Function at 0x18000eca0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1800b2020]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov r13, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x40], r14d
mov rcx, qword [rcx + 0x50]
test rcx, rcx
je 0x18000ecf8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r13 + 8]
cmp rcx, 0xffffffffffffffff
je 0x18000ed08
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [r13 + 0x58], dil
je 0x18000ef08
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r13 + 0x50], rax
test rax, rax
jne 0x18000ef08
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], edi
je 0x18000ee12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [rbp + 0x10]
call fcn.18000fff0
nop
mov dword [rsp + 0x40], 1
cmp qword [rax + 0x18], 8
jb 0x18000ed65
mov rax, qword [rax]
mov dword [rsp + 0x50], ebx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x50], 2
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x50], rax
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x18000eda0
mov qword [rsp + 0x58], rsi
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180024380
nop
mov dword [rsp + 0x40], 0x200003
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
nop
mov edi, 0x600007
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
test dil, 4
je 0x18000ee71
and edi, 0xfffffffb
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000ee5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff74
call fcn.18006080c
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
test dil, 2
je 0x18000eebb
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000eebb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eeb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff7a
call fcn.18006080c
nop
test dil, 1
je 0x18000ef01
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x18000ef01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eefc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff80
call fcn.18006080c
xor al, al
jmp 0x18000ff24
mov rsi, 0xffffffffffffffff
cmp byte [r13 + 0x59], dil
je 0x18000f323
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], edi
je 0x18000f010
mov rbx, qword [r13 + 0x20]
lea rdx, [rbp - 0x58]
call fcn.180010170
mov rcx, rax
mov dword [rsp + 0x40], 8
cmp qword [rax + 0x18], 8
jb 0x18000ef4b
mov rcx, qword [rax]
lea rdx, [r13 + 0x10]
cmp qword [r13 + 0x28], 8
jb 0x18000ef5a
mov rdx, qword [r13 + 0x10]
mov rax, qword [r13 + 0x20]
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rbx
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x20], xmm1
mov qword [rbp - 0x30], 0x4d
lea rax, [rbp + 0x10]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x30], rcx
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000efa0
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x80]
call fcn.180024380
nop
mov dword [rsp + 0x40], 0x800018
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
nop
mov edi, 0x1800038
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
test dil, 0x20
je 0x18000f06f
and edi, 0xffffffdf
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000f05b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f056
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff86
call fcn.18006080c
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
test dil, 0x10
je 0x18000f0b9
and edi, 0xffffffef
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000f0b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f0b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff8c
call fcn.18006080c
nop
test dil, 8
je 0x18000f102
and edi, 0xfffffff7
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000f102
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f0fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff92
call fcn.18006080c
mov rax, qword [r13 + 0x20]
mov qword [rbp - 0x60], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r9, r14
mov qword [rbp - 0x30], r14
mov qword [rsp + 0x70], r14
bts edi, 0x19
mov dword [rsp + 0x40], edi
mov r12, rax
mov qword [rbp - 0x20], rax
mov r15, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
test rax, rax
je 0x18000f271
mov r14, rax
movabs rdx, 0x8000000000000000
movsd xmm6, qword [0x1800a5cf0]
mov rcx, rax
nop dword [rax]
cmp r14, 2
jb 0x18000f251
je 0x18000f208
test r14b, 1
je 0x18000f251
mov ebx, 3
xorps xmm1, xmm1
test r14, r14
js 0x18000f18e
cvtsi2sd xmm1, r14
jmp 0x18000f1a6
mov rcx, r14
shr rcx, 1
mov rax, r14
and eax, 1
or rcx, rax
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
xorps xmm0, xmm0
ucomisd xmm0, xmm1
ja 0x18000f1b5
sqrtpd xmm0, xmm1
jmp 0x18000f1d0
movaps xmm0, xmm1
call fcn.18008f41c
mov r8, qword [rsp + 0x60]
mov r9, qword [rbp - 0x30]
movabs rdx, 0x8000000000000000
xor eax, eax
comisd xmm0, xmm6
jb 0x18000f1e5
subsd xmm0, xmm6
comisd xmm0, xmm6
jae 0x18000f1e5
mov rax, rdx
cvttsd2si rcx, xmm0
add rcx, rax
cmp rbx, rcx
ja 0x18000f208
xor edx, edx
mov rax, r14
div rbx
test rdx, rdx
je 0x18000f243
add rbx, 2
cmp rbx, rcx
jbe 0x18000f1f2
cmp r15, r9
je 0x18000f21b
mov qword [r15], r12
add r15, 8
mov qword [rsp + 0x68], r15
jmp 0x18000f243
lea r8, [rbp - 0x20]
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.180023fb0
mov r9, qword [rsp + 0x70]
mov qword [rbp - 0x30], r9
mov r15, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov r12, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x60]
movabs rdx, 0x8000000000000000
inc r12
mov qword [rbp - 0x20], r12
mov r14, r12
mov rax, r15
sub rax, r8
sar rax, 3
cmp rax, rcx
jb 0x18000f160
xor r14d, r14d
lea rbx, [r13 + 0x60]
lea rax, [rsp + 0x60]
cmp rbx, rax
je 0x18000f2de
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000f2c4
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
jb 0x18000f2bf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000ff9e
mov rcx, r8
call fcn.18006080c
mov rax, qword [rsp + 0x60]
mov qword [rbx], rax
mov qword [rbx + 8], r15
mov rax, qword [rbp - 0x30]
mov qword [rbx + 0x10], rax
mov r8, r14
mov r9, r14
btr edi, 0x19
test r8, r8
je 0x18000f323
sub r9, r8
sar r9, 3
lea rdx, [r9*8]
mov rax, r8
cmp rdx, 0x1000
jb 0x18000f31b
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff56
mov rcx, r8
call fcn.18006080c
lea r15, [r13 + 0x10]
mov r13, qword [r15 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, 9
jb 0x18000ff98
cmp qword [r15 + 0x18], 8
jb 0x18000f34f
mov r15, qword [r15]
mov qword [rbp - 0x10], r14
mov qword [rbp], r14
mov qword [rbp + 8], r14
lea r12, [r13 + 9]
mov r14d, 7
lea rbx, [rbp - 0x10]
cmp r12, r14
jbe 0x18000f3fa
mov r14, r12
or r14, 7
cmp r14, rcx
jbe 0x18000f383
mov r14, rcx
jmp 0x18000f38f
mov eax, 0xa
cmp r14, rax
cmovb r14, rax
mov rcx, r14
add rcx, 1
cmovb rcx, rsi
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x18000ffa4
add rcx, rcx
cmp rcx, 0x1000
jb 0x18000f3e5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000ffa4
mov rcx, rax
call fcn.1800607d0
test rax, rax
je 0x18000ff56
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000f3f6
test rcx, rcx
je 0x18000f3f4
call fcn.1800607d0
mov rbx, rax
jmp 0x18000f3f6
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov qword [rbp], r12
mov qword [rbp + 8], r14
movups xmm0, xmmword [str..pipe_]
movups xmmword [rbx], xmm0
movzx eax, word [0x1800a4680]
mov word [rbx + 0x10], ax
lea rcx, [rbx + 0x12]
lea r8, [r13*2]
mov rdx, r15
call fcn.180062d30
xor r15d, r15d
mov word [rbx + r12*2], r15w
bts edi, 0x1a
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov r14, qword [rsp + 0x50]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x30], r15
mov edx, 0xc0000000
cmp byte [r14 + 0x58], r15b
je 0x18000f460
mov dword [rsp + 0x28], 0x40110000
jmp 0x18000f468
mov dword [rsp + 0x28], 0x110000
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x18000fcf3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 2
jne 0x18000f4b2
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
jmp 0x18000f4be
cmp ebx, 0xe7
je 0x18000f6b4
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x18000f5b7
lea rdx, [rbp - 0x58]
call fcn.180010530
nop
bts edi, 9
mov dword [rsp + 0x40], edi
cmp qword [rax + 0x18], 8
jb 0x18000f4eb
mov rax, qword [rax]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
mov dword [rsp + 0x50], ebx
mov qword [rbp - 0x30], rcx
mov dword [rbp - 0x20], r15d
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp + 0x30], xmm0
mov qword [rsp + 0x50], 0x2c2
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x58], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x50], rax
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x18000f540
mov qword [rsp + 0x58], rsi
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180024380
bts edi, 0x1d
bts edi, 0xa
mov dword [rsp + 0x40], edi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
bts edi, 0x1e
bts edi, 0xb
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
bt edi, 0xb
jae 0x18000f617
btr edi, 0xb
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000f603
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f5fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffaa
call fcn.18006080c
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
bt edi, 0xa
jae 0x18000f662
btr edi, 0xa
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000f662
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f65c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffb0
call fcn.18006080c
nop
bt edi, 9
jae 0x18000f922
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f91d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff5c
jmp 0x18000f91d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
nop dword [rax]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x18000fb14
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x30], r15
mov edx, 0xc0000000
cmp byte [r14 + 0x58], 0
je 0x18000f700
mov dword [rsp + 0x28], 0x40000000
jmp 0x18000f705
mov dword [rsp + 0x28], r15d
cmp qword [rbp + 8], 8
cmovae rcx, qword [rbp - 0x10]
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r14 + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x18000f929
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x18000f929
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0x1f4
jb 0x18000f6c0
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x18000f831
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [rbp - 0x58]
call fcn.1800108c0
nop
bts edi, 0x12
mov dword [rsp + 0x40], edi
cmp qword [rax + 0x18], 8
jb 0x18000f78c
mov rax, qword [rax]
mov dword [rsp + 0x50], ebx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x50], 2
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x50], rax
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x18000f7c0
mov qword [rsp + 0x58], rsi
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180024380
nop
bts edi, 0x13
mov dword [rsp + 0x40], edi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
nop
bts edi, 0x14
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
bt edi, 0x14
jae 0x18000f891
btr edi, 0x14
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000f87d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f878
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffb6
call fcn.18006080c
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
bt edi, 0x13
jae 0x18000f8dc
btr edi, 0x13
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000f8dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f8d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffbc
call fcn.18006080c
nop
bt edi, 0x12
jae 0x18000f922
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f91d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffc2
call fcn.18006080c
xor bl, bl
jmp 0x18000fee5
cmp byte [r14 + 0x59], 0
je 0x18000fee3
mov edx, 0x1388
mov rcx, r14
call fcn.180011ec0
test al, al
jne 0x18000fee3
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x18000fa17
lea rdx, [rbp - 0x58]
call fcn.180010360
mov rbx, rax
bts edi, 0xf
mov dword [rsp + 0x40], edi
cmp qword [rax + 0x18], 8
jb 0x18000f980
mov rbx, qword [rax]
nop dword [rax + rax]
lea rcx, [rbp - 0x30]
call fcn.180006e30
mov qword [rsp + 0x50], r15
lea rax, [rbp - 0x30]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x50], rbx
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x18000f9a6
mov qword [rsp + 0x58], rsi
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180024380
nop
bts edi, 0x10
mov dword [rsp + 0x40], edi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
nop
bts edi, 0x11
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
bt edi, 0x11
jae 0x18000fa77
btr edi, 0x11
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000fa63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fa5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffc8
call fcn.18006080c
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
bt edi, 0x10
jae 0x18000fac2
btr edi, 0x10
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000fac2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fabc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffce
call fcn.18006080c
nop
bt edi, 0xf
jae 0x18000f922
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f91d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff62
jmp 0x18000f91d
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x18000fbf6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, [rbp - 0x58]
call fcn.180010720
nop
bts edi, 0xc
mov dword [rsp + 0x40], edi
cmp qword [rax + 0x18], 8
jb 0x18000fb49
mov rax, qword [rax]
mov dword [rsp + 0x50], ebx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rsp + 0x50], 2
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x50], rax
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x18000fb80
mov qword [rsp + 0x58], rsi
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180024380
or edi, 0x80000000
bts edi, 0xd
mov dword [rsp + 0x40], edi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
nop
bts edi, 0xe
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
bt edi, 0xe
jae 0x18000fc56
btr edi, 0xe
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000fc42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fc3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffd4
call fcn.18006080c
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
bt edi, 0xd
jae 0x18000fca1
btr edi, 0xd
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000fca1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fc9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffda
call fcn.18006080c
nop
bt edi, 0xc
jae 0x18000f922
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f91d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff68
jmp 0x18000f91d
cmp byte [r14 + 0x59], 0
je 0x18000fee3
mov edx, 0x1388
mov rcx, r14
call fcn.180011ec0
test al, al
jne 0x18000fee3
call fcn.18002f970
mov rcx, qword [rax]
cmp dword [rcx], 0
je 0x18000fde7
lea rdx, [rbp - 0x58]
call fcn.180010360
mov rbx, rax
or edi, 0x40
mov dword [rsp + 0x40], edi
cmp qword [rax + 0x18], 8
jb 0x18000fd41
mov rbx, qword [rax]
lea rcx, [rbp - 0x30]
call fcn.180006e30
mov qword [rsp + 0x50], r15
lea rax, [rbp - 0x30]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x20], xmm0
mov qword [rsp + 0x50], rbx
nop word [rax + rax]
inc rsi
cmp word [rbx + rsi*2], 0
jne 0x18000fd70
mov qword [rsp + 0x58], rsi
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180024380
bts edi, 0x1b
bts edi, 7
mov dword [rsp + 0x40], edi
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.18002e720
bts edi, 0x1c
bts edi, 8
mov dword [rsp + 0x40], edi
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call fcn.18002f970
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str._antimalware_provider__::_bd::PipeClient::Connect____
xor edx, edx
mov rcx, rax
call fcn.18002caa0
nop
bt edi, 8
jae 0x18000fe47
btr edi, 8
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x18000fe33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fe2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffe0
call fcn.18006080c
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
test dil, dil
jns 0x18000fe91
btr edi, 7
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x18000fe91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fe8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ffe6
call fcn.18006080c
nop
test dil, 0x40
je 0x18000f922
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x18000f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f91d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff6e
jmp 0x18000f91d
mov bl, 1
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x18000ff21
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ff1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000ff56
call fcn.18006080c
movzx eax, bl
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1800607b0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
int3
call fcn.18006e72c
int3
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
int3
call fcn.1800013e0
nop
call fcn.18006e72c
nop
call fcn.1800012b0
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
nop
call fcn.18006e72c
int3