Function at 0x18007e6b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x1804762b8]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov r10, qword [rsp + 0x50]
mov eax, edx
mov r13, qword [rbp + 0x340]
mov r15, r9
mov dword [rbp - 0x70], edx
mov r11, r8
mov rdx, qword [rbp + 0x348]
mov r12, rcx
lea r14d, [rax + 0xd]
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x78], r8
mov esi, eax
mov qword [rbp - 0x50], rdx
lea r9, [0x180000000]
mov qword [rbp - 0x78], r10
cmp eax, r14d
jae 0x18007e969
mov r15, qword [rsp + 0x50]
lea edi, [rax - 0x43]
mov r8, qword [rsp + 0x70]
mov r9d, 0x6732
mov ebx, 0x71
cmp edi, 0x4b
ja case.0x18007e766.2
lea rcx, [0x180000000]
movzx eax, byte [rcx + rdi + 0x7f5e0]
mov ecx, dword [rcx + rax*4 + 0x7f5a8]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov word [rbp + 0x1c4], r9w
mov dword [rbp + 0x1c6], 0x2b5b75
jmp case.0x18007e766.2
mov rbx, qword [rsp + 0x70]
inc qword [rbx + 0xd0]
mov rax, qword [rbx + 0xc0]
test rax, rax
je 0x18007e7a0
mov rdx, r11
mov rcx, rbx
call rax
mov r10, qword [rbp - 0x78]
mov r8, rbx
mov r11, qword [rsp + 0x78]
inc esi
inc edi
cmp esi, r14d
jae 0x18007e95a
mov rdx, qword [rbp - 0x50]
jmp 0x18007e736
mov rax, qword [r8 + 0x78]
mov rdx, qword [r11 + 8]
mov rcx, qword [rax + 0x18]
mov rax, qword [r12]
sub rcx, rdx
add rax, 0xfffffffffffffffe
add rcx, rax
mov qword [r11 + 0x10], rcx
lea r15, [rcx + rdx]
jmp case.0x18007e766.2
mov ecx, 0xae
nop word [rax + rax]
mov eax, ecx
sub eax, 0xad
je case.0x18007e9d7.72
cmp eax, 1
jne 0x18007e80a
mov rax, qword [r8 + 0x10]
mov qword [rbp - 0x80], rax
dec ecx
cmp ecx, 0xac
ja 0x18007e7f0
lea rax, [r15 + 1]
mov qword [r11 + 0x10], 1
mov qword [r11 + 8], rax
jmp case.0x18007e766.2
mov qword [r11 + 0x10], 1
mov qword [r11 + 8], r15
jmp case.0x18007e766.2
mov rax, qword [rdx]
lea r9, [rsp + 0x50]
mov rcx, qword [rsp + 0x70]
mov edx, 0x80
mov qword [rbp - 0x68], rax
mov r8, rcx
mov rax, qword [r12]
mov qword [rsp + 0x50], rax
mov eax, dword [rcx + 0x8c]
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], eax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.1800a0350
mov r8, qword [rsp + 0x70]
mov r10, qword [rbp - 0x78]
jmp case.0x18007e766.2
cmp dword [r11], 1
jne case.0x18007e766.2
mov byte [rbp - 0x80], 1
jmp case.0x18007e9d7.72
mov eax, 0x62
mov word [rbp + 0x1c0], ax
mov eax, 0x7467
mov word [rbp + 0x1c1], ax
jmp case.0x18007e766.2
mov word [rbp + 0x1c3], bx
jmp case.0x18007e766.2
mov dword [r11], 2
jmp case.0x18007e766.2
mov ebx, 0x17
nop dword [rax]
cmp ebx, 0x17
je 0x18007e8f3
cmp ebx, 0x3af
je case.0x18007e9d7.72
jmp 0x18007e910
mov rax, qword [rsp + 0x70]
xor edx, edx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
mov byte [rbp - 0x80], al
add ebx, 0x398
cmp ebx, 0x730
jbe 0x18007e8e0
mov r8, qword [rsp + 0x70]
xor eax, eax
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
mov rax, qword [rsp + 0x70]
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
mov rax, qword [rax + 0x58]
movsd xmm0, qword [rbp + 0xa0]
movsd qword [rbp - 0x28], xmm0
mov r10, qword [rax + 0x10]
mov qword [rbp - 0x78], r10
jmp case.0x18007e766.2
mov r15, qword [rsp + 0x70]
lea r9, [0x180000000]
mov eax, dword [rbp - 0x70]
lea ecx, [rax + 0x98c]
xor r14d, r14d
mov dword [rsp + 0x48], ecx
mov r12d, eax
cmp eax, ecx
jae 0x18007eee3
mov r13, qword [rbp - 0x68]
mov eax, 0x7265
mov rsi, qword [rsp + 0x50]
movzx ebx, byte [rsp + 0x40]
mov r8d, 0x67
movabs rdx, 0x10100000000001
cmp r12d, 0x11b
ja 0x18007edcd
je 0x18007edad
lea eax, [r12 - 0x43]
cmp eax, 0xca
ja case.default.0x18007e9d7
movzx eax, byte [r9 + rax + 0x7f648]
mov ecx, dword [r9 + rax*4 + 0x7f62c]
add rcx, r9
jmp rcx
mov dword [r11], 0x14
mov ecx, dword [rsp + 0x48]
mov eax, 0x7265
add r12d, 0xbc
cmp r12d, ecx
jae 0x18007eee0
mov r10, qword [rbp - 0x78]
lea r9, [0x180000000]
mov r11, qword [rsp + 0x78]
jmp 0x18007e994
mov eax, dword [str.V803_DstShort]
mov dword [rbp + 0x70], eax
movzx eax, byte [0x180469b5c]
mov byte [rbp + 0x74], al
mov word [rbp + 0x1c9], r8w
jmp case.0x18007e9d7.73
movsxd rax, dword [r15]
mov rax, qword [r9 + rax*8 + 0x472200]
movzx ecx, word [rax]
shr ecx, 2
and ecx, 0xf
mov dword [rbp - 0x80], ecx
jmp case.0x18007e9d7.73
mov dword [rsp + 0x68], r14d
mov edi, 0x11f
nop dword [rax + rax]
lea eax, [rdi - 0x11f]
cmp eax, 8
ja case.0x18007ea6a.292
mov ecx, dword [r9 + rax*4 + 0x7f714]
add rcx, r9
jmp rcx
mov eax, dword [rsp + 0x68]
add eax, 0xffffffe8
cmp eax, 0x34
ja 0x18007ea82
bt rdx, rax
jb 0x18007ebd2
mov dword [rsp + 0x68], r14d
mov edi, 0x121
jmp case.0x18007ea6a.292
lea rax, [rbp - 0x48]
mov r9, r11
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x20], 0xf7
mov rcx, r15
call fcn.180010d60
test al, al
jne 0x18007ebd2
mov r11, qword [rsp + 0x78]
cmp dword [r11], 2
je 0x18007eb66
xor bl, bl
jmp case.0x18007e9d7.73
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x40]
mov r9, r15
mov qword [rsp + 0x20], r11
xor edx, edx
mov r8d, 0xb4
call fcn.1800bac60
mov rbx, rax
jmp 0x18007eb61
xor bl, bl
jmp case.0x18007ea6a.292
mov r8, qword [rbp - 0x48]
test r8, r8
jne 0x18007eb38
mov byte [rsp + 0x58], r8b
lea rax, [rsp + 0x58]
lea r8, [rbp - 0x48]
mov qword [rsp + 0x28], r15
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rdx, r11
mov byte [rsp + 0x60], 1
mov ecx, 0x56
call fcn.18009cf20
mov r8, qword [rbp - 0x48]
mov rax, qword [rbp - 0x38]
xor edx, edx
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0x2a]
call fcn.180092a60
mov dword [rsp + 0x68], eax
mov r11, qword [rsp + 0x78]
movabs rdx, 0x10100000000001
lea r9, [0x180000000]
inc edi
cmp edi, 0x126
jb 0x18007ea50
test bl, bl
je case.0x18007e9d7.73
mov r14d, 0x4d
cmp r14d, 0x4d
je 0x18007ed79
cmp r14d, 0x12a6
je 0x18007ed39
cmp r14d, 0x24ff
je 0x18007ed1e
cmp r14d, 0x3758
je 0x18007ebd6
cmp r14d, 0x49b1
je case.0x18007e9d7.72
jmp 0x18007ed91
mov bl, 1
jmp 0x18007eb8d
cmp qword [rbp - 0x58], 0
je 0x18007ec76
mov edi, 0x22
lea r13, [0x18006ce90]
nop dword [rax]
cmp edi, 0x22
je 0x18007ec30
cmp edi, 0x1496
je 0x18007ec23
cmp edi, 0x290a
je 0x18007ec16
cmp edi, 0x3d7e
jne 0x18007ec5f
mov qword [r15 + 0x98], r13
jmp 0x18007ec5f
mov rcx, qword [rsi + 8]
mov eax, dword [rsp + 0x68]
mov dword [rcx + 8], eax
jmp 0x18007ec5f
mov rcx, qword [rsi + 8]
mov rax, qword [rbp - 0x58]
mov qword [rcx], rax
jmp 0x18007ec5f
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
mov qword [rsp + 0x50], 0x10
mov r8d, 0xac
call fcn.18009b6a0
mov qword [rsi + 8], rax
add edi, 0x1474
cmp edi, 0x51d0
jbe 0x18007ebf0
mov r13, qword [rbp - 0x68]
jmp 0x18007ed01
cmp dword [rsp + 0x68], 0x18
jne 0x18007eced
mov edi, 0xaa
lea r13, [0x18006ce90]
nop dword [rax]
mov eax, edi
sub eax, 0xa9
je 0x18007ecd6
cmp eax, 1
jne 0x18007ecdd
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
mov qword [rsp + 0x50], 0x10
mov r8d, 0xac
call fcn.18009b6a0
mov qword [rsi + 8], rax
mov dword [rax + 8], 0x18
jmp 0x18007ecdd
mov qword [r15 + 0x98], r13
dec edi
cmp edi, 0xa8
ja 0x18007ec90
mov r13, qword [rbp - 0x68]
jmp 0x18007ed01
mov eax, dword [rsp + 0x68]
mov dword [rsi], eax
lea rax, [0x18006cdc0]
mov qword [r15 + 0x98], rax
lea r8, [rbp - 0x48]
mov byte [rsp + 0x40], 1
mov edx, 0x9f
lea rcx, [rsp + 0x40]
call fcn.1800578b0
mov byte [rbp - 0x80], al
jmp 0x18007ed91
mov rax, qword [r13 + 0x10]
mov r8d, 0x13f
mov rdx, r15
mov rcx, qword [rax + 8]
call fcn.1800e0900
mov rsi, rax
jmp 0x18007ed91
mov rax, qword [r13 + 0x10]
cmp qword [rax + 8], 0
jne 0x18007ed91
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
mov qword [rsp + 0x50], 0x10
mov r8d, 0xac
call fcn.18009b6a0
mov rcx, qword [r13 + 0x10]
mov qword [rcx + 8], rax
jmp 0x18007ed91
mov rdx, qword [r15 + 0x58]
xor r9d, r9d
mov r8d, 0x83
xor ecx, ecx
call fcn.18003f9f0
mov qword [r13 + 0x10], rax
add r14d, 0x1259
cmp r14d, 0x5bbd
jbe 0x18007eb93
xor r14d, r14d
jmp case.0x18007e9d7.73
mov r8d, 3
mov byte [rbp + 0x75], 0
lea rdx, [0x180469b97]
lea rcx, [rbp + 0x75]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.0x18007e9d7.73
cmp r12d, 0x201
ja 0x18007ee68
je 0x18007ee2a
mov eax, r12d
sub eax, 0x145
je 0x18007ee06
sub eax, 0x76
je 0x18007eea0
cmp eax, 0x1c
mov eax, 0x7265
jne 0x18007e9e9
mov byte [rbp + 0x78], 0
jmp 0x18007e9e9
inc qword [r15 + 0xd0]
mov rax, qword [r15 + 0xc0]
test rax, rax
je case.default.0x18007e9d7
mov rdx, r11
mov rcx, r15
call rax
jmp case.0x18007e9d7.73
mov eax, 0x98
nop
cmp eax, 0x98
je 0x18007eed4
add eax, 0x6b
cmp eax, 0x103
jb 0x18007ee30
mov rcx, qword [r10 + 8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x56]
call fcn.180069e70
mov r13, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], r14
jmp case.0x18007e9d7.73
cmp r12d, 0x293
je 0x18007ee87
cmp r12d, 0x34f
jne 0x18007e9e9
mov word [rbp + 0x7d], ax
jmp 0x18007e9e9
mov eax, dword [0x180469b48]
mov dword [rbp + 0x78], eax
movzx eax, byte [0x180469b4c]
mov byte [rbp + 0x7c], al
jmp case.default.0x18007e9d7
xor edx, edx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x59]
call fcn.18004f870
lea r8, [rbp - 0x48]
mov byte [rsp + 0x40], al
mov edx, 0x9f
lea rcx, [rsp + 0x40]
call fcn.1800578b0
mov byte [rbp - 0x80], al
jmp case.0x18007e9d7.72
mov rax, qword [rbp - 0x50]
mov rax, qword [rax]
jmp 0x18007f57d
mov eax, dword [rbp - 0x70]
imul r13d, eax, 0xa48
mov esi, eax
cmp eax, r13d
ja case.0x18007e9d7.72
mov r15, qword [rsp + 0x50]
mov edx, 0x69
mov r12d, dword [rbp - 0x78]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
lea r8d, [rdx + 0xa]
lea r9d, [rdx - 0x49]
lea r10d, [rdx - 0x3b]
lea r11d, [rdx + 5]
nop dword [rax]
cmp esi, 0x1e8bb
ja 0x18007f2c1
je 0x18007f2b5
cmp esi, 0xd1ab
ja 0x18007f1c2
je 0x18007f1aa
cmp esi, 0x5f
je 0x18007f1a1
cmp esi, 0x4623
je 0x18007ef66
cmp esi, 0x8be7
je 0x18007f531
jmp 0x18007f561
mov rax, qword [rsp + 0x70]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x18007ef78
mov rcx, qword [rax]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [rax + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18007f548
mov ebx, 0x16
cmp ebx, 0x16
ja case.0x18007efcf.3
lea rdx, [0x180000000]
mov ecx, ebx
mov eax, dword [rdx + rcx*4 + 0x7f738]
add rax, rdx
jmp rax
mov r8d, 1
mov byte [rbp + 0xba], 0
lea rdx, [0x180469db0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.0x18007efcf.3
mov r8d, 3
lea rdx, [0x180469de8]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0xc4], 0x6c
jmp case.0x18007efcf.3
mov eax, dword [0x180469e64]
mov dword [rbp + 0x50], eax
movzx eax, word [0x180469e68]
mov word [rbp + 0x54], ax
jmp case.0x18007efcf.3
mov r8d, 2
mov byte [rbp + 0xbe], 0
lea rdx, [0x180469ec7]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.0x18007efcf.3
mov edx, 0x69
mov dword [rbp + 0x60], edx
jmp 0x18007f189
mov byte [rbp + 0xb6], 0
jmp case.0x18007efcf.3
mov r8d, 2
lea rdx, [0x180469f0e]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x7469
mov word [rbp + 0xb8], ax
jmp case.0x18007efcf.3
mov eax, dword [0x180469f82]
mov dword [rbp + 0x56], eax
movzx eax, word [0x180469f86]
mov word [rbp + 0x5a], ax
jmp case.0x18007efcf.3
xor eax, eax
mov word [rbp + 0x5c], ax
jmp case.0x18007efcf.3
mov byte [rbp + 0xb5], 0x63
jmp case.0x18007efcf.3
xor eax, eax
mov dword [rbp + 0x5c], 0x460073
mov word [rbp + 0x60], ax
jmp case.0x18007efcf.3
mov byte [rbp + 0xc6], 0
jmp case.0x18007efcf.3
mov r8d, 5
lea rdx, str.ri.secInfo.usePredefinedCert
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.0x18007efcf.3
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
jmp case.0x18007efcf.3
xor eax, eax
mov word [rbp + 0x68], ax
mov byte [rbp + 0xb0], al
jmp case.0x18007efcf.3
mov byte [rbp + 0xc5], 0x3a
jmp case.0x18007efcf.3
mov word [rbp + 0xc0], 0x74
jmp case.0x18007efcf.3
lea rcx, [rbp + 0xb0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
jmp case.0x18007efcf.3
movzx eax, word [str.yPkZT_lkf_TidSZO_TTZMYgqYWQJRW8M_FXHkfQZFZP_8]
mov word [rbp + 0xbb], ax
movzx eax, byte [0x180469fba]
mov byte [rbp + 0xbd], al
jmp case.0x18007efcf.3
mov r8d, 2
lea rdx, [0x180469ff4]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov eax, 0x64
mov word [rbp + 0x66], ax
mov edx, 0x69
dec ebx
lea eax, [rbx + 0xcc]
cmp eax, 0xcb
ja 0x18007efb3
jmp 0x18007f54d
mov byte [rbp + 0x7f], 0
jmp 0x18007f561
xor eax, eax
xor edx, edx
mov rcx, r15
mov dword [rbp - 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
jmp 0x18007f548
cmp esi, 0x15d33
je 0x18007f1ff
cmp esi, 0x1a2f7
jne 0x18007f561
xor edx, edx
mov rcx, rdi
call fcn.180008c20
mov rdx, rax
lea r9, [rbp - 0x60]
xor eax, eax
mov r8d, r12d
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18007f548
mov r10, qword [rsp + 0x78]
xorps xmm0, xmm0
xor eax, eax
mov ecx, r12d
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp + 0x40], rax
mov r8, qword [r10 + 0x10]
mov dword [rbp + 0x48], eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
cmp rcx, r8
ja 0x18007f251
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18007f245
mov rax, qword [r10]
mov byte [rax + rcx], 0
mov rdi, r10
jmp 0x18007f557
mov rdx, qword [r10 + 0x18]
mov rdi, rcx
mov rax, rdx
sub rdi, r8
sub rax, r8
cmp rdi, rax
ja 0x18007f295
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp rdx, 0x10
jb 0x18007f276
mov rax, qword [r10]
lea rbx, [rax + r8]
xor edx, edx
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
mov rdi, qword [rsp + 0x78]
jmp 0x18007f548
mov r9, rdi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rdi
mov rcx, r10
call fcn.1800076a0
mov rdi, qword [rsp + 0x78]
jmp 0x18007f548
mov dword [rbp - 0x1c], 0x6c
jmp 0x18007f561
cmp esi, 0x2ffcb
ja 0x18007f4fc
je 0x18007f311
cmp esi, 0x22e7f
je 0x18007f305
cmp esi, 0x27443
je 0x18007f2f7
cmp esi, 0x2ba07
jne 0x18007f561
mov dword [rbp - 0x78], 0x6c
jmp 0x18007f561
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18007f548
mov dword [rbp - 0x68], 0x104
jmp 0x18007f561
cmp r12d, dword [rbp - 0x60]
je 0x18007f4e5
xor eax, eax
mov ebx, eax
nop
cmp ebx, 0x16
ja case.0x18007f343.17
mov eax, ebx
lea rcx, [0x180000000]
mov ecx, dword [rcx + rax*4 + 0x7f794]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x80]
call qword [sym.imp.SHLWAPI.dll_StrTrimW]
mov edx, 0x69
lea r8d, [rdx + 0xa]
lea r9d, [rdx - 0x49]
lea r10d, [rdx - 0x3b]
lea r11d, [rdx + 5]
jmp case.0x18007f343.17
mov dword [rbp + 0x80], 0x730055
jmp case.0x18007f343.17
mov dword [rbp + 0x94], 0x660020
jmp case.0x18007f343.17
mov r8d, 3
lea rdx, [0x180469c26]
lea rcx, [rbp + 0x5e]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18007f356
xor eax, eax
lea rdx, [0x180469ca6]
lea rcx, [rbp + 0x50]
mov word [rbp + 0xa6], ax
lea r8d, [rax + 5]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
jmp 0x18007f356
xor eax, eax
mov word [rbp + 0x5a], ax
jmp case.0x18007f343.17
mov dword [rbp + 0xa0], 0x730025
mov word [rbp + 0xa4], r10w
jmp case.0x18007f343.17
xor eax, eax
mov word [rbp + 0x5e], ax
jmp case.0x18007f343.17
mov word [rbp + 0x92], r11w
jmp case.0x18007f343.17
mov dword [rbp + 0x5a], 0x2d0065
jmp case.0x18007f343.17
mov r8d, 1
lea rdx, [0x180469d52]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x18007f356
mov r8d, 2
lea rdx, [0x180469d94]
lea rcx, [rbp + 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov word [rbp + 0x68], ax
jmp 0x18007f356
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x18007f356
xor eax, eax
mov word [rbp + 0x64], ax
jmp case.0x18007f343.17
xor eax, eax
mov dword [rsp + 0x48], eax
jmp case.0x18007f343.17
mov word [rbp + 0x98], dx
jmp case.0x18007f343.17
mov dword [rbp + 0x84], 0x6e0069
mov dword [rbp + 0x88], 0x200067
jmp case.0x18007f343.17
mov word [rbp + 0x8c], r8w
mov dword [rbp + 0x8e], 0x69006b
jmp case.0x18007f343.17
xor eax, eax
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18007f4b5
mov rax, qword [rdi]
mov byte [rax], 0
jmp case.0x18007f343.17
mov dword [rbp + 0x9a], 0x65006c
mov word [rbp + 0x9e], r9w
jmp case.0x18007f343.17
xor eax, eax
mov qword [rsp + 0x50], rax
inc ebx
lea eax, [rbx + 0x7e]
cmp eax, 0x95
jb 0x18007f320
mov r8d, dword [rbp - 0x68]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_StrCatBuffA]
jmp 0x18007f548
cmp esi, 0x3458f
je 0x18007f538
cmp esi, 0x38b53
jne 0x18007f561
mov eax, 0x8a
cmp eax, 0x8a
je 0x18007f521
cmp eax, 0x144
je case.0x18007e9d7.72
jmp 0x18007f525
mov byte [rbp - 0x80], 1
add eax, 0xba
cmp eax, 0x1fe
jb 0x18007f511
xor eax, eax
mov r14d, eax
jmp 0x18007f561
mov edx, dword [rbp - 0x78]
lea r8, [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov edx, 0x69
mov r9d, 0x20
lea r11d, [r9 + 0x4e]
mov r10d, 0x2e
lea r8d, [r10 + 0x45]
imul eax, dword [rbp - 0x70], 0xbc
add esi, eax
cmp esi, r13d
jbe 0x18007ef20
jmp case.0x18007e9d7.72
mov byte [rbp - 0x80], 0
mov rax, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.1800e9340
mov rbx, qword [rsp + 0x428]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret