax, qword [rax]
mov qword [rbp + 0x6f0], rax
call fcn.18005bea0
jmp 0x180008f86
mov rax, qword [r11]
lea rdx, [rbp + 0x318]
xor r14d, r14d
mov qword [rbp + 0x6f8], rax
lea rcx, [rbp + 0x6f8]
mov dword [rbp + 0x318], r14d
lea r8d, [r14 + 0x52]
call fcn.18005bea0
mov r9d, dword [rbp + 0x33c0]
jmp 0x180008f90
lea r15, [0x180000000]
mov ecx, 0x12
mov eax, ecx
sub eax, 0x12
je 0x180008472
sub eax, 1
je 0x180008512
cmp eax, 1
je 0x1800082df
jmp 0x180008512
xor esi, esi
movsx eax, byte [rsi]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18000c73e.14
cdqe
movzx eax, byte [r15 + rax + 0xe4bc]
mov ecx, dword [r15 + rax*4 + 0xe4b4]
add rcx, r15
jmp rcx
cmp dword [r11 + 4], esi
jne 0x180008506
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffd
jae 0x1800084f7
movzx eax, byte [rsi]
lea rcx, [rbp + 0x80]
mov byte [rbp + 0x80], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
jmp 0x180008506
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
mov dword [r11], 6
mov ecx, 0x12
inc ecx
cmp ecx, 0x15
jb 0x180008454
mov ecx, 0x105
mov eax, ecx
sub eax, 0x105
je 0x180008555
sub eax, 0x2b
je 0x180008881
sub eax, 0x2b
je 0x180008547
cmp eax, 0x2b
je case.0x18000cbc8.17
jmp 0x180008881
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp 0x180008881
xor r15d, r15d
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x18000c73e.14
lea r8, [0x180000000]
cdqe
movzx eax, byte [r8 + rax + 0xe4fc]
mov ecx, dword [r8 + rax*4 + 0xe4f4]
add rcx, r8
jmp rcx
cmp dword [r11 + 4], r15d
jne 0x180008875
mov r14d, 0xb5
mov dword [rbp - 0x78], r14d
nop dword [rax + rax]
mov eax, r14d
sub eax, 0xb5
je 0x180008749
cmp eax, 1
jne 0x180008861
mov rcx, qword [r11 + 8]
lea r9d, [rax + 0x47]
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffe
jae 0x180008735
mov esi, 7
nop dword [rax]
cmp esi, 0x177
ja 0x180008699
je 0x18000866b
mov eax, esi
sub eax, 7
je 0x18000863a
sub eax, 0x5c
je 0x180008624
sub eax, 0x5c
je 0x180008617
cmp eax, 0x5c
jne 0x180008721
mov dword [rbp + 0x41a], 0x67006f
jmp 0x180008721
mov word [rbp + 0x41a], r15w
jmp 0x180008721
movabs rax, 0x6c006100690044
mov qword [rbp + 0x412], rax
jmp 0x180008721
mov eax, dword [0x1800aa8b6]
mov dword [rbp + 0x408], eax
movzx eax, word [0x1800aa8ba]
mov word [rbp + 0x40c], ax
mov dword [rbp + 0x40e], 0x65006c
mov word [rbp + 0x412], r15w
jmp 0x180008721
mov r8d, 2
mov word [rbp + 0x41e], r15w
lea rdx, [0x1800aa878]
lea rcx, [rbp + 0x41e]
call fcn.18007b4a8
mov word [rbp + 0x422], r15w
jmp 0x180008721
mov eax, esi
sub eax, 0x1d3
je 0x180008715
sub eax, 0x5c
je 0x1800086fd
cmp eax, 0xb8
jne 0x180008721
mov rdx, qword [rbp + 0x100]
lea r8, [rbp + 0x408]
mov rcx, qword [rbp + 0x208]
xor r9d, r9d
call qword [sym.imp.oledlg.dll_OleUIUpdateLinksW]
movzx eax, byte [r15]
lea rcx, [rbp + 0x88]
mov byte [rbp + 0x88], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
jmp 0x180008721
mov word [rbp + 0x424], r15w
mov qword [rbp + 0x208], r15
mov qword [rbp + 0x100], r15
jmp 0x180008721
mov eax, 0x78
mov word [rbp + 0x422], ax
add esi, 0x5c
cmp esi, 0x343
jb 0x1800085e0
jmp 0x18000885a
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
jmp 0x180008861
mov esi, 0xbc
mov edi, 0x6974
lea r13d, [rsi - 0x70]
lea r15d, [rsi - 0x5b]
nop dword [rax + rax]
cmp esi, 0x1d3
ja 0x1800087fb
je 0x1800087d9
mov eax, esi
sub eax, 0xbc
je 0x1800087c3
sub eax, 0x5d
je 0x1800087a3
cmp eax, 0x5d
jne 0x18000882c
mov word [rbp + 0x28c], r15w
mov word [rbp + 0x28d], di
mov dword [rbp + 0x28f], 0x6f506e6f
jmp 0x18000882c
mov dword [rbp + 0x282], 0x655361
mov dword [rbp + 0x285], 0x666e4974
mov dword [rbp + 0x289], 0x6d726f
jmp 0x18000882c
mov eax, 0x73
mov word [rbp + 0x280], r13w
mov word [rbp + 0x281], ax
jmp 0x18000882c
mov eax, 0x79
mov dword [rbp + 0x293], 0x63696c
mov word [rbp + 0x296], ax
mov dword [rbp + 0x297], 0xa702520
jmp 0x18000882c
mov eax, esi
sub eax, 0x230
je 0x180008825
cmp eax, 0x5d
jne 0x18000882c
mov r8, qword [sym.imp.ADVAPI32.dll_LsaSetInformationPolicy]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1320]
call fcn.180001130
jmp 0x18000882c
mov byte [rbp + 0x29b], 0
add esi, 0x5d
cmp esi, 0x2ea
jb 0x180008760
mov ebx, dword [rsp + 0x78]
mov edi, 0xa
mov r14d, dword [rbp - 0x78]
xor r15d, r15d
mov r12, qword [rbp + 0x128]
movzx r13d, byte [rbp + 0x33c8]
mov r11, qword [rbp + 0x33b0]
inc r14d
mov dword [rbp - 0x78], r14d
cmp r14d, 0xb7
jb 0x1800085a0
mov dword [r11], 1
mov ecx, 0x105
add ecx, 0x2b
cmp ecx, 0x1b1
jb 0x180008522
mov r15d, 0x58
jmp 0x180008f86
mov rax, qword [r11]
lea rdx, [rbp + 0x2f0]
xor r14d, r14d
mov qword [rbp + 0x700], rax
lea rcx, [rbp + 0x700]
mov dword [rbp + 0x2f0], r14d
lea r8d, [r14 + 0x52]
call fcn.18005bea0
mov rsi, qword [rbp + 0x33b0]
lea r8d, [r14 + 0x52]
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rsi]
movsx eax, word [rcx + 0x154]
mov qword [rbp + 0x720], rcx
lea rcx, [rbp + 0x720]
mov dword [rbp + 0x2e8], eax
call fcn.18005bea0
mov rcx, qword [rsi]
lea r8d, [r14 + 0x52]
lea rdx, [rbp + 0x2e0]
movsx eax, word [rcx + 0x156]
mov qword [rbp + 0x728], rcx
lea rcx, [rbp + 0x728]
mov dword [rbp + 0x2e0], eax
call fcn.18005bea0
mov r9d, dword [rbp + 0x33c0]
jmp 0x180008f90
mov rax, qword [r11]
mov rcx, qword [rax + 0x278]
lea rax, [0x18001f440]
mov qword [rcx], rax
jmp case.0x180007041.64
mov eax, 0xd8
cmp eax, 0xd8
je 0x18000896d
cmp eax, 0x192
je case.0x18000cbc8.17
xor r14d, r14d
jmp 0x180008d78
xor r14d, r14d
movsx eax, byte [r14]
add eax, 0xffffffde
cmp eax, 0x53
ja case.0x18000c73e.14
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0xe540]
mov ecx, dword [rdx + rax*4 + 0xe534]
add rcx, rdx
jmp rcx
mov esi, 0x2e
mov eax, esi
sub eax, 0x2e
je 0x1800089fd
cmp eax, 0x78
jne 0x180008ae2
mov ebx, 0x126
lea edi, [rax - 0xf]
nop word [rax + rax]
mov eax, ebx
sub eax, 0x122
je 0x180008cb9
sub eax, 1
je 0x180008c68
sub eax, 1
je 0x180008c2b
sub eax, 1
je 0x180008be9
cmp eax, 1
jne 0x180008ccf
mov byte [rbp + 0xe0], r14b
jmp 0x180008ccf
cmp dword [r11 + 4], r14d
jne 0x180008ad4
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffe
jae 0x180008ac5
mov ebx, 0x109
nop
mov eax, ebx
sub eax, 0x109
je 0x180008aa4
sub eax, 1
je 0x180008a74
cmp eax, 1
jne 0x180008aae
movzx eax, byte [r14]
lea rcx, [rbp + 0x90]
mov byte [rbp + 0x90], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
jmp 0x180008aae
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
test rax, rax
jne 0x180008a86
xor r13b, r13b
jmp 0x180008aa7
test r13b, r13b
je 0x180008aae
mov edx, 1
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemRealloc]
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x180008aae
mov r13b, 1
mov byte [rbp + 0x33c8], r13b
inc ebx
cmp ebx, 0x10c
jb 0x180008a30
mov r11, qword [rbp + 0x33b0]
jmp 0x180008ad4
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
mov r12, qword [sym.imp.RPCRT4.dll_MesInqProcEncodingId]
mov qword [rbp + 0x128], r12
add esi, 0x78
cmp esi, 0x11e
jb 0x1800089a2
mov esi, dword [rbp - 0x80]
cmp dword [r11 + 4], r14d
jne 0x180008d5c
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffa
jae 0x180008d4d
mov ebx, 0xeb
nop word [rax + rax]
cmp ebx, 0xeb
je 0x180008d13
cmp ebx, 0xbef
je 0x180008ceb
cmp ebx, 0x16f3
jne 0x180008d32
mov rax, qword [rbp + 0x33b0]
lea rcx, [rbp + 0x98]
mov edx, 0xb5
mov byte [rbp + 0x98], 0x75
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
je 0x180008d32
mov ebx, 0xb3
nop word [rax + rax]
mov eax, ebx
sub eax, 0xb0
je 0x180009fa9
sub eax, 1
je 0x180009f6b
sub eax, 1
je 0x180009f17
cmp eax, 1
jne 0x180009fdc
lea rcx, [rbp + 0xe0]
mov byte [rbp + 0xe0], r14b
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x180008bd0
movzx eax, word [0x1800aa8f4]
mov word [rcx], ax
jmp 0x180009fdc
lea rdx, [0x1800aa8f4]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
movzx eax, word [0x1800aa8f8]
mov word [rbp + 0xe1], ax
movzx eax, word [0x1800aa8fc]
mov word [rbp + 0xe3], ax
movzx eax, byte [0x1800aa8fe]
mov byte [rbp + 0xe5], al
jmp 0x180008ccf
lea rdx, [0x1800aa900]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.rocE
lea rcx, [rbp + 0xe7]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [str.ncod]
mov dword [rbp + 0xeb], eax
mov word [rbp + 0xef], di
jmp 0x180008ccf
movzx eax, word [0x1800aa918]
lea rdx, str.Id__
mov word [rbp + 0xf0], ax
lea rcx, [rbp + 0xf2]
movzx eax, byte [0x1800aa91a]
mov r8d, 5
mov byte [rbp + 0xf2], al
call fcn.18007b500
movzx eax, word [0x1800aa924]
mov word [rbp + 0xf6], ax
movzx eax, byte [0x1800aa926]
mov byte [rbp + 0xf8], al
jmp 0x180008ccf
mov r8, r12
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x1520]
call fcn.180001130
dec ebx
cmp ebx, 0x121
ja 0x1800089c0
mov r11, qword [rbp + 0x33b0]
mov edi, 0xa
jmp 0x180008d63
test sil, sil
je 0x180008d32
mov rcx, qword [rbp + 0x130]
lea r8, [rbp + 0x654]
mov r9d, 4
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapQueryInformation]
jmp 0x180008d32
mov sil, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp rax, 0
movzx esi, sil
mov qword [rbp + 0x130], rax
cmove esi, r14d
mov dword [rbp - 0x80], esi
add ebx, 0xb04
cmp ebx, 0x210c
jbe 0x180008b30
mov r11, qword [rbp + 0x33b0]
jmp 0x180008d5c
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
mov dword [r11], 3
mov esi, dword [rbp - 0x80]
mov ebx, 1
mov eax, 0xd8
mov dword [rsp + 0x78], ebx
lea r15d, [rbx + 0x55]
add eax, 0xba
cmp eax, 0x24c
jb 0x180008953
mov r9d, dword [rbp + 0x33c0]
jmp 0x180008f90
xor edx, edx
cmp byte [rdx], 0x72
je 0x180008f66
mov esi, OleUIChangeSourceA
cmp esi, 0xb
ja case.default.0x180008dc1
lea r8, [0x180000000]
mov eax, esi
mov ecx, dword [r8 + rax*4 + 0xe594]
add rcx, r8
jmp rcx
mov dword [rbp + 0x5ec], 0x74
mov byte [rbp + 0x33b8], 1
jmp case.default.0x180008dc1
mov qword [rbp + 0x730], rdx
jmp case.default.0x180008dc1
mov r8d, 2
lea rdx, [0x1800aa958]
lea rcx, [rbp + 0x5d4]
call fcn.18007b4a8
movabs rax, 0x6e006900700070
mov qword [rbp + 0x5d8], rax
jmp 0x180008f4a
mov r8d, 1
lea rdx, str.e_e2e_eReaefe
lea rcx, [rbp + 0x5d2]
call fcn.18007b4a8
xor edx, edx
mov word [rbp + 0x5d4], dx
jmp case.default.0x180008dc1
mov eax, 0x4f
mov word [rbp + 0x5e2], ax
movabs rax, 0x630065006a0062
mov qword [rbp + 0x5e4], rax
jmp case.default.0x180008dc1
mov word [rbp + 0x5d2], dx
jmp case.default.0x180008dc1
xor r9d, r9d
lea rax, [rbp + 0x5c8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
jne 0x180008ea6
mov byte [rbp + 0x33b8], al
lea ebx, [rax + 7]
jmp 0x180008f4a
cmp byte [rbp + 0x33b8], 0
je 0x180008f05
lea r9, [rbp + 0x738]
mov rcx, rbx
lea r8, [rbp + 0x730]
lea rdx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x180008ee8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp + 0x33b8], 0
mov ebx, 7
jmp 0x180008f4a
lea rdx, [rbp + 0x740]
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 7
jmp 0x180008f4a
mov dword [rbp + 0x5e0], 0x67
jmp case.default.0x180008dc1
mov qword [rbp + 0x738], rdx
mov qword [rbp + 0x740], rdx
jmp case.default.0x180008dc1
mov qword [rbp + 0x4f0], rdx
jmp case.default.0x180008dc1
mov r8d, 5
lea rdx, [0x1800aa9d8]
lea rcx, [rbp + 0x5c8]
call fcn.18007b4a8
xor edx, edx
dec esi
lea eax, [rsi + 0x9c]
cmp eax, 0x9b
ja 0x180008da4
mov r11, qword [rbp + 0x33b0]
mov ebx, 1
mov dword [r11], 8
mov dword [rsp + 0x78], ebx
inc r14d
cmp r14d, 0xa9
jb 0x180007302
mov r9d, dword [rbp + 0x33c0]
xor r14d, r14d
mov r11, qword [rbp + 0x33b0]
lea eax, [r9 + 0x11]
inc r15d
cmp r15d, eax
jae 0x180009ff4
mov esi, dword [rbp - 0x80]
mov r8d, 9
jmp 0x180007003
xor r14d, r14d
lea r8, [rbp + 0x448]
mov qword [rsp + 0x58], r14
lea rdx, [rbp + 0x140]
mov qword [rsp + 0x50], r14
mov r9d, 0xcf0000
mov qword [rsp + 0x48], r14
xor ecx, ecx
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
movzx ecx, byte [rbp + 0x33c0]
mov rax, qword [rbp + 0x33c8]
mov r15, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov dword [rbp - 0x70], r15d
mov qword [rbp - 0x60], rcx
jmp 0x18000cc2e
movzx ecx, byte [rbp + 0x33c0]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
mov r13d, 0x54
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
xorps xmm0, xmm0
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
movups xmmword [rbp + 0xab0], xmm0
mov qword [rbp - 0x30], r9
movups xmmword [rbp + 0xac0], xmm0
mov qword [rbp - 0x48], r8
movups xmmword [rbp + 0xad0], xmm0
mov dword [rbp - 0x70], r15d
movups xmmword [rbp + 0xae0], xmm0
mov qword [rbp - 0x60], rcx
movups xmmword [rbp + 0xaf0], xmm0
jmp 0x18000a369
mov rax, qword [rbp + 0x33c8]
xor edx, edx
movzx ecx, byte [rbp + 0x33c0]
mov r14, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
mov r11, qword [rbp + 0x33b0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33c8], r12b
mov r10, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r14
mov r14d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov word [rbp + 0x7aa], dx
mov dword [rbp - 0x70], r14d
mov byte [rsp + 0x73], cl
mov qword [rbp - 0x60], r10
jmp 0x18000d9a2
movzx ecx, byte [rbp + 0x33c0]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
mov r13d, 0x5b
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
mov rax, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx r13d, byte [rbp + 0x33c0]
mov r11, qword [rbp + 0x33b0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x38], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x70], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov byte [rbp + 0x33b8], r13b
mov qword [rbp - 0x60], rcx
jmp 0x18000bc93
movzx ecx, byte [rbp + 0x33c0]
lea r10, [0x180000000]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
mov eax, 0x119
cmp eax, 0x119
je 0x18000b9c0
cmp eax, 0x7af0
je case.0x18000cbc8.17
jmp 0x18000ba28
movzx ecx, byte [rbp + 0x33c0]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
mov r13d, 0x62
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
lea r10, [0x180000000]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov qword [rbp - 0x60], rcx
mov esi, 0xa6
nop word [rax + rax]
lea eax, [rsi - 0xa0]
cmp eax, 6
ja case.0x18000979a.163
mov ecx, dword [r10 + rax*4 + 0xe5c4]
add rcx, r10
jmp rcx
movzx ecx, byte [rbp + 0x33c0]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov qword [rbp - 0x60], rcx
mov ecx, 0xf0
mov eax, ecx
sub eax, 0xf0
je 0x18000a348
cmp eax, 0x7f
je 0x1800082df
jmp 0x18000a35a
movzx ecx, byte [rbp + 0x33c0]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
mov ecx, 0x8f
mov eax, ecx
sub eax, 0x8e
je 0x18000e0aa
cmp eax, 1
jne 0x180009960
xor eax, eax
cmp byte [rax], 0x75
jne case.0x18000c73e.14
dec ecx
cmp ecx, 0x8d
ja 0x180009943
mov r13d, 0x57
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
mov r13d, 0x57
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
mov r13d, 0x5e
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
lea r10, [0x180000000]
mov eax, dword [rbp + 0x33c0]
mov r15, qword [rbp + 0x33c8]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], r15d
mov qword [rbp - 0x60], rcx
jmp 0x18000a4b5
movzx ecx, byte [rbp + 0x33c0]
mov rax, qword [rbp + 0x33c8]
mov r15, qword [rbp + 0x33c8]
mov r13d, dword [rbp + 0x33c0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov qword [rbp - 0x40], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rbp + 0x33c8], al
mov byte [rsp + 0x73], cl
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x38], r15
mov r15d, dword [rbp + 0x33c0]
mov qword [rbp - 0x60], rcx
mov dword [rbp - 0x7c], r13d
mov dword [rbp - 0x70], r15d
jmp 0x18000a906
movzx ecx, byte [rbp + 0x33c0]
mov r13d, 0x5c
mov rax, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x38], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x70], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
jmp case.default.0x18000a0e7
movzx ecx, byte [rbp + 0x33c0]
lea r10, [0x180000000]
mov rdx, qword [rbp + 0x33c8]
mov eax, dword [rbp + 0x33c0]
mov r9, qword [rbp + 0x33c8]
mov r8, qword [rbp + 0x33c8]
mov r13d, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rsp + 0x74], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
movzx eax, byte [rbp + 0x33c0]
mov byte [rbp + 0x33c8], al
mov byte [rsp + 0x73], cl
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x38], rdx
mov edx, dword [rbp + 0x33c0]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x48], r8
mov dword [rbp - 0x70], edx
mov qword [rbp - 0x40], r13
jmp 0x18000c6fb
movzx ecx, byte [rbp + 0x33c0]
mov r13d, 0x59
mov rax, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x38], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x70], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
jmp case.default.0x18000a0e7
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsZoomed]
mov eax, 7
jmp 0x18000731b
mov r8d, 8
lea rdx, str.esInqPro
lea rcx, [rbp + 0xe0]
call fcn.18007c4e0
movzx eax, word [0x1800aa944]
lea rcx, [rbp + 0xe0]
mov word [rbp + 0xe9], ax
dec rcx
movzx eax, byte [0x1800aa946]
mov byte [rbp + 0xeb], al
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x180009f55
movzx eax, word [0x1800aa948]
mov word [rcx], ax
jmp 0x180009fdc
mov eax, dword [str.codin]
mov dword [rbp + 0xec], eax
movzx eax, word [0x1800aa92c]
mov word [rbp + 0xf0], ax
mov eax, 0x67
mov word [rbp + 0xf1], ax
mov eax, 0x49
mov word [rbp + 0xf2], ax
mov dword [rbp + 0xf3], 0x252064
jmp 0x180009fdc
mov r8d, 2
lea rdx, [0x1800aa924]
lea rcx, [rbp + 0xe0]
call fcn.18007c4e0
mov r8, qword [sym.imp.RPCRT4.dll_MesInqProcEncodingId]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x1720]
call fcn.180001130
dec ebx
cmp ebx, 0xaf
ja 0x180008b90
mov eax, 6
jmp 0x18000731b
lea r10, [0x180000000]
mov edx, 0x65
movzx ecx, byte [rbp + 0x33c0]
mov r13d, r9d
mov rax, qword [rbp + 0x33c8]
movzx r12d, byte [rbp + 0x33c0]
movzx esi, byte [rbp + 0x33c0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x48], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x7c], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x68], eax
mov rax, qword [rbp + 0x33c8]
mov qword [rbp - 0x38], rax
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x72], al
movzx eax, byte [rbp + 0x33c0]
mov byte [rsp + 0x71], cl
movzx ecx, byte [rbp + 0x33c0]
mov byte [rbp + 0x33b8], al
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x70], cl
mov ecx, dword [rbp + 0x33c0]
mov dword [rbp - 0x70], eax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x6c], ecx
movzx ecx, byte [rbp + 0x33c0]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp + 0x33c0]
mov byte [rsp + 0x73], cl
mov byte [rbp + 0x33c8], r12b
mov rcx, qword [rbp + 0x33c8]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x33c0]
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x74], esi
mov qword [rbp - 0x60], rcx
lea eax, [r9 + 0x12]
cmp r13d, eax
jae case.0x18000cbc8.17
lea eax, [r13 - 0x53]
cmp eax, 0x11
ja case.default.0x18000a0e7
mov ecx, dword [r10 + rax*4 + 0xe5e0]
add rcx, r10
jmp rcx
xor ecx, ecx
movsx eax, byte [rcx]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.default.0x18000a10c
cdqe
movzx eax, byte [r10 + rax + 0xe63c]
mov ecx, dword [r10 + rax*4 + 0xe628]
add rcx, r10
jmp rcx
mov rax, qword [OleUIPromptUserA]
test rax, rax
je case.0x18000a10c.9
call rax
mov esi, 0xa2
jmp case.0x18000979a.163
mov rax, qword [0x18]
test rax, rax
je case.0x18000a10c.9
call rax
mov esi, 0xa2
jmp case.0x18000979a.163
mov rax, qword [0x50]
test rax, rax
je 0x18000a157
call rax
mov rax, qword [rbp + 0x33b0]
mov esi, 0xa2
mov dword [rax], 0x1b
jmp case.0x18000979a.163
xor ecx, ecx
mov r15d, 0x4f
mov dword [rbp - 0x50], r15d
nop word [rax + rax]
cmp r15d, 0x4f
je 0x18000a1a5
cmp r15d, 0x22df
je case.0x18000c73e.14
cmp r15d, 0x456f
je case.0x18000a10c.9
jmp 0x18000a27a
mov r14d, 6
mov esi, ecx
lea r12d, [r14 + 0x5d]
lea r15d, [r14 + 0x68]
cmp esi, 5
ja case.default.0x18000a1cb
mov eax, esi
mov ecx, dword [r10 + rax*4 + 0xe6b4]
add rcx, r10
jmp rcx
mov dword [rbp + 0x2b3], 0x70252064
jmp case.default.0x18000a1cb
mov eax, 0x4967
mov word [rbp + 0x2b0], r15w
mov word [rbp + 0x2b1], ax
jmp case.default.0x18000a1cb
mov word [rbp + 0x2b7], di
jmp case.default.0x18000a1cb
mov eax, 0x654d
mov dword [rbp + 0x2a2], 0x6e4973
mov word [rbp + 0x2a0], ax
mov dword [rbp + 0x2a5], 0x6f725071
mov word [rbp + 0x2a9], r12w
jmp case.default.0x18000a1cb
mov eax, 0x6964
mov dword [rbp + 0x2aa], 0x6f636e45
mov word [rbp + 0x2ae], ax
jmp case.default.0x18000a1cb
mov r8, qword [sym.imp.RPCRT4.dll_MesInqProcEncodingId]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x1920]
call fcn.180001130
lea r10, [0x180000000]
inc esi
sub r14, 1
jne 0x18000a1b5
mov ebx, dword [rsp + 0x78]
mov r15d, dword [rbp - 0x50]
movzx r12d, byte [rbp + 0x33c8]
add r15d, 0x2290
mov ecx, 0
mov dword [rbp - 0x50], r15d
cmp r15d, 0x67b0
jbe 0x18000a180
mov esi, 0xa2
jmp case.0x18000979a.163
mov r8d, 1
mov word [rbp + 0xc4], 0x6e
lea rdx, str.gSSAPI_TOKEN
lea rcx, [rbp + 0xc5]
call fcn.18007b500
jmp case.0x18000979a.163
movzx eax, word [0x1800aaa01]
lea rdx, [0x1800aaa18]
mov word [rbp + 0xc0], ax
lea rcx, [rbp + 0xc0]
movzx eax, byte [0x1800aaa03]
mov r8d, 1
mov byte [rbp + 0xc2], al
mov byte [rbp + 0xc3], 0
call fcn.18007c4e0
jmp case.0x18000979a.163
lea rdx, [rbp + 0xb20]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.USER32.dll_OemToCharW]
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp case.0x18000979a.163
mov byte [rbp + 0xc6], 0
dec esi
lea r10, [0x180000000]
cmp esi, 0x9f
ja 0x180009780
mov r13d, 0x61
jmp 0x18000dbb2
xor eax, eax
cmp byte [rax], 0x73
jne case.0x18000c73e.14
mov dword [r11], 0xd
add ecx, 0x7f
cmp ecx, 0x1ee
jb 0x180009862
mov r13d, 0x56
mov r14d, 0x85
nop word [rax + rax]
mov eax, r14d
sub eax, 0x81
je case.0x18000cbc8.17
sub eax, 1
je 0x18000a3ef
sub eax, 1
je 0x18000a3c8
sub eax, 1
je 0x18000a3c1
cmp eax, 1
jne 0x18000a40a
mov byte [rbp - 0x63], al
xor eax, eax
cmp byte [rax], 0x65
jne case.0x18000c73e.14
lea ecx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov dword [rbp + 0xcc], eax
jmp 0x18000a40a
xor eax, eax
mov dword [r11], eax
jmp 0x18000a40a
xor eax, eax
cmp dword [rbp + 0xcc], 0xffffffff
mov esi, eax
movzx eax, byte [rbp - 0x63]
cmovne esi, eax
mov rax, qword [0x38]
test rax, rax
je 0x18000a3e9
call rax
mov byte [rbp - 0x63], sil
jmp 0x18000a40a
cmp byte [rbp - 0x63], 0
je 0x18000a401
mov ecx, dword [rbp + 0xcc]
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
mov ebx, 1
mov dword [rsp + 0x78], ebx
mov r11, qword [rbp + 0x33b0]
dec r14d
cmp r14d, 0x80
ja 0x18000a380
jmp 0x18000dbb2
mov ecx, 0x104
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x104
je 0x18000a444
cmp eax, 1
je case.0x18000cbc8.17
jmp 0x18000a45e
cmp byte [r14], 0x6c
jne case.0x18000c73e.14
mov ebx, 1
mov dword [r11], reloc.oledlg.dll_OleUIChangeSourceA
mov dword [rsp + 0x78], ebx
inc ecx
cmp ecx, 0x106
jb 0x18000a430
jmp case.default.0x18000a0e7
mov eax, 0xd7
cmp eax, 0xd7
je 0x18000a498
cmp eax, 0x4259
je 0x18000a48d
cmp eax, 0x83db
je case.0x18000cbc8.17
jmp 0x18000a4a9
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp 0x18000a4a9
cmp byte [r14], 0x6c
jne case.0x18000c73e.14
mov dword [r11], 0x10
add eax, 0x4182
cmp eax, 0xc486
jbe 0x18000a472
xor edx, edx
mov r14d, edx
lea r13d, [rdx + 0x58]
nop
cmp r14d, 8
ja case.default.0x18000a4d8
mov eax, r14d
mov ecx, dword [r10 + rax*4 + 0xe6cc]
add rcx, r10
jmp rcx
cmp byte [rdx], 0x6c
jne case.0x18000c73e.14
lea rcx, [rbp + 0x188]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18000a4f1
mov dword [rbp + 0xd0], eax
jmp case.default.0x18000a4d8
mov dword [rbp + 0x2dc], edx
mov dword [r11], edx
jmp case.default.0x18000a4d8
cmp byte [rbp - 0x58], 0
je 0x18000a57d
mov ebx, 0xb2
nop
mov eax, ebx
sub eax, 0xb0
je 0x18000a55f
sub eax, 1
je 0x18000a556
cmp eax, 1
jne 0x18000a573
mov qword [rbp + 0x208], rdx
lea r8, [rbp + 0x208]
mov edx, dword [rbp + 0xd0]
lea rcx, [rbp + 0x188]
call qword [sym.imp.RPCRT4.dll_MesDecodeBufferHandleCreate]
jmp 0x18000a571
mov rcx, qword [rbp + 0x1e0]
jmp 0x18000a566
mov rcx, qword [rbp + 0x208]
test rcx, rcx
je 0x18000a573
call qword [sym.imp.RPCRT4.dll_MesHandleFree]
xor edx, edx
dec ebx
cmp ebx, 0xaf
ja 0x18000a520
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp case.default.0x18000a4d8
mov byte [rbp + 0x18e], 0
jmp case.default.0x18000a4d8
mov qword [rbp + 0x1e0], rdx
lea r9, [rbp + 0x1e0]
mov edx, dword [rbp + 0xd0]
lea r8, [rbp + 0x2dc]
lea rcx, [rbp + 0x188]
call qword [sym.imp.RPCRT4.dll_MesEncodeFixedBufferHandleCreate]
mov rcx, qword [0x40]
mov esi, eax
test rcx, rcx
je 0x18000a5d0
call rcx
test esi, esi
je case.default.0x18000a4d8
mov byte [rbp - 0x58], 0
jmp case.default.0x18000a4d8
mov eax, 0x6564
mov byte [rbp + 0x194], 0
mov word [rbp + 0x192], ax
mov byte [rbp - 0x58], 1
jmp case.default.0x18000a4d8
mov eax, 0x676e
mov dword [rbp + 0x188], 0x69727453
mov word [rbp + 0x18c], ax
jmp case.default.0x18000a4d8
mov r8d, 4
lea rdx, str.Encode_error:_modrm_not_selecting_mem_but_not_selecting_reg
lea rcx, [rbp + 0x188]
call fcn.18007c4e0
mov r11, qword [rbp + 0x33b0]
lea r10, [0x180000000]
inc r14d
mov edx, 0
lea eax, [r14 + 0xe1]
cmp eax, 0xea
jb 0x18000a4c0
jmp 0x18000dbb2
mov esi, 0x10d
mov eax, esi
sub eax, 0x10d
je 0x18000a6b7
sub eax, 7
je 0x18000a8e0
sub eax, 7
je 0x18000a67b
cmp eax, 7
je 0x1800082df
jmp 0x18000a8ec
mov rdx, qword [rbp + 0x1e8]
mov ecx, dword [rbp + 0x2d8]
call qword [sym.imp.ole32.dll_CoGetSystemSecurityPermissions]
test eax, eax
je 0x18000a69b
mov byte [rbp - 0x57], 0
jmp 0x18000a8e5
cmp byte [rbp - 0x57], 0
je 0x18000a8e5
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000a8e5
movsx edx, byte [r14]
mov byte [rbp - 0x57], 1
mov dword [rbp + 0x2d8], 1
mov qword [rbp + 0x1e8], r14
lea eax, [rdx - 0x30]
cmp eax, 9
ja case.0x18000c73e.14
cdqe
mov ecx, dword [r10 + rax*4 + 0xe6f0]
add rcx, r10
jmp rcx
mov r8, qword [r11 + 8]
lea rcx, [rbp + 0xa0]
mov byte [rbp + 0xa0], dl
mov edx, 0xb5
call fcn.18005fbe0
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x11
jmp 0x18000a8e0
cmp dword [r11 + 4], 0
jne 0x18000a8d9
mov r14d, 0x103
nop dword [rax]
mov eax, r14d
sub eax, 0x103
je 0x18000a898
cmp eax, 0x29
jne 0x18000a8c5
lea edx, [rax - 0x24]
lea rcx, [rbp + 0x7c8]
call qword [sym.imp.USER32.dll_CreateAcceleratorTableA]
test rax, rax
jne 0x18000a761
mov byte [rbp - 0x56], al
jmp 0x18000a770
cmp byte [rbp - 0x56], 0
je 0x18000a770
mov rcx, rax
call qword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov r15, qword [rbp + 0x33b0]
xor r12d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
mov rcx, qword [r15 + 8]
lea r9d, [r12 + 0x48]
call fcn.18002a4c0
cmp rax, 0xffffffffffffffff
jae 0x18000a8be
lea rdx, [rbp + 0x748]
mov qword [rbp + 0x748], 5
lea ecx, [r12 + 0x7d]
call fcn.180036d40
mov qword [r15 + 8], rax
test rax, rax
jne 0x18000a862
mov esi, 0x9f
nop word [rax + rax]
mov eax, esi
sub eax, 0x9f
je 0x18000a840
sub eax, 0xa
je 0x18000a82b
sub eax, 0xa
je 0x18000a7ee
cmp eax, 0xa
je case.0x18000cbc8.17
jmp 0x18000a853
lea rdx, [rbp + 0x708]
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.ole32.dll_PropVariantCopy]
test eax, eax
jne 0x18000a813
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.ole32.dll_PropVariantClear]
lea rcx, [rbp + 0x708]
call qword [sym.imp.ole32.dll_PropVariantClear]
mov ebx, 6
mov dword [rsp + 0x78], ebx
jmp 0x18000a853
xor eax, eax
xorps xmm1, xmm1
movups xmmword [rbp + 0x7b0], xmm1
mov qword [rbp + 0x7c0], rax
jmp 0x18000a842
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x718], rax
movups xmmword [rbp + 0x708], xmm0
add esi, 0xa
cmp esi, 0xc7
jb 0x18000a7d0
movzx eax, byte [r12]
lea rcx, [rbp + 0xa8]
mov r8, qword [r15 + 8]
mov edx, 0xb5
mov byte [rbp + 0xa8], al
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], eax
jmp 0x18000a8c5
xor eax, eax
mov byte [rbp - 0x56], 1
xorps xmm0, xmm0
mov qword [rbp + 0x7d8], rax
movups xmmword [rbp + 0x7c8], xmm0
mov dword [rbp + 0x7e0], eax
mov word [rbp + 0x7e4], ax
jmp 0x18000a8c5
mov r11, qword [rbp + 0x33b0]
add r14d, 0x29
cmp r14d, 0x155
jb 0x18000a730
xor r14d, r14d
mov dword [r11], 0x18
mov esi, 0x114
lea r10, [0x180000000]
mov r11, qword [rbp + 0x33b0]
add esi, 7
cmp esi, 0x129
jb 0x18000a656
mov r13d, dword [rbp - 0x7c]
mov ecx, 0x103
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x103
je 0x18000a943
sub eax, 1
je 0x18000b737
sub eax, 1
je 0x18000a935
cmp eax, 1
je case.0x18000cbc8.17
jmp 0x18000b737
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp 0x18000b737
xor edx, edx
movsx eax, byte [rdx]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18000a971.16
lea r8, [0x180000000]
cdqe
movzx eax, byte [r8 + rax + 0xe738]
mov ecx, dword [r8 + rax*4 + 0xe718]
add rcx, r8
jmp rcx
cmp dword [r11 + 4], edx
jne 0x18000b732
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], rdx
call fcn.18002a4c0
cmp rax, 0xffffffffffffffff
jae 0x18000ae24
mov r15d, 0x78
nop dword [rax]
nop dword [rax + rax]
cmp r15d, 0x62e8
ja 0x18000aa91
je 0x18000aa6e
cmp r15d, 0x78
je 0x18000aa47
cmp r15d, 0x1428
je 0x18000aa2c
cmp r15d, 0x27d8
je 0x18000aa11
cmp r15d, 0x3b88
je 0x18000aa02
cmp r15d, 0x4f38
jne 0x18000ae0b
mov eax, 0x67
mov word [rbp + 0x4a8], ax
jmp 0x18000ae0b
mov dword [rbp + 0x4a4], 0x6e0069
jmp 0x18000ae0b
mov eax, 0x70
mov dword [rbp + 0x49e], 0x700061
mov word [rbp + 0x4a2], ax
jmp 0x18000ae0b
mov eax, 0x6c
mov dword [rbp + 0x49a], 0x4d0065
mov word [rbp + 0x498], ax
jmp 0x18000ae0b
mov eax, 0x4d
mov dword [rbp + 0x492], 0x460079
mov word [rbp + 0x490], ax
mov eax, 0x69
mov word [rbp + 0x496], ax
jmp 0x18000ae0b
mov dword [rbp + 0x4aa], 0x62004f
mov dword [rbp + 0x4ae], 0x65006a
mov dword [rbp + 0x4b2], 0x740063
jmp 0x18000ae0b
cmp r15d, 0x7698
je 0x18000adf2
cmp r15d, 0x8a48
je 0x18000abed
cmp r15d, 0x9df8
je 0x18000abab
cmp r15d, 0xb1a8
jne 0x18000ae0b
cmp byte [rbp - 0x55], 0
je 0x18000ab0d
movsx rax, word [rbp + 0xbc]
xor edx, edx
mov rcx, qword [rbp + 0x750]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
xor r8d, r8d
mov edx, 0xf001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x2b20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
mov edx, 0xb5
movzx eax, byte [rcx]
lea rcx, [rbp + 0xb0]
mov byte [rbp + 0xb0], al
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
je 0x18000ae0b
mov esi, 0x6b
cmp esi, 0x6b
je 0x18000ab8e
cmp esi, 0x50ab
je 0x18000ab6f
cmp esi, 0xa0eb
je case.0x18000cbc8.17
jmp 0x18000ab98
lea rdx, [rbp + 0x2c4]
lea rcx, [rbp + 0x2d30]
call qword [sym.imp.WINSPOOL.DRV_Ordinal_203]
mov ebx, 6
mov dword [rsp + 0x78], ebx
jmp 0x18000ab98
mov dword [rbp + 0x2c4], 0x104
add esi, 0x5040
cmp esi, 0xf0c0
jbe 0x18000ab54
jmp 0x18000ae0b
movsx eax, word [rbp + 0xbc]
lea rcx, [rbp + 0x490]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp + 0x750], rax
test rax, rax
jne 0x18000ae0b
mov byte [rbp - 0x55], al
jmp 0x18000ae0b
lea rdx, [rbp + 0x758]
mov qword [rbp + 0x758], 5
mov ecx, 0x7d
call fcn.180036d40
mov rcx, qword [rbp + 0x33b0]
mov qword [rcx + 8], rax
test rax, rax
jne 0x18000ae0b
mov r14d, 0x8b
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
sub eax, 0x8a
je 0x18000d698
cmp eax, 1
jne 0x18000ade0
mov esi, 0xf4
nop dword [rax]
cmp esi, 0x2344
ja 0x18000ad24
je 0x18000ad04
cmp esi, 0xf4
je 0x18000acd1
cmp esi, 0xc64
je 0x18000ac9e
cmp esi, 0x17d4
jne 0x18000adce
movzx eax, word [0x1800aaa6c]
mov word [rbp + 0x176], ax
movzx eax, byte [0x1800aaa6e]
mov byte [rbp + 0x178], al
jmp 0x18000adce
mov eax, dword [str.atePr]
lea rdx, [0x1800aaa7c]
mov dword [rbp + 0x16f], eax
lea rcx, [rbp + 0x168]
movzx eax, word [0x1800aaa78]
mov word [rbp + 0x173], ax
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x18000adce
movzx eax, word [0x1800aaa60]
mov word [rbp + 0x169], ax
mov eax, dword [str.Priv]
mov dword [rbp + 0x16b], eax
movzx eax, byte [0x1800aaa68]
mov byte [rbp + 0x16f], al
mov byte [rbp + 0x168], 0x47
jmp 0x18000adce
movzx eax, word [0x1800aaa70]
mov word [rbp + 0x178], ax
movzx eax, byte [0x1800aaa72]
mov byte [rbp + 0x17a], al
jmp 0x18000adce
cmp esi, 0x2eb4
je 0x18000ad79
cmp esi, 0x3a24
je 0x18000ad5c
cmp esi, 0x4594
jne 0x18000adce
mov r8, qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rbp + 0x168]
lea rcx, [rbp + 0x1b20]
call fcn.180001130
jmp 0x18000adce
movzx eax, word [0x1800aaa5c]
mov word [rbp + 0x180], ax
movzx eax, byte [0x1800aaa5e]
mov byte [rbp + 0x182], al
jmp 0x18000adce
mov r8d, 2
lea rdx, [0x1800a9f64]
lea rcx, [rbp + 0x17a]
call fcn.18007b500
mov r8d, 1
lea rdx, [0x1800aa06c]
lea rcx, [rbp + 0x168]
call fcn.18007c4e0
mov r8d, 2
lea rdx, [0x1800aa914]
lea rcx, [rbp + 0x17c]
call fcn.18007b500
mov dword [rbp + 0x17d], 0x20676e
add esi, 0xb70
cmp esi, 0x5010
jbe 0x18000ac50
dec r14d
cmp r14d, 0x89
ja 0x18000ac30
jmp 0x18000ae0b
xor eax, eax
mov byte [rbp - 0x55], 1
mov word [rbp + 0x4b6], ax
mov eax, 0x100
mov word [rbp + 0xbc], ax
add r15d, 0x13b0
cmp r15d, 0xc4e0
jbe 0x18000a9b0
jmp 0x18000b732
mov rax, qword [rbp + 0x33b0]
mov dword [rax + 4], 1
jmp 0x18000b732
lea rdx, [rbp + 0x760]
mov qword [rbp + 0x760], 5
mov ecx, 0x7d
call fcn.180036d40
mov rsi, qword [rbp + 0x33b0]
mov qword [rsi + 8], rax
test rax, rax
je 0x18000d698
mov r8, rax
mov byte [rbp - 0x28], 0x2e
mov edx, 0xb5
lea rcx, [rbp - 0x28]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov dword [rsi], 0x12
jmp 0x18000b732
mov esi, 8
mov eax, esi
sub eax, 8
je 0x18000aeb5
sub eax, 1
je 0x18000aeac
cmp eax, 1
je 0x18000b732
jmp 0x18000af14
mov dword [r11], 0x14
jmp 0x18000af14
lea rdx, [rbp + 0x768]
mov qword [rbp + 0x768], 5
mov ecx, 0x7d
call fcn.180036d40
mov rcx, qword [rbp + 0x33b0]
mov qword [rcx + 8], rax
test rax, rax
je 0x18000d698
xor r14d, r14d
mov r8, rax
mov edx, 0xb5
movzx ecx, byte [r14]
mov byte [rbp - 0x20], cl
lea rcx, [rbp - 0x20]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], r14d
inc esi
cmp esi, 0xb
jb 0x18000ae95
mov esi, 0x1a
mov eax, esi
sub eax, 0x19
je 0x18000b732
cmp eax, 1
jne 0x18000af70
mov rcx, qword [r11 + 8]
lea r14, [r11 + 8]
test rcx, rcx
je 0x18000d698
mov rax, qword [0x28]
test rax, rax
je 0x18000af57
mov rcx, qword [rcx]
call rax
mov rdx, r14
mov ecx, 0x117
call fcn.180020110
mov r11, qword [rbp + 0x33b0]
xor eax, eax
mov dword [r11], eax
dec esi
cmp esi, 0x18
ja 0x18000af24
lea r8, [0x180000000]
mov r12d, 0x46
mov dword [rbp - 0x74], r12d
nop dword [rax + rax]
cmp r12d, 0x46
je 0x18000b157
cmp r12d, 0xf7
je 0x18000aff0
cmp r12d, 0x1a8
jne 0x18000b162
xor eax, eax
cmp qword [rax], rax
je 0x18000b1ba
mov esi, 0xbe
cmp esi, 0xbe
je 0x18000b197
cmp esi, 0x47fe
je 0x18000b189
cmp esi, 0x8f3e
jne 0x18000b1a1
call qword [OleUIPromptUserA]
jmp 0x18000b1a1
cmp qword [0x28], 0
je 0x18000b140
mov r15d, 0x38
mov dword [rbp - 0x50], r15d
lea ebx, [r15 + 0xb]
lea r13d, [r15 + 0x30]
lea r12d, [r15 + 0x29]
cmp r15d, 0x38
je 0x18000b103
cmp r15d, 0x1fb8
je 0x18000b048
cmp r15d, 0x3f38
jne 0x18000b10e
mov rcx, qword [r11 + 8]
mov eax, 0x28
mov rcx, qword [rcx]
call qword [rax]
jmp 0x18000b10e
mov esi, 5
lea r14d, [rsi + 1]
lea r15d, [rsi + 0x4a]
cmp esi, 5
ja case.default.0x18000b06b
mov eax, esi
mov ecx, dword [r8 + rax*4 + 0xe7b0]
add rcx, r8
jmp rcx
mov dword [rbp + 0x267], 0x702520
jmp case.default.0x18000b06b
mov word [rbp + 0x25d], bx
mov word [rbp + 0x25e], r13w
mov word [rbp + 0x25f], r12w
mov dword [rbp + 0x259], 0x4955656c
jmp case.default.0x18000b06b
mov eax, 0x6e6f
mov word [rbp + 0x265], ax
jmp case.default.0x18000b06b
mov eax, 0x6349
mov dword [rbp + 0x260], 0x65676e
mov word [rbp + 0x263], ax
jmp case.default.0x18000b06b
mov r8, qword [rbp - 0x30]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x1d20]
mov word [rbp + 0x26a], di
call fcn.180001130
jmp case.default.0x18000b06b
mov word [rbp + 0x258], r15w
dec esi
lea r8, [0x180000000]
sub r14, 1
jne 0x18000b055
mov r15d, dword [rbp - 0x50]
jmp 0x18000b10e
mov rax, qword [sym.imp.oledlg.dll_OleUIChangeIconA]
mov qword [rbp - 0x30], rax
mov r11, qword [rbp + 0x33b0]
lea r8, [0x180000000]
add r15d, 0x1f80
mov dword [rbp - 0x50], r15d
cmp r15d, 0x5e80
jbe 0x18000b015
mov ebx, dword [rsp + 0x78]
mov r12d, dword [rbp - 0x74]
mov r13d, dword [rbp - 0x7c]
mov rdx, qword [rbp + 0x33b0]
mov ecx, 0x117
add rdx, 8
call fcn.180020110
jmp 0x18000b162
cmp qword [r11 + 8], 0
je 0x18000d698
add r12d, 0xb1
lea r8, [0x180000000]
mov dword [rbp - 0x74], r12d
cmp r12d, 0x259
jae 0x18000b1c6
mov r11, qword [rbp + 0x33b0]
jmp 0x18000af90
mov ecx, dword [rbp + 0x2c8]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x18000b1a1
mov dword [rbp + 0x2c8], 0x50
add esi, 0x4740
cmp esi, 0xd5c0
jbe 0x18000afc0
mov r11, qword [rbp + 0x33b0]
mov dword [r11], 0x1a
jmp 0x18000b732
xor edx, edx
mov r15d, 0x1e
mov dword [rbp - 0x74], r15d
mov eax, r15d
sub eax, 0x1e
je 0x18000b425
sub eax, 0x34
je 0x18000b1f1
cmp eax, 0x34
je 0x18000b732
jmp 0x18000b437
cmp qword [0x28], 0
je 0x18000b3fa
movzx edi, byte [rsp + 0x71]
mov esi, reloc.oledlg.dll_OleUIChangeSourceA
lea r14d, [rsi + 1]
lea ebx, [rsi + 0x42]
lea r13d, [rsi + 0x59]
lea r15d, [rsi + 0x55]
nop dword [rax]
cmp esi, 0xc
ja case.default.0x18000b236
mov eax, esi
mov ecx, dword [r8 + rax*4 + 0xe7c8]
add rcx, r8
jmp rcx
mov word [rbp + 0x1d0], bx
jmp case.default.0x18000b236
mov eax, 0x76
mov word [rbp + 0x1d7], ax
mov dword [rbp + 0x1d8], 0x656369
jmp case.default.0x18000b236
mov word [rbp + 0x109], r15w
jmp case.default.0x18000b236
mov eax, 0x7961
mov byte [rbp + 0x113], 0
mov word [rbp + 0x111], ax
mov dil, 1
jmp case.default.0x18000b236
mov eax, 0x6d
mov word [rbp + 0x10a], ax
mov word [rbp + 0x10b], r13w
jmp case.default.0x18000b236
mov rcx, qword [rbp + 0x770]
lea r8, [rbp + 0x108]
mov qword [rsp + 0x60], rdx
xorps xmm0, xmm0
mov qword [rsp + 0x58], rdx
xor eax, eax
mov qword [rsp + 0x50], rdx
mov r9d, 0xf01ff
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdx
lea rdx, [rbp + 0x1d0]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
movups xmmword [rbp + 0x880], xmm0
mov qword [rbp + 0x8a0], rax
movups xmmword [rbp + 0x890], xmm0
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rbp - 0x48], rax
jmp case.default.0x18000b236
test dil, dil
je 0x18000b34a
mov r12, qword [rbp - 0x48]
lea r8, [rbp + 0x880]
mov rcx, r12
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rax, qword [rbp + 0x33b0]
mov rcx, qword [rax + 8]
mov eax, 0x28
mov rcx, qword [rcx]
call qword [rax]
jmp case.default.0x18000b236
cmp qword [rbp - 0x48], 0
mov ecx, edx
movzx eax, dil
cmovne ecx, eax
movzx edi, cl
jmp case.default.0x18000b236
mov eax, 0x44
mov word [rbp + 0x10c], ax
mov eax, 0x6c
mov dword [rbp + 0x10d], 0x707369
mov word [rbp + 0x110], ax
jmp case.default.0x18000b236
mov eax, 0x72
mov word [rbp + 0x1d6], ax
jmp case.default.0x18000b236
mov word [rbp + 0x108], bx
jmp case.default.0x18000b236
mov qword [rbp + 0x770], rdx
mov qword [rbp - 0x48], rdx
jmp case.default.0x18000b236
mov word [rbp + 0x1d1], r15w
mov dword [rbp + 0x1d2], 0x6553656d
dec esi
lea r8, [0x180000000]
mov edx, 0
sub r14, 1
jne 0x18000b220
mov ebx, dword [rsp + 0x78]
mov r15d, dword [rbp - 0x74]
mov r13d, dword [rbp - 0x7c]
mov byte [rsp + 0x71], dil
lea edi, [rdx + 0xa]
mov rsi, qword [rbp + 0x33b0]
mov ecx, 0x117
lea rdx, [rsi + 8]
call fcn.180020110
xor eax, eax
cmp qword [rax], rax
je 0x18000b41d
call qword [0x18]
mov dword [rsi], 0x1a
jmp 0x18000b437
mov rax, qword [rbp + 0x33b0]
cmp qword [rax + 8], 0
je 0x18000d698
add r15d, 0x34
lea r8, [0x180000000]
mov dword [rbp - 0x74], r15d
mov edx, 0
cmp r15d, 0xba
jb 0x18000b1d2
mov r12d, 0x88
mov dword [rbp - 0x50], r12d
mov eax, r12d
sub eax, 0x88
je 0x18000b518
sub eax, 1
je 0x18000b4a7
cmp eax, 1
jne 0x18000b6e2
mov rax, qword [rbp + 0x33b0]
lea rcx, [rbp + 0x990]
mov dword [rbp + 0x990], 0x88
mov dword [rax], 0x1b
call qword [sym.imp.oledlg.dll_OleUIPasteSpecialA]
jmp 0x18000b732
mov rdx, qword [rbp + 0x33b0]
mov ecx, 0x117
add rdx, 8
call fcn.180020110
xorps xmm0, xmm0
xor eax, eax
mov qword [rbp + 0xa10], rax
mov rax, qword [0x48]
movups xmmword [rbp + 0x990], xmm0
movups xmmword [rbp + 0x9a0], xmm0
movups xmmword [rbp + 0x9b0], xmm0
movups xmmword [rbp + 0x9c0], xmm0
movups xmmword [rbp + 0x9d0], xmm0
movups xmmword [rbp + 0x9e0], xmm0
movups xmmword [rbp + 0x9f0], xmm0
movups xmmword [rbp + 0xa00], xmm0
test rax, rax
je 0x18000b6e2
call rax
jmp 0x18000b6e2
mov rcx, qword [rbp + 0x33b0]
cmp qword [rcx + 8], 0
je 0x18000d698
cmp qword [0x28], 0
je 0x18000b6e2
movzx edi, byte [rsp + 0x70]
mov eax, 0x3d
mov r12d, dword [rbp - 0x68]
mov r15d, eax
mov dword [rbp - 0x74], eax
lea ebx, [rax + 0x2b]
mov eax, r15d
sub eax, 0x3a
je 0x18000b6a3
sub eax, 1
je 0x18000b5a9
sub eax, 1
je 0x18000b577
cmp eax, 1
jne 0x18000b6b8
movzx edi, al
jmp 0x18000b6b8
mov dword [rbp + 0xb8], 0x3039
lea rcx, [rbp + 0x838]
mov eax, dword [rbp + 0xb8]
mov dword [rbp + 0xb8], eax
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov r13d, eax
lock inc dword [rbp + 0xb8]
jmp 0x18000b6b1
test r13d, r13d
movzx eax, dil
mov ecx, edx
cmove ecx, eax
movzx edi, cl
test cl, cl
je 0x18000b6b1
mov r15d, dword [rbp - 0x6c]
mov r14d, 0xbd
nop word [rax + rax]
mov eax, r14d
sub eax, 0xbd
je 0x18000b694
cmp eax, 1
jne 0x18000b676
xor ecx, ecx
mov dword [rbp + 0xd4], edx
call qword [sym.imp.ole32.dll_CoInitialize]
mov r13d, eax
test eax, eax
jne 0x18000b663
mov esi, ebx
nop
mov eax, esi
sub eax, 0x65
je 0x18000b659
sub eax, 1
je 0x18000b651
sub eax, 1
je 0x18000b63e
cmp eax, 1
jne 0x18000b65c
mov rdx, qword [rbp - 0x38]
lea rax, [rbp + 0xd4]
mov r9d, r12d
mov qword [rsp + 0x20], rax
mov r8d, r15d
lea rcx, [rbp + 0x838]
call qword [sym.imp.ole32.dll_CoRegisterClassObject]
mov r13d, eax
jmp 0x18000b65c
test r13d, r13d
jne 0x18000b65c
mov ecx, dword [rbp + 0xd4]
call qword [sym.imp.ole32.dll_CoRevokeClassObject]
jmp 0x18000b65c
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x18000b65c
xor dil, dil
dec esi
cmp esi, 0x64
ja 0x18000b600
test dil, dil
je 0x18000b674
cmp r13d, 1
jne 0x18000b674
call qword [sym.imp.ole32.dll_CoUninitialize]
xor edx, edx
inc r14d
cmp r14d, 0xbf
jb 0x18000b5d0
mov dword [rbp - 0x6c], r15d
mov r15d, dword [rbp - 0x74]
mov dword [rbp - 0x68], r12d
jmp 0x18000b6b1
mov qword [rbp - 0x38], rdx
mov r15d, 0x20000
mov r12d, edx
jmp 0x18000b676
mov rcx, qword [rcx + 8]
mov eax, 0x28
mov rcx, qword [rcx]
call qword [rax]
mov rcx, qword [rbp + 0x33b0]
dec r15d
mov edx, 0
mov dword [rbp - 0x74], r15d
cmp r15d, 0x39
ja 0x18000b550
mov ebx, dword [rsp + 0x78]
mov r12d, dword [rbp - 0x50]
mov byte [rsp + 0x70], dil
lea edi, [rdx + 0xa]
mov dword [rbp - 0x7c], r13d
inc r12d
mov dword [rbp - 0x50], r12d
cmp r12d, 0x8b
jae case.0x18000a971.16
xor edx, edx
jmp 0x18000b462
mov ecx, 0xd8
nop
mov eax, ecx
sub eax, 0xd8
je 0x18000b719
sub eax, 0x47
je 0x18000e0bb
cmp eax, 0x47
je 0x18000b732
jmp 0x18000b727
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rbp + 0x640], rax
add ecx, 0x47
cmp ecx, 0x1ad
jb 0x18000b700
mov ecx, 0x103
mov r11, qword [rbp + 0x33b0]
inc ecx
cmp ecx, 0x107
jb 0x18000a910
movzx r12d, byte [rbp + 0x33c8]
mov r13d, 0x5f
jmp 0x18000dbb2
mov r14d, 0xd2
mov eax, r14d
sub eax, 0xd2
je 0x18000b77d
cmp eax, 0x6d
je 0x1800082df
jmp 0x18000b9a3
xor r15d, r15d
movsx eax, byte [r15]
add eax, 0xffffffd0
cmp eax, 9
ja case.default.0x18000b79d
cdqe
mov ecx, dword [r10 + rax*4 + 0xe7fc]
add rcx, r10
jmp rcx
mov esi, 0x16
mov eax, esi
sub eax, 0x16
je 0x18000b866
sub eax, 1
je 0x18000b810
sub eax, 1
je 0x18000b7e0
cmp eax, 1
jne 0x18000b8c3
lea rdx, [rbp + 0x394]
lea rcx, [rbp + 0xe00]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, 1
jmp 0x18000731b
lea rcx, [rbp + 0x830]
mov dword [rbp + 0x394], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
lea rcx, [rbp + 0xa20]
call qword [sym.imp.oledlg.dll_OleUIChangeSourceA]
mov r11, qword [rbp + 0x33b0]
jmp 0x18000b8c3
xorps xmm0, xmm0
mov dword [r11], 0x15
xor eax, eax
mov dword [rbp + 0xa20], 0x88
movups xmmword [rbp + 0xa24], xmm0
mov dword [rbp + 0xaa4], eax
movups xmmword [rbp + 0xa34], xmm0
movups xmmword [rbp + 0xa44], xmm0
movups xmmword [rbp + 0xa54], xmm0
movups xmmword [rbp + 0xa64], xmm0
movups xmmword [rbp + 0xa74], xmm0
movups xmmword [rbp + 0xa84], xmm0
movups xmmword [rbp + 0xa94], xmm0
jmp 0x18000b8c3
cmp dword [r11 + 4], r15d
jne 0x18000b8c3
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffe
jae 0x18000b8b4
movzx eax, byte [r15]
lea rcx, [rbp + 0x28]
mov byte [rbp + 0x28], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
mov r11, qword [rbp + 0x33b0]
jmp 0x18000b8c3
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
inc esi
cmp esi, 0x1a
jb 0x18000b7a4
mov esi, 0x107
cmp esi, 0x24057
ja 0x18000b95f
je 0x18000b949
cmp esi, 0x107
je 0x18000b93d
cmp esi, 0x90db
je 0x18000b931
cmp esi, 0x120af
je 0x18000b923
cmp esi, 0x1b083
jne 0x18000b98a
mov dword [rbp + 0x462], 0x690072
mov dword [rbp + 0x466], 0x67006e
mov word [rbp + 0x46a], r15w
jmp 0x18000b98a
mov eax, 0x74
mov word [rbp + 0x460], ax
jmp 0x18000b98a
mov dword [rbp + 0x45c], 0x53006f
jmp 0x18000b98a
mov dword [rbp + 0x458], 0x770054
jmp 0x18000b98a
lea rdx, [rbp + 0x458]
lea rcx, [rbp + 0xb38]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x18000b98a
cmp esi, 0x2d02b
je 0x18000b981
cmp esi, 0x35fff
je case.0x18000cbc8.17
cmp esi, 0x3efd3
je 0x1800082df
jmp 0x18000b98a
mov ebx, 7
mov dword [rsp + 0x78], ebx
add esi, 0x8fd4
cmp esi, 0x47ea0
jbe 0x18000b8d3
lea r10, [0x180000000]
mov r11, qword [rbp + 0x33b0]
add r14d, 0x6d
cmp r14d, 0x1ac
jb 0x18000b765
jmp 0x18000dbb2
xor edx, edx
movsx eax, byte [rdx]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18000c73e.14
cdqe
movzx eax, byte [r10 + rax + 0xe834]
mov ecx, dword [r10 + rax*4 + 0xe824]
add rcx, r10
jmp rcx
mov qword [r11 + 8], rdx
mov dword [r11], 1
jmp case.0x18000b9e7.9
mov rax, qword [OleUIPromptUserA]
test rax, rax
je 0x18000ba13
call rax
mov r11, qword [rbp + 0x33b0]
lea r10, [0x180000000]
mov dword [r11], 0x1a
mov ebx, 1
mov eax, 0x119
mov dword [rsp + 0x78], ebx
add eax, 0x79d7
cmp eax, 0xf3ae
jbe 0x1800095c2
mov r13d, 0x60
jmp case.default.0x18000a0e7
mov r15d, 0x46
mov ecx, r15d
nop dword [rax]
mov eax, ecx
sub eax, 0x45
je 0x1800082df
cmp eax, 1
jne 0x18000bc80
movsx eax, byte [r14]
add eax, 0xffffffd5
cmp eax, 0xe
ja case.0x18000c73e.14
cdqe
mov ecx, dword [r10 + rax*4 + 0xe8ac]
add rcx, r10
jmp rcx
mov r8, qword [r11 + 8]
lea rcx, [rbp - 0x18]
mov dword [r11 + 4], r14d
mov edx, 0xb5
movzx eax, byte [r14]
mov byte [rbp - 0x18], al
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
mov eax, 0x16
jmp 0x18000bc73
cmp dword [r11 + 4], 0
jne 0x18000bc6e
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffe
jae 0x18000bb19
movzx eax, byte [r14]
lea rcx, [rbp - 0x10]
mov byte [rbp - 0x10], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r11, qword [rbp + 0x33b0]
jmp 0x18000bc6e
mov r15d, 6
nop
cmp r14d, 5
ja case.default.0x18000bb3e
lea rdx, [0x180000000]
mov eax, r14d
mov ecx, dword [rdx + rax*4 + 0xe8e8]
add rcx, rdx
jmp rcx
mov r8d, dword [rbp + 0x2cc]
lea rcx, [rbp + 0x8a8]
mov edx, dword [rbp + 0x370]
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ConvertSecurityDescriptorToStringSecurityDescriptorA]
cmp dword [rbp + 0x2d4], esi
movzx eax, byte [rbp - 0x54]
cmovne esi, eax
test sil, sil
je 0x18000bbb7
lea rax, [rbp + 0x658]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea r9, [rbp + 0x330]
lea rax, [rbp + 0x320]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x668]
lea rax, [rbp + 0x2f40]
lea rdx, [rbp + 0xf10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov byte [rbp - 0x54], sil
jmp case.default.0x18000bb3e
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
jmp 0x18000bc58
xorps xmm0, xmm0
mov byte [rbp - 0x54], 1
xor eax, eax
mov dword [rbp + 0x2d0], 0x104
movups xmmword [rbp + 0x8a8], xmm0
mov qword [rbp + 0x8c8], rax
movups xmmword [rbp + 0x8b8], xmm0
jmp case.default.0x18000bb3e
xor eax, eax
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0xf10]
mov dword [rbp + 0x2cc], eax
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rbp + 0x2d4], eax
jmp case.default.0x18000bb3e
mov dword [rbp + 0x330], reloc.oledlg.dll_OleUIChangeSourceA
mov dword [rbp + 0x320], 0x104
jmp case.default.0x18000bb3e
xor eax, eax
mov dword [rbp + 0x370], 1
mov qword [rbp + 0x668], rax
mov dword [rbp + 0x670], eax
mov r11, qword [rbp + 0x33b0]
inc r14d
sub r15, 1
jne 0x18000bb20
xor r14d, r14d
mov r15d, 0x46
mov eax, 0x15
mov dword [r11], eax
lea r10, [0x180000000]
mov ecx, r15d
dec ecx
cmp ecx, 0x44
ja 0x18000ba50
movzx r13d, byte [rbp + 0x33b8]
mov esi, 0x81
nop dword [rax + rax]
cmp esi, 0xdeba
ja 0x18000bd63
je 0x18000bd52
cmp esi, 0x81
je 0x18000bd1f
cmp esi, 0x4a94
je 0x18000bce7
cmp esi, 0x94a7
jne 0x18000c6cf
mov dword [rbp + 0x3d8], 0x460064
mov dword [rbp + 0x3dc], 0x6c0069
jmp 0x18000c6cf
lea rdx, [0x1800aa7c4]
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 0x65
mov dword [rbp + 0x3d0], 0x79004d
mov dword [rbp + 0x600], eax
mov dword [rbp + 0x3d4], 0x6c004f
jmp 0x18000c6cf
mov eax, dword [0x1800aaadc]
lea rdx, str.NewFi
mov dword [rbp + 0x5f0], eax
lea rcx, [rbp + 0x5f4]
movzx eax, word [0x1800aaae0]
mov word [rbp + 0x5f4], ax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x18000c6cf
mov eax, 0x65
mov word [rbp + 0x3e0], ax
jmp 0x18000c6cf
cmp esi, 0x128cd
je 0x18000bdaa
cmp esi, 0x172e0
jne 0x18000c6cf
xor eax, eax
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x5f0]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
mov eax, 1
jmp 0x18000731b
xor r15d, r15d
mov word [rbp + 0x3e2], r15w
movsx eax, byte [r15]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18000bde0.14
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0xe918]
mov ecx, dword [rdx + rax*4 + 0xe900]
add rcx, rdx
jmp rcx
cmp dword [r11 + 4], r15d
jne 0x18000c6ca
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xfffffffffffffffe
jae 0x18000be39
movzx eax, byte [r15]
lea rcx, [rbp - 8]
mov byte [rbp - 8], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
jmp 0x18000c6ca
mov rax, qword [rbp + 0x33b0]
mov dword [rax + 4], 1
jmp 0x18000c6ca
mov esi, 0x78
mov eax, esi
sub eax, 0x78
je 0x18000bede
sub eax, 1
je 0x18000beb6
cmp eax, 1
jne 0x18000bf04
mov esi, 0x98
lea r12d, [rax + 0x60]
cmp esi, 0xe498
ja 0x18000bfed
je 0x18000bfd2
cmp esi, 0x98
je 0x18000bf74
cmp esi, 0x4c98
je 0x18000bf41
cmp esi, 0x9898
jne 0x18000c064
mov word [rbp + 0x3f5], r12w
jmp 0x18000c064
lea rdx, [r11 + 8]
mov ecx, 0x117
call fcn.180020110
mov r11, qword [rbp + 0x33b0]
mov rax, qword [sym.imp.RPCRT4.dll_IUnknown_Release_Proxy]
mov qword [rbp + 0x778], rax
mov dword [r11], r15d
jmp 0x18000bf04
mov rcx, qword [r11 + 8]
test rcx, rcx
je 0x18000d698
mov rax, qword [0x28]
test rax, rax
je 0x18000bf04
mov rcx, qword [rcx]
call rax
mov r11, qword [rbp + 0x33b0]
inc esi
cmp esi, 0x7b
jb 0x18000be51
mov r15d, 0x5f
nop word [rax + rax]
mov eax, r15d
sub eax, 0x5f
je 0x18000c083
cmp eax, 1
jne 0x18000c0ee
mov dword [r11], 0x1a
jmp 0x18000c6ca
mov eax, dword [str.n_Rel]
lea rdx, str.ea_n
mov dword [rbp + 0x3ef], eax
lea rcx, [rbp + 0x3e8]
movzx eax, word [0x1800aac0c]
mov word [rbp + 0x3f3], ax
call qword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x18000c064
mov r8d, 2
lea rdx, [0x1800aa070]
lea rcx, [rbp + 0x3e8]
call fcn.18007b500
mov r8d, 2
lea rdx, [0x1800aaaf4]
lea rcx, [rbp + 0x3e9]
call fcn.18007b500
lea rcx, [rbp + 0x3e8]
dec rcx
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x18000bfb0
mov eax, dword [str.nknow]
mov dword [rcx], eax
movzx eax, word [0x1800aac04]
mov word [rcx + 4], ax
jmp 0x18000c064
mov r8d, 2
lea rdx, [0x1800aac1c]
lea rcx, [rbp + 0x3e8]
call fcn.18007c4e0
jmp 0x18000c064
cmp esi, 0x13098
je 0x18000c043
cmp esi, 0x17c98
je 0x18000c028
cmp esi, 0x1c898
jne 0x18000c064
mov r8, qword [rbp + 0x778]
lea rdx, [rbp + 0x3e8]
lea rcx, [rbp + 0x1f20]
mov word [rbp + 0x401], di
call fcn.180001130
jmp 0x18000c064
mov r8d, 9
lea rdx, [0x1800aac20]
lea rcx, [rbp + 0x3f9]
call fcn.18007b500
jmp 0x18000c064
lea rcx, [rbp + 0x3e8]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], r15b
lea rcx, [rcx + 1]
jne 0x18000c050
movzx eax, word [0x1800aac2c]
mov word [rcx], ax
add esi, 0x4c00
cmp esi, 0x21400
jbe 0x18000be73
movzx r12d, byte [rbp + 0x33c8]
jmp 0x18000c6ca
cmp qword [r11 + 8], 0
lea r14, [r11 + 8]
je 0x18000d698
cmp qword [0x28], 0
je 0x18000c0d3
mov esi, 0x102
mov eax, esi
sub eax, 0x102
je 0x18000c0bf
cmp eax, 1
jne 0x18000c0c9
mov rcx, qword [r14]
mov eax, 0x28
mov rcx, qword [rcx]
call qword [rax]
jmp 0x18000c0c9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
inc esi
cmp esi, 0x104
jb 0x18000c0a2
mov rdx, r14
mov ecx, 0x117
call fcn.180020110
xor eax, eax
cmp qword [rax], rax
je 0x18000c0ee
call qword [OleUIPromptUserA]
inc r15d
cmp r15d, 0x61
jae 0x18000c103
mov r11, qword [rbp + 0x33b0]
jmp 0x18000bf20
xor r15d, r15d
mov r14d, 0x93
nop dword [rax]
mov eax, r14d
sub eax, 0x93
je 0x18000c135
cmp eax, 1
jne 0x18000c1d8
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x1a
jmp 0x18000c6ca
cmp qword [0x28], 0
mov rsi, qword [rbp + 0x33b0]
mov rcx, qword [rsi + 8]
je 0x18000c162
test rcx, rcx
je 0x18000d698
mov rcx, qword [rcx]
mov eax, 0x28
call qword [rax]
mov rcx, qword [rsi + 8]
call fcn.18007c144
mov qword [rsi + 8], r15
cmp qword [r15], 0
je 0x18000c1d8
movzx edi, byte [rsp + 0x72]
mov esi, 0x43
nop dword [rax + rax]
mov eax, esi
sub eax, 0x43
je 0x18000c1c0
sub eax, 0x50
je 0x18000c1a5
cmp eax, 0x50
jne 0x18000c1c3
test dil, dil
je 0x18000c19c
call qword [sym.imp.USER32.dll_DestroyCaret]
call qword [0x18]
jmp 0x18000c1c3
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_CreateCaret]
test eax, eax
jne 0x18000c1c3
xor dil, dil
jmp 0x18000c1c3
mov dil, 1
add esi, 0x50
cmp esi, 0x133
jb 0x18000c180
mov byte [rsp + 0x72], dil
mov edi, 0xa
inc r14d
cmp r14d, 0x95
jb 0x18000c110
mov r14d, 0xfe
nop
mov eax, r14d
sub eax, 0xfe
je 0x18000c21f
sub eax, 1
je 0x18000c20d
cmp eax, 1
je 0x18000c6ca
jmp 0x18000c3dc
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x1b
jmp 0x18000c3dc
cmp qword [0x28], 0
je 0x18000c2e3
mov esi, Ordinal_203
mov eax, esi
sub eax, 0xc8
je 0x18000c2b2
sub eax, 1
je 0x18000c284
sub eax, 1
je 0x18000c25c
cmp eax, 1
jne 0x18000c2d3
mov rax, qword [rbp + 0x33b0]
mov qword [rax + 8], r15
jmp 0x18000c2d3
mov rax, qword [rbp + 0x33b0]
mov rcx, qword [rax + 8]
call fcn.18007c144
lea r8, [rbp + 0x780]
xor ecx, ecx
lea rdx, [rbp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
jmp 0x18000c2d3
mov rax, qword [rbp + 0x33b0]
mov byte [rbp + 0xdc], 0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18000d698
mov qword [rbp + 0x780], r15
mov eax, 0x28
mov rcx, qword [rcx]
call qword [rax]
jmp 0x18000c2d3
mov eax, 0x4e
mov byte [rbp + 0xdb], 0x65
mov word [rbp + 0xd8], ax
movzx eax, word [0x1800aac30]
mov word [rbp + 0xd9], ax
inc esi
cmp esi, 0xcc
jb 0x18000c233
jmp 0x18000c2f7
mov rsi, qword [rbp + 0x33b0]
mov rcx, qword [rsi + 8]
call fcn.18007c144
mov qword [rsi + 8], r15
cmp qword [0x48], 0
je 0x18000c3dc
mov esi, 0xd7
lea edi, [rsi - 0x74]
lea r15d, [rdi - 0x1a]
mov eax, esi
sub eax, 0xd7
je 0x18000c383
sub eax, 1
je 0x18000c368
sub eax, 1
je 0x18000c35e
cmp eax, 1
jne 0x18000c3c1
lea rdx, str.d__p_n
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8, qword [sym.imp.RPCRT4.dll_MesInqProcEncodingId]
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x2120]
call fcn.180001130
jmp 0x18000c3c1
mov word [rbp + 0x482], r15w
jmp 0x18000c3c1
mov r8d, 3
lea rdx, [0x1800aacd4]
lea rcx, [rbp + 0x470]
call fcn.18007c4e0
jmp 0x18000c3c1
mov eax, dword [0x1800aac48]
movsd xmm0, qword [str.MesInqProcEn]
mov dword [rbp + 0x478], eax
movzx eax, word [0x1800aacd0]
mov word [rbp + 0x47c], di
mov word [rbp + 0x47d], ax
movzx eax, byte [0x1800aacd2]
mov byte [rbp + 0x47f], al
movsd qword [rbp + 0x470], xmm0
inc esi
cmp esi, 0xdb
jb 0x18000c312
mov edi, 0xa
xor r15d, r15d
lea eax, [rdi + 0x3e]
call qword [rax]
inc r14d
cmp r14d, 0x101
jb 0x18000c1f0
mov r14d, 0x8f
mov dword [rbp - 0x74], r14d
nop word [rax + rax]
cmp r14d, 0x23c
ja 0x18000c4c3
je 0x18000c4a1
cmp r14d, 0x8f
je 0x18000c483
cmp r14d, 0x11e
je 0x18000c452
cmp r14d, 0x1ad
jne 0x18000c6b2
movzx eax, word [str.int3___OVERLOADABLE___select_int3_a__int3_b__int3_c__]
mov word [rbp + 0x19f], ax
movzx eax, byte [0x1800aad1a]
mov byte [rbp + 0x1a1], al
jmp 0x18000c6b2
mov eax, 0x654e
mov byte [rbp + 0x19c], 0
mov r8d, 3
mov word [rbp + 0x19a], ax
lea rdx, [0x1800aace4]
lea rcx, [rbp + 0x19c]
call fcn.18007b500
jmp 0x18000c6b2
mov r8d, 2
lea rdx, [0x1800aacf3]
lea rcx, [rbp + 0x198]
call fcn.18007b500
jmp 0x18000c6b2
mov eax, 0x7265
mov byte [rbp + 0x1a4], 0
mov r13b, 1
mov word [rbp + 0x1a2], ax
mov byte [rbp + 0x33b8], r13b
jmp 0x18000c6b2
cmp r14d, 0x2cb
je 0x18000c68d
cmp r14d, 0x35a
je 0x18000c4eb
cmp r14d, 0x3e9
je case.0x18000c73e.14
jmp 0x18000c6b2
cmp dword [rbp - 0x70], 0
mov ecx, r15d
movzx eax, r13b
cmovne ecx, eax
mov byte [rbp + 0x33b8], cl
movzx r13d, cl
test cl, cl
je 0x18000c6b2
mov edi, dword [rbp - 0x78]
mov esi, 0x122
mov r14d, 0x656d
nop dword [rax]
cmp esi, 0x3629a
ja 0x18000c5c7
je 0x18000c5a3
cmp esi, 0x122
je 0x18000c57c
cmp esi, 0xd980
je 0x18000c55e
cmp esi, 0x1b1de
jne 0x18000c65e
mov word [rbp + 0x11e], r14w
mov byte [rbp + 0x120], 0
jmp 0x18000c65e
mov r8d, 1
lea rdx, [0x1800aad55]
lea rcx, [rbp + 0x118]
call fcn.18007c4e0
jmp 0x18000c65e
mov r8d, 4
lea rdx, [0x1800aad74]
lea rcx, [rbp + 0x118]
call fcn.18007b500
mov word [rbp + 0x11c], 0x4e
jmp 0x18000c65e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x858], xmm0
mov qword [rbp + 0x878], rax
mov edi, 1
movups xmmword [rbp + 0x868], xmm0
jmp 0x18000c65e
cmp esi, 0x43af8
je 0x18000c60d
cmp esi, 0x51356
jne 0x18000c65e
test r13b, r13b
je 0x18000c65e
mov rcx, qword [rbp + 0x100]
lea r9, [rbp + 0x858]
mov r8d, edi
lea rdx, [rbp + 0x118]
call qword [sym.imp.WINSPOOL.DRV_SetFormA]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
jmp 0x18000c65e
mov rcx, qword [rbp + 0x100]
lea rax, [rbp + 0x380]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x858]
mov eax, 0x28
mov dword [rbp + 0x380], r15d
mov r8d, edi
mov dword [rsp + 0x20], eax
lea rdx, [rbp + 0x118]
call qword [sym.imp.WINSPOOL.DRV_GetFormA]
mov dword [rbp - 0x70], eax
test eax, eax
jne 0x18000c65e
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
xor r13b, r13b
add esi, 0xd85e
cmp esi, 0x5ea92
jbe 0x18000c520
mov r14d, dword [rbp - 0x74]
movzx r12d, byte [rbp + 0x33c8]
mov dword [rbp - 0x78], edi
mov edi, 0xa
mov byte [rbp + 0x33b8], r13b
jmp 0x18000c6b2
xor r8d, r8d
mov qword [rbp + 0x100], 0xffffffffffffffff
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x198]
call qword [sym.imp.WINSPOOL.DRV_OpenPrinterA]
mov dword [rbp - 0x70], eax
add r14d, 0x8f
mov dword [rbp - 0x74], r14d
cmp r14d, 0x478
jb 0x18000c400
mov esi, 0x128cd
mov r11, qword [rbp + 0x33b0]
add esi, 0x4a13
cmp esi, 0x1bc72
jbe 0x18000bca0
mov esi, dword [rsp + 0x74]
mov r13d, 0x5c
jmp case.default.0x18000a0e7
mov r13, qword [rbp - 0x40]
mov ecx, 0xda
mov eax, ecx
sub eax, 0xda
je 0x18000c717
cmp eax, 1
je 0x1800082df
jmp 0x18000c7fc
xor edx, edx
movsx eax, byte [rdx]
add eax, 0xfffffff7
cmp eax, 0x74
ja case.0x18000c73e.14
cdqe
movzx eax, byte [r10 + rax + 0xe9a8]
mov ecx, dword [r10 + rax*4 + 0xe990]
add rcx, r10
jmp rcx
mov esi, 0x10
jmp 0x18000c757
mov r11, qword [rbp + 0x33b0]
mov eax, esi
sub eax, 0xe
je 0x18000c7f7
sub eax, 1
je 0x18000c7ba
cmp eax, 1
jne 0x18000c7c1
lea rdx, [rbp + 0x788]
mov qword [rbp + 0x788], 5
lea ecx, [rax + 0x7c]
call fcn.180036d40
mov rcx, qword [rbp + 0x33b0]
mov qword [rcx + 8], rax
test rax, rax
je 0x18000d698
mov r8, rax
mov byte [rbp], 0x2e
mov edx, 0xb5
lea rcx, [rbp]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
jmp 0x18000c7c1
mov dword [r11], 0x12
dec esi
cmp esi, 0xd
ja 0x18000c750
mov esi, 0xc6
nop dword [rax]
mov eax, esi
sub eax, 0xc6
je 0x18000c82f
cmp eax, 1
jne 0x18000c855
mov rsi, qword [rbp + 0x33b0]
mov ecx, 0x117
lea rdx, [rsi + 8]
call fcn.180020110
xor eax, eax
mov dword [rsi], eax
mov ecx, 0xda
mov r11, qword [rbp + 0x33b0]
lea r10, [0x180000000]
inc ecx
cmp ecx, 0xdc
jb 0x18000c700
movzx r12d, byte [rbp + 0x33c8]
mov esi, dword [rsp + 0x74]
mov r13d, 0x59
jmp case.default.0x18000a0e7
mov rax, qword [rbp + 0x33b0]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18000d698
mov rax, qword [0x28]
test rax, rax
je 0x18000c855
mov rcx, qword [rcx]
call rax
inc esi
cmp esi, 0xc8
jb 0x18000c7d0
mov r14d, 0x86
nop dword [rax]
mov eax, r14d
sub eax, 0x84
je 0x18000c903
sub eax, 1
je 0x18000c89c
cmp eax, 1
jne 0x18000c8d7
mov rax, qword [rbp + 0x33b0]
cmp qword [rax + 8], 0
je 0x18000d698
jmp 0x18000c8d7
mov rsi, qword [rbp + 0x33b0]
mov rax, qword [0x28]
add rsi, 8
test rax, rax
je 0x18000c8bc
mov rcx, qword [rsi]
mov rcx, qword [rcx]
call rax
mov rdx, rsi
mov ecx, 0x117
call fcn.180020110
xor edx, edx
cmp qword [rdx], rdx
je 0x18000c8d9
call qword [OleUIPromptUserA]
xor edx, edx
dec r14d
cmp r14d, 0x83
ja 0x18000c870
mov r12d, 0xcc
mov dword [rbp - 0x74], r12d
nop
mov eax, r12d
sub eax, 0xcc
je 0x18000c915
cmp eax, 0x63
jne 0x18000cb0b
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x1a
jmp 0x18000c7f7
mov r15, qword [rbp + 0x33b0]
cmp qword [r15 + 8], 0
je 0x18000d698
cmp qword [0x28], 0
je 0x18000caed
movzx edi, byte [rsp + 0x73]
mov r14d, 0xbb
mov r12d, 0x7453
nop word [rax + rax]
cmp r14d, 0x44aa
ja 0x18000ca18
je 0x18000ca06
cmp r14d, 0xbb
je 0x18000c9d9
cmp r14d, 0x1760
je 0x18000c9c3
cmp r14d, 0x2e05
jne 0x18000cac8
mov r8d, 5
lea rdx, [0x1800aadbb]
lea rcx, [rbp + 0x1a8]
call fcn.18007c4e0
lea rax, [rbp + 0x1a8]
mov dil, 1
mov r13, 0xffffffffffffffff
nop dword [rax]
inc r13
cmp byte [rax + r13], 0
jne 0x18000c9b0
mov qword [rbp - 0x40], r13
jmp 0x18000cac8
mov dword [rbp + 0x1ab], 0x45676e69
mov byte [rbp + 0x1af], 0
jmp 0x18000cac8
mov r8d, 1
mov word [rbp + 0x1a8], r12w
lea rdx, [0x1800aada5]
mov byte [rbp + 0x1aa], 0
lea rcx, [rbp + 0x1aa]
call fcn.18007b500
jmp 0x18000cac8
mov dword [rbp + 0x384], edx
mov qword [rbp + 0x1f8], rdx
jmp 0x18000cac8
cmp r14d, 0x5b4f
je 0x18000ca41
cmp r14d, 0x71f4
jne 0x18000cac8
mov rcx, qword [r15 + 8]
mov eax, 0x28
mov rcx, qword [rcx]
call qword [rax]
jmp 0x18000cac8
lea r9, [rbp + 0x1f8]
mov edx, r13d
lea r8, [rbp + 0x384]
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.RPCRT4.dll_MesEncodeFixedBufferHandleCreate]
test eax, eax
je 0x18000ca68
xor dil, dil
jmp 0x18000cac8
test dil, dil
je 0x18000cac8
mov esi, 0x7e
cmp esi, 0x7e
je 0x18000ca88
cmp esi, 0x30ba
jne 0x18000caba
mov rcx, qword [rbp + 0x1f0]
jmp 0x18000caaf
xor eax, eax
lea r8, [rbp + 0x1f0]
mov edx, r13d
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x1a8]
call qword [sym.imp.RPCRT4.dll_MesDecodeBufferHandleCreate]
mov rcx, qword [rbp + 0x1f8]
test rcx, rcx
je 0x18000caba
call qword [sym.imp.RPCRT4.dll_MesHandleFree]
add esi, 0x303c
cmp esi, 0x6078
jbe 0x18000ca72
add r14d, 0x16a5
mov edx, 0
cmp r14d, 0x87de
jbe 0x18000c950
mov r12d, dword [rbp - 0x74]
mov byte [rsp + 0x73], dil
lea edi, [rdx + 0xa]
lea rdx, [r15 + 8]
mov ecx, 0x117
call fcn.180020110
xor edx, edx
cmp qword [rdx], rdx
je 0x18000cb0b
call qword [0x18]
xor edx, edx
add r12d, 0x63
mov dword [rbp - 0x74], r12d
cmp r12d, 0x192
jb 0x18000c8f0
mov r14d, 0x47
cmp r14d, 0x4a
jae case.0x18000c73e.14
mov eax, r14d
sub eax, 0x47
je 0x18000cb6e
sub eax, 1
je 0x18000cb4d
cmp eax, 1
je 0x18000c7f7
inc r14d
xor edx, edx
jmp 0x18000cb26
cmp qword [rdx], 0
je 0x18000cb5a
call qword [0x48]
mov rax, qword [rbp + 0x33b0]
inc r14d
xor edx, edx
mov dword [rax], 0x1b
jmp 0x18000cb26
mov rsi, qword [rbp + 0x33b0]
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x18000d698
mov rax, qword [0x28]
test rax, rax
je 0x18000cb94
mov rcx, qword [rcx]
call rax
lea rdx, [rsi + 8]
mov ecx, 0x117
call fcn.180020110
inc r14d
xor edx, edx
jmp 0x18000cb26
mov esi, r14d
nop
movzx r14d, byte [rsp + 0x7c]
cmp esi, 0x11
ja case.0x18000cbc8.9
mov eax, esi
mov ecx, dword [r10 + rax*4 + 0xea20]
add rcx, r10
jmp rcx
xor r14d, r14d
lea rdx, [0x1800aadda]
lea rcx, [rbp + 0x3a0]
mov word [rbp + 0x3a6], r14w
lea r8d, [r14 + 5]
call fcn.180076a10
mov dword [rbp + 0x3b0], 0x63
jmp 0x18000cc11
mov eax, 0x4e
mov dword [rbp + 0x442], 0x74
mov word [rbp + 0x3a0], ax
xor r14d, r14d
mov r11, qword [rbp + 0x33b0]
lea r10, [0x180000000]
inc esi
mov edx, 0x65
lea eax, [rsi + 0x5b]
cmp eax, 0x6d
jb 0x18000cbb0
mov ecx, 0x4a
lea r13d, [rcx + 9]
nop word [rax + rax]
mov eax, ecx
sub eax, 0x4a
je 0x18000cec8
sub eax, 1
je 0x18000cebd
cmp eax, 1
je case.0x18000cbc8.17
jmp 0x18000cedf
mov eax, 0x6a
mov word [rbp + 0x43c], ax
jmp case.0x18000cbc8.9
xor eax, eax
mov r14d, eax
movzx eax, byte [rbp - 0x53]
cmp dword [rbp + 0x374], r14d
cmovne r14d, eax
test r14b, r14b
je 0x18000cc9f
mov r8d, dword [rbp + 0x38c]
lea rdx, [rbp + 0x200]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_ObjectDeleteAuditAlarmW]
mov ebx, 1
mov byte [rbp - 0x53], r14b
mov dword [rsp + 0x78], ebx
jmp case.0x18000cbc8.9
mov rax, qword [0x30]
xor r14d, r14d
mov dword [rbp + 0x398], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x848], xmm0
test rax, rax
je 0x18000cc11
call rax
jmp 0x18000cc11
lea rax, [rbp + 0x38c]
xor ecx, ecx
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x3a0]
lea rax, [rbp + 0x65c]
mov qword [rsp + 0x48], rax
lea r8, [rbp + 0x428]
lea rax, [rbp + 0x660]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x200]
mov eax, dword [rbp + 0x398]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0x848]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x378]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AccessCheckAndAuditAlarmW]
mov dword [rbp + 0x374], eax
cmp r14b, 0
je case.0x18000cbc8.9
lea rdx, [rbp + 0x790]
lea rcx, [rbp + 0x820]
call qword [sym.imp.ole32.dll_CreateClassMoniker]
mov dword [rbp + 0xc8], eax
test eax, eax
je 0x18000cd82
mov byte [rsp + 0x7c], 0
jmp case.0x18000cbc8.9
mov rcx, qword [rbp + 0x790]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov byte [rsp + 0x7c], r14b
jmp case.0x18000cbc8.9
mov eax, 0x54
mov word [rbp + 0x430], ax
jmp case.0x18000cbc8.9
mov eax, 0x4e
mov dword [rbp + 0x42a], 0x6d0061
mov word [rbp + 0x428], ax
mov word [rbp + 0x42e], dx
jmp case.0x18000cbc8.9
xor r14d, r14d
lea rdx, [0x1800aae02]
lea rcx, [rbp + 0x3a2]
mov word [rbp + 0x3a2], r14w
lea r8d, [r14 + 2]
call fcn.18007b4a8
jmp 0x18000cc11
movzx eax, byte [rsp + 0x7c]
xor r14d, r14d
cmp dword [rbp + 0xc8], r14d
mov ecx, r14d
cmove ecx, eax
mov byte [rsp + 0x7c], cl
jmp 0x18000cc11
xor eax, eax
mov dword [rbp + 0x378], 0x2000000
xorps xmm0, xmm0
mov qword [rbp + 0x8f0], rax
xor r14d, r14d
mov dword [r11], r14d
movups xmmword [rbp + 0x8d0], xmm0
movups xmmword [rbp + 0x8e0], xmm0
jmp 0x18000cc11
mov eax, 0x79
mov dword [rbp + 0x434], 0x650070
mov word [rbp + 0x432], ax
mov dword [rbp + 0x438], 0x62004f
jmp case.0x18000cbc8.9
mov dword [rbp + 0x43e], 0x630065
jmp case.0x18000cbc8.9
mov dword [rbp + 0x3b2], 0x74
mov byte [rbp - 0x53], 1
mov byte [rsp + 0x7c], 1
jmp case.0x18000cbc8.9
lea rcx, [rbp + 0x820]
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov dword [rbp + 0xc8], eax
jmp case.0x18000cbc8.9
xor r14d, r14d
cmp byte [r14], 0x65
jne case.0x18000c73e.14
mov qword [rbp + 0x200], r14
jmp 0x18000cc11
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp 0x18000cedf
cmp byte [r14], 0x61
jne case.0x18000c73e.14
mov rax, qword [rbp + 0x33b0]
mov dword [rax], OleUIChangeSourceA
inc ecx
cmp ecx, 0x4d
jb 0x18000cc40
jmp 0x18000dbb2
mov r12d, 0xdd
mov dword [rbp - 0x50], r12d
nop dword [rax]
mov eax, r12d
sub eax, 0xdd
je 0x18000cf34
sub eax, 1
je case.0x18000d572.7
sub eax, 1
je 0x18000cf26
cmp eax, 1
je case.0x18000cbc8.17
jmp 0x18000d19b
mov ebx, 1
mov dword [rsp + 0x78], ebx
jmp 0x18000d19b
movsx eax, byte [r14]
add eax, 0xfffffff7
cmp eax, 0x72
ja case.0x18000cf5a.19
cdqe
movzx eax, byte [r10 + rax + 0xea94]
mov ecx, dword [r10 + rax*4 + 0xea68]
add rcx, r10
jmp rcx
mov esi, 0xfd
cmp esi, 0xacf3
ja 0x18000d04a
je 0x18000d031
cmp esi, 0xfd
je 0x18000d01c
cmp esi, 0x3a4f
je 0x18000cff0
cmp esi, 0x73a1
jne 0x18000d074
mov rcx, qword [rbp + 0x608]
lea r8, [rbp + 9]
mov qword [rsp + 0x60], r14
lea rdx, [rbp + 8]
mov qword [rsp + 0x58], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x10
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rbp + 0x130], rax
jmp 0x18000d074
lea r8, [rbp + 8]
mov byte [rbp - 0x52], 0
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x52]
call fcn.180067a10
lea r8, [rbp + 9]
mov byte [rbp - 0x64], 0
lea rdx, [rbp - 0x63]
lea rcx, [rbp - 0x64]
call fcn.180067a10
jmp 0x18000d074
mov byte [rsp + 0x7d], 1
mov qword [rbp + 0x608], r14
mov qword [rbp + 0x130], r14
jmp 0x18000d074
movzx eax, byte [rsp + 0x7d]
mov ecx, r14d
cmp qword [rbp + 0x130], 0
cmovne ecx, eax
mov byte [rsp + 0x7d], cl
jmp 0x18000d074
cmp esi, 0xe645
je 0x18000d060
cmp esi, 0x11f97
je case.0x18000d572.7
jmp 0x18000d074
cmp byte [rsp + 0x7d], 0
je 0x18000d074
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add esi, 0x3952
cmp esi, 0x157ec
jbe 0x18000cf61
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 1
mov qword [rax + 8], r14
jmp case.0x18000d572.7
mov rax, qword [r14]
test rax, rax
je 0x18000d0a6
call rax
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x19
jmp case.0x18000d572.7
mov rax, qword [0x10]
test rax, rax
je case.0x18000d572.7
call rax
jmp case.0x18000d572.7
mov dword [r11], 7
jmp case.0x18000d572.7
mov dword [r11], edi
jmp case.0x18000d572.7
mov dword [r11], 0xe
jmp case.0x18000d572.7
mov eax, 4
cmp eax, 4
je 0x18000d112
add eax, 0x2dc
cmp eax, 0x2dc
jbe 0x18000d0f5
mov r15d, 0xab
mov dword [rbp - 0x74], r15d
jmp 0x18000d177
lea rdx, [rbp + 0x610]
mov dword [r11], 0x11
mov ecx, 0x7d
mov qword [rbp + 0x610], 5
call fcn.180036d40
mov rcx, qword [rbp + 0x33b0]
mov qword [rcx + 8], rax
test rax, rax
je 0x18000d698
mov r8, rax
mov byte [rbp + 0x10], 0x30
mov edx, 0xb5
lea rcx, [rbp + 0x10]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
jmp case.0x18000d572.7
mov r11, qword [rbp + 0x33b0]
cmp r15d, 0xab
je 0x18000d1ce
cmp r15d, 0x142
jne 0x18000d4c2
xor r14d, r14d
mov r12d, 0xde
lea r13d, [r12 - 0x7b]
mov esi, dword [rsp + 0x74]
lea r10, [0x180000000]
mov r11, qword [rbp + 0x33b0]
inc r12d
mov dword [rbp - 0x50], r12d
cmp r12d, 0xe1
jb 0x18000cf00
movzx r12d, byte [rbp + 0x33c8]
jmp 0x18000dbb2
lea rdx, [rbp + 0x618]
mov dword [r11], 0x18
mov ecx, 0x7d
mov qword [rbp + 0x618], 5
call fcn.180036d40
mov r14, qword [rbp + 0x33b0]
mov qword [r14 + 8], rax
test rax, rax
jne 0x18000d2af
mov esi, 0xa2
nop word [rax + rax]
mov eax, esi
sub eax, 0xa2
je 0x18000d294
sub eax, 1
je 0x18000d26d
sub eax, 1
je 0x18000d22e
cmp eax, 1
je case.0x18000cbc8.17
jmp 0x18000d29d
mov r9d, 0xffffffff
mov dword [rsp + 0x28], 0x104
lea rax, [rbp + 0x3150]
mov byte [rbp + 0x13e], 0
lea r8, [rbp + 0x138]
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, 6
mov dword [rsp + 0x78], ebx
jmp 0x18000d29d
mov r8d, 3
lea rdx, [0x1800aae24]
lea rcx, [rbp + 0x139]
call fcn.18007b500
mov eax, 0x676e
mov word [rbp + 0x13c], ax
jmp 0x18000d29d
mov word [rbp + 0x138], 0x53
inc esi
cmp esi, 0xa6
jb 0x18000d210
mov esi, dword [rsp + 0x74]
mov r8, qword [r14 + 8]
lea rcx, [rbp + 0x18]
xor eax, eax
mov edx, 0xb5
movzx eax, byte [rax]
mov byte [rbp + 0x18], al
call fcn.18005fbe0
cmp eax, 1
je 0x18000d4c2
mov r14d, 0x11c
nop dword [rax + rax]
cmp r14d, 0x11c
je 0x18000d473
cmp r14d, 0xd738
je 0x18000d451
cmp r14d, 0x28370
je 0x18000d444
cmp r14d, 0x3598c
je 0x18000d322
cmp r14d, 0x42fa8
je 0x18000d698
jmp 0x18000d4ae
xor r8d, r8d
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.WINSPOOL.DRV_OpenPrinterA]
movzx esi, sil
mov ecx, 0
test eax, eax
cmove esi, ecx
mov dword [rsp + 0x74], esi
test sil, sil
je 0x18000d4ae
mov edi, dword [rbp - 0x80]
lea ebx, [rcx + 0x56]
mov esi, 0x92
lea r12d, [rcx + 0x65]
lea r15d, [rcx + 0x4e]
nop word [rax + rax]
mov eax, esi
sub eax, 0x92
je 0x18000d403
sub eax, 1
je 0x18000d3e9
sub eax, 2
je 0x18000d3e2
sub eax, 1
je 0x18000d3a6
cmp eax, 1
jne 0x18000d41c
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.WINSPOOL.DRV_ClosePrinter]
xor ecx, ecx
jmp 0x18000d41c
lea rax, [rbp + 0x37c]
mov dword [rbp + 0x37c], ecx
mov rcx, qword [rbp + 0x128]
lea r9, [rbp + 0xcf0]
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x388]
lea rdx, [rbp + 0x210]
mov dword [rsp + 0x20], edi
call qword [sym.imp.WINSPOOL.DRV_GetPrinterDataA]
xor ecx, ecx
jmp 0x18000d41c
mov edi, 0x104
jmp 0x18000d41c
mov word [rbp + 0x215], r15w
mov dword [rbp + 0x216], 0x656d61
mov dword [rbp + 0x388], ecx
jmp 0x18000d41c
mov word [rbp + 0x210], bx
mov dword [rbp + 0x211], 0x756c61
mov word [rbp + 0x214], r12w
inc esi
cmp esi, 0x98
jb 0x18000d370
mov ebx, dword [rsp + 0x78]
mov r15d, dword [rbp - 0x74]
mov r12d, dword [rbp - 0x50]
mov esi, dword [rsp + 0x74]
mov dword [rbp - 0x80], edi
mov edi, 0xa
jmp 0x18000d4ae
mov qword [rbp + 0x128], 0xffffffffffffffff
jmp 0x18000d4ae
mov r8d, 1
lea rdx, [0x1800aa06c]
lea rcx, [rbp + 0x4e0]
call fcn.18007c4e0
mov sil, 1
mov dword [rsp + 0x74], esi
jmp 0x18000d4ae
movabs rax, 0x725077654e794d
lea rcx, [rbp + 0x4e0]
mov qword [rbp + 0x4e0], rax
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000d490
movzx eax, word [0x1800aa914]
mov word [rcx], ax
mov dword [rbp + 0x4e8], 0x65746e
add r14d, 0xd61c
cmp r14d, 0x504a8
jbe 0x18000d2e0
add r15d, 0x97
mov dword [rbp - 0x74], r15d
cmp r15d, 0x1d9
jb 0x18000d170
mov esi, 0x106
nop
mov eax, esi
sub eax, 0x106
je 0x18000d4f4
cmp eax, 1
je 0x18000d18d
jmp 0x18000d549
mov r14, qword [rbp + 0x33b0]
lea rdx, [rbp + 0x620]
mov ecx, 0x7d
mov qword [rbp + 0x620], 8
mov dword [r14], 0x17
call fcn.180036d40
mov qword [r14 + 8], rax
test rax, rax
je 0x18000d698
mov r8, rax
mov byte [rbp + 0x20], 0x2d
mov edx, 0xb5
lea rcx, [rbp + 0x20]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
inc esi
cmp esi, 0x108
jb 0x18000d4e0
xor r14d, r14d
lea r10, [0x180000000]
mov edx, r14d
cmp edx, 7
ja case.default.0x18000d572
mov eax, edx
mov ecx, dword [r10 + rax*4 + 0xeb08]
add rcx, r10
jmp rcx
mov dword [rbp + 0x348], 0x650054
mov dword [rbp + 0x34c], 0x740073
jmp case.default.0x18000d572
mov dword [rbp + 0x3bc], 0x610056
jmp case.default.0x18000d572
mov dword [rbp + 0x3ca], 0x65
jmp case.default.0x18000d572
mov word [rbp + 0x350], r14w
mov dword [rbp + 0x3b8], 0x79004d
jmp case.default.0x18000d572
mov eax, 0x6c
mov word [rbp + 0x3c8], ax
jmp case.default.0x18000d572
mov dword [rbp + 0x3c0], 0x690072
mov dword [rbp + 0x3c4], 0x620061
inc edx
lea eax, [rdx + 0x94]
cmp eax, 0x9c
jb 0x18000d560
jmp 0x18000d19b
mov ecx, 0x129
mov eax, ecx
sub eax, 0x129
je 0x18000d60c
cmp eax, 0x7b
je case.0x18000cbc8.17
jmp 0x18000d98d
movsx eax, byte [r14]
add eax, 0xffffffd0
cmp eax, 9
ja case.default.0x18000d629
cdqe
mov ecx, dword [r10 + rax*4 + 0xeb28]
add rcx, r10
jmp rcx
cmp dword [r11 + 4], 0
jne 0x18000d6c3
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xffffffffffffffff
jae 0x18000d6cf
movzx eax, byte [r14]
lea rcx, [rbp + 0x70]
mov byte [rbp + 0x70], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
je 0x18000d6b5
mov eax, 8
nop
cmp eax, 8
je 0x18000d6a2
cmp eax, 0xab
jne 0x18000d6a9
mov ecx, dword [rbp + 0x2c0]
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
mov eax, 6
jmp 0x18000731b
mov dword [rbp + 0x2c0], r14d
add eax, 0xa3
cmp eax, 0x14e
jb 0x18000d680
mov r11, qword [rbp + 0x33b0]
lea r10, [0x180000000]
mov dword [r11], 0x13
jmp 0x18000d97f
mov esi, reloc.oledlg.dll_OleUIChangeSourceA
mov ebx, r14d
lea r12d, [rsi + 0x31]
nop dword [rax + rax]
lea r10, [0x180000000]
cmp ebx, 0xb
ja case.default.0x18000d6fd
mov eax, ebx
mov ecx, dword [r10 + rax*4 + 0xeb50]
add rcx, r10
jmp rcx
mov r8d, 3
lea rdx, [0x1800aae92]
lea rcx, [rbp + 0x550]
call fcn.18007b4a8
jmp 0x18000d898
mov r8d, 2
mov word [rbp + 0x53a], r14w
lea rdx, [0x1800aaf16]
lea rcx, [rbp + 0x530]
call fcn.180076a10
mov dword [rbp + 0x53e], 0x300030
jmp 0x18000d898
mov r8d, 2
mov word [rbp + 0x534], r14w
lea rdx, [0x1800aaf64]
lea rcx, [rbp + 0x530]
call fcn.180076a10
mov word [rbp + 0x538], r12w
jmp 0x18000d898
mov word [rbp + 0x556], r14w
jmp case.default.0x18000d6fd
lea rdx, [rbp + 0x800]
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x18000d898
xorps xmm0, xmm0
mov dword [rbp + 0x56e], 0x31
movdqu xmmword [rbp + 0x804], xmm0
mov qword [rbp + 0x814], r14
mov dword [rbp + 0x800], 0x1c
jmp case.default.0x18000d6fd
mov eax, dword [0x1800aaff6]
mov dword [rbp + 0x54a], eax
movzx eax, word [0x1800aaffa]
mov word [rbp + 0x54e], ax
mov word [rbp + 0x550], r14w
jmp case.default.0x18000d6fd
mov dword [rbp + 0x530], 0x610062
jmp case.default.0x18000d6fd
mov r8d, 4
mov word [rbp + 0x542], r14w
lea rdx, [0x1800ab02a]
lea rcx, [rbp + 0x542]
call fcn.18007b4a8
jmp 0x18000d898
mov r11, qword [rbp + 0x33b0]
mov dword [r11 + 4], 1
jmp 0x18000d8a6
movsd xmm0, qword [0x1800ab07e]
movzx eax, word [0x1800ab086]
movsd qword [rbp + 0x556], xmm0
mov word [rbp + 0x55e], ax
jmp case.default.0x18000d6fd
mov r8d, 4
mov word [rbp + 0x560], r14w
lea rdx, [0x1800ab0b8]
lea rcx, [rbp + 0x530]
call fcn.180076a10
mov r8d, 3
lea rdx, [0x1800ab106]
lea rcx, [rbp + 0x568]
call fcn.18007b4a8
mov word [rbp + 0x56e], r14w
lea r10, [0x180000000]
mov r11, qword [rbp + 0x33b0]
inc ebx
sub rsi, 1
jne 0x18000d6e0
movzx r12d, byte [rbp + 0x33c8]
lea edi, [rsi + 0xa]
mov dword [r11], 0x13
jmp 0x18000d97f
mov ecx, 7
nop
cmp ecx, 7
je 0x18000d95f
cmp ecx, 0xad
jne 0x18000d96d
mov ebx, 0x109
nop word [rax + rax]
mov eax, ebx
sub eax, 0x109
je 0x18000e1a9
sub eax, 1
je 0x18000e19d
sub eax, 1
je 0x18000e181
cmp eax, 1
jne 0x18000e1ce
lea rdx, str.ilities
lea rcx, [rbp + 0x14b]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [0x1800ab130]
lea rcx, [rbp + 0x152]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov r8, qword [rbp + 0x648]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x2920]
call fcn.180001130
jmp 0x18000e1ce
mov rax, qword [sym.imp.WINSPOOL.DRV_DeviceCapabilitiesA]
mov qword [rbp + 0x648], rax
add ecx, 0xa6
cmp ecx, 0x153
jb 0x18000d8d0
mov ebx, 1
mov ecx, 0x129
mov dword [rsp + 0x78], ebx
add ecx, 0x7b
cmp ecx, 0x21f
jb 0x18000d5f5
mov r10, qword [rbp - 0x60]
xor edx, edx
mov r15d, 0xf6
mov dword [rbp - 0x74], r15d
nop dword [rax]
mov eax, r15d
sub eax, 0xf6
je 0x18000dafc
sub eax, 0x61
je 0x18000db82
sub eax, 0x61
je 0x18000dae9
sub eax, 0x61
je 0x18000d9e3
cmp eax, 0x61
je 0x1800082df
jmp 0x18000db88
mov edi, 0x65
mov esi, edx
lea ebx, [rdi + 4]
lea r14d, [rdi - 0x5e]
lea r12d, [rdi + 0xd]
lea r15d, [rdi - 0x21]
nop dword [rax]
cmp esi, 6
ja case.default.0x18000da1c
lea rdx, [0x180000000]
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0xeb80]
add rcx, rdx
jmp rcx
mov eax, 0x746e
mov word [rbp + 0x228], bx
mov word [rbp + 0x229], ax
mov dword [rbp + 0x22b], 0x447265
jmp case.default.0x18000da1c
mov r8, qword [rbp + 0x628]
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x2320]
call fcn.180001130
jmp case.default.0x18000da1c
mov eax, 0x7250
mov word [rbp + 0x226], ax
jmp case.default.0x18000da1c
mov word [rbp + 0x221], di
mov dword [rbp + 0x222], 0x74656c
mov word [rbp + 0x225], di
jmp case.default.0x18000da1c
mov word [rbp + 0x22e], r12w
jmp case.default.0x18000da1c
mov word [rbp + 0x220], r15w
jmp case.default.0x18000da1c
mov eax, 0x45
mov dword [rbp + 0x22f], 0x72657669
mov word [rbp + 0x233], ax
mov eax, 0x78
mov word [rbp + 0x234], ax
mov dword [rbp + 0x235], 0x702520
inc esi
sub r14, 1
jne 0x18000da00
mov ebx, dword [rsp + 0x78]
lea edi, [r14 + 0xa]
mov r15d, dword [rbp - 0x74]
movzx r12d, byte [rbp + 0x33c8]
jmp 0x18000db88
mov rax, qword [sym.imp.WINSPOOL.DRV_DeletePrinterDriverExA]
mov qword [rbp + 0x628], rax
jmp 0x18000db88
xor r13d, r13d
movsx edx, byte [r13]
lea eax, [rdx - 9]
cmp eax, 0x74
ja case.0x18000c73e.14
lea r8, [0x180000000]
cdqe
movzx eax, byte [r8 + rax + 0xebb8]
mov ecx, dword [r8 + rax*4 + 0xeb9c]
add rcx, r8
jmp rcx
cmp dword [r11 + 4], r13d
jne 0x18000db82
mov rcx, qword [r11 + 8]
mov r9d, 0x48
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
call fcn.18002a4c0
cmp rax, 0xffffffffffffffff
jae 0x18000dbda
movzx eax, byte [r13]
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x30], al
mov edx, 0xb5
mov rax, qword [rbp + 0x33b0]
mov r8, qword [rax + 8]
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov r15d, 0x157
mov r10, qword [rbp - 0x60]
add r15d, 0x61
mov r11, qword [rbp + 0x33b0]
mov r13d, 0x5a
mov dword [rbp - 0x74], r15d
lea edx, [r13 - 0x5a]
cmp r15d, 0x2db
jb 0x18000d9b0
mov esi, dword [rsp + 0x74]
mov r11, qword [rbp + 0x33b0]
lea r10, [0x180000000]
mov r9d, dword [rbp + 0x33c0]
inc r13d
xor r14d, r14d
lea edx, [r14 + 0x65]
jmp 0x18000a0c2
mov rax, qword [rbp + 0x33b0]
mov dword [rax + 4], 1
jmp 0x18000db82
mov r8, qword [r11 + 8]
lea rcx, [rbp + 0x38]
mov byte [rbp + 0x38], dl
mov edx, 0xb5
call fcn.18005fbe0
cmp eax, 1
jne 0x18000d698
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x14
jmp 0x18000db82
mov r15d, 8
mov eax, r15d
sub eax, 7
je 0x18000db82
cmp eax, 1
jne 0x18000de4e
cmp qword [r11 + 8], r13
lea r14, [r11 + 8]
jne 0x18000de21
mov esi, 0x115
nop dword [rax + rax]
mov eax, esi
sub eax, 0x115
je 0x18000dde7
sub eax, 0x14
je 0x18000dc70
cmp eax, 0x14
je case.0x18000cbc8.17
jmp 0x18000de12
test r10, r10
jne 0x18000dda9
mov ebx, 0xd5
lea edi, [rbx - 0x70]
mov eax, ebx
sub eax, 0xd5
je 0x18000dd2a
sub eax, 1
je 0x18000dcbd
cmp eax, 1
jne 0x18000dd7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x4b8]
lea rcx, [rbp + 0x2520]
call fcn.180001130
jmp 0x18000dd7d
movsd xmm0, qword [str.bleTimer_fa]
lea rcx, [rbp + 0x4b8]
mov eax, dword [0x1800ab150]
dec rcx
mov dword [rbp + 0x4cb], eax
movsd qword [rbp + 0x4c3], xmm0
mov dword [rbp + 0x4ce], 0x656c69
nop dword [rax]
cmp byte [rcx + 1], r13b
lea rcx, [rcx + 1]
jne 0x18000dcf0
movzx eax, word [0x1800ab154]
mov word [rcx], ax
movzx eax, byte [0x1800ab156]
mov byte [rcx + 2], al
mov eax, dword [str.__u__n]
mov dword [rbp + 0x4d3], eax
movzx eax, word [reloc.oledlg.dll_OleUIPromptUserA]
mov word [rbp + 0x4d7], ax
jmp 0x18000dd7d
mov eax, dword [str.Creat]
lea rdx, [0x1800aac14]
mov dword [rbp + 0x4b8], eax
lea rcx, [rbp + 0x4c2]
movzx eax, word [0x1800ab138]
mov r8d, 2
mov word [rbp + 0x4bc], ax
mov eax, dword [str.Wait]
mov word [rbp + 0x4bd], di
mov dword [rbp + 0x4be], eax
movzx eax, byte [0x1800ab140]
mov byte [rbp + 0x4c2], al
call fcn.18007b500
inc ebx
cmp ebx, 0xd8
jb 0x18000dc81
mov r10, qword [rbp - 0x60]
xor r12b, r12b
mov ebx, 6
mov byte [rbp + 0x33c8], r12b
mov dword [rsp + 0x78], ebx
mov edi, 0xa
jmp 0x18000de12
test r12b, r12b
je 0x18000dddc
mov dword [rsp + 0x28], r13d
lea rdx, [rbp + 0x630]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [rbp - 0x60]
mov ebx, 6
mov dword [rsp + 0x78], ebx
jmp 0x18000de12
xor r8d, r8d
mov r12b, 1
xor ecx, ecx
mov byte [rbp + 0x33c8], r12b
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
mov r10, rax
mov qword [rbp - 0x60], rax
mov qword [rbp + 0x630], 0xfffffffffa0a1f00
add esi, 0x14
cmp esi, 0x151
jb 0x18000dc50
mov r8, qword [0x28]
test r8, r8
je 0x18000de37
mov rcx, qword [r14]
mov rcx, qword [rcx]
call r8
mov rdx, r14
mov ecx, 0x117
call fcn.180020110
mov r11, qword [rbp + 0x33b0]
mov dword [r11], r13d
mov r10, qword [rbp - 0x60]
dec r15d
cmp r15d, 6
ja 0x18000dc20
mov r14d, 0x11b
nop word [rax + rax]
mov eax, r14d
sub eax, 0x117
je 0x18000db82
sub eax, 1
je 0x18000ded5
sub eax, 1
je 0x18000dec6
sub eax, 1
je 0x18000de9e
cmp eax, 1
jne 0x18000dedc
cmp qword [r11 + 8], r13
je 0x18000d698
jmp 0x18000dedc
mov rax, qword [0x28]
lea rsi, [r11 + 8]
test rax, rax
je 0x18000deb7
mov rcx, qword [rsi]
mov rcx, qword [rcx]
call rax
mov rdx, rsi
mov ecx, 0x117
call fcn.180020110
jmp 0x18000dedc
cmp qword [r13], r13
je 0x18000dedc
call qword [OleUIPromptUserA]
jmp 0x18000dedc
mov dword [r11], 0x1a
mov r11, qword [rbp + 0x33b0]
dec r14d
cmp r14d, 0x116
ja 0x18000de70
mov r14d, 0x18
cmp r14d, 0x18
je 0x18000df17
cmp r14d, 0x55
jne 0x18000dfd6
mov rax, qword [rbp + 0x33b0]
mov dword [rax], 0x1a
jmp 0x18000db82
cmp qword [0x28], r13
je 0x18000dfb0
mov esi, 0xd9
nop word [rax + rax]
cmp esi, 0xd9
je 0x18000df99
cmp esi, 0x188
je 0x18000df72
cmp esi, 0x237
jne 0x18000dfa0
mov rdx, qword [rbp + 0x638]
mov ecx, dword [rbp + 0x390]
call qword [sym.imp.oledlg.dll_OleUIPromptUserA]
mov rdx, qword [rbp + 0x33b0]
mov ecx, 0x117
add rdx, 8
call fcn.180020110
jmp 0x18000dfa0
mov rax, qword [rbp + 0x33b0]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18000d698
mov rcx, qword [rcx]
mov eax, 0x28
mov qword [rbp + 0x638], r13
call qword [rax]
jmp 0x18000dfa0
mov dword [rbp + 0x390], r13d
add esi, 0xaf
cmp esi, 0x2e6
jb 0x18000df30
jmp 0x18000dfc9
mov rsi, qword [rbp + 0x33b0]
mov ecx, 0x117
lea rdx, [rsi + 8]
call fcn.180020110
mov qword [rsi + 8], r13
cmp qword [r13], r13
je 0x18000dfd6
call qword [0x18]
add r14d, 0x3d
cmp r14d, 0x92
jb 0x18000def5
mov esi, 0x3e
nop dword [rax]
cmp esi, 0x21e8
ja case.0x18000c73e.14
cmp esi, 0x3e
je 0x18000e079
cmp esi, 0x706
je 0x18000e059
cmp esi, 0xdce
je 0x18000e042
cmp esi, 0x1496
je 0x18000e02d
cmp esi, 0x1b5e
je 0x18000db82
add esi, 0x6c8
jmp 0x18000dff0
mov rax, qword [rbp + 0x33b0]
add esi, 0x6c8
mov dword [rax], 0x1b
jmp 0x18000dff0
mov rax, qword [0x48]
test rax, rax
je 0x18000e09f
call rax
add esi, 0x6c8
jmp 0x18000dff0
mov rdx, qword [rbp + 0x33b0]
mov ecx, 0x117
add rdx, 8
call fcn.180020110
add esi, 0x6c8
jmp 0x18000dff0
mov rax, qword [rbp + 0x33b0]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18000d698
mov rax, qword [0x28]
test rax, rax
je 0x18000e09f
mov rcx, qword [rcx]
call rax
add esi, 0x6c8
jmp 0x18000dff0
mov dword [r11], 0xf
mov eax, 1
jmp 0x18000731b
mov ebx, 9
cmp ebx, 9
je 0x18000e11d
cmp ebx, 0x6a5
je 0x18000e0f8
cmp ebx, 0xd41
jne 0x18000e147
mov r8, qword [rbp + 0x640]
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x2720]
mov byte [rbp + 0x251], 0
call fcn.180001130
jmp 0x18000e147
mov eax, dword [0x1800aaaab]
mov dword [rbp + 0x24c], eax
movzx eax, byte [0x1800aaaaf]
mov byte [rbp + 0x250], al
mov dword [rbp + 0x248], 0x696c6169
jmp 0x18000e147
mov r8d, 4
mov byte [rbp + 0x240], 0
lea rdx, [0x1800aaacd]
lea rcx, [rbp + 0x240]
call fcn.18007c4e0
mov dword [rbp + 0x244], 0x74696e69
add ebx, 0x69c
cmp ebx, 0x13d4
jbe 0x18000e0c0
mov eax, 7
jmp 0x18000731b
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0x3b8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, 7
jmp 0x18000731b
mov eax, dword [str.Capab]
mov dword [rbp + 0x146], eax
movzx eax, word [0x1800ab11c]
mov word [rbp + 0x14a], ax
jmp 0x18000e1ce
mov dword [rbp + 0x143], 0x656369
jmp 0x18000e1ce
mov r8d, 3
lea rdx, [0x1800ab120]
lea rcx, [rbp + 0x140]
call fcn.18007b500
mov eax, 0x76
mov word [rbp + 0x142], ax
inc ebx
cmp ebx, 0x10d
jb 0x18000d8f0
mov eax, 7
jmp 0x18000731b