Function at 0x1800b7370
Capabilities:
Check for time delay via gettickcount
Get file size
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1840
call fcn.180124410
sub rsp, rax
lea rbp, [rsp + 0x70]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov qword [rbp + 0x1828], rbx
mov rax, qword [0x1801dc960]
xor rax, rbp
mov qword [rbp + 0x17c0], rax
mov qword [rbp + 0x30], r8
mov r13, rdx
mov r12, rcx
test rcx, rcx
je 0x1800b73c2
call fcn.1800fd3f0
test r13, r13
je 0x1800b73cf
mov rcx, r13
call fcn.1800fd3f0
mov byte [rbp + 0x7e0], 0
xor edx, edx
mov r8d, 0x7ff
lea rcx, [rbp + 0x7e1]
call fcn.1800f4fb0
lea rbx, [0x180152644]
xor r14d, r14d
lea esi, [r14 + 1]
cmp dword [0x1802210f4], r14d
je 0x1800b8055
cmp dword [0x180259e9c], r14d
je 0x1800b8055
cmp byte [r13], 0x5c
je 0x1800b8055
lea r8, [0x1801665e0]
mov edx, 0xaec2
lea rcx, [0x180155288]
call fcn.18005cd20
mov r15d, r14d
mov dword [rbp + 0x28], r14d
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
cmp dword [0x1802211f8], r14d
je 0x1800b752a
lea r8, [0x1801665d0]
mov edx, 0xaec7
lea rcx, [0x180155288]
call fcn.18005cd20
movzx edx, byte [0x18025bde4]
cmp byte [r13], dl
je 0x1800b752a
mov rcx, r13
call fcn.180065ab0
mov dword [0x18025c98c], eax
lea r8, [0x1801665c0]
mov edx, 0xaecc
lea rcx, [0x180155288]
call fcn.18005cd20
cmp dword [0x18025c98c], r14d
jne 0x1800b74c6
mov rcx, r13
call fcn.1800658c0
test eax, eax
jne 0x1800b74c6
movzx ecx, byte [r13]
call fcn.180065cb0
test eax, eax
je 0x1800b751d
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022151c]
call fcn.18008efc0
test eax, eax
je 0x1800b751d
xor r8d, r8d
mov rdx, r12
lea rcx, [0x1802211fc]
call fcn.18008f400
test eax, eax
je 0x1800b751d
lea r8, [0x1801665a8]
mov edx, 0xaed1
lea rcx, [0x180155288]
call fcn.18005cd20
mov r15d, esi
mov dword [rbp + 0x28], esi
movzx eax, byte [r13]
mov byte [0x18025b31c], al
jmp 0x1800b7524
mov byte [0x18025b31c], dil
mov dword [0x18025c208], ebx
cmp dword [0x1802216ac], edi
je 0x1800b7687
movzx eax, byte [0x18025bde5]
cmp byte [r12], al
je 0x1800b75d8
mov rcx, r12
call fcn.180065ab0
mov dword [0x18025c988], eax
test eax, eax
jne 0x1800b7573
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800b7573
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800b75c6
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022151c]
call fcn.18008efc0
test eax, eax
je 0x1800b75c6
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022138c]
call fcn.18008f400
test eax, eax
je 0x1800b75c6
lea r8, [0x180166590]
mov edx, 0xaeea
lea rcx, [0x180155288]
call fcn.18005cd20
mov edi, esi
movzx eax, byte [r12]
mov byte [0x18025b31d], al
jmp 0x1800b75cd
mov byte [0x18025b31d], dil
mov dword [0x18025c20c], ebx
jmp 0x1800b7687
mov eax, ebx
sub eax, dword [0x18025c20c]
cmp eax, 0xea60
jbe 0x1800b7674
mov rcx, r12
call fcn.180065ab0
mov dword [0x18025c988], eax
test eax, eax
jne 0x1800b7617
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800b7617
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800b766a
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022151c]
call fcn.18008efc0
test eax, eax
je 0x1800b766a
xor r8d, r8d
mov rdx, r12
lea rcx, [0x18022138c]
call fcn.18008f400
test eax, eax
je 0x1800b766a
lea r8, [0x180166580]
mov edx, 0xaf04
lea rcx, [0x180155288]
call fcn.18005cd20
mov edi, esi
movzx eax, byte [r12]
mov byte [0x18025b31d], al
jmp 0x1800b767a
xor al, al
mov byte [0x18025b31d], al
jmp 0x1800b767a
mov al, byte [0x18025b31d]
mov dword [0x18025c20c], ebx
cmp byte [r12], al
cmove edi, esi
cmp dword [0x1802216b4], r14d
jne 0x1800b769d
cmp dword [0x1802216b8], r14d
je 0x1800b8045
test r15d, r15d
jne 0x1800b76aa
test edi, edi
je 0x1800b804e
mov byte [rbp + 0x50], r14b
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0x51]
call fcn.1800f4fb0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov r15d, r14d
mov byte [rbp + 0x1a0], r14b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
cmp rbx, 0xffffffffffffffff
je 0x1800b7722
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1a0]
mov rcx, r12
call fcn.180065a00
cmp dword [rbp + 0x28], r14d
je 0x1800b7c5e
test edi, edi
jne 0x1800b7fed
cmp dword [0x18025c98c], r14d
je 0x1800b77f3
lea rdx, [0x180151500]
lea ecx, [rdi + 2]
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rdi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801512a8]
mov ecx, 0x403
call fcn.180001000
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
mov byte [rbp + 0x40], r14b
xor eax, eax
mov qword [rbp + 0x41], rax
mov byte [rbp + 0x49], al
movsx r8d, byte [r13]
lea rdx, [0x18015cc84]
lea rcx, [rbp + 0x40]
call fcn.1800f509c
mov r8d, esi
lea rdx, str.uatinfo.ini
lea rcx, [rbp]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b7836
mov rax, qword [rax + 8]
jmp 0x1800b783a
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x64
lea r9, [rbp + 0x50]
lea r8, [0x180152644]
lea rdx, [rbp + 0x40]
lea rcx, str.UsbDisk
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
cmp qword [rbp + 0x20], 0x10
jb 0x1800b7874
mov rcx, qword [rbp + 8]
call fcn.1800f4b9c
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
mov byte [rbp + 0x130], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0x131]
call fcn.1800f4fb0
mov byte [rbp + 0xc0], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0xc1]
call fcn.1800f4fb0
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
test rax, rax
je 0x1800b7934
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800b7908
lea r8, [rcx - 2]
inc rdx
lea rcx, [rbp + 0xc0]
call fcn.1800f6e10
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov byte [rax], 0
lea r8, [rbp + 0x50]
lea rdx, [0x180166564]
lea rcx, [rbp + 0x130]
call fcn.1800f509c
jmp 0x1800b7953
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x50]
mov byte [rbp + rcx + 0x130], al
inc rcx
test al, al
jne 0x1800b7940
cmp dword [0x180221ea0], 2
je 0x1800b7adf
cmp byte [rbp + 0xc0], 0
je 0x1800b7a2c
lea rdx, [0x1801514c0]
mov ecx, 8
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151298]
mov ecx, 0x404
call fcn.180001000
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s___s__context_s_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
lea rdx, [0x1801514c0]
mov ecx, 8
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151298]
mov ecx, 0x404
call fcn.180001000
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s__context_s_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
cmp byte [rbp + 0xc0], 0
je 0x1800b7bab
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151298]
mov ecx, 0x404
call fcn.180001000
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s___s__context_s_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151298]
mov ecx, 0x404
call fcn.180001000
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind103__policyid_d__policyname_s__context_s_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
test edi, edi
je 0x1800b7fed
cmp dword [0x18025c988], r14d
je 0x1800b7d1a
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801512d0]
mov ecx, 0x401
call fcn.180001000
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind102__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
mov byte [rbp + 0x40], r14b
xor eax, eax
mov qword [rbp + 0x41], rax
mov byte [rbp + 0x49], al
movsx r8d, byte [r12]
lea rdx, [0x18015cc84]
lea rcx, [rbp + 0x40]
call fcn.1800f509c
mov r8d, esi
lea rdx, str.uatinfo.ini
lea rcx, [rbp]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b7d5d
mov rax, qword [rax + 8]
jmp 0x1800b7d61
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x64
lea r9, [rbp + 0x50]
lea r8, [0x180152644]
lea rdx, [rbp + 0x40]
lea rcx, str.UsbDisk
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
nop
cmp qword [rbp + 0x20], 0x10
jb 0x1800b7d9b
mov rcx, qword [rbp + 8]
call fcn.1800f4b9c
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
mov byte [rbp + 0xc0], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0xc1]
call fcn.1800f4fb0
mov byte [rbp + 0x130], 0
xor edx, edx
lea r8d, [rdx + 0x63]
lea rcx, [rbp + 0x131]
call fcn.1800f4fb0
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
test rax, rax
je 0x1800b7e5b
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800b7e2f
lea r8, [rcx - 2]
inc rdx
lea rcx, [rbp + 0x130]
call fcn.1800f6e10
lea rdx, [0x180153a60]
lea rcx, [rbp + 0x50]
call fcn.1800f4d08
mov byte [rax], 0
lea r8, [rbp + 0x50]
lea rdx, [0x180166564]
lea rcx, [rbp + 0xc0]
call fcn.1800f509c
jmp 0x1800b7e73
mov rcx, r14
nop
movzx eax, byte [rbp + rcx + 0x50]
mov byte [rbp + rcx + 0xc0], al
inc rcx
test al, al
jne 0x1800b7e60
cmp byte [rbp + 0x130], 0
je 0x1800b7f3f
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801512c0]
mov ecx, 0x402
call fcn.180001000
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind102__policyid_d__policyname_s___s__context_s__s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
jmp 0x1800b7fed
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801512c0]
mov ecx, 0x402
call fcn.180001000
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [0x1802210fc]
mov r8d, dword [0x1802210f8]
lea rdx, str.kind102__policyid_d__policyname_s__context_s__s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov esi, 1
lea rcx, [rbp + 0x7e0]
call fcn.18009c870
cmp dword [rbp + 0x28], 0
je 0x1800b802a
cmp dword [0x18025c98c], 0
jne 0x1800b8033
cmp dword [0x1802216c4], 0
je 0x1800b803c
mov r8d, esi
mov edx, 0x500
mov rcx, r12
call fcn.180068d50
lea rbx, [0x180152644]
jmp 0x1800b8055
lea rbx, [0x180152644]
jmp 0x1800b8055
lea rbx, [0x180152644]
jmp 0x1800b8055
lea rbx, [0x180152644]
jmp 0x1800b8055
lea rbx, [0x180152644]
jmp 0x1800b8055
lea rbx, [0x180152644]
cmp dword [0x180221ea4], 0
je 0x1800b88bf
mov r8d, esi
lea rdx, str.EdpBigData.ini
lea rcx, [rbp]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b8083
mov r9, qword [rax + 8]
jmp 0x1800b8087
lea r9, [rax + 8]
mov r8d, esi
lea rdx, str.CustomName
lea rcx, str.CUSTOMERS
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
cmp qword [rbp + 0x20], 0x10
jb 0x1800b80b0
mov rcx, qword [rbp + 8]
call fcn.1800f4b9c
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
cmp edi, 2
jne 0x1800b8114
mov dword [0x1802663bc], esi
lea rax, [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp]
call fcn.180003700
nop
lea rax, [rbp]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov ecx, edi
call fcn.1800a33e0
lea ebx, [rdi - 1]
jmp 0x1800b88ee
cmp dword [0x180221ea4], 0
je 0x1800b88e9
cmp dword [0x180259e9c], 0
je 0x1800b88cd
cmp byte [r13], 0x5c
je 0x1800b88c6
mov esi, r14d
mov edi, r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
cmp dword [0x180221fac], r14d
je 0x1800b81fa
movzx ecx, byte [0x18025bde4]
cmp byte [r13], cl
je 0x1800b81f2
mov rcx, r13
call fcn.180065ab0
mov dword [0x18025c98c], eax
test eax, eax
jne 0x1800b8191
mov rcx, r13
call fcn.1800658c0
test eax, eax
jne 0x1800b8191
movzx ecx, byte [r13]
call fcn.180065cb0
test eax, eax
je 0x1800b81d5
xor r8d, r8d
mov rdx, r12
lea rcx, [0x180221fb0]
call fcn.18008f400
test eax, eax
je 0x1800b81d5
lea r8, [0x180163a68]
mov edx, 0xafc4
lea rcx, [0x180155288]
call fcn.18005cd20
mov r15d, 1
mov esi, r15d
movzx eax, byte [r13]
mov byte [0x18025b31c], al
jmp 0x1800b81e2
mov byte [0x18025b31c], sil
mov r15d, 1
mov dword [0x18025c208], ebx
test esi, esi
jne 0x1800b832f
jmp 0x1800b8200
mov r15d, 1
jmp 0x1800b8200
mov r15d, 1
cmp dword [0x1802222d0], edi
je 0x1800b832f
movzx eax, byte [0x18025bde5]
cmp byte [r12], al
je 0x1800b8295
mov rcx, r12
call fcn.180065ab0
mov dword [0x18025c988], eax
test eax, eax
jne 0x1800b8245
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800b8245
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800b8283
xor r8d, r8d
mov rdx, r12
lea rcx, [0x180222140]
call fcn.18008f400
test eax, eax
je 0x1800b8283
lea r8, [0x180163a68]
mov edx, 0xafda
lea rcx, [0x180155288]
call fcn.18005cd20
mov edi, r15d
movzx eax, byte [r12]
mov byte [0x18025b31d], al
jmp 0x1800b828a
mov byte [0x18025b31d], dil
mov dword [0x18025c20c], ebx
jmp 0x1800b832f
mov eax, ebx
sub eax, dword [0x18025c20c]
cmp eax, 0xea60
jbe 0x1800b831b
mov rcx, r12
call fcn.180065ab0
mov dword [0x18025c988], eax
test eax, eax
jne 0x1800b82d0
mov rcx, r12
call fcn.1800658c0
test eax, eax
jne 0x1800b82d0
movzx ecx, byte [r12]
call fcn.180065cb0
test eax, eax
je 0x1800b82e6
xor r8d, r8d
mov rdx, r12
lea rcx, [0x180222140]
call fcn.18008f400
test eax, eax
jne 0x1800b82f3
mov edi, r14d
xor al, al
mov byte [0x18025b31d], al
jmp 0x1800b8321
lea r8, [0x180163a50]
mov edx, 0xaff2
lea rcx, [0x180155288]
call fcn.18005cd20
mov edi, r15d
movzx eax, byte [r12]
mov byte [0x18025b31d], al
jmp 0x1800b8321
mov al, byte [0x18025b31d]
mov dword [0x18025c20c], ebx
cmp byte [r12], al
cmove edi, r15d
cmp dword [0x1802222d4], 0
jne 0x1800b8345
cmp dword [0x1802222d8], 0
je 0x1800b88db
test esi, esi
jne 0x1800b8351
test edi, edi
je 0x1800b88e2
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov r15d, r14d
mov byte [rbp + 0x1a0], r15b
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x1a1]
call fcn.1800f4fb0
cmp rbx, 0xffffffffffffffff
je 0x1800b83b6
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r15d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1a0]
mov rcx, r12
call fcn.180065a00
test esi, esi
je 0x1800b870e
test edi, edi
je 0x1800b8578
cmp dword [0x18025c98c], 0
je 0x1800b847d
cmp dword [0x18025c988], 0
jne 0x1800b847d
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514f4]
mov ecx, 4
call fcn.180001000
mov rdi, rax
lea rdx, [0x180150e60]
mov ecx, 0x435
call fcn.180001000
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x180221eb0]
mov r8d, dword [0x180221eac]
lea rdx, str.kind103__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov ebx, 1
jmp 0x1800b88ee
mov byte [rbp + 0x2b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2b1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5e0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8d, 2
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov ebx, 1
mov dword [rsp + 0x38], ebx
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18008e860
jmp 0x1800b88ee
cmp dword [0x18025c98c], 0
je 0x1800b8613
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801512a8]
mov ecx, 0x403
call fcn.180001000
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x180221eb0]
mov r8d, dword [0x180221eac]
lea rdx, str.kind103__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_.
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov ebx, 1
jmp 0x1800b88ee
mov byte [rbp + 0x2b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2b1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4d0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8d, 2
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov ebx, 1
mov dword [rsp + 0x38], ebx
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18008e860
jmp 0x1800b88ee
test edi, edi
je 0x1800b88d4
cmp dword [0x18025c988], 0
je 0x1800b87ca
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rsi, rax
lea rdx, [0x180151370]
mov ecx, 0x3f9
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801512d0]
mov ecx, 0x404
call fcn.180001000
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [0x180221eb0]
mov r8d, dword [0x180221eac]
lea rdx, str.kind102__policyid_d__policyname_s__context_s__s___s___s_s__s_d_bytes_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov ebx, 1
jmp 0x1800b88ee
mov byte [rbp + 0x2b0], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp + 0x2b1]
call fcn.1800f4fb0
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x38], rdx
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x4d0]
mov r8, r13
mov rdx, r12
mov ecx, dword [0x1802222dc]
call fcn.180085950
lea rdx, [rbp + 0xfe0]
mov qword [rsp + 0x50], rdx
lea rax, [rbp + 0x5e0]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x3c0]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x4d0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov r9, r12
mov ebx, 1
mov r8d, ebx
lea rdx, str.Mode_d_r_nSrcP_s_r_nDstP_s_r_nFSize_d_r_nFSign_s_r_nFCode_s_r_nCreateTime_s_r_nMifTime_s_r_nUType_s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], ebx
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0xe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18008e860
jmp 0x1800b88ee
mov ebx, 1
jmp 0x1800b88ee
mov ebx, 1
jmp 0x1800b88ee
mov ebx, 1
jmp 0x1800b88ee
mov ebx, 1
jmp 0x1800b88ee
mov ebx, 1
jmp 0x1800b88ee
mov ebx, 1
jmp 0x1800b88ee
mov ebx, 1
cmp dword [0x180220ad8], 0
je 0x1800b895f
cmp dword [0x180259e9c], 0
je 0x1800b895f
cmp dword [0x180220adc], 0
je 0x1800b8924
mov rcx, r12
call fcn.1800658c0
test eax, eax
je 0x1800b8924
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800b97b8
cmp dword [0x180220ae0], 0
je 0x1800b8948
mov rcx, r12
call fcn.180065ab0
test eax, eax
je 0x1800b8948
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
jmp 0x1800b97b8
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x30]
mov rcx, r12
call fcn.1800fda7c
cmp dword [0x1801e68d0], 0
je 0x1800b8ed2
mov rcx, r12
call fcn.1800679d0
test eax, eax
jne 0x1800b8ed2
mov rcx, r13
call fcn.1800679d0
test eax, eax
jne 0x1800b8ed2
mov rcx, r12
call fcn.1800676d0
mov esi, eax
cmp dword [0x1801f520c], 0
je 0x1800b89c4
cmp byte [0x1801f5206], 0x4f
jne 0x1800b89c4
call fcn.1800629f0
test eax, eax
je 0x1800b89c4
test esi, esi
jne 0x1800b89c4
mov rdx, r12
lea rcx, [0x1801f5210]
call fcn.180067220
mov rcx, r13
call fcn.180083ee0
lea rdx, [0x1801ece6c]
lea r15, [0x1801e1be0]
cmp eax, 0xffffffff
je 0x1800b8c4d
movsxd rdi, eax
mov rcx, rdi
imul rcx, rcx, 0x64
add rcx, rdx
mov r8d, ebx
mov rdx, r12
call fcn.18008f400
test eax, eax
je 0x1800b8c4d
imul rdi, rdi, 0x208
cmp byte [rdi + r15 + 0x4cfc], 0x52
jne 0x1800b8b58
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800b8afe
test esi, esi
jne 0x1800b8afe
call fcn.1800629f0
test eax, eax
je 0x1800b8afe
mov rdx, r13
mov rcx, r12
call fcn.18010b680
test eax, eax
je 0x1800b8afe
lea rdx, [0x1801514d0]
lea ecx, [rsi + 7]
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801663e0]
mov ecx, 0x441
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind614__policyid_d__policyname_s__context_s___s___s_s._s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileA_FileProtectMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
call fcn.1800629a0
test eax, eax
je 0x1800b8c4d
lea rdx, [0x180151330]
mov ecx, 0x432
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800b97b8
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800b8c4d
call fcn.1800629f0
test eax, eax
je 0x1800b8c4d
test esi, esi
jne 0x1800b8c4d
mov rdx, r13
mov rcx, r12
call fcn.18010b680
test eax, eax
je 0x1800b8c4d
lea rdx, [0x180151500]
lea ecx, [rsi + 2]
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x180166380]
mov ecx, 0x442
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind609__policyid_d__policyname_s__context_s___s___s_s._s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
lea rcx, [rbp + 0x7e0]
call fcn.1800a7a30
test eax, eax
je 0x1800b8c4d
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileA_FileProtectMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
mov rcx, r12
call fcn.180083ee0
cmp eax, 0xffffffff
je 0x1800b8ed2
movsxd rdi, eax
mov rcx, rdi
imul rcx, rcx, 0x64
lea rax, [0x1801ece6c]
add rcx, rax
mov r8d, 1
mov rdx, r12
call fcn.18008f400
test eax, eax
je 0x1800b8ed2
imul rdi, rdi, 0x208
cmp byte [rdi + r15 + 0x4cfc], 0x52
jne 0x1800b8ddd
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800b8d83
test esi, esi
jne 0x1800b8d83
call fcn.1800629f0
test eax, eax
je 0x1800b8d83
mov rdx, r13
mov rcx, r12
call fcn.18010b680
test eax, eax
je 0x1800b8d83
lea rdx, [0x1801514d0]
lea ecx, [rsi + 7]
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801663e0]
mov ecx, 0x441
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind614__policyid_d__policyname_s__context_s___s___s_s._s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileA_FileProtectMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
call fcn.1800629a0
test eax, eax
je 0x1800b8ed2
lea rdx, [0x180151330]
mov ecx, 0x432
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800b97b8
cmp byte [0x1801f4bdb], 0x4f
jne 0x1800b8ed2
call fcn.1800629f0
test eax, eax
je 0x1800b8ed2
test esi, esi
jne 0x1800b8ed2
mov rdx, r13
mov rcx, r12
call fcn.18010b680
test eax, eax
je 0x1800b8ed2
lea rdx, [0x180151500]
lea ecx, [rsi + 2]
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
lea ecx, [rsi + 3]
call fcn.180001000
mov rdi, rax
lea rdx, [0x180166380]
mov ecx, 0x442
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e66d0]
mov r8d, dword [0x1801e66cc]
lea rdx, str.kind609__policyid_d__policyname_s__context_s___s___s_s._s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
lea rcx, [rbp + 0x7e0]
call fcn.1800a7a30
test eax, eax
je 0x1800b8ed2
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileA_FileProtectMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801f5414]
mov edx, dword [0x1801f5410]
lea rcx, [0x180161c7c]
call fcn.18008e860
movabs r15, 0xffffffffffffff0
cmp dword [0x1801e3950], 0
je 0x1800b96be
mov r8d, 2
lea rdx, [0x180159ce8]
mov rcx, r13
call fcn.1800fbb00
test eax, eax
jne 0x1800b96be
movzx eax, byte [r13 + 2]
cmp al, 0x3f
je 0x1800b96be
cmp al, 0x2e
je 0x1800b96be
cmp dword [0x1801e5424], 1
jne 0x1800b902a
xor r8d, r8d
mov rdx, r12
lea rcx, [0x1801e542c]
call fcn.18008f400
test eax, eax
je 0x1800b902a
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151330]
mov ecx, 0x432
call fcn.180001000
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s:___s___s_s.
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
lea rdx, [0x180151330]
mov ecx, 0x432
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800b97b8
cmp dword [0x1801e5428], 1
jne 0x1800b96be
xor r8d, r8d
mov rdx, r12
lea rcx, [0x1801e562c]
call fcn.18008f400
test eax, eax
je 0x1800b96be
cmp dword [0x1801e59cc], 0
je 0x1800b95fd
mov esi, 1
mov r8d, esi
lea rdx, str.ckfiles64.dll
lea rcx, [rbp]
call fcn.18001f690
nop
cmp qword [rax + 0x20], 0x10
jb 0x1800b9084
mov rcx, qword [rax + 8]
jmp 0x1800b9088
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
cmp qword [rbp + 0x20], 0x10
jb 0x1800b90a1
mov rcx, qword [rbp + 8]
call fcn.1800f4b9c
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], r14
mov byte [rbp + 8], 0
test rdi, rdi
je 0x1800b95fd
lea rdx, [0x180155630]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800b95fd
call rax
mov rbx, rax
test rax, rax
je 0x1800b95fd
mov byte [rbp + 0x5e0], 0
xor edx, edx
mov r8d, 0x1f3
lea rcx, [rbp + 0x5e1]
call fcn.1800f4fb0
mov edi, r14d
cmp dword [0x1801e59d4], r14d
jle 0x1800b9155
lea rsi, [0x1801e59d8]
nop
movsxd r8, edi
imul r8, r8, 0xc8
add r8, rsi
mov edx, 0x1f4
lea rcx, [rbp + 0x5e0]
call fcn.1800fe138
lea r8, [0x18015284c]
mov edx, 0x1f4
lea rcx, [rbp + 0x5e0]
call fcn.1800fe138
inc edi
cmp edi, dword [0x1801e59d4]
jl 0x1800b9110
mov esi, 1
mov byte [rbp + 0xfe0], 0
xor edx, edx
mov r8d, 0x3e7
lea rcx, [rbp + 0xfe1]
call fcn.1800f4fb0
lea r9, [rbp + 0x5e0]
lea r8, str.__xml_version_1.0__encoding_UTF_8____root__rules__group_id_65419047_3090_44b1_98c5_987ea08fea4a__name_
mov edx, 0x3e8
lea rcx, [rbp + 0xfe0]
call fcn.1800f5158
mov byte [rbp + 0x13d0], 0
xor edx, edx
mov r8d, 0x3e7
lea rcx, [rbp + 0x13d1]
call fcn.1800f4fb0
mov r8d, 0x3e8
lea rdx, [rbp + 0x13d0]
lea rcx, [rbp + 0xfe0]
call fcn.18005e260
mov rax, qword [rbx]
xor r8d, r8d
lea rdx, [rbp + 0x13d0]
mov rcx, rbx
call qword [rax + 0x18]
test r12, r12
jne 0x1800b91e0
mov rdx, r14
jmp 0x1800b9232
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
cmp r8d, 0x3fffffff
jle 0x1800b91fb
mov rdx, r14
jmp 0x1800b9232
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b920d
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x70]
mov r9d, 3
mov rdx, r12
call fcn.18005df00
mov rdx, rax
mov rax, qword [rbx]
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x28]
test eax, eax
jne 0x1800b9537
mov eax, dword [0x1801e59d0]
test eax, eax
jne 0x1800b9361
cmp dword [0x1801e59c4], eax
je 0x1800b9314
lea rdx, [0x180151330]
mov ecx, 0x3fd
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801662b0]
mov ecx, 0x43c
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
lea rdx, [0x180151330]
mov ecx, 0x432
call fcn.180001000
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rax
lea rax, [0x180152644]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10
mov r9d, 3
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800b97b8
cmp eax, 2
jne 0x1800b9471
lea rdx, [0x18015150c]
mov ecx, esi
call fcn.180001000
mov rdi, rax
lea rdx, [0x180166248]
mov ecx, 0x43d
call fcn.180001000
mov rdx, rax
mov r9d, 4
mov r8, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x1800b9471
cmp dword [0x1801e59c4], 0
je 0x1800b946a
lea rdx, [0x180151330]
mov ecx, 0x3fd
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x1801662b0]
mov ecx, 0x43c
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
xor eax, eax
jmp 0x1800b97b8
cmp dword [0x1801e59c4], 0
je 0x1800b96be
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151280]
mov ecx, 0x43c
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s__s_.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
jmp 0x1800b96be
cmp dword [0x1801e59c4], 0
je 0x1800b96be
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151320]
mov ecx, 0x43b
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
jmp 0x1800b96be
cmp dword [0x1801e59c4], 0
je 0x1800b96be
lea rdx, [0x180151500]
mov ecx, 2
call fcn.180001000
mov rbx, rax
lea rdx, [0x1801514fc]
mov ecx, 3
call fcn.180001000
mov rdi, rax
lea rdx, [0x180151320]
mov ecx, 0x43b
call fcn.180001000
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
lea r9, [0x1801e3750]
mov r8d, dword [0x1801e374c]
lea rdx, str.kind602__policyid_d__policyname_s__context_s___s___s_s.__s
lea rcx, [rbp + 0x7e0]
call fcn.1800f509c
mov dword [rsp + 0x38], r14d
lea rax, [rbp + 0x7e0]
mov qword [rsp + 0x30], rax
lea rax, str.MyCopyFileExW_FileExportMainPolicy.DisableNetFile0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x80
xor r9d, r9d
mov r8d, dword [0x1801e59c8]
mov edx, dword [0x1801e59c4]
lea rcx, [0x1801554c0]
call fcn.18008e860
cmp dword [0x18021adec], 0
je 0x1800b97b3
cmp dword [0x1801e1bdc], 0
jne 0x1800b97b3
test r13, r13
jne 0x1800b96e2
mov rdi, r14
jmp 0x1800b9734
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
cmp r8d, 0x3fffffff
jle 0x1800b96fd
mov rdi, r14
jmp 0x1800b9734
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b970f
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x70]
mov r9d, 3
mov rdx, r13
call fcn.18005df00
mov rdi, rax
test r12, r12
je 0x1800b9786
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8d, [rax + 1]
cmp r8d, 0x3fffffff
jg 0x1800b9786
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800b9761
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180124410
sub rsp, rcx
lea rcx, [rsp + 0x70]
mov r9d, 3
mov rdx, r12
call fcn.18005df00
mov r14, rax
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.18005f6c0
test eax, eax
je 0x1800b97b3
cmp dword [0x1802209d4], 0
je 0x1800b97af
mov rcx, r13
call fcn.1800658c0
test eax, eax
jne 0x1800b97b3
jmp 0x1800b97b8
xor eax, eax
jmp 0x1800b97b8
mov eax, 1
mov rcx, qword [rbp + 0x17c0]
xor rcx, rbp
call fcn.1800f4f80
mov rbx, qword [rbp + 0x1828]
lea rsp, [rbp + 0x17d0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret