Function at 0x180028970
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x18009da48]
xor rax, rsp
mov qword [rbp + 0x17], rax
imul r13d, ecx, 0x488
mov rdi, r8
mov r12, rdx
mov dword [rbp - 0x51], ecx
mov eax, ecx
mov r15d, ecx
cmp ecx, r13d
ja 0x180028e60
mov r14d, dword [rbp - 0x31]
xor esi, esi
mov ebx, dword [rbp - 0x31]
lea r8d, [rsi + 0x36]
lea r9d, [rsi + 0x34]
lea r10d, [rsi + 0x41]
lea r11d, [rsi + 0x6c]
mov edx, 0x3434
mov eax, 0x6e
mov ecx, 0x6957
cmp r15d, 0x4260
ja 0x180028ccb
je 0x18002999c
cmp r15d, 0xf71
ja 0x180028c7e
je 0x180028ad0
mov eax, r15d
sub eax, 0x43
je 0x180028aa5
sub eax, 0x4b
je 0x180028a9c
sub eax, 0x1c
je 0x180028a4b
sub eax, 0x6c
je 0x180028ea4
cmp eax, 0xa
jne 0x180028e4d
mov r8d, pe_nt_image_headers64
mov rdx, rdi
xor ecx, ecx
call fcn.18005a9e0
mov qword [rbp - 0x59], rax
jmp 0x180028e3b
mov edx, SHTestTokenMembership
mov eax, edx
sub eax, 0xf4
je 0x180028a67
cmp eax, 1
jne 0x180028a8a
mov dword [rbp - 0x59], r14d
jmp 0x18002999c
movzx ecx, byte [rdi]
mov r14d, esi
test cl, cl
je 0x180028a8a
cmp cl, 0x2f
lea eax, [r14 + 1]
movzx ecx, byte [rdi + 1]
cmovne eax, r14d
inc rdi
mov r14d, eax
test cl, cl
jne 0x180028a71
inc edx
cmp edx, 0xf6
jb 0x180028a50
mov dword [rbp - 0x59], esi
jmp 0x180028e4d
mov word [rbp - 0x19], cx
jmp 0x180028e4d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov r9, rdi
xor ecx, ecx
lea r8d, [rdx + 0x3b]
call fcn.180071540
cmp dword [r12], 0
jg 0x180028e3b
mov dword [rbp - 0x59], esi
jmp 0x18002999c
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
xor eax, edx
sub eax, edx
and eax, 0xfffffff
je 0x180028ad0
mov qword [rsp + 0x28], rdi
lea r8, [rbp - 0x49]
mov r9d, 0x59
mov qword [rsp + 0x20], rsi
xor edx, edx
mov dword [rbp - 0x49], eax
mov rcx, rdi
call fcn.180014590
test eax, eax
jne 0x180028ebb
dec dword [r12]
cmp dword [r12], eax
jle 0x180028e3b
nop dword [rax]
mov esi, 0x66
mov eax, esi
sub eax, 0x66
je 0x180028c1b
sub eax, 0x73
je 0x180028bef
sub eax, 0x3a
je 0x180028b4e
cmp eax, 0xad
je 0x180028c2d
jmp 0x180028c1b
mov eax, dword [rdi]
inc eax
cmp dword [rdi + 4], eax
jge 0x180028b79
xor r9d, r9d
mov dword [rbp - 0x41], eax
mov r8, rdi
lea rdx, [rbp - 0x41]
mov ecx, 0xbf
call fcn.18000ee90
mov rbx, rax
test eax, eax
jne 0x180028ebb
mov r9d, 0x122
nop
mov eax, r9d
sub eax, 0x120
je 0x180028bd5
sub eax, 1
je 0x180028b98
cmp eax, 1
jne 0x180028bdf
inc dword [rdi]
jmp 0x180028bdf
movsxd rdx, dword [rdi]
mov rax, qword [rdi + 0x10]
lea r8, [rdx - 1]
lea r8, [rax + r8*4]
lea rax, [rax + rdx*4]
add rax, 0xfffffffffffffff8
dec edx
cmp edx, 1
jl 0x180028bdf
nop word [rax + rax]
mov ecx, dword [rax]
lea rax, [rax - 4]
mov dword [r8], ecx
lea r8, [r8 - 4]
sub rdx, 1
jne 0x180028bc0
jmp 0x180028bdf
mov rax, qword [rdi + 0x10]
mov dword [rax], 0
dec r9d
cmp r9d, 0x11f
ja 0x180028b80
xor ebx, ebx
jmp 0x180028c1b
mov ecx, 0x6f
mov eax, ecx
sub eax, 0x6c
je 0x180028c0f
sub eax, 1
je 0x180028c1b
cmp eax, 2
jne 0x180028c14
test rdi, rdi
je 0x180028c14
and byte [rdi], 0xfd
jmp 0x180028c14
test rdi, rdi
je 0x180028c1b
inc ecx
cmp ecx, 0x72
jb 0x180028bf4
add esi, 0xad
cmp esi, 0x31a
jb 0x180028b25
mov eax, ebx
test ebx, ebx
jne 0x180028ebb
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor esi, esi
mov qword [rsp + 0x28], rdi
cdq
mov qword [rsp + 0x20], rsi
xor eax, edx
lea r9d, [rbx + 0x59]
sub eax, edx
lea r8, [rbp - 0x31]
xor edx, edx
mov dword [rbp - 0x31], eax
mov rcx, rdi
call fcn.180014590
test eax, eax
jne 0x180028ebb
dec dword [r12]
cmp dword [r12], esi
jg 0x180028b20
jmp 0x180028e3b
cmp r15d, 0x1e9f
je 0x180028a94
cmp r15d, 0x20ba
je 0x180028cc2
cmp r15d, 0x2dcd
je 0x18002999c
cmp r15d, 0x40e6
jne 0x180028e4d
mov word [rbp - 0x16], r8w
mov word [rbp - 0x15], r9w
mov word [rbp - 1], r10w
jmp 0x180028e4d
mov word [rbp - 0x17], ax
jmp 0x180028e4d
cmp r15d, 0xe1c2
ja 0x180028dd6
je 0x180028db9
cmp r15d, 0x6112
je 0x180028d80
cmp r15d, 0x813e
je 0x180028d48
cmp r15d, 0xa16a
je 0x180028d2a
cmp r15d, 0xc196
jne 0x180028e4d
mov r8d, 5
mov byte [rbp - 9], 0
lea rdx, str.Gecko
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180028e3b
movzx eax, word [0x1800944a0]
mov word [rbp - 0x21], r11w
mov word [rbp - 0x20], ax
mov eax, 0x65
mov word [rbp - 0x1e], ax
jmp 0x180028e4d
movzx eax, word [0x1800944bc]
mov word [rbp + 8], ax
movzx eax, byte [0x1800944be]
mov byte [rbp + 0xa], al
mov eax, dword [str.537.36]
mov dword [rbp - 0x11], eax
movzx eax, word [0x1800944c4]
mov word [rbp - 0xd], ax
movzx eax, byte [0x1800944c6]
mov byte [rbp - 0xb], al
jmp 0x180028e4d
mov eax, dword [str.ppleW]
lea rdx, [0x1800944b0]
mov dword [rbp], eax
lea rcx, [rbp + 5]
movzx eax, word [0x1800944ac]
mov r8d, 3
mov word [rbp + 4], ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, reloc.SHELL32.dll_PathYetAnotherMakeUniqueName
mov word [rbp + 7], ax
jmp 0x180028e3b
mov r8d, 6
mov byte [rbp + 0xf], 0
lea rdx, str.Chrome
lea rcx, [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180028e3b
cmp r15d, 0x101ee
je 0x180028e27
cmp r15d, 0x1221a
je 0x180028e08
cmp r15d, 0x14246
je 0x180028e02
cmp r15d, 0x16272
jne 0x180028e4d
mov word [rbp - 0x37], 0x37
jmp 0x180028e4d
mov word [rbp - 0x39], dx
jmp 0x180028e4d
mov r8d, 2
lea rdx, [0x180093b28]
lea rcx, [rbp - 0x27]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov word [rbp - 0x26], 0x30
jmp 0x180028e3b
mov r8d, 0xa
lea rdx, [rbp - 0x29]
lea ecx, [r8 + 0x51]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov r8d, 0x36
lea r9d, [r8 - 2]
lea r10d, [r8 + 0xb]
lea r11d, [r8 + 0x36]
imul eax, dword [rbp - 0x51], 0x3a
add r15d, eax
cmp r15d, r13d
jbe 0x1800289d1
mov eax, dword [rbp - 0x51]
lea r14d, [rax + 0x3f]
cmp eax, r14d
jae 0x18002999c
lea r15, [0x180000000]
mov r12d, 0x69
nop word [rax + rax]
add eax, 0xffffff72
cmp eax, 0x3c
ja case.0x180028ea2.163
movzx eax, byte [r15 + rax + 0x29a20]
mov ecx, dword [r15 + rax*4 + 0x299c8]
add rcx, r15
jmp rcx
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov ecx, reloc.SHELL32.dll_SHSetFolderPathW
call fcn.18000e3a0
jmp 0x1800299a0
mov dword [rbp - 0x59], eax
jmp 0x18002999c
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180028eec
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180028ee4
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x180028efe
xor r8d, r8d
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180028f48
lea rax, [rcx + 6]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180028f26
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 6
mov rcx, rbx
lea rdx, str.537.36
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 6], 0
jmp case.0x180028ea2.163
xor r8d, r8d
mov qword [rsp + 0x20], 6
lea r9, str.537.36
mov rcx, rdi
lea edx, [r8 + 6]
call fcn.180002ac0
jmp case.0x180028ea2.163
lea rcx, [rbp - 0x31]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x180028f73
mov eax, dword [str.Safar]
lea rdx, str.Mozilla_5.0
mov dword [rcx], eax
mov r8d, ILFindLastID
movzx eax, word [0x1800944d4]
mov word [rcx + 4], ax
mov rcx, rdi
mov word [rbp - 0x2c], r12w
call fcn.180021a30
jmp case.0x180028ea2.163
mov byte [rbp - 0x35], 0
mov byte [rbp - 0x31], 0
jmp case.0x180028ea2.163
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x180029003
lea rax, [rcx + 5]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180028fe4
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 5
mov rcx, rbx
lea rdx, str.KHTML
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
jmp 0x180029022
xor r8d, r8d
mov qword [rsp + 0x20], 5
lea r9, str.KHTML
mov rcx, rdi
lea edx, [r8 + 5]
call fcn.180002ac0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18002904e
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029043
mov rax, qword [rdi]
mov word [rax + rcx], PathMakeUniqueName
jmp 0x18002994f
mov r9b, 0x2c
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
jmp 0x18002994f
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029091
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029086
mov rax, qword [rdi]
mov word [rax + rcx], 0x29
jmp 0x18002994f
mov r9b, 0x29
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
jmp 0x18002994f
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1800290ef
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800290d0
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800944ec]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x18002910e
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800944ec]
mov rcx, rdi
lea edx, [r8 + 3]
call fcn.180002ac0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18002913a
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18002912f
mov rax, qword [rdi]
mov word [rax + rcx], 0x3b
jmp case.0x180028ea2.163
mov r9b, 0x3b
jmp 0x18002997b
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18002916b
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029163
mov rax, qword [rdi]
mov word [rax + rcx], PathMakeUniqueName
jmp 0x18002917d
xor r8d, r8d
mov r9b, PathMakeUniqueName
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1800291c7
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800291a5
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800944f0]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x18002994f
mov qword [rsp + 0x20], 3
lea r9, [0x1800944f0]
mov edx, 3
jmp 0x180029944
lea rax, [rbp - 0x31]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800291f0
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18002923c
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029220
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x31]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp case.0x180028ea2.163
lea r9, [rbp - 0x31]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
mov r9b, 0x28
jmp 0x18002997b
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029289
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029281
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp case.0x180028ea2.152
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029258
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800292bc
mov rax, qword [rdi]
mov word [rax + rcx], 0x28
jmp case.0x180028ea2.163
mov byte [rbp - 0x36], 0x32
jmp case.0x180028ea2.163
lea rax, [rbp + 0xf]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800292e0
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18002932c
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029310
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp + 0xf]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp case.0x180028ea2.163
lea r9, [rbp + 0xf]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029371
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029369
mov rax, qword [rdi]
mov word [rax + rcx], 0x3b
jmp 0x180029383
xor r8d, r8d
mov r9b, 0x3b
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800293ac
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800293a4
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x1800293be
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x180029408
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800293e6
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800944f4]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp case.0x180028ea2.163
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800944f4]
mov rcx, rdi
lea edx, [r8 + 3]
call fcn.180002ac0
jmp case.0x180028ea2.163
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029458
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18002944d
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp case.0x180028ea2.163
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x18002997b
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029489
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029481
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x18002949b
xor r8d, r8d
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
lea rax, [rbp - 0x11]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800294a6
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1800294f2
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800294d6
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x11]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x18002994f
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x11]
mov rdx, rsi
jmp 0x180029944
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18002952c
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029524
mov rax, qword [rdi]
mov word [rax + rcx], PathMakeUniqueName
jmp 0x18002953e
xor r8d, r8d
mov r9b, PathMakeUniqueName
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
lea rax, [rbp - 0x39]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180029550
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18002959c
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029580
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x39]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
jmp case.0x180028ea2.163
lea r9, [rbp - 0x39]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800295e1
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800295d9
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x1800295f3
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
lea rax, [rbp - 0x19]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x180029600
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18002964c
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029630
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x19]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
jmp case.0x180028ea2.163
lea r9, [rbp - 0x19]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
lea rax, [rbp - 0x29]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x180029673
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1800296bf
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800296a3
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x29]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
jmp case.0x180028ea2.163
lea r9, [rbp - 0x29]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180029704
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800296fc
mov rax, qword [rdi]
mov word [rax + rcx], 0x29
jmp 0x180029716
xor r8d, r8d
mov r9b, 0x29
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18002973f
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029737
mov rax, qword [rdi]
mov word [rcx + rax], 0x20
jmp 0x180029751
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
lea rax, [rbp - 1]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180029760
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1800297ac
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029790
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 1]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp case.0x180028ea2.163
lea r9, [rbp - 1]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
lea rax, [rbp - 0x21]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x1800297d3
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18002981c
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029803
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x21]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x180029833
lea r9, [rbp - 0x21]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18002985c
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029854
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x18002986e
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
lea rax, [rbp - 9]
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x180029880
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x1800298cc
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800298b0
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 9]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp case.0x180028ea2.163
lea r9, [rbp - 9]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ac0
jmp case.0x180028ea2.163
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x18002992f
lea rax, [rcx + 0xa]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029910
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0xa
mov rcx, rbx
lea rdx, str.Windows_NT
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
jmp 0x18002994f
mov qword [rsp + 0x20], 0xa
lea r9, str.Windows_NT
mov edx, 0xa
xor r8d, r8d
mov rcx, rdi
call fcn.180002ac0
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
cmp rcx, rdx
jae 0x180029978
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180029970
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp case.0x180028ea2.163
mov r9b, 0x20
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002960
mov eax, dword [rbp - 0x51]
add eax, 3
mov dword [rbp - 0x51], eax
cmp eax, r14d
jb 0x180028e80
mov rax, qword [rbp - 0x59]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180083f10
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret