Function at 0x180049470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea eax, [rcx + 0xa]
mov rsi, r8
mov dword [rsp + 0x34], eax
mov rdi, rdx
mov ebp, ecx
cmp ecx, eax
jae case.0x1800494e6.67
movzx ebx, byte [rsp + 0x80]
lea rdx, [0x180000000]
mov r12d, dword [rsp + 0x80]
mov r14d, dword [rsp + 0x80]
mov r13d, dword [rsp + 0x80]
nop dword [rax]
lea eax, [rbp - 0x38]
cmp eax, 0x18
ja case.0x1800494e6.59
mov ecx, dword [rdx + rax*4 + 0x49874]
add rcx, rdx
jmp rcx
mov eax, dword [rsi + 0x10]
mov dword [rsi + 8], eax
jmp case.0x1800494e6.59
mov eax, 0x2a
cmp eax, 0x2a
jne 0x180049521
mov edi, dword [rsi + 8]
lea r8d, [rax + 0x6a]
mov rdx, rsi
xor ecx, ecx
call fcn.18003ebc0
test eax, eax
js 0x18004985b
mov eax, 0x2a
mov dword [rsi + 8], edi
lea ebp, [rax + 0x25]
add eax, 0x15fc
cmp eax, 0x15fc
jbe 0x1800494f8
mov rdi, qword [rsp + 0x88]
mov dword [rsp + 0x80], 1
jmp 0x18004982e
movzx ecx, byte [rsi]
lea eax, [rcx - 8]
test al, 0x7f
jne 0x180049558
cmp dword [rdi], 0x10
jb 0x180049843
sub cl, 0x18
test cl, 0x7f
jne 0x180049569
cmp dword [rdi], 0x28
jb 0x180049843
mov byte [rsp + 0x80], 0
jmp case.0x1800494e6.59
mov ecx, 0x2d
nop dword [rax + rax]
mov eax, ecx
sub eax, 0x2c
je 0x1800495af
cmp eax, 1
jne 0x1800495bb
mov eax, dword [rsi + 8]
mov rdx, rsi
mov ecx, reloc.SHELL32.dll_ILAppendID
mov dword [rsp + 0x24], eax
call fcn.180073c90
test eax, eax
js 0x18004985b
mov ecx, 0x2d
jmp 0x1800495bb
mov eax, dword [rsp + 0x24]
mov ebp, 0x4c
mov dword [rsi + 8], eax
dec ecx
cmp ecx, 0x2b
ja 0x180049580
mov eax, dword [rsi + 8]
mov edi, 0xd7
mov dword [rsi + 0x10], eax
mov eax, dword [rsi + 0xc]
mov dword [rsi + 8], eax
mov eax, edi
sub eax, 0xd7
je 0x18004961b
sub eax, 3
je 0x1800495f6
sub eax, 3
je 0x180049607
cmp eax, 3
jne 0x180049623
mov eax, dword [rsi + 0xc]
sub eax, r12d
mov dword [rsi + 8], eax
jmp 0x180049623
mov rdx, rsi
mov ecx, 0x8e
call fcn.18003e210
test eax, eax
jne 0x180049613
mov edi, 0xdd
mov ebp, 0x4c
jmp 0x180049623
js 0x18004985b
jmp 0x180049623
mov r12d, dword [rsi + 0xc]
sub r12d, dword [rsi + 8]
add edi, 3
cmp edi, 0xe3
jb 0x1800495d3
mov r15d, 0xbe
nop dword [rax]
nop dword [rax + rax]
mov eax, r15d
sub eax, 0xbe
je 0x18004971c
sub eax, 0x3c
je 0x180049661
cmp eax, 0x3c
je 0x180049706
jmp 0x180049724
mov edi, 0x2d
cmp edi, 0x2d
je 0x1800496e4
cmp edi, 0x1b6c
je 0x1800496c0
cmp edi, 0x36ab
je 0x1800496a8
cmp edi, 0x51ea
jne 0x1800496ec
mov eax, dword [rsi + 0xc]
mov ebp, 0x4c
sub eax, r14d
mov rcx, rsi
mov dword [rsi + 8], eax
lea edx, [rbp + 0x24]
call fcn.18007ce90
test eax, eax
je 0x180049706
js 0x18004985b
jmp 0x1800496ec
mov rdx, rsi
mov ecx, 0x74
call fcn.180076be0
test eax, eax
jne 0x180049700
mov edi, 0x36ab
jmp 0x1800496ec
mov edx, 0x6f
mov rcx, rsi
call fcn.18006a930
test eax, eax
jne 0x180049700
lea ebp, [rax + 0x4c]
mov edi, 0x1b6c
mov eax, dword [rsi + 0xc]
sub eax, r14d
mov dword [rsi + 8], eax
jmp 0x1800496ec
mov r14d, dword [rsi + 0xc]
sub r14d, dword [rsi + 8]
add edi, 0x1b3f
cmp edi, 0x6cfc
jbe 0x180049666
jmp 0x180049724
js 0x18004985b
mov eax, dword [rsi + 0xc]
mov ebp, 0x4c
sub eax, r13d
mov r15d, 0x136
mov dword [rsi + 8], eax
jmp 0x180049724
mov r13d, dword [rsi + 0xc]
sub r13d, dword [rsi + 8]
add r15d, 0x3c
cmp r15d, 0x172
jb 0x180049640
mov rdi, qword [rsp + 0x88]
jmp 0x18004982e
mov ecx, dword [rsi]
lea r9, [rsp + 0x28]
mov eax, dword [rsi + 4]
and ecx, 0x29ce5c
and eax, 0x870804
xor r8d, r8d
xor ecx, eax
mov edx, 0xde
mov eax, dword [rsp + 0x20]
xor eax, ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], eax
call fcn.1800301f0
mov ecx, dword [rsi + 4]
add ecx, ecx
or ecx, eax
mov eax, dword [rsi]
mov dword [rsi + 4], eax
mov dword [rsi], ecx
jmp 0x18004982e
mov edi, SHSetFolderPathW
nop
mov eax, edi
sub eax, 0xe4
je 0x1800497a0
cmp eax, 0x53
je 0x1800497be
jmp 0x1800497da
mov eax, dword [rsi + 0xc]
xor edx, edx
sub eax, dword [rsi + 8]
mov r9, rsi
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea ecx, [rdx + 0x22]
call fcn.180051fb0
test eax, eax
jne 0x1800497d4
mov eax, dword [rsi + 0xc]
mov edi, 0x137
sub eax, dword [rsp + 0x30]
mov ebp, 0x4d
mov dword [rsi + 8], eax
jmp 0x1800497da
js 0x18004985b
add edi, 0x53
cmp edi, 0x18a
jb 0x180049790
mov rdi, qword [rsp + 0x88]
jmp 0x18004982e
mov eax, dword [rsi]
lea rcx, [rsp + 0x28]
mov edx, 0xf9
mov dword [rsp + 0x28], eax
call fcn.18006e390
xor r15d, r15d
mov rbx, rax
mov rax, qword [rsp + 0x98]
cmp dword [rax], r15d
movzx eax, bl
setne r15b
and r15d, eax
xor eax, eax
cmp byte [rdi], al
setne al
xor r15d, eax
mov dword [rsp + 0x20], r15d
lea rdx, [0x180000000]
inc ebp
cmp ebp, dword [rsp + 0x34]
jb 0x1800494d0
jmp case.0x1800494e6.67
mov byte [rsp + 0x80], 1
jmp case.0x1800494e6.67
mov byte [rsp + 0x80], bl
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret