Function at 0x180049820
Capabilities:
Create pipe
Create thread
Enumerate files on windows
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xed0]
sub rsp, 0xfd0
mov rax, qword [0x180079880]
xor rax, rsp
mov qword [rbp + 0xec0], rax
mov rsi, rdx
mov edi, ecx
mov dword [rsp + 0x48], ecx
movdqa xmm0, xmmword [0x180072c40]
movdqa xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
movdqa xmm1, xmm0
movdqa xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
xor r13d, r13d
mov qword [rbp + 0x60], r13
mov word [rbp + 0x68], r13w
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], r13b
mov qword [rbp + 0x30], r13
mov word [rbp + 0x38], r13w
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], r13b
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa0], r13
lea ecx, [r13 + 0x30]
call fcn.1800504a0
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa8], r13
xorps xmm2, xmm2
movsd qword [rbp + 0xb0], xmm2
mov qword [rbp + 0xb8], r13
mov dword [rbp + 0xc0], 1
mov qword [rbp + 0xc8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
movdqa xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], 0xffffffffffffffff
mov dword [rbp + 0x110], r13d
xor eax, eax
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [0x180072c40]
movdqa xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], al
mov word [rbp + 0x180], r13w
mov dword [rbp + 0x184], r13d
mov qword [rbp + 0x188], r13
xorps xmm0, xmm0
movaps xmmword [rbp + 0x190], xmm0
movsd qword [rbp + 0x1a0], xmm2
mov byte [rbp + 0x1a8], al
mov qword [rbp + 0x1ac], r13
lea eax, [rdi - 0xc]
lea rdx, [0x180000000]
cmp edi, eax
jbe 0x180049c0c
lea ebx, [rdi - 0x37]
lea edi, [r13 + 0xc]
mov r14d, 0x2038
lea r15d, [r13 + 0x72]
movabs r12, 0x61727561747365
lea r13d, [rdi + 0x67]
nop dword [rax]
cmp ebx, 0xc
ja case.0x180049a53.1
mov ecx, dword [rdx + rbx*4 + 0x4abe8]
add rcx, rdx
jmp rcx
mov r8d, 6
lea rdx, str.marin
lea rcx, [rbp + 0xadb]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180049bf2
movzx eax, word [0x1800725e0]
mov word [rbp + 0xaea], ax
movzx eax, byte [0x1800725e2]
mov byte [rbp + 0xaec], al
jmp case.0x180049a53.1
mov r8d, 1
lea rdx, [0x1800725e9]
lea rcx, [rbp + 0xaba]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x180049bf2
mov word [rbp + 0xabe], 0x4f
jmp case.0x180049a53.1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], rax
jmp case.0x180049a53.1
mov word [rbp + 0xabb], r14w
jmp case.0x180049a53.1
mov r8d, 3
lea rdx, [0x180072620]
lea rcx, [rbp + 0xaec]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov dword [rbp + 0xaee], 0x642e72
jmp 0x180049bf2
mov word [rbp + 0xad8], r15w
mov r8d, 2
lea rdx, [0x18006fc20]
lea rcx, [rbp + 0xad9]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov word [rbp + 0xada], r13w
jmp 0x180049bf2
mov word [rbp + 0xabd], 0x49
jmp case.0x180049a53.1
lea rcx, [rbp + 0xad8]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180049b53
movzx eax, word [0x18006fc24]
mov word [rcx], ax
mov eax, dword [str.114_27_28_88_WITH_153_AND_OXIA_AND_462]
mov dword [rbp + 0xab0], eax
movzx eax, byte [0x18007262c]
mov byte [rbp + 0xab4], al
mov byte [rbp + 0xab5], 0
mov r8d, 5
lea rdx, [0x18007265c]
lea rcx, [rbp + 0xab0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180049bf2
mov byte [rbp + 0xabd], 0
jmp case.0x180049a53.1
mov r8d, 1
lea rdx, [0x180072678]
lea rcx, [rbp + 0xad8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x180072624]
lea rcx, [rbp + 0xae1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov qword [rbp + 0xae2], r12
mov eax, 0x6e
mov word [rbp + 0xae9], ax
lea rdx, [0x180000000]
dec ebx
sub rdi, 1
jne 0x180049a40
mov edi, dword [rsp + 0x48]
xor r13d, r13d
lea eax, [rdi - 0xb]
mov dword [rsp + 0x54], eax
mov ebx, dword [rsp + 0x54]
cmp edi, eax
jbe 0x18004a926
mov r9d, 0x4154
mov r8d, 0x1bb
lea r10, [0x18000aa20]
movzx esi, word [rsp + 0x48]
mov dword [rsp + 0x50], esi
movzx r15d, byte [rsp + 0x40]
movzx r14d, byte [rsp + 0x40]
mov r13, qword [rbp - 0x18]
movzx r12d, byte [rsp + 0x40]
lea eax, [rdi - 0x39]
cmp eax, 0xa
ja case.default.0x180049c67
mov ecx, dword [rdx + rax*4 + 0x4ac1c]
add rcx, rdx
jmp rcx
lea rax, [rbp + 0x30]
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, qword [rbp - 0x80]
je 0x180049c8c
lea rax, [rbp + 0x30]
mov qword [rdx], rax
add qword [rsp + 0x78], 8
jmp 0x180049c9b
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.1800011d0
mov eax, dword [0x180079820]
mov dword [rsp + 0x48], eax
xor r9d, r9d
lea r8d, [r9 + 0x38]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.180010b70
lea rax, [rsp + 0x70]
mov qword [rbp], rax
mov eax, dword [0x180079820]
mov dword [rbp + 8], eax
mov eax, dword [0x180079824]
mov dword [rbp + 0xc], eax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x20], xmm0
jmp 0x18004a8f5
mov word [rbp + 0xabf], r9w
mov byte [rbp + 0xac1], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xa3
lea rcx, [0x180079778]
call fcn.1800438e0
test al, al
jne 0x18004a33c
mov eax, 0x4e
mov edi, eax
nop dword [rax]
cmp edi, 0x291d2
ja 0x18004a03e
je 0x18004a01e
cmp edi, 0x12fc6
ja 0x180049f28
je 0x180049ed6
cmp edi, 0x980a
ja 0x180049e57
je 0x180049e05
cmp edi, 0x4e
je 0x180049df9
cmp edi, 0x32e2
je 0x180049dbe
cmp edi, 0x6576
jne 0x18004a326
lea rcx, [rbp + 0xa90]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180049d80
movzx eax, word [0x1800726dc]
mov word [rcx], ax
movzx eax, byte [0x1800726de]
mov byte [rcx + 2], al
mov r8d, 0xa
lea rdx, [rbp + 0xa96]
lea ecx, [r8 + 0x18]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
mov eax, 0x4e
jmp 0x18004a326
mov r8d, 2
lea rdx, [0x1800726a4]
lea rcx, [rbp + 0xa90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 0xa
lea rdx, [rbp + 0xa92]
lea ecx, [r8 + 0x2e]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltoa]
mov eax, 0x4e
jmp 0x18004a326
mov byte [rbp + 0xa90], 0
jmp 0x18004a326
mov eax, dword [str.2_36]
mov dword [rbp + 0xa98], eax
movzx eax, word [0x1800726d4]
mov word [rbp + 0xa9c], ax
lea rcx, [rbp + 0xa90]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180049e30
movzx eax, word [0x1800726d8]
mov word [rcx], ax
movzx eax, byte [0x1800726da]
mov byte [rcx + 2], al
mov eax, 0x4e
jmp 0x18004a326
cmp edi, 0xca9e
je 0x180049e7e
cmp edi, 0xfd32
jne 0x18004a326
movups xmm0, xmmword [str.RELOC_A]
movups xmmword [rbp + 0xb40], xmm0
jmp 0x18004a326
mov eax, 0x41
mov word [rbp + 0xa9f], ax
mov eax, 0x42
mov dword [rbp + 0xb38], eax
lea rcx, [rbp + 0xb38]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180049ea0
mov eax, dword [0x1800726b0]
mov dword [rcx], eax
mov eax, dword [0x1800726b4]
mov dword [rbp + 0xb3c], eax
movzx eax, word [0x1800726b8]
mov word [rbp + 0xb40], ax
mov eax, 0x4e
jmp 0x18004a326
mov eax, 0x41
mov dword [rbp + 0xb4e], eax
lea rcx, [rbp + 0xb38]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x180049ef0
mov eax, dword [0x1800726a8]
mov dword [rcx], eax
movzx eax, word [0x1800726ac]
mov word [rcx + 4], ax
movabs rax, 0x3400360048
mov qword [rbp + 0xb54], rax
mov eax, 0x4e
jmp 0x18004a326
cmp edi, 0x1fa16
ja 0x180049fe2
je 0x180049fd6
cmp edi, 0x1625a
je 0x180049fb2
cmp edi, 0x194ee
je 0x180049f8a
cmp edi, 0x1c782
jne 0x18004a326
movsd xmm0, qword [str.TIVE]
movsd qword [rbp + 0xb66], xmm0
movzx eax, word [0x1800726e8]
mov word [rbp + 0xb6e], ax
mov eax, 0x49
mov word [rbp + 0xaf8], ax
mov eax, 0x4e
jmp 0x18004a326
movsd xmm0, qword [str.RELA]
movsd qword [rbp + 0xb5e], xmm0
movzx eax, word [0x1800726a0]
mov word [rbp + 0xb66], ax
mov eax, 0x4e
jmp 0x18004a326
mov r8d, 3
lea rdx, [0x1800726ec]
lea rcx, [rbp + 0xb5a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 0x4e
jmp 0x18004a326
mov word [rbp + 0xafa], ax
jmp 0x18004a326
cmp edi, 0x22caa
je 0x18004a00f
cmp edi, 0x25f3e
jne 0x18004a326
mov dword [rbp + 0xb00], 0x5f0046
mov dword [rbp + 0xb04], 0x440049
jmp 0x18004a326
mov dword [rbp + 0xafc], 0x550042
jmp 0x18004a326
mov dword [rbp + 0xb08], 0x5f0058
mov eax, 0x54
mov word [rbp + 0xb0c], ax
mov eax, 0x4e
jmp 0x18004a326
cmp edi, 0x3f3de
ja 0x18004a15e
je 0x18004a151
cmp edi, 0x35c22
ja 0x18004a10a
je 0x18004a0ea
cmp edi, 0x2c466
je 0x18004a0d9
cmp edi, 0x2f6fa
je 0x18004a0a3
cmp edi, 0x3298e
jne 0x18004a326
mov dword [rbp + 0xb1c], 0x350036
mov dword [rbp + 0xb20], 0x360037
mov ecx, 0x34
mov word [rbp + 0xb24], cx
jmp 0x18004a326
mov dword [rbp + 0xb10], 0x410044
mov eax, 0x42
mov word [rbp + 0xb14], ax
mov dword [rbp + 0xb16], 0x500059
mov eax, 0x5f
mov word [rbp + 0xb1a], ax
mov eax, 0x4e
jmp 0x18004a326
mov ecx, 0x52
mov word [rbp + 0xb0e], cx
jmp 0x18004a326
mov dword [rbp + 0xb26], 0x56005f
mov eax, 0x31
mov word [rbp + 0xb2a], ax
mov eax, 0x4e
jmp 0x18004a326
cmp edi, 0x38eb6
je 0x18004a131
cmp edi, 0x3c14a
jne 0x18004a326
xor eax, eax
mov word [rbp + 0xb32], ax
mov eax, 0x4e
jmp 0x18004a326
mov dword [rbp + 0xb2c], 0x610061
mov eax, 0x31
mov word [rbp + 0xb30], ax
mov eax, 0x4e
jmp 0x18004a326
mov byte [rsp + 0x41], 1
mov r15b, 1
jmp 0x18004a326
cmp edi, 0x4be2e
ja 0x18004a30b
je 0x18004a2c3
cmp edi, 0x42672
je 0x18004a256
cmp edi, 0x45906
je 0x18004a238
cmp edi, 0x48b9a
jne 0x18004a326
movsx eax, si
lea rcx, [rbp + 0xa90]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
mov qword [rbp - 0x30], rax
cmp byte [rsp + 0x41], 0
je 0x18004a1e1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r15d, r15b
test rsi, rsi
mov eax, 0
cmove r15d, eax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xba0]
mov qword [rsp + 0x20], rax
mov r9d, 0x104
lea r8, [rbp + 0xb38]
lea rdx, str.erase_chars
lea rcx, [rbp + 0xaf8]
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov esi, dword [rsp + 0x50]
mov eax, 0x4e
jmp 0x18004a326
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x41]
cmp qword [rbp - 0x38], rcx
cmovne ecx, eax
mov byte [rsp + 0x41], cl
mov eax, 0x4e
jmp 0x18004a326
mov esi, pe_nt_image_headers64
mov dword [rsp + 0x50], esi
movups xmm0, xmmword [str.queryIdx___int_i]
movups xmmword [rbp + 0xb70], xmm0
movups xmm1, xmmword [0x180072708]
movups xmmword [rbp + 0xb80], xmm1
mov eax, dword [0x180072718]
mov dword [rbp + 0xb90], eax
movzx eax, word [0x18007271c]
mov word [rbp + 0xb94], ax
lea rax, [rbp + 0xb70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x38], rax
mov eax, 0x4e
jmp 0x18004a326
test r15b, r15b
je 0x18004a326
movsx rax, si
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x50]
mov eax, 0x4e
jmp 0x18004a326
cmp edi, 0x4f0c2
je 0x18004a321
cmp edi, 0x52356
je case.0x180049c67.57
jmp 0x18004a326
mov ebx, 1
add edi, 0x3294
cmp edi, 0x5559c
jbe 0x180049d20
mov edi, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
jmp 0x18004a8f5
xor eax, eax
mov ebx, eax
jmp case.default.0x180049c67
mov r8d, 0x2b
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x230]
call fcn.180035110
mov eax, 0x1bb
mov word [rsp + 0x48], ax
mov r9d, 0x123
lea r8, [rsp + 0x48]
lea rdx, [0x1800797d8]
lea rcx, [rbp + 0x60]
call fcn.18003d1d0
jmp 0x18004a8f5
lea rax, [rbp + 0xad8]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18004a3b0
lea rdx, [rbp + 0xad8]
lea rcx, [rbp + 0x1c0]
call fcn.18003e0a0
mov r8d, 1
lea rdx, [0x18006ff44]
lea rcx, [rbp + 0x1e0]
call fcn.18003e0a0
jmp 0x18004a8f5
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x20]
lea r8, [0x180016710]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x18004a6ea
mov edi, 0x5e
nop dword [rax]
cmp edi, 0x43e
ja 0x18004a587
je 0x18004a578
cmp edi, 0x24e
ja 0x18004a4ea
je 0x18004a4d1
mov eax, edi
sub eax, 0x5e
je 0x18004a4c0
sub eax, 0x7c
je 0x18004a48f
sub eax, 0x7c
je 0x18004a480
cmp eax, 0x7c
jne 0x18004a6d7
mov byte [rbp + 0xad7], 0
mov eax, 0x6166
mov word [rbp + 0xa90], ax
mov dword [rbp + 0xa92], 0x656c69
jmp 0x18004a6d7
mov dword [rbp + 0xad3], 0x65746174
jmp 0x18004a6d7
mov dword [rbp + 0xac9], 0x74616470
mov dword [rbp + 0xacd], 0x795365
mov eax, 0x6e
mov word [rbp + 0xad0], ax
mov eax, 0x5363
mov word [rbp + 0xad1], ax
jmp 0x18004a6d7
mov eax, 0x55
mov word [rbp + 0xac8], ax
jmp 0x18004a6d7
mov dword [rbp + 0xa95], 0x742064
mov dword [rbp + 0xa98], 0x70206f
jmp 0x18004a6d7
mov eax, edi
sub eax, 0x2ca
je 0x18004a551
sub eax, 0x7c
je 0x18004a528
cmp eax, 0x7c
jne 0x18004a6d7
mov eax, 0x70
mov word [rbp + 0xaa4], ax
mov eax, 0x61
mov word [rbp + 0xaa5], ax
mov dword [rbp + 0xaa6], 0x736d6172
jmp 0x18004a6d7
mov eax, 0x6f
mov word [rbp + 0xaa1], ax
mov eax, 0x67
mov word [rbp + 0xaa2], ax
mov eax, 0x20
mov word [rbp + 0xaa3], ax
jmp 0x18004a6d7
mov dword [rbp + 0xa9b], 0x65737261
mov eax, 0x20
mov word [rbp + 0xa9f], ax
mov eax, 0x6c
mov word [rbp + 0xaa0], ax
jmp 0x18004a6d7
mov dword [rbp + 0xaaa], 0x73253a
jmp 0x18004a6d7
cmp edi, 0x6aa
ja 0x18004a66f
je 0x18004a627
mov eax, edi
sub eax, 0x4ba
je 0x18004a618
sub eax, 0x7c
je 0x18004a610
sub eax, 0x7c
je 0x18004a605
cmp eax, 0x7c
jne 0x18004a6d7
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x28], rax
xor edx, edx
mov r8d, 0x140
lea rcx, [rbp + 0xba0]
call sub.VCRUNTIME140.dll_memset
lea r8, [rbp + 0xac8]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x28], 0xffffffffffffffff
jne 0x18004a6d7
mov byte [rsp + 0x40], 0
jmp 0x18004a6d7
xor eax, eax
mov qword [rbp - 8], rax
jmp 0x18004a6d7
mov r14b, 1
jmp 0x18004a6d7
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x42], 1
jmp 0x18004a6d7
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0xa90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov qword [rbp - 0x18], rax
cmp byte [rsp + 0x40], 0
je 0x18004a659
lea r8, [rbp - 8]
xor edx, edx
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
xor eax, eax
mov edx, eax
movzx ecx, byte [rsp + 0x42]
cmp qword [rbp - 0x20], rax
cmovne edx, ecx
mov byte [rsp + 0x42], dl
jmp 0x18004a6d7
mov eax, edi
sub eax, 0x726
je 0x18004a68f
sub eax, 0x7c
je 0x18004a688
cmp eax, 0x7c
je case.0x180049c67.57
jmp 0x18004a6d7
mov ebx, 1
jmp 0x18004a6d7
xor eax, eax
mov ecx, eax
movzx eax, r14b
cmp r13, 0xffffffffffffffff
cmovne ecx, eax
movzx r14d, cl
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp byte [rsp + 0x42], 0
je 0x18004a6b9
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x18004a6d7
lea rdx, [rbp + 0xba0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
add edi, 0x7c
cmp edi, 0x89a
jb 0x18004a420
mov edi, dword [rsp + 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, eax
movzx eax, byte [rsp + 0x43]
cmp qword [rsp + 0x60], rcx
cmovne ecx, eax
mov byte [rsp + 0x43], cl
jmp 0x18004a8f5
mov word [rsp + 0x48], r8w
mov r9d, 0x9c
lea r8, [rbp + 0x30]
lea rdx, [0x1800797f8]
lea rcx, [rsp + 0x48]
call fcn.18001a020
xor eax, eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea ecx, [rax + 0x30]
call fcn.18000edd0
lea rax, [rbp + 0x60]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x78]
cmp rdx, qword [rbp - 0x80]
je 0x18004a76b
lea rax, [rbp + 0x60]
mov qword [rdx], rax
add qword [rsp + 0x78], 8
jmp 0x18004a77a
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.1800011d0
mov edx, 0x104
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
jmp 0x18004a8f5
mov qword [rbp + 0x10], r10
xor r8d, r8d
lea rdx, [rbp + 0x10]
lea ecx, [r8 + 0x28]
call fcn.1800056d0
lea r9, [0x180079770]
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x90]
mov ecx, 0xef
call fcn.1800081c0
mov r9d, 0x34
lea r8, [rbp + 0x90]
xor edx, edx
xor ecx, ecx
call fcn.18004fde0
cmp byte [rsp + 0x43], 0
je 0x18004a8f5
mov edi, 0x41
mov r13, qword [rsp + 0x60]
mov eax, edi
sub eax, 0x3f
je 0x18004a81c
sub eax, 1
je 0x18004a80e
cmp eax, 1
jne 0x18004a8a6
movzx r12d, al
jmp 0x18004a8a6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalLock]
jmp 0x18004a8a6
mov dword [rsp + 0x58], 2
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x18004a842
xor r12b, r12b
jmp 0x18004a89d
test r12b, r12b
je 0x18004a89d
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x10]
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
test eax, eax
je 0x18004a888
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
dec edi
cmp edi, 0x3e
ja 0x18004a7f0
mov r13, qword [rbp - 0x18]
mov edi, dword [rsp + 0x48]
jmp 0x18004a8f5
mov r8d, 0x104
lea rdx, [rbp + 0xdb0]
lea rcx, [rbp + 0xab0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
jmp 0x18004a8f5
mov byte [rsp + 0x43], 1
mov word [rbp + 0x220], r8w
mov edx, 0x66
lea rcx, [rbp + 0x200]
call fcn.180022120
lea r10, [0x18000aa20]
mov r9d, 0x4154
mov r8d, 0x1bb
dec edi
mov dword [rsp + 0x48], edi
cmp edi, dword [rsp + 0x54]
mov esi, dword [rsp + 0x50]
lea rdx, [0x180000000]
ja 0x180049c51
xor r13d, r13d
lea rcx, [rbp + 0x108]
call fcn.180003250
mov rdi, qword [rbp + 0xf0]
test rdi, rdi
je 0x18004a9b1
mov rsi, qword [rbp + 0xf8]
cmp rdi, rsi
je 0x18004a968
nop word [rax + rax]
mov rcx, rdi
call fcn.18003db50
add rdi, 0x20
cmp rdi, rsi
jne 0x18004a950
mov rdi, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0x100]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x18004a997
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004a9ec
mov rcx, rdi
call fcn.1800504dc
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r13
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x18004aa0a
mov rdx, qword [rbp + 0xe8]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a9f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004a9f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800504dc
mov qword [rbp + 0xd8], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
lea rcx, [rbp + 0x98]
call fcn.180003180
nop
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x18004aaa4
mov rsi, qword [rbp - 0x70]
cmp rdi, rsi
je 0x18004aa45
nop dword [rax]
mov rcx, rdi
call fcn.180002a90
add rdi, 0x28
cmp rdi, rsi
jne 0x18004aa30
mov rdi, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
sub rcx, rdi
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x18004aa90
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004aae2
mov rcx, rdi
call fcn.1800504dc
mov qword [rbp - 0x78], r13
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x18004aafb
mov rax, qword [rbp - 0x80]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004aae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004aae9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800504dc
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r13
mov rdx, qword [rbp + 0x52]
cmp rdx, 0x10
jb 0x18004ab39
inc rdx
mov rcx, qword [rbp + 0x3a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ab34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004ab34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800504dc
movdqa xmm0, xmmword [0x180072c40]
movdqu xmmword [rbp + 0x4a], xmm0
mov byte [rbp + 0x3a], 0
mov rdx, qword [rbp + 0x82]
cmp rdx, 0x10
jb 0x18004ab8b
inc rdx
mov rcx, qword [rbp + 0x6a]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ab86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004ab86
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800504dc
movdqa xmm0, xmmword [0x180072c40]
movdqu xmmword [rbp + 0x7a], xmm0
mov byte [rbp + 0x6a], 0
lea rcx, [rbp + 0x230]
call fcn.180002df0
nop
lea rcx, [rbp + 0x1c0]
call fcn.180002ea0
mov eax, ebx
mov rcx, qword [rbp + 0xec0]
xor rcx, rsp
call fcn.180050c90
lea r11, [rsp + 0xfd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret