Function at 0x18004f9e0
Capabilities:
Get common file path
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x180087e88]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov r10d, dword [rbp + 0x370]
mov rsi, r8
mov r11, qword [rbp + 0x378]
mov r14d, r10d
mov rdi, qword [rbp + 0x368]
mov qword [rbp - 0x70], r8
mov r8, qword [rbp + 0x360]
lea ebx, [r10 + 0x1932]
mov dword [rsp + 0x30], ebx
cmp r10d, ebx
movzx ebx, byte [rsp + 0x34]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x50], r11
jae 0x1800501ea
mov r13d, dword [rsp + 0x38]
mov r10d, 0x36
mov r15, qword [rsp + 0x48]
movzx r12d, byte [rsp + 0x34]
mov eax, dword [rsp + 0x30]
mov esi, dword [rbp + 0x168]
cmp r14d, 0x48e
ja 0x18004fda3
je 0x18004fd96
cmp r14d, 0x28a
ja 0x18004fc58
je 0x18004fc35
cmp r14d, 0x188
ja 0x18004fb8d
je 0x18004fb6d
cmp r14d, 0x107
ja 0x18004fb3e
je 0x18004fb19
mov eax, r14d
sub eax, 0x10
je 0x18004fb08
sub eax, 0x81
je 0x18004faf7
cmp eax, 0x4d
jne 0x1800501cb
mov eax, dword [r8]
mov dword [rdi + 4], eax
jmp 0x1800501cb
mov eax, 0x73
mov word [rbp + 0x1d2], ax
jmp 0x1800501cb
mov eax, 0x77
mov word [rbp + 0x1d0], ax
jmp 0x1800501cb
mov eax, dword [0x18007da61]
mov dword [rbp + 0x1c0], eax
movzx eax, byte [0x18007da65]
mov byte [rbp + 0x1c4], al
mov byte [rbp + 0x1c5], 0
jmp 0x1800501cb
mov eax, r14d
sub eax, 0x112
je 0x18004fb5c
cmp eax, 0x4d
jne 0x1800501cb
mov eax, dword [r9]
mov dword [rdi + 8], eax
jmp 0x1800501cb
mov eax, 0x32
mov word [rbp + 0x1d4], ax
jmp 0x1800501cb
mov r10d, 0x616c
mov byte [rbp + 0x1c7], 0
mov word [rbp + 0x1c5], r10w
mov r10d, 0x36
jmp 0x1800501cf
mov eax, r14d
sub eax, 0x193
je 0x18004fc24
sub eax, 0x4d
je 0x18004fc19
sub eax, 0x29
je 0x18004fbe0
sub eax, 0xb
je 0x18004fbc5
cmp eax, 0x4d
jne 0x1800501cb
mov eax, dword [r11]
mov dword [rdi + 0x10], eax
mov qword [rdi + 0x80], rdx
jmp 0x1800501cb
mov eax, 0x33
mov dword [rbp + 0x1da], 0x2e0032
mov word [rbp + 0x1d8], ax
jmp 0x1800501cb
mov r8d, 2
lea rdx, [0x18007d948]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x18007d96b]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800501ac
mov eax, dword [r9]
mov dword [rdi + 0xc], eax
jmp 0x1800501cb
mov eax, 0x5f
mov word [rbp + 0x1d6], ax
jmp 0x1800501cb
mov r10d, 0x64
mov dword [rbp + 0x1b0], 0x6e6957
mov word [rbp + 0x1b3], r10w
mov r10d, 0x36
jmp 0x1800501cf
cmp r14d, 0x38c
ja 0x18004fd23
je 0x18004fcf7
mov eax, r14d
sub eax, 0x295
je 0x18004fce8
sub eax, 0x4d
je 0x18004fcd8
sub eax, 0x29
je 0x18004fcad
sub eax, 0xb
je 0x18004fc9c
cmp eax, 0x4d
jne 0x1800501cb
xor eax, eax
mov dword [rdi + 0x14], eax
mov eax, dword [rdi]
mov dword [rdi + 0x18], eax
jmp 0x1800501cb
mov eax, 0x6c
mov word [rbp + 0x1e2], ax
jmp 0x1800501cb
mov eax, 0x6f
lea rdx, [0x18007da54]
mov word [rbp + 0x1b4], ax
lea rcx, [rbp + 0x1b5]
mov r8d, 4
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800501ac
xor eax, eax
mov qword [rdi + 0x88], rcx
mov dword [rdi], eax
jmp 0x1800501cb
mov dword [rbp + 0x1de], 0x6c0064
jmp 0x1800501cb
movzx eax, word [0x18007da58]
mov word [rbp + 0x1b8], ax
movzx eax, byte [0x18007da5a]
mov byte [rbp + 0x1ba], al
mov eax, 0x57
mov word [rbp + 0x188], ax
jmp 0x1800501cb
mov eax, r14d
sub eax, 0x397
je 0x18004fd85
sub eax, 0x4d
je 0x18004fd73
sub eax, 0x29
je 0x18004fd62
sub eax, 0xb
je 0x18004fd56
cmp eax, 0x4d
mov eax, dword [rsp + 0x30]
jne 0x1800501cf
mov qword [rdi + 0x48], 8
jmp 0x1800501cf
xor eax, eax
mov qword [rsp + 0x48], rax
jmp 0x1800501cb
mov eax, 0x6e69
mov word [rbp + 0x189], ax
jmp 0x1800501cb
mov edx, ILFree
mov rcx, rdi
call fcn.180071430
jmp 0x1800501ac
xor eax, eax
mov r12b, 1
mov word [rbp + 0x1e4], ax
jmp 0x1800501cb
mov word [rbp + 0x18b], r10w
jmp 0x1800501cf
cmp r14d, 0x794
ja 0x18004ff6a
je 0x18004ff54
cmp r14d, 0x611
ja 0x18004fec9
je 0x18004fea2
cmp r14d, 0x51a
ja 0x18004fe3b
je 0x18004fe2a
mov eax, r14d
sub eax, 0x499
je 0x18004fe17
sub eax, 0x4d
je 0x18004fe04
cmp eax, 0x29
jne 0x1800501cb
mov eax, 0x34
mov byte [rbp + 0x1a0], 0
mov word [rbp + 0x18c], ax
jmp 0x1800501cb
mov dword [rdi + 0x40], 3
mov dword [rdi + 0x44], 0x1c
jmp 0x1800501cb
xor eax, eax
mov dword [rsp + 0x70], 1
mov qword [rbp - 0x68], rax
jmp 0x1800501cb
mov dword [rsp + 0x38], r10d
mov dword [rbp - 0x78], 0x2381f
jmp 0x1800501cf
mov eax, r14d
sub eax, 0x590
je 0x18004fe70
cmp eax, 0xb
jne 0x1800501cb
mov r8d, SHSetFolderPathW
lea rdx, str.WSAStartup
lea rcx, [rbp + 0x1d0]
call fcn.18004bdc0
mov qword [rbp - 0x60], rax
jmp 0x1800501ac
lea rcx, [rbp + 0x1a0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18004fe80
mov eax, dword [str.Apple]
mov dword [rcx], eax
movzx eax, word [0x18007da94]
mov word [rcx + 4], ax
jmp 0x1800501c6
mov r10d, 0x57
mov word [rbp + 0x1a5], r10w
mov r10d, 0x65
mov word [rbp + 0x1a6], r10w
mov r10d, 0x36
jmp 0x1800501cf
mov eax, r14d
sub eax, 0x61c
je 0x18004ff4a
sub eax, 0x76
je 0x18004ff2a
sub eax, 0xb
je 0x18004ff1e
sub eax, 0x76
je 0x18004fefe
cmp eax, 0xb
mov eax, dword [rsp + 0x30]
jne 0x1800501cf
mov dword [rbp + 0x160], 1
jmp 0x1800501cf
movzx eax, word [0x18007da5c]
mov word [rbp + 0x1a9], ax
movzx eax, byte [0x18007da5e]
mov byte [rbp + 0x1ab], al
jmp 0x1800501cb
xor eax, eax
mov qword [rsp + 0x58], rax
jmp 0x1800501cb
movzx eax, word [0x18007d93c]
mov word [rbp + 0x1a7], ax
movzx eax, byte [0x18007d93e]
mov byte [rbp + 0x1a9], al
jmp 0x1800501cb
xor eax, eax
mov dword [rbp - 0x80], eax
jmp 0x1800501cb
mov dword [rbp + 0x198], 0x2e373335
mov byte [rbp + 0x19c], 0
jmp 0x1800501cf
cmp r14d, 0x917
ja 0x1800500a5
je 0x180050099
mov eax, r14d
sub eax, 0x79f
je 0x18005000e
sub eax, 0x76
je 0x18004fffd
sub eax, 0xb
je 0x18004ffc3
sub eax, 0x76
jne 0x1800501cb
mov byte [rbp + 0x19e], al
lea rdx, [0x18007da13]
lea rcx, [rbp + 0x180]
mov r8d, 4
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x1800501ac
mov r9d, dword [rbp - 0x80]
xor eax, eax
mov r8d, dword [rbp - 0x78]
mov edx, dword [rsp + 0x70]
mov rcx, qword [rbp - 0x68]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], eax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x160]
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov r13d, eax
jmp 0x1800501ac
mov eax, 0x3633
mov word [rbp + 0x19c], ax
jmp 0x1800501cb
xor eax, eax
lea rdx, [rbp - 0x40]
mov ecx, 0x202
mov dword [rbp + 0x168], eax
call qword [rbp - 0x60]
test eax, eax
je 0x18005008e
mov esi, 0xdc
nop dword [rax + rax]
cmp esi, 0x11f08
ja 0x180050051
je 0x180050049
cmp esi, 0x6040
jne 0x180050080
xor eax, eax
mov r15d, eax
jmp 0x180050080
xor eax, eax
mov qword [rbp - 0x58], rax
jmp 0x180050080
cmp esi, 0x17e6c
je 0x180050073
cmp esi, 0x1ddd0
je 0x18005006f
cmp esi, 0x23d34
je case.0x18005025f.17
jmp 0x180050080
xor bl, bl
jmp 0x180050080
lea rdx, [rbp - 0x58]
mov rcx, r15
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
add esi, 0x5f64
cmp esi, 0x29bbc
jbe 0x180050030
mov esi, dword [rbp + 0x168]
jmp 0x1800501ac
mov byte [rbp + 0x184], 0
jmp 0x1800501cf
mov eax, r14d
sub eax, 0x922
je 0x18005014d
sub eax, 0x76
je 0x180050142
sub eax, 0xb
je 0x180050108
sub eax, 0x76
je 0x1800500fa
cmp eax, 0x81
jne 0x1800501cb
lea r8d, [rax - 0x7e]
lea rdx, [0x18007dab3]
lea rcx, [rbp + 0x178]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x6547
mov word [rbp + 0x170], ax
jmp 0x1800501ac
mov word [rbp + 0x178], 0x6c
jmp 0x1800501cb
mov r8, qword [rsp + 0x58]
lea rax, [rbp + 0x1f0]
mov edx, dword [rsp + 0x38]
mov r9d, esi
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
test r12b, r12b
je 0x1800501ac
mov ecx, r13d
call qword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
jmp 0x1800501ac
mov word [rbp + 0x184], 0x4c
jmp 0x1800501cb
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov ecx, 0xa8
call fcn.18005bbd0
test al, al
jne 0x18005019c
mov edx, 6
nop dword [rax]
cmp edx, 6
ja case.0x180050189.2
lea r8, [0x180000000]
mov eax, edx
mov ecx, dword [r8 + rax*4 + 0x51260]
add rcx, r8
jmp rcx
xor bl, bl
dec edx
lea eax, [rdx + 0xd4]
cmp eax, 0xd3
ja 0x180050170
test r13d, r13d
movzx r12d, r12b
mov eax, 0
cmove r12d, eax
mov rdx, qword [rsp + 0x78]
mov r10d, 0x36
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x30]
add r14d, 0x81
cmp r14d, eax
jb 0x18004fa90
mov r10d, dword [rbp + 0x370]
mov rsi, qword [rbp - 0x70]
lea edx, [r10 + 0x31]
mov dword [rsp + 0x30], edx
cmp r10d, edx
jae case.0x18005025f.17
mov r13d, dword [rsp + 0x38]
mov eax, 0x6b63
mov r12d, 0x35
mov r14d, 0x6153
lea r15, [0x180085060]
lea r9, [0x180086060]
cmp r10d, 0x107
ja 0x18005060a
je 0x1800505fe
lea eax, [r10 - 0x10]
cmp eax, 0x57
ja case.default.0x18005062c
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x512b4]
mov ecx, dword [rcx + rax*4 + 0x5127c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x5a]
call fcn.1800517d0
mov edx, dword [rsp + 0x30]
movzx ebx, al
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
movsxd rax, dword [rdi + 0x10]
lea r9, [rsp + 0x48]
mov r8d, 0xfd
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], 0x1028
xor ecx, ecx
call fcn.180046890
mov qword [rdi + 0x70], rax
lea r9, [rsp + 0x48]
movsxd rax, dword [rdi + 0x10]
lea rdx, [rsp + 0x58]
mov r8d, 0xfd
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x58], 4
call fcn.180046890
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov qword [rdi + 0x50], rax
jmp case.default.0x18005062c
xor eax, eax
mov esi, eax
test r13d, r13d
je case.default.0x18005062c
cmp r13d, 0x10
jb 0x18005033f
lea rdx, [rdi + 0x90]
mov r9, qword [rdx]
lea eax, [r13 - 1]
add rax, r9
cmp r9, rdx
ja 0x180050319
cmp rax, rdx
jae 0x18005033b
mov eax, r13d
and eax, 0xfffffff0
nop
add esi, 0x10
cmp esi, eax
jb 0x180050320
mov r8d, eax
mov dl, 2
mov rcx, r9
call sub.VCRUNTIME140.dll_memset
mov r10d, dword [rbp + 0x370]
mov edx, dword [rsp + 0x30]
cmp esi, r13d
jae case.default.0x18005062c
mov edx, r13d
mov ecx, esi
sub edx, esi
nop
mov rax, qword [rdi + 0x90]
lea rcx, [rcx + 1]
mov byte [rcx + rax - 1], 2
sub rdx, 1
jne 0x180050350
mov edx, dword [rsp + 0x30]
jmp case.default.0x18005062c
xor ecx, ecx
mov r12d, ecx
cmp dword [r11], ecx
jle 0x180050448
mov r14d, ecx
mov r15d, ecx
mov esi, 0x11f
cmp esi, 0x11f
jne 0x180050407
mov rax, qword [rdi + 0x38]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x38], 4
mov dword [r15 + rax], ecx
lea ecx, [rsi - 0x43]
mov eax, dword [r8]
lea r8, [rsp + 0x38]
mov dword [rsp + 0x70], eax
call fcn.18006cdb0
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x78]
lea rdx, [rbp - 0x80]
mov dword [rbp - 0x78], 1
mov ecx, dword [rcx]
mov dword [rbp - 0x80], ecx
mov ecx, eax
mov qword [rsp + 0x58], rcx
lea ecx, [rsi - 0x43]
call fcn.18006cdb0
mov eax, eax
lea r9, [rsp + 0x48]
lea r8d, [rsi - 0x22]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x58]
xor ecx, ecx
call fcn.180046890
mov rcx, qword [rdi + 0x30]
mov qword [r14 + rcx], rax
xor ecx, ecx
mov r8, qword [rsp + 0x40]
add esi, 0xbe
cmp esi, 0x1dd
jb 0x180050388
mov r11, qword [rsp + 0x50]
inc r12d
add r15, 4
add r14, 8
cmp r12d, dword [r11]
jl 0x180050383
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
mov r12d, 0x35
mov eax, 0x6b63
inc r10d
mov dword [rbp + 0x370], r10d
cmp r10d, edx
jae case.0x18005025f.17
mov r8, qword [rsp + 0x40]
mov r11, qword [rsp + 0x50]
mov rsi, qword [rbp - 0x70]
jmp 0x180050211
xor eax, eax
mov qword [rdi + 0x98], rax
jmp case.default.0x18005062c
movsxd rax, dword [r11]
lea r9, [rsp + 0x48]
mov r8d, 0xfd
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], 4
xor ecx, ecx
call fcn.180046890
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov qword [rdi + 0x38], rax
jmp case.default.0x18005062c
xor eax, eax
mov qword [rdi + 0x78], rax
jmp case.default.0x18005062c
mov eax, 0x111
nop word [rax + rax]
cmp eax, 0x111
je 0x180051227
add eax, 0xb106
cmp eax, 0xb106
jbe 0x1800504d0
lea rax, [rbp + 0x170]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x1800504f5
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050e92
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18005052a
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x170]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rsi], 0
jmp 0x180050eac
mov qword [rdi + 0x58], r9
jmp case.default.0x18005062c
mov eax, dword [r8]
lea rdx, [rsp + 0x70]
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov ecx, 0xdc
mov dword [rsp + 0x70], eax
call fcn.18006cdb0
mov r13d, eax
lea r9, [rsp + 0x48]
mov r8d, 0xfd
mov qword [rsp + 0x48], r13
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], 1
xor ecx, ecx
call fcn.180046890
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov qword [rdi + 0x90], rax
jmp case.default.0x18005062c
mov qword [rdi + 0x60], r15
jmp case.default.0x18005062c
mov qword [rdi + 0x28], rsi
lea r9, [rsp + 0x48]
movsxd rax, dword [r11]
lea rdx, [rsp + 0x58]
mov r8d, 0xfd
mov qword [rsp + 0x48], rax
xor ecx, ecx
mov qword [rsp + 0x58], 8
call fcn.180046890
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov qword [rdi + 0x30], rax
jmp case.default.0x18005062c
mov word [rbp + 0x172], ax
jmp 0x180050453
lea eax, [r10 - 0x108]
cmp eax, 0x22
ja case.default.0x18005062c
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x5130c]
add rcx, r8
jmp rcx
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18005065e
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18005064f
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov word [rax + rcx], 0x3b
jmp case.default.0x18005062c
mov r9b, 0x3b
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180044bb0
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov r8d, 0xa
lea rdx, [rbp + 0x190]
mov ecx, 0x19a
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov byte [rbp + 0x174], 0x6f
jmp case.default.0x18005062c
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
cmp rcx, rdx
jae 0x1800506e4
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800506d5
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov word [rax + rcx], 0x20
jmp case.default.0x18005062c
mov r9b, 0x20
jmp 0x180050661
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x180050733
lea rax, [rcx + 6]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050714
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8d, 6
mov rcx, rsi
lea rdx, str.Chrome
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + 6], 0
jmp 0x180050752
xor r8d, r8d
mov qword [rsp + 0x20], 6
lea r9, str.Chrome
mov rcx, rdi
lea edx, [r8 + 6]
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050789
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050773
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp case.default.0x18005062c
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x180050661
mov byte [rbp + 0x16e], 0
jmp case.default.0x18005062c
mov eax, 0x33
mov word [rbp + 0x160], r12w
mov word [rbp + 0x161], ax
jmp case.default.0x18005062c
mov eax, 0x37
mov word [rbp + 0x162], ax
mov eax, PathMakeUniqueName
mov word [rbp + 0x163], ax
jmp case.default.0x18005062c
lea rax, [rbp + 0x168]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x1800507e1
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x18005082f
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050812
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x168]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rsi], 0
jmp 0x180050849
lea r9, [rbp + 0x168]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050886
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18005086a
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp case.default.0x18005062c
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180044bb0
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x1800508e9
lea rax, [rcx + 2]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800508d6
mov rax, qword [rdi]
mov edx, 0x3739
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], 0
jmp case.0x18005062c.275
xor r8d, r8d
mov qword [rsp + 0x20], 2
lea r9, [0x18007dacc]
mov rcx, rdi
lea edx, [r8 + 2]
call fcn.180044d10
mov r10d, dword [rbp + 0x370]
jmp case.0x18005062c.275
lea rax, [rbp + 0x190]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180050922
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050970
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050953
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp 0x18005098a
lea r9, [rbp + 0x190]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800509c7
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800509ab
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
mov word [rax + rcx], PathMakeUniqueName
jmp case.default.0x18005062c
mov r9b, PathMakeUniqueName
jmp 0x180050889
lea rax, [rbp + 0x178]
mov r14, 0xffffffffffffffff
nop dword [rax]
inc r14
cmp byte [rax + r14], 0
jne 0x1800509e0
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050a2e
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050a11
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x178]
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp 0x180050a48
lea r9, [rbp + 0x178]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050a85
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050a69
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
mov word [rax + rcx], 0x20
jmp case.default.0x18005062c
mov r9b, 0x20
jmp 0x180050889
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050ab6
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050aae
mov rax, qword [rdi]
mov word [rax + rcx], 0x28
jmp 0x180050ac8
xor r8d, r8d
mov r9b, 0x28
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180044bb0
lea rax, [rbp + 0x1b0]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180050ad6
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050b38
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050b07
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov byte [r14 + rsi], 0
mov r14d, 0x6153
jmp case.default.0x18005062c
lea r9, [rbp + 0x1b0]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x180050bbd
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050b90
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8d, 3
mov rcx, rsi
lea rdx, [0x18007dad0]
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov byte [rsi + 3], 0
jmp case.default.0x18005062c
lea r9, [0x18007dad0]
xor r8d, r8d
mov qword [rsp + 0x20], 3
mov rcx, rdi
lea edx, [r8 + 3]
call fcn.180044d10
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov byte [rbp + 0x175], 0
jmp case.default.0x18005062c
lea rax, [rbp + 0x1a0]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180050c06
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050c54
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050c37
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rsi], 0
jmp 0x180050c6e
lea r9, [rbp + 0x1a0]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jb 0x180050856
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180044bb0
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
lea rax, [rbp + 0x180]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180050cb5
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050d17
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050ce6
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x180]
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov byte [r14 + rsi], 0
mov r14d, 0x6153
jmp case.default.0x18005062c
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov eax, 0x3633
mov word [rbp + 0x164], ax
jmp case.default.0x18005062c
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180050d8e
lea rax, [rcx + 4]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050d80
mov rax, qword [rdi]
mov dword [rax + rcx], 0x302e3338
mov byte [rax + rcx + 4], 0
jmp 0x180050db4
xor r8d, r8d
mov qword [rsp + 0x20], 4
lea r9, str.83.0
mov rcx, rdi
lea edx, [r8 + 4]
call fcn.180044d10
mov r10d, dword [rbp + 0x370]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050de4
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050dd5
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov word [rax + rcx], PathMakeUniqueName
jmp case.default.0x18005062c
mov r9b, PathMakeUniqueName
jmp 0x180050661
lea rax, [rbp + 0x160]
mov r14, 0xffffffffffffffff
nop word [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x180050e00
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180050e62
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050e31
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x160]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov byte [r14 + rsi], 0
mov r14d, 0x6153
jmp case.default.0x18005062c
lea r9, [rbp + 0x160]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
lea r9, [rbp + 0x170]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050ee9
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050ecd
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
mov word [rax + rcx], 0x29
jmp case.default.0x18005062c
mov r9b, 0x29
jmp 0x180050c82
lea rax, [rbp + 0x188]
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x180050f00
mov rcx, qword [rdi + 0x18]
mov r14, qword [rdi + 0x10]
mov rax, rcx
sub rax, r14
cmp rsi, rax
ja 0x180050f4e
lea rax, [rsi + r14]
mov r15, rdi
mov qword [rdi + 0x10], rax
cmp rcx, 0x10
jb 0x180050f30
mov r15, qword [rdi]
lea rcx, [r15 + r14]
mov r8, rsi
lea rdx, [rbp + 0x188]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsi + r15]
mov byte [rax + r14], 0
jmp 0x180050f68
lea r9, [rbp + 0x188]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180044d10
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180050fa5
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180050f89
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
mov word [rcx + rax], 0x3b
jmp case.default.0x18005062c
mov r9b, 0x3b
jmp 0x180050c82
mov dword [rbp + 0x16a], 0x69726166
jmp case.default.0x18005062c
mov byte [rbp + 0x174], 0
jmp case.default.0x18005062c
lea rax, [rbp + 0x198]
mov r14, 0xffffffffffffffff
inc r14
cmp byte [rax + r14], 0
jne 0x180050fd6
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x180051038
lea rax, [rcx + r14]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180051007
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8, r14
mov rcx, rsi
lea rdx, [rbp + 0x198]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov byte [rsi + r14], 0
mov r14d, 0x6153
jmp case.default.0x18005062c
lea r9, [rbp + 0x198]
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180044d10
mov edx, dword [rsp + 0x30]
mov r14d, 0x6153
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x180051091
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180051089
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x1800510a3
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180044bb0
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1800510f8
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800510cb
mov rax, qword [rdi]
lea rsi, [rax + rcx]
mov r8d, 3
mov rcx, rsi
lea rdx, [0x18007dadc]
call sub.VCRUNTIME140.dll_memmove
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov byte [rsi + 3], 0
jmp case.default.0x18005062c
lea r9, [0x18007dadc]
jmp 0x180050bc4
mov r8d, 0xa
lea rdx, [rbp + 0x193]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
mov word [rbp + 0x168], r14w
jmp case.default.0x18005062c
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18005115f
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180051154
mov rax, qword [rdi]
mov word [rax + rcx], 0x29
jmp case.0x18005062c.275
mov r9b, 0x29
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180044bb0
mov r10d, dword [rbp + 0x370]
jmp case.0x18005062c.275
mov byte [rbp + 0x166], 0
lea rax, [rbp + 0x1c0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180051192
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call fcn.180063650
mov edx, dword [rsp + 0x30]
mov r10d, dword [rbp + 0x370]
jmp case.default.0x18005062c
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800511eb
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800511dc
mov rax, qword [rdi]
mov edx, dword [rsp + 0x30]
mov word [rax + rcx], 0x28
jmp case.default.0x18005062c
mov r9b, 0x28
jmp 0x180050661
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18005121f
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x180051214
mov rax, qword [rdi]
mov word [rax + rcx], PathMakeUniqueName
jmp case.0x18005062c.275
mov r9b, 0x2c
jmp 0x180051162
xor eax, eax
mov qword [rdi + 0x68], rax
movzx eax, bl
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.180079740
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret