Function at 0x18006fac0
Capabilities:
Create thread

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x518]
sub rsp, 0x618
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rbp + 0x508], rax
mov qword [rbp - 0x68], r9
mov qword [rbp - 0x50], r8
mov qword [rsp + 0x68], rdx
mov qword [rbp - 0x28], rcx
movdqa xmm0, xmmword [0x1800d3f80]
movdqa xmmword [rbp + 0x220], xmm0
mov byte [rbp + 0x210], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
movdqa xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
movdqa xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], 0
xor ebx, ebx
mov qword [rbp + 0xb0], rbx
mov word [rbp + 0xb8], bx
movdqu xmmword [rbp + 0xca], xmm0
mov byte [rbp + 0xba], bl
mov qword [rbp + 0x80], rbx
mov word [rbp + 0x88], bx
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], bl
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0xf0], rbx
lea ecx, [rbx + 0x30]
call fcn.1800c0594
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf8], rbx
xorps xmm2, xmm2
movsd qword [rbp + 0x100], xmm2
mov qword [rbp + 0x108], rbx
mov dword [rbp + 0x110], 1
mov qword [rbp + 0x118], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x130], xmm1
movdqa xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], 0xffffffffffffffff
mov dword [rbp + 0x160], ebx
xor eax, eax
movups xmmword [rbp + 0x168], xmm0
movups xmmword [rbp + 0x178], xmm0
movups xmmword [rbp + 0x188], xmm0
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], rax
movdqa xmm0, xmmword [0x1800d3f80]
movdqa xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], al
mov word [rbp + 0x1d0], bx
mov dword [rbp + 0x1d4], ebx
mov qword [rbp + 0x1d8], rbx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1e0], xmm0
movsd qword [rbp + 0x1f0], xmm2
mov byte [rbp + 0x1f8], al
mov qword [rbp + 0x1fc], rbx
mov r11d, dword [rbp + 0x580]
mov esi, r11d
mov dword [rsp + 0x64], r11d
lea eax, [r11 + 0x3da]
lea edi, [rbx + 2]
lea rcx, [0x180000000]
mov r15, qword [rbp - 0x68]
mov ebx, dword [rsp + 0x54]
cmp r11d, eax
jae 0x180070341
mov r9d, dword [rsp + 0x54]
mov dword [rsp + 0x60], r9d
mov r10d, dword [rsp + 0x54]
mov dword [rbp - 0x80], r10d
mov edx, dword [rsp + 0x54]
mov dword [rsp + 0x5c], edx
mov r14d, dword [rbp - 0x74]
mov r12d, dword [rbp - 0x74]
mov r13d, dword [rbp - 0x74]
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x51], al
mov r8, qword [rbp - 0x68]
mov qword [rbp - 0x70], r8
nop dword [rax]
cmp esi, 0x17c
ja 0x18007007c
je 0x18007005f
lea eax, [rsi - 0x6b]
cmp eax, 0xe8
ja case.default.0x18006fd59
movzx eax, byte [rcx + rax + 0x70db0]
mov ecx, dword [rcx + rax*4 + 0x70d80]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, 0x6f
mov word [rbp + 0x500], ax
mov eax, 0x6d
mov word [rbp + 0x501], ax
movzx eax, word [0x1800d0c04]
mov word [rbp + 0x4d0], ax
movzx eax, byte [0x1800d0c06]
mov byte [rbp + 0x4d2], al
jmp case.0x18006fd59.118
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
mov r9, qword [rsp + 0x68]
mov r8d, 0x18
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
mov dword [rax + 0x20], 1
jmp 0x18007027f
mov rax, qword [rbp - 0x28]
mov r9d, dword [rax]
mov r8, qword [rsp + 0x68]
sub r9d, dword [r8]
inc r9d
mov dword [rsp + 0x60], r9d
mov dword [rbp - 0x80], 0
mov r15, qword [rbp + 0x70]
mov rcx, qword [rbp - 0x50]
mov rcx, qword [rcx]
mov rdx, qword [r8]
cmp rdx, qword [rcx + 0x20]
jb 0x18006fe0a
mov rax, qword [rax]
cmp rax, qword [rcx + 0x28]
ja 0x18006fe0a
cmp rdx, rax
jbe 0x18007028b
mov ebx, 0x16
mov edi, ebx
lea rcx, [rbp + 0x158]
call fcn.1800330b0
mov rbx, qword [rbp + 0x140]
test rbx, rbx
je 0x180070b8a
mov rsi, qword [rbp + 0x148]
cmp rbx, rsi
je 0x18006fe58
nop dword [rax]
mov rcx, rbx
call fcn.1800462c0
add rbx, 0x20
cmp rbx, rsi
jne 0x18006fe40
mov rbx, qword [rbp + 0x140]
mov r8, qword [rbp + 0x150]
sub r8, rbx
sar r8, 5
mov rdx, rbx
lea rcx, [rbp + 0x140]
call fcn.180060080
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x140], xmm0
xor r14d, r14d
mov qword [rbp + 0x150], r14
jmp 0x180070b8d
mov r8d, 3
lea rdx, [0x1800d0c08]
lea rcx, [rbp + 0x4d2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x75
mov word [rbp + 0x4d4], ax
jmp 0x18007027f
mov rax, qword [rsp + 0x68]
lea rcx, [0x180000000]
test rax, rax
je 0x18006fee3
mov qword [0x1800e2248], rax
lea rax, [0x180060710]
mov qword [rsp + 0x68], rax
jmp case.default.0x18006fd59
lea rax, [0x1800603c0]
mov qword [rsp + 0x68], rax
jmp case.default.0x18006fd59
cmp r9d, 8
jb case.0x18006fd59.118
nop
test r15b, 7
je case.0x18006fd59.118
mov ecx, 0x107
nop
mov eax, ecx
sub eax, 0x107
je 0x18006ff3a
sub eax, 1
je 0x18006ff2c
cmp eax, 1
jne 0x18006ff44
add edx, 8
mov dword [rsp + 0x5c], edx
jmp 0x18006ff44
inc r15
add r9d, 0xfffffff8
mov dword [rsp + 0x60], r9d
jmp 0x18006ff44
cmp byte [r15], 0xff
jne 0x1800702b5
inc ecx
cmp ecx, 0x10a
jb 0x18006ff10
cmp r9d, 8
jae 0x18006ff00
jmp case.0x18006fd59.118
mov r15, qword [rbp - 0x50]
mov rax, qword [r15]
cmp dword [rax + 0x38], 0
jne 0x18006fe0a
test dl, 7
je 0x18006ffc1
nop
test r9d, r9d
je 0x18006ffb6
mov esi, edx
mov qword [rbp - 0x30], rsi
mov r9, qword [r8]
lea r8, [rbp - 0x30]
mov edx, 0x78
xor ecx, ecx
call fcn.1800618a0
test eax, eax
je 0x180070329
mov edx, dword [rsp + 0x5c]
inc edx
mov dword [rsp + 0x5c], edx
mov r9d, dword [rsp + 0x60]
dec r9d
mov dword [rsp + 0x60], r9d
test dl, 7
mov r8, qword [rbp - 0x70]
jne 0x18006ff70
mov r11d, dword [rbp + 0x580]
mov esi, dword [rsp + 0x64]
test r9d, r9d
je 0x18006fe11
mov r15d, edx
shr r15, 3
add r15, qword [r8]
jmp case.0x18006fd59.118
mov rax, qword [rbp - 0x50]
mov rax, qword [rax]
mov r8, qword [rax + 0x50]
mov qword [rbp - 0x70], r8
jmp case.0x18006fd59.118
mov eax, 0x76
mov word [rbp + 0x4f0], ax
mov dword [rbp + 0x4f1], 0x65756c61
mov eax, 0x6d
mov word [rbp + 0x4f5], ax
jmp case.0x18006fd59.118
mov rax, qword [rbp - 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx]
sub edx, dword [rax + 0x20]
mov dword [rsp + 0x5c], edx
jmp case.0x18006fd59.118
mov dword [rbp + 0x4f6], 0x62657779
mov dword [rbp + 0x4fa], 0x746973
mov eax, 0x65
mov word [rbp + 0x4fd], ax
mov eax, 0x632e
mov word [rbp + 0x4fe], ax
jmp case.0x18006fd59.118
mov dword [rbp + 0x4d5], 0x49746e
movzx eax, word [0x1800c7b2c]
mov word [rbp + 0x4d8], ax
jmp case.default.0x18006fd59
mov eax, esi
sub eax, 0x1b6
je 0x180070265
sub eax, 0x3a
je 0x18007021d
sub eax, 0x3a
je 0x180070205
sub eax, 0x3a
je 0x1800701f2
cmp eax, 0x3a
jne case.default.0x18006fd59
mov dword [rsp + 0x20], 0x54
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800dbdb8]
xor ecx, ecx
call fcn.18007b4e0
test al, al
jne 0x1800701ac
mov esi, 0x73
nop word [rax + rax]
mov eax, esi
sub eax, 0x6f
je case.0x18007041c.109
sub eax, 1
je 0x180070152
sub eax, 1
je 0x18007013d
sub eax, 1
je 0x180070131
cmp eax, 1
jne 0x18007019d
mov qword [rbp - 0x58], 0
mov eax, 8
mov word [rbp - 0x56], ax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x2c0]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x7c], 0
jmp 0x18007019d
mov r14d, 4
lea r12d, [r14 + 0x3c]
jmp 0x18007019d
mov dword [rbp - 0x78], 0
xor eax, eax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x78], eax
xor r13d, r13d
jmp 0x18007019d
lea r8, [rbp - 0x74]
mov edx, r12d
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.ADVAPI32.dll_QueryAllTracesA]
xor ecx, ecx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], r13d
lea rax, [rbp + 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp - 0x78]
mov r8d, r14d
mov edx, dword [rbp - 0x7c]
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_AddAuditAccessObjectAce]
mov ebx, 1
dec esi
cmp esi, 0x6e
ja 0x1800700e0
mov esi, dword [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov byte [rsp + 0x51], 1
lea rax, [rbp + 0x4f0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800701d0
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x210]
call fcn.180048670
jmp 0x18007027f
movzx eax, word [0x1800caef0]
mov word [rbp + 0x4e7], ax
jmp case.default.0x18006fd59
mov eax, dword [str.2Pri]
mov dword [rbp + 0x4e0], eax
mov dword [rbp + 0x4e4], 0x746176
jmp case.default.0x18006fd59
movzx eax, word [0x1800d0c0c]
mov word [rbp + 0x4db], ax
movzx eax, word [0x1800d0c10]
mov word [rbp + 0x4dd], ax
movzx eax, byte [0x1800d0c12]
mov byte [rbp + 0x4df], al
lea rcx, [rbp + 0x4d0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180070250
movzx eax, word [0x1800ced80]
mov word [rcx], ax
jmp case.0x18006fd59.118
mov r8d, 3
lea rdx, [0x1800d0c14]
lea rcx, [rbp + 0x4d9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r11d, dword [rbp + 0x580]
mov r9d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
mov r8, qword [rbp - 0x70]
lea rcx, [0x180000000]
add esi, 0x3a
mov dword [rsp + 0x64], esi
lea eax, [r11 + 0x3da]
cmp esi, eax
jae 0x180070369
jmp 0x18006fd20
mov dword [rbp - 0x80], 1
mov edx, dword [rsp + 0x54]
mov qword [rsp + 0x68], rdx
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x7c], eax
mov ecx, dword [rsp + 0x54]
mov dword [rbp - 0x60], ecx
movzx r9d, byte [rsp + 0x51]
mov byte [rsp + 0x50], r9b
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x48], eax
mov r14, qword [rbp - 0x68]
mov qword [rbp - 0x40], r14
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x70], eax
mov r13d, dword [rsp + 0x54]
mov qword [rbp - 0x58], r13
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x64], eax
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x52], al
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x78], eax
mov esi, dword [rsp + 0x54]
mov r12d, dword [rsp + 0x54]
mov ecx, 0x6b
jmp 0x180070b53
mov rax, qword [r15]
mov rax, qword [rax + 0x20]
add rax, rsi
mov rcx, qword [rbp - 0x68]
mov qword [rcx], rax
xor ebx, ebx
jmp case.0x18007041c.109
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x80], eax
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x5c], eax
movzx eax, byte [rsp + 0x51]
mov byte [rsp + 0x51], al
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x58], r11d
mov edx, dword [rsp + 0x54]
mov qword [rsp + 0x68], rdx
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x7c], eax
mov ecx, dword [rsp + 0x54]
mov dword [rbp - 0x60], ecx
movzx r9d, byte [rsp + 0x51]
mov byte [rsp + 0x50], r9b
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x48], eax
mov r14, qword [rbp - 0x68]
mov qword [rbp - 0x40], r14
mov r8d, dword [rsp + 0x54]
mov dword [rsp + 0x70], r8d
mov r13d, dword [rsp + 0x54]
mov qword [rbp - 0x58], r13
mov r11d, dword [rsp + 0x54]
mov dword [rsp + 0x64], r11d
movzx r10d, byte [rsp + 0x51]
mov byte [rsp + 0x52], r10b
mov eax, dword [rsp + 0x54]
mov dword [rbp - 0x78], eax
mov esi, dword [rsp + 0x54]
mov r12d, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x58]
mov eax, dword [rbp + 0x580]
add eax, 0x11
cmp ecx, eax
jae case.0x18007041c.109
mov eax, dword [rsp + 0x58]
add eax, 0xffffff95
cmp eax, 0x36
ja case.0x18007041c.110
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x70ee0]
mov ecx, dword [rcx + rax*4 + 0x70e9c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rdx, [rbp + 0xe0]
mov ecx, 0x1c
call fcn.180072bd0
cmp byte [rsp + 0x51], 0
je 0x180070b44
mov r14d, 0x80
mov rcx, qword [rbp - 0x38]
mov edi, dword [rbp - 0x7c]
mov r13d, dword [rbp - 0x60]
nop dword [rax + rax]
mov eax, r14d
sub eax, 0x80
je 0x180070495
cmp eax, 1
jne 0x18007049f
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x70]
mov r8d, edi
mov edx, r13d
call sub.RPCRT4.dll_MesBufferHandleReset
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x18007049f
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rbp - 0x38]
jmp 0x18007049f
xor edi, edi
lea r13d, [rdi + 1]
mov qword [rbp + 0x70], rdi
inc r14d
cmp r14d, 0x82
jb 0x180070450
mov dword [rbp - 0x60], r13d
mov dword [rbp - 0x7c], edi
mov edi, 2
mov r13, qword [rbp - 0x58]
mov r14, qword [rbp - 0x40]
jmp 0x180070b44
lea rax, [0x180036f30]
mov qword [rsp + 0x78], rax
xor r9d, r9d
lea r8, [rsp + 0x78]
xor edx, edx
lea ecx, [rdx + 0x20]
call fcn.180033d50
jmp 0x180070b44
test r9b, r9b
je 0x180070546
mov ebx, 0x100
cmp ebx, 0x100
je 0x180070507
cmp ebx, 0x6500
jne 0x18007052d
mov rcx, qword [rbp - 0x30]
jmp 0x180070523
mov qword [rbp - 0x30], 0
lea r8, [rbp - 0x30]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov dword [rbp - 0x48], eax
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x18007052d
call sub.RPCRT4.dll_MesHandleFree
add ebx, 0x6400
cmp ebx, 0xc800
jbe 0x1800704f1
mov rdx, qword [rsp + 0x68]
movzx r9d, byte [rsp + 0x50]
xor ebx, ebx
jmp case.0x18007041c.110
mov qword [rbp + 0x40], 0
mov eax, 0x1bb
mov word [rsp + 0x78], ax
lea r9, [rsp + 0x78]
mov r8d, 0x83
lea rdx, [rbp + 0x80]
lea rcx, [0x1800dbe38]
call fcn.180053cb0
jmp 0x180070b44
lea rax, [rbp + 0x80]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 8]
cmp rax, qword [rbp]
je 0x1800705a8
lea rcx, [rbp + 0x80]
mov qword [rax], rcx
add qword [rbp - 8], 8
jmp 0x1800705b9
lea r8, [rbp - 0x48]
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x10]
call fcn.180031030
lea r9, [rbp + 0x40]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov dword [rbp - 0x48], eax
mov qword [rbp - 0x38], 0
jmp 0x180070b44
mov r8d, 1
lea rdx, [0x1800cf66c]
lea rcx, [rbp + 0x230]
call fcn.180048670
mov eax, 0x1bb
mov word [rbp + 0x270], ax
mov r9b, 1
mov byte [rsp + 0x50], r9b
jmp 0x180070b4a
test r14, r14
jne 0x1800707fb
nop dword [rax]
nop dword [rax + rax]
cmp r14d, 0xe7
ja case.0x180070647.1
lea rdx, [0x180000000]
movzx eax, byte [rdx + r14 + 0x70f4c]
mov ecx, dword [rdx + rax*4 + 0x70f18]
add rcx, rdx
jmp rcx
mov dword [rbp - 0x20], 0
jmp case.0x180070647.1
lea rdx, [rbp - 0x74]
mov ecx, r8d
call qword [sym.imp.ADVAPI32.dll_CredGetSessionTypes]
mov r8d, dword [rsp + 0x70]
movzx r10d, byte [rsp + 0x52]
mov r11d, dword [rsp + 0x64]
jmp case.0x180070647.1
mov qword [rbp - 0x28], 0
lea r9, [rbp - 0x28]
lea r8, [rbp - 0x20]
mov edx, r13d
lea rcx, [rbp + 0x4c0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov r11d, eax
mov dword [rsp + 0x64], eax
nop dword [rax]
mov r8d, dword [rsp + 0x70]
movzx r10d, byte [rsp + 0x52]
jmp case.0x180070647.1
mov eax, 0x3676
mov word [rbp + 0x4cb], ax
mov byte [rbp + 0x4cd], 0
mov r10b, 1
mov byte [rsp + 0x52], r10b
jmp case.0x180070647.1
lea rax, [rbp + 0x4c0]
mov r13, 0xffffffffffffffff
nop
inc r13
cmp byte [rax + r13], 0
jne 0x1800706e0
mov qword [rbp - 0x58], r13
mov r8d, 1
mov dword [rsp + 0x70], r8d
jmp case.0x180070647.1
mov dword [rbp - 0x74], 0
jmp case.0x180070647.1
mov ebx, 1
jmp case.0x180070647.1
mov eax, dword [0x1800d0c20]
mov dword [rbp + 0x4c0], eax
movzx eax, byte [0x1800d0c24]
mov byte [rbp + 0x4c4], al
jmp case.0x180070647.1
movzx eax, word [0x1800d0c36]
mov word [rbp + 0x4c8], ax
movzx eax, byte [0x1800d0c38]
mov byte [rbp + 0x4ca], al
jmp case.0x180070647.1
xor ecx, ecx
movzx eax, r10b
test r11d, r11d
cmove ecx, eax
movzx r10d, cl
mov byte [rsp + 0x52], cl
test cl, cl
je case.0x180070647.1
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x78]
mov edx, r13d
lea rcx, [rbp + 0x4c0]
call sub.RPCRT4.dll_MesDecodeBufferHandleCreate
mov r11d, eax
mov dword [rsp + 0x64], eax
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1800707a1
call sub.RPCRT4.dll_MesHandleFree
mov r11d, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1800706a0
call sub.RPCRT4.dll_MesHandleFree
mov r8d, dword [rsp + 0x70]
movzx r10d, byte [rsp + 0x52]
mov r11d, dword [rsp + 0x64]
jmp case.0x180070647.1
movzx eax, word [0x1800d0c55]
mov word [rbp + 0x4c5], ax
movzx eax, byte [0x1800d0c57]
mov byte [rbp + 0x4c7], al
add r14d, 0x15
lea eax, [r14 + 0x128]
cmp eax, 0x224
jb 0x180070620
mov r14, qword [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
movzx eax, byte [rsp + 0x50]
cmp dword [rbp - 0x48], ecx
cmove ecx, eax
movzx r9d, cl
mov byte [rsp + 0x50], cl
jmp 0x180070b4a
mov eax, dword [0x1800dbe60]
mov dword [rsp + 0x78], eax
lea r9, [rsp + 0x78]
mov r8d, 0xfe
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.1800787a0
lea rax, [rbp - 0x10]
mov qword [rbp + 0x50], rax
mov eax, dword [0x1800dbe60]
mov dword [rbp + 0x58], eax
mov eax, dword [0x1800dbe64]
mov dword [rbp + 0x5c], eax
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x60], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x60]
lea r8, [0x18003dfd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
mov qword [rbp - 0x40], rax
jmp 0x180070b44
xor eax, eax
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 0x22]
lea rcx, [rbp - 0x10]
call fcn.18008ffe0
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x78], rax
mov rdx, qword [rbp - 8]
cmp rdx, qword [rbp]
je 0x1800708d9
lea rax, [rbp + 0xb0]
mov qword [rdx], rax
add qword [rbp - 8], 8
jmp 0x180070b44
lea r8, [rsp + 0x78]
lea rcx, [rbp - 0x10]
call fcn.180031030
jmp 0x180070b44
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov ecx, 0x12a
call fcn.18003f690
lea r8, [rbp + 0x210]
mov edx, 0x6e
lea rcx, [rbp + 0x280]
call fcn.180054b50
lea rax, [rbp + 0x4d0]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x180070926
mov qword [rsp + 0x68], rdx
movzx r9d, byte [rsp + 0x50]
jmp case.0x18007041c.110
mov eax, 0x1bb
mov word [rsp + 0x78], ax
mov dword [rsp + 0x20], 0xc2
lea r9, [0x1800dbe18]
lea r8, [rbp + 0xb0]
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x4f0]
call fcn.180085890
jmp 0x180070b44
lea rax, [0x1800dbdb0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xe0]
lea r8, [rbp - 0x10]
mov edx, 0xaf
xor ecx, ecx
call fcn.18004cb00
xor ecx, ecx
movzx eax, byte [rsp + 0x51]
cmp dword [rbp - 0x78], ecx
cmove ecx, eax
mov byte [rsp + 0x51], cl
jmp 0x180070b44
cmp dword [rbp - 0x80], 0
jne 0x180070ad0
mov ecx, 0xaf
mov r13d, dword [rsp + 0x60]
mov r14d, dword [rsp + 0x5c]
cmp ecx, 0x8133
ja 0x180070a4b
je 0x180070a46
cmp ecx, 0xaf
je 0x180070a1f
cmp ecx, 0x20d0
je 0x180070a80
cmp ecx, 0x40f1
je 0x180070a0f
cmp ecx, 0x6112
jne 0x180070aac
sub r12d, esi
shl r12d, 6
add r14d, r12d
mov r12d, r13d
shr r12d, 3
jmp 0x180070aac
mov eax, esi
sub eax, r12d
shl eax, 6
add r13d, eax
jmp 0x180070aac
mov r12d, r13d
shr r12d, 6
mov esi, r12d
test r12d, r12d
je 0x180070a3f
nop
cmp qword [r15], 0xffffffffffffffff
jne 0x180070a3f
add r15, 8
add esi, 0xffffffff
jne 0x180070a30
mov ecx, 0xaf
jmp 0x180070aac
mov esi, r12d
jmp 0x180070aac
cmp ecx, 0xa154
je 0x180070a8a
cmp ecx, 0xc175
je 0x180070aa7
cmp ecx, 0xe196
je 0x180070a80
cmp ecx, 0x101b7
jne 0x180070aac
mov eax, esi
sub eax, r12d
lea r13d, [r13 + rax*8]
mov eax, r12d
sub eax, esi
lea r14d, [r14 + rax*8]
jmp 0x180070aac
mov dword [rsp + 0x58], 0x6c
jmp 0x180070aac
test esi, esi
je 0x180070aac
nop
cmp byte [r15], 0xff
jne 0x180070aa0
inc r15
add esi, 0xffffffff
jne 0x180070a90
jmp 0x180070aac
mov dword [rbp - 0x80], 1
mov ecx, 0xc175
add ecx, 0x2021
cmp ecx, 0x12129
jbe 0x1800709c7
mov dword [rsp + 0x5c], r14d
mov dword [rsp + 0x60], r13d
mov r13, qword [rbp - 0x58]
mov r14, qword [rbp - 0x40]
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x180070b22
nop dword [rax + rax]
dec eax
mov dword [rsp + 0x60], eax
mov ebx, dword [rsp + 0x5c]
mov qword [rsp + 0x78], rbx
mov rax, qword [rbp - 0x70]
mov r9, qword [rax]
lea r8, [rsp + 0x78]
mov edx, 0x78
xor ecx, ecx
call fcn.1800618a0
test eax, eax
je 0x180070b6e
inc dword [rsp + 0x5c]
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x180070ae0
mov rdx, qword [rsp + 0x68]
movzx r9d, byte [rsp + 0x50]
dec eax
mov dword [rsp + 0x60], eax
mov ebx, edi
jmp case.0x18007041c.110
lea r9, [rbp - 0x38]
lea r8, [rsp + 0x54]
lea rcx, [rbp + 0x4d0]
call sub.RPCRT4.dll_MesEncodeFixedBufferHandleCreate
mov dword [rbp - 0x78], eax
movzx r9d, byte [rsp + 0x50]
mov rdx, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x58]
inc ecx
mov dword [rsp + 0x58], ecx
mov r8d, dword [rsp + 0x70]
movzx r10d, byte [rsp + 0x52]
mov r11d, dword [rsp + 0x64]
jmp 0x1800703db
mov rax, qword [rbp - 0x50]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
add rax, rbx
mov rcx, qword [rbp - 0x68]
mov qword [rcx], rax
xor edi, edi
jmp 0x18006fe11
xor r14d, r14d
mov rdx, qword [rbp + 0x128]
test rdx, rdx
je 0x180070bc5
mov r8, qword [rbp + 0x138]
sub r8, rdx
sar r8, 4
lea rcx, [rbp + 0x128]
call fcn.18005ffe0
mov qword [rbp + 0x128], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x130], xmm0
lea rcx, [rbp + 0xe8]
call fcn.180032fe0
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x180070c63
mov rsi, qword [rbp + 0x10]
cmp rbx, rsi
je 0x180070bfd
mov rcx, rbx
call fcn.1800328f0
add rbx, 0x28
cmp rbx, rsi
jne 0x180070be8
mov rbx, qword [rbp + 8]
mov rcx, qword [rbp + 0x18]
sub rcx, rbx
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x180070c4f
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180070c4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800c05d0
mov qword [rbp + 8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x180070c8c
mov r8, qword [rbp]
sub r8, rdx
sar r8, 3
lea rcx, [rbp - 0x10]
call fcn.18005ff90
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov rdx, qword [rbp + 0xa2]
cmp rdx, 0x10
jb 0x180070cd0
inc rdx
mov rcx, qword [rbp + 0x8a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180070ccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180070ccb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800c05d0
movdqa xmm0, xmmword [0x1800d3f80]
movdqu xmmword [rbp + 0x9a], xmm0
mov byte [rbp + 0x8a], 0
mov rdx, qword [rbp + 0xd2]
cmp rdx, 0x10
jb 0x180070d2b
inc rdx
mov rcx, qword [rbp + 0xba]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180070d26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180070d26
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800c05d0
movdqa xmm0, xmmword [0x1800d3f80]
movdqu xmmword [rbp + 0xca], xmm0
mov byte [rbp + 0xba], 0
lea rcx, [rbp + 0x280]
call fcn.180032c50
nop
lea rcx, [rbp + 0x210]
call fcn.180032d00
mov eax, edi
mov rcx, qword [rbp + 0x508]
xor rcx, rsp
call fcn.1800c0ae0
add rsp, 0x618
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret