Function at 0x1800bf530
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7a8]
sub rsp, 0x8a8
mov rax, qword [0x180183c70]
xor rax, rsp
mov qword [rbp + 0x790], rax
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x68], r8
mov r13, rdx
mov qword [rbp + 0x18], rdx
mov rdi, rcx
mov qword [rbp - 0x70], rcx
movdqa xmm0, xmmword [0x180174670]
movdqa xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
xor ecx, ecx
mov qword [rbp + 0x60], rcx
mov word [rbp + 0x68], cx
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], cl
mov qword [rbp + 0x30], rcx
mov word [rbp + 0x38], cx
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], cl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rcx
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x98], rcx
mov qword [rbp + 0xa0], rcx
mov ecx, 0x30
call fcn.18015bcd4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x98], rax
xor edx, edx
mov qword [rbp + 0xa8], rdx
xorps xmm2, xmm2
movsd qword [rbp + 0xb0], xmm2
mov qword [rbp + 0xb8], rdx
mov ecx, 1
mov dword [rbp + 0xc0], ecx
mov qword [rbp + 0xc8], rdx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
movdqa xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rdx
mov qword [rbp + 0x108], 0xffffffffffffffff
mov dword [rbp + 0x110], edx
xor eax, eax
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [0x180174670]
movdqa xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], al
mov word [rbp + 0x180], dx
mov dword [rbp + 0x184], edx
mov qword [rbp + 0x188], rdx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x190], xmm0
movsd qword [rbp + 0x1a0], xmm2
mov byte [rbp + 0x1a8], al
mov qword [rbp + 0x1ac], rdx
mov r12d, dword [rbp + 0x810]
mov esi, r12d
mov dword [rsp + 0x58], r12d
imul eax, r12d, 0x917
mov dword [rsp + 0x68], eax
mov ebx, dword [rsp + 0x68]
mov dword [rsp + 0x74], ebx
cmp r12d, eax
ja 0x1800bfef7
mov r8d, 0x1bb
movzx r14d, byte [rsp + 0x48]
mov r15d, dword [rsp + 0x70]
mov r12d, dword [rsp + 0x70]
movzx eax, byte [rsp + 0x48]
mov dword [rsp + 0x50], eax
nop
cmp esi, 0xd0d4
ja 0x1800bfd18
je 0x1800bfcdf
cmp esi, 0x129
ja 0x1800bfc96
je 0x1800bfaea
mov eax, esi
sub eax, 0xc
je 0x1800bfa85
sub eax, 0xb3
je 0x1800bfa7a
cmp eax, 0x15
jne 0x1800bfe1b
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180182b68]
lea ecx, [rax + 0x67]
call fcn.180009dd0
test al, al
jne 0x1800bfe0e
mov r13d, 0x70
nop dword [rax + rax]
cmp r13d, 0x3a6
ja 0x1800bf902
je 0x1800bf8eb
cmp r13d, 0x70
je 0x1800bf8c2
cmp r13d, 0xf9
je 0x1800bf899
cmp r13d, 0x182
je 0x1800bf84e
cmp r13d, 0x20b
je 0x1800bf832
cmp r13d, 0x294
jne 0x1800bf872
mov r8d, 0xa
lea rdx, [rbp + 0x44a]
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov r14b, 1
jmp 0x1800bf872
movzx eax, word [0x180172e9c]
mov word [rbp + 0x447], ax
mov eax, 0x2e
mov word [rbp + 0x449], ax
jmp 0x1800bf872
mov dword [rbp + 0x43e], 0x632e32
mov r8d, 6
lea rdx, str.vtw2ma
lea rcx, [rbp + 0x430]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xor edx, edx
add r13d, 0x89
cmp r13d, 0x653
jb 0x1800bf7d0
mov esi, dword [rsp + 0x58]
mov r13, qword [rbp + 0x18]
mov rdi, qword [rbp - 0x70]
jmp 0x1800bfe10
mov eax, dword [str.86.av]
mov dword [rbp + 0x436], eax
movzx eax, word [0x180172ea4]
mov word [rbp + 0x43a], ax
mov r8d, 3
lea rdx, [0x180172ea8]
jmp 0x1800bf865
movzx eax, word [0x180172e90]
mov word [rbp + 0x430], ax
mov eax, dword [str.vm.x]
mov dword [rbp + 0x432], eax
movzx eax, byte [0x180172e98]
mov byte [rbp + 0x436], al
jmp 0x1800bf872
call qword [sym.imp.WINMM.dll_mixerGetNumDevs]
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x78], 0x10
jmp 0x1800bf872
cmp r13d, 0x42f
je 0x1800bfa63
cmp r13d, 0x4b8
je 0x1800bfa4d
cmp r13d, 0x541
je 0x1800bf93c
cmp r13d, 0x5ca
jne 0x1800bf872
mov esi, 1
jmp 0x1800bfb77
test r14b, r14b
je 0x1800bf872
mov esi, 0x105
xor edi, edi
nop dword [rax]
mov eax, esi
sub eax, 0x101
je 0x1800bf9b5
sub eax, 1
je 0x1800bf9a0
sub eax, 1
je 0x1800bf983
sub eax, 1
je 0x1800bf97a
cmp eax, 1
jne 0x1800bfa3a
mov qword [rbp - 0x60], rdi
jmp 0x1800bfa3a
mov dword [rsp + 0x60], edi
jmp 0x1800bfa3a
mov r8d, 0x80000000
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.WINMM.dll_mixerGetID]
mov r15d, eax
jmp 0x1800bfa3a
mov ecx, edi
movzx eax, r14b
test r15d, r15d
cmove ecx, eax
movzx r14d, cl
jmp 0x1800bfa3a
test r14b, r14b
je 0x1800bfa3a
mov edi, 0x105
mov eax, edi
sub eax, 0x105
je 0x1800bfa26
sub eax, 1
je 0x1800bfa21
sub eax, 1
je 0x1800bfa03
sub eax, 1
je 0x1800bf9f1
cmp eax, 1
jne 0x1800bfa2e
test r14b, r14b
je 0x1800bfa2e
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WINMM.dll_mixerClose]
jmp 0x1800bfa2e
xor ecx, ecx
movzx eax, r14b
test r15d, r15d
cmove ecx, eax
movzx r14d, cl
jmp 0x1800bfa2e
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x60]
lea rcx, [rbp - 0x78]
call qword [sym.imp.WINMM.dll_mixerOpen]
mov r15d, eax
jmp 0x1800bfa2e
xor r12d, r12d
jmp 0x1800bfa2e
mov qword [rbp - 0x78], 0
inc edi
cmp edi, 0x10a
jb 0x1800bf9c3
xor edi, edi
dec esi
cmp esi, 0x100
ja 0x1800bf950
jmp 0x1800bf872
mov edx, dword [rsp + 0x78]
lea rcx, [rbp + 0x430]
call qword [sym.imp.WINMM.dll_mmioStringToFOURCCA]
jmp 0x1800bf872
movzx r14d, r14b
cmp dword [rsp + 0x7c], 0
mov edx, 0
cmove r14d, edx
jmp 0x1800bf874
mov eax, dword [rdi]
mov dword [r13], eax
jmp 0x1800bfe1b
mov rax, qword [rbp - 0x68]
mov ecx, dword [rax]
mov rax, qword [0x1801d5a50]
sub rax, qword [0x1801d5a48]
sar rax, 4
cmp eax, ecx
jbe 0x1800bfab3
mov eax, ecx
shl rax, 4
add qword [0x1801d5a48], rax
jmp 0x1800bfe16
mov dword [rsp + 0x48], ecx
mov eax, dword [rdi]
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [r13]
lea rdx, [rsp + 0x48]
lea ecx, [r9 + 0x6b]
call fcn.1801036f0
mov qword [r13], rax
jmp 0x1800bfe0e
cmp word [rdi], 0x40
jne 0x1800bfe1b
mov dword [rsp + 0x20], 0xc6
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call fcn.180121cc0
mov rsi, rax
mov r9d, 0x2f
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1800aa6a0
cmp al, 6
jne 0x1800bfc8d
mov edi, 0x82
nop
mov ecx, edi
sub ecx, 0x82
je 0x1800bfc0d
cmp ecx, 1
jne 0x1800bfc72
mov byte [rsp + 0x48], 0
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov r9d, 0xa1
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, r13
call fcn.1800a74e0
mov esi, ebx
lea rcx, [rbp + 0x108]
call fcn.180004af0
mov rbx, qword [rbp + 0xf0]
test rbx, rbx
je 0x1800c04a7
mov rdi, qword [rbp + 0xf8]
cmp rbx, rdi
je 0x1800bfbb8
nop
mov rcx, rbx
call fcn.18001bb70
add rbx, 0x20
cmp rbx, rdi
jne 0x1800bfba0
mov rbx, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0x100]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800bfbeb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c04e5
mov rcx, rbx
call fcn.18015bd10
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
xor r14d, r14d
mov qword [rbp + 0x100], r14
jmp 0x1800c04aa
mov rax, qword [rbp - 0x70]
movzx eax, word [rax + 2]
test ax, ax
jne 0x1800bfc3d
mov byte [rsp + 0x48], al
mov byte [rsp + 0x40], 0x5c
mov r9d, 0x52
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.1800ffd70
jmp 0x1800bfc72
cmp ax, 2
jne 0x1800bfc72
mov byte [rsp + 0x48], 0
mov qword [rbp], 0xa
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8, r13
lea rdx, str.de_la_nuit
mov ecx, 0x11a
call fcn.180091dd0
inc edi
cmp edi, 0x84
jb 0x1800bfb30
mov esi, dword [rsp + 0x58]
mov rdi, qword [rbp - 0x70]
jmp 0x1800bfe0e
mov esi, dword [rsp + 0x58]
jmp 0x1800bfe0e
cmp esi, 0x864c
je 0x1800bfcd6
cmp esi, 0x9510
jne 0x1800bfe1b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov r8d, 0xf
lea rdx, str.scatophilia.com
lea rcx, [rbp + 0x1c0]
call fcn.180041080
jmp 0x1800bfe0e
mov dword [r13 + 4], edx
jmp 0x1800bfe1b
mov rax, qword [rbp - 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x48], eax
mov rax, qword [rbp - 0x68]
mov eax, dword [rax]
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
mov r8d, 0x6d
mov rdx, r13
mov rcx, rdi
call fcn.1800b8a80
jmp 0x1800bfe0e
cmp esi, 0x1bd88
ja 0x1800bfd94
je 0x1800bfd77
cmp esi, 0x10bd9
je 0x1800bfd6e
cmp esi, 0x1294c
je 0x1800bfd4d
cmp esi, 0x19166
jne 0x1800bfe1b
mov qword [r13 + 0x10], rdx
mov ebx, edx
mov dword [rsp + 0x74], edx
jmp 0x1800bfe1b
mov al, 1
mov dword [rsp + 0x50], eax
mov r8, rcx
lea rdx, [0x18016cc34]
lea rcx, [rbp + 0x1e0]
call fcn.180041080
jmp 0x1800bfe0e
mov dword [r13 + 8], edx
jmp 0x1800bfe1b
mov word [rbp + 0x220], r8w
lea r8, [rbp + 0x200]
mov edx, 0x2a
xor ecx, ecx
call fcn.180017440
jmp 0x1800bfe0e
cmp esi, 0x251c4
je 0x1800bfdca
cmp esi, 0x2e600
jne 0x1800bfe1b
mov qword [rbp + 0x10], rdx
mov word [rsp + 0x48], r8w
lea r9, [rsp + 0x48]
lea r8, [rbp + 0x30]
mov edx, 0x52
lea rcx, [0x180182be8]
call fcn.180035560
jmp 0x1800bfe0e
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1c0]
xor r8d, r8d
lea rdx, [rbp + 0x230]
lea ecx, [r8 + 0x38]
call fcn.180068550
mov eax, 0x1bb
mov word [rsp + 0x48], ax
lea r9, [rbp + 0x60]
mov r8d, 0x23
lea rdx, [rsp + 0x48]
lea rcx, [0x180182bc8]
call fcn.180058bd0
xor edx, edx
mov r8d, 0x1bb
mov ecx, 1
imul eax, dword [rbp + 0x810], 0xb3
add esi, eax
mov dword [rsp + 0x58], esi
cmp esi, dword [rsp + 0x68]
jbe 0x1800bf760
mov r12d, dword [rbp + 0x810]
mov edx, dword [rsp + 0x50]
lea edi, [r12 + 0x7c5]
mov dword [rsp + 0x48], edi
cmp r12d, edi
jae 0x1800bfb75
mov ecx, 0x6c
lea esi, [rcx - 0x27]
lea r8d, [rcx - 0x19]
lea r9d, [rcx - 0x18]
lea r10d, [rcx - 0x47]
lea r11d, [rcx + 0xc]
movzx r13d, byte [rsp + 0x48]
mov r15d, dword [rsp + 0x70]
mov r14d, dword [rsp + 0x70]
movzx edi, byte [rsp + 0x40]
mov eax, dword [rsp + 0x48]
nop word [rax + rax]
cmp r12d, 0x3d1
ja 0x1800c032d
je 0x1800c002b
cmp r12d, 0x206
ja 0x1800bffb3
je 0x1800bff47
mov eax, r12d
sub eax, 0xbf
je 0x1800bfb75
sub eax, 0x15
je 0x1800bff1b
cmp eax, 0x99
jne 0x1800c0487
lea rax, [rbp + 0x60]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x1800bff05
lea rcx, [rbp + 0x60]
mov qword [rax], rcx
add qword [rbp - 0x48], 8
jmp 0x1800c0482
movzx edx, byte [rsp + 0x48]
mov dword [rsp + 0x50], edx
jmp 0x1800bfe40
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.180002a70
jmp 0x1800c046c
xor edx, edx
mov r8d, 0x1c0
lea rcx, [rbp + 0x270]
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
mov ecx, 0xd9
call fcn.1800f0110
jmp 0x1800c046c
lea rax, [rbp + 0x30]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp - 0x48]
cmp rax, qword [rbp - 0x40]
je 0x1800bff67
lea rcx, [rbp + 0x30]
mov qword [rax], rcx
add qword [rbp - 0x48], 8
jmp 0x1800bff78
lea r8, [rbp - 0x80]
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x50]
call fcn.180002a70
mov eax, dword [0x180182c10]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x1f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180039cc0
jmp 0x1800c046c
cmp r12d, 0x29f
je 0x1800c0015
cmp r12d, 0x338
jne 0x1800c048b
lea rax, [rbp - 0x50]
mov qword [rbp], rax
mov eax, dword [0x180182c10]
mov dword [rbp + 8], eax
mov eax, dword [0x180182c14]
mov dword [rbp + 0xc], eax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x20]
lea r8, [0x1800165b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x68], rax
jmp 0x1800c046c
lea rcx, [rbp + 0x270]
call qword [sym.imp.ADVAPI32.dll_OpenTraceW]
mov qword [rbp - 0x60], rax
jmp 0x1800c046c
cmp qword [rbp - 0x68], 0
jne 0x1800c048b
mov r12d, 0xd2
mov dword [rsp + 0x58], r12d
cmp r12d, 0x3e9
ja 0x1800c0109
je 0x1800c00fc
cmp r12d, 0x225
ja 0x1800c00be
je 0x1800c00a8
mov eax, r12d
sub eax, 0xd2
je 0x1800c009b
sub eax, 0x71
je 0x1800c0084
cmp eax, 0x71
jne 0x1800c02f2
mov word [rbp + 0x458], r8w
jmp 0x1800c02f2
mov word [rbp + 0x452], r9w
mov dword [rbp + 0x454], 0x5c0073
jmp 0x1800c02f2
mov word [rbp + 0x450], r10w
jmp 0x1800c02f2
mov dword [rbp + 0x45a], 0x650068
mov word [rbp + 0x45e], cx
jmp 0x1800c02f2
mov eax, r12d
sub eax, 0x296
je 0x1800c00ed
sub eax, 0x71
je 0x1800c00de
cmp eax, 0x71
jne 0x1800c02f2
mov r13b, 1
jmp 0x1800c02f2
mov dword [rbp + 0x464], 0x78
jmp 0x1800c02f2
mov dword [rbp + 0x460], 0x45006c
jmp 0x1800c02f2
mov dil, 1
mov byte [rsp + 0x40], dil
jmp 0x1800c02f2
cmp r12d, 0x61e
ja 0x1800c0190
je 0x1800c0175
mov eax, r12d
sub eax, 0x4cb
je 0x1800c0168
sub eax, 0x71
je 0x1800c0144
cmp eax, 0x71
jne 0x1800c02f2
xor eax, eax
mov ecx, eax
movzx eax, r13b
cmp dword [rsp + 0x60], ecx
cmovne ecx, eax
movzx r13d, cl
jmp 0x1800c02f2
lea rcx, [rbp + 0x450]
call qword [sym.imp.WINMM.dll_mciGetDeviceIDW]
mov dword [rsp + 0x60], eax
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
mov dword [rsp + 0x7c], eax
jmp 0x1800c02f2
mov qword [rbp - 0x78], 0xffffffffffffffff
jmp 0x1800c02f2
xor eax, eax
mov ecx, eax
movzx eax, dil
cmp dword [rsp + 0x7c], ecx
cmovne ecx, eax
movzx edi, cl
mov byte [rsp + 0x40], cl
jmp 0x1800c02f2
mov eax, r12d
sub eax, 0x68f
je 0x1800c01a8
cmp eax, 0x71
je 0x1800bf932
jmp 0x1800c02f2
test r13b, r13b
je 0x1800c0293
mov esi, 0x127
mov r12d, dword [rbp - 0x70]
mov ebx, dword [rsp + 0x78]
nop
mov eax, esi
sub eax, 0x127
je 0x1800c026f
sub eax, 1
je 0x1800c0267
sub eax, 1
je 0x1800c0230
cmp eax, 1
jne 0x1800c0274
xor eax, eax
mov ecx, eax
movzx eax, r13b
test r15d, r15d
cmovne ecx, eax
movzx r13d, cl
test cl, cl
je 0x1800c0274
mov edi, 0x1e
nop
mov eax, edi
sub eax, 0x1e
je 0x1800c0221
cmp eax, 1
jne 0x1800c0227
mov r8d, r14d
lea rdx, [rbp + 0x580]
mov ecx, r15d
call qword [sym.imp.WINMM.dll_mciGetErrorStringW]
jmp 0x1800c0227
mov r14d, 0x104
inc edi
cmp edi, 0x20
jb 0x1800c0200
jmp 0x1800c0274
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x430], xmm0
mov qword [rbp + 0x440], rax
mov dword [rbp + 0x448], eax
lea r9, [rbp + 0x430]
mov r9d, r9d
mov r8d, r12d
mov edx, ebx
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.WINMM.dll_mciSendCommandW]
mov r15d, eax
jmp 0x1800c0274
mov r12d, 0x400
jmp 0x1800c0274
mov ebx, 0x810
inc esi
cmp esi, 0x12b
jb 0x1800c01c0
mov dword [rsp + 0x78], ebx
mov dword [rbp - 0x70], r12d
mov ebx, dword [rsp + 0x74]
mov r12d, dword [rsp + 0x58]
movzx esi, byte [rsp + 0x40]
test sil, sil
je 0x1800c02e9
mov edi, 0x9d
mov eax, edi
sub eax, 0x9c
je 0x1800c02cb
cmp eax, 1
jne 0x1800c02da
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
xor eax, eax
mov ecx, eax
movzx eax, sil
cmp qword [rbp - 0x78], 0xffffffffffffffff
cmovne ecx, eax
movzx esi, cl
jmp 0x1800c02da
test sil, sil
je 0x1800c02da
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec edi
cmp edi, 0x9b
ja 0x1800c02a2
mov byte [rsp + 0x40], sil
movzx edi, sil
mov esi, 0x45
add r12d, 0x71
mov dword [rsp + 0x58], r12d
cmp r12d, 0x771
mov ecx, 0x6c
lea r8d, [rcx - 0x19]
lea r9d, [rcx - 0x18]
lea r10d, [rcx - 0x47]
jb 0x1800c0041
mov r12d, dword [rbp + 0x810]
mov edx, dword [rsp + 0x50]
lea r11d, [rcx + 0xc]
jmp 0x1800c0487
cmp r12d, 0x635
ja 0x1800c040e
je 0x1800c03ce
cmp r12d, 0x46a
je 0x1800c03bf
cmp r12d, 0x503
je 0x1800c03b2
cmp r12d, 0x59c
jne 0x1800c048b
mov rax, qword [rbp - 0x60]
inc rax
movabs rcx, 0xfffffffeffffffff
test rcx, rax
movzx edx, dl
mov ecx, 0
cmove edx, ecx
mov dword [rsp + 0x50], edx
lea rax, [0x180006cd0]
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x122
lea r9, [rbp - 0x80]
xor r8d, r8d
xor edx, edx
call fcn.1800310c0
jmp 0x1800c046c
mov dword [rsp + 0x70], 0x104
jmp 0x1800c048b
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800c046c
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [0x180182b60]
lea r8d, [rax + 0x20]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x90]
call fcn.180024310
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x28]
call fcn.1800334a0
jmp 0x1800c046c
cmp r12d, 0x6ce
je 0x1800c0446
cmp r12d, 0x767
jne 0x1800c048b
mov ecx, 0x3b
mov eax, ecx
sub eax, 0x3a
je 0x1800bfb75
cmp eax, 1
jne 0x1800c043d
xor eax, eax
mov ebx, eax
mov dword [rsp + 0x74], eax
dec ecx
cmp ecx, 0x39
ja 0x1800c0425
jmp 0x1800c0482
test dl, dl
je 0x1800c0454
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_CloseTrace]
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x470]
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
mov edx, dword [rsp + 0x50]
mov r8d, 0x53
lea r9d, [r8 + 1]
lea r10d, [r8 - 0x2e]
lea r11d, [r8 + 0x25]
mov ecx, 0x6c
mov eax, dword [rsp + 0x48]
add r12d, 0x99
mov dword [rbp + 0x810], r12d
cmp r12d, eax
jae 0x1800bfb75
jmp 0x1800bfe90
xor r14d, r14d
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x1800c0503
mov rdx, qword [rbp + 0xe8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c04ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c04ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18015bd10
mov qword [rbp + 0xd8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0x98]
call fcn.180004a20
nop
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x1800c05a1
mov rdi, qword [rbp - 0x30]
cmp rbx, rdi
je 0x1800c053b
mov rcx, rbx
call fcn.180004330
add rbx, 0x28
cmp rbx, rdi
jne 0x1800c0526
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x28]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800c058d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c058d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.18015bd10
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1800c05ca
mov r8, qword [rbp - 0x40]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x50]
call fcn.180048730
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r14
mov rdx, qword [rbp + 0x52]
cmp rdx, 0x10
jb 0x1800c0608
inc rdx
mov rcx, qword [rbp + 0x3a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c0603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c0603
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18015bd10
movdqa xmm0, xmmword [0x180174670]
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], 0
mov rdx, qword [rbp + 0x82]
cmp rdx, 0x10
jb 0x1800c065a
inc rdx
mov rcx, qword [rbp + 0x6a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c0655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800c0655
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18015bd10
movdqa xmm0, xmmword [0x180174670]
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], 0
lea rcx, [rbp + 0x230]
call fcn.180004690
nop
lea rcx, [rbp + 0x1c0]
call fcn.180004740
mov eax, esi
mov rcx, qword [rbp + 0x790]
xor rcx, rsp
call fcn.18015c4c0
add rsp, 0x8a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret