Function at 0x180035600
Capabilities:
Get file attributes
Modify service
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x338]
sub rsp, 0x448
movaps xmmword [rsp + 0x430], xmm6
mov rax, qword [0x1800ad828]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rdi, r9
mov qword [rbp - 0x40], r9
mov r14, r8
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x28], rcx
xor ebx, ebx
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], bx
mov esi, dword [rbp + 0x3a0]
mov edx, esi
mov dword [rbp - 0x80], edx
lea r15d, [rsi + 0xf]
mov dword [rbp - 0x70], r15d
lea r10, [0x180000000]
lea r13d, [rbx + 0x64]
mov r9, qword [rbp - 0x50]
mov r12d, dword [rbp - 0x54]
mov qword [rbp - 0x78], r9
mov dword [rbp - 0x5c], r12d
cmp esi, r15d
jae 0x1800369e8
lea r13d, [rbx + 0x61]
lea r11d, [rbx + 0x74]
movabs r8, 0x7ffffffffffffffe
lea eax, [rdx - 0x26]
cmp eax, 0x2e
ja case.0x1800356c6.53
movzx eax, byte [r10 + rax + 0x36a74]
mov ecx, dword [r10 + rax*4 + 0x36a34]
add rcx, r10
jmp rcx
lea r9, [rbp + 0xa0]
mov r8d, ILFree
mov rdx, r14
mov rcx, rdi
call fcn.180035000
jmp 0x1800364f6
xor r8d, r8d
mov edx, 0x109
lea rcx, [rbp + 0x2d0]
call fcn.180072eb0
mov edx, dword [0x1800ad2a4]
lea rcx, str.force_directshow
call fcn.180092680
movzx eax, byte [rbp + 0x2df]
movzx ecx, byte [rbp + 0x2de]
movzx r10d, byte [rbp + 0x2dd]
movzx r11d, byte [rbp + 0x2dc]
movzx ebx, byte [rbp + 0x2db]
movzx edi, byte [rbp + 0x2da]
movzx esi, byte [rbp + 0x2d9]
movzx r14d, byte [rbp + 0x2d8]
movzx r15d, byte [rbp + 0x2d7]
movzx r12d, byte [rbp + 0x2d6]
movzx r13d, byte [rbp + 0x2d5]
movzx r9d, byte [rbp + 0x2d2]
movzx r8d, byte [rbp + 0x2d1]
movzx edx, byte [rbp + 0x2d0]
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
movzx eax, byte [rbp + 0x2d4]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp + 0x2d3]
mov dword [rsp + 0x20], eax
lea rcx, str.sukurta__a_href_1_target_blank__u__font_color0000FF__2__font___u___a_
call fcn.180092680
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x3e]
call fcn.18004b350
mov r15d, dword [rbp - 0x70]
mov r12d, dword [rbp - 0x5c]
xor ebx, ebx
lea r13d, [rbx + 0x61]
jmp 0x1800364f6
mov dword [rbp - 0x68], 3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 0x10b
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.180055790
mov qword [0x1800ad9b8], rax
jmp 0x1800364f6
mov rdi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
cmp rdi, rcx
jae 0x18003585b
lea rax, [rdi + 1]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
cmp rcx, 8
cmovae rax, qword [rbp + 0x30]
mov dword [rax + rdi*2], 0x61
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
jmp case.0x1800356c6.53
mov rax, r8
sub rax, rdi
cmp rax, 1
jb 0x180036a26
lea r15, [rdi + 1]
mov rsi, qword [rbp + 0x48]
mov rbx, r15
or rbx, 7
cmp rbx, r8
jbe 0x180035884
mov rbx, r8
jmp 0x1800358a5
mov rcx, rsi
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp rsi, rax
jbe 0x18003589a
mov rbx, r8
jmp 0x1800358a5
lea rax, [rcx + rsi]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.180018580
mov r14, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rbx
add rdi, rdi
mov r8, rdi
mov rcx, rax
cmp rsi, 8
jb 0x180035917
mov rbx, qword [rbp + 0x30]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + r14], 0x61
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x18003590d
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18003656a
mov rbx, rcx
mov rcx, rbx
call fcn.180092818
jmp 0x180035928
lea rdx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + r14], 0x61
mov r11d, 0x74
mov r15d, dword [rbp - 0x70]
mov edx, dword [rbp - 0x80]
mov qword [rbp + 0x30], r14
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
jmp case.0x1800356c6.53
mov ebx, dword [rbp - 0x60]
test dword [rdi], ebx
mov esi, 0
mov eax, esi
setne al
mov dword [rbp - 0x68], eax
mov r9, r14
xor r8d, r8d
mov edx, 0x102
lea rcx, [rbp - 0x68]
call fcn.180007410
shr ebx, 1
mov dword [rbp - 0x60], ebx
je 0x1800359c0
nop dword [rax + rax]
mov dword [rbp - 0x68], 1
mov r9, r14
xor r8d, r8d
mov edx, 0x102
lea rcx, [rbp - 0x68]
call fcn.180007410
test dword [rdi], ebx
mov eax, esi
setne al
mov dword [rbp - 0x68], eax
mov r9, r14
xor r8d, r8d
mov edx, 0x102
lea rcx, [rbp - 0x68]
call fcn.180007410
shr ebx, 1
jne 0x180035980
mov dword [rbp - 0x60], ebx
xor ebx, ebx
mov dword [rbp - 0x68], ebx
mov r9, r14
xor r8d, r8d
mov edx, 0x102
lea rcx, [rbp - 0x68]
call fcn.180007410
jmp 0x1800364f6
xor edx, edx
mov r8d, 0x228
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
jmp 0x1800364f6
mov rdi, qword [0x1800ad348]
lea rbx, [0x1800ad338]
cmp qword [0x1800ad350], 8
cmovae rbx, qword [0x1800ad338]
cmp rdi, 8
jae 0x180035a2d
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm0
mov esi, 7
mov r14, qword [rbp + 0x50]
jmp 0x180035a6c
mov rsi, rdi
or rsi, 7
cmp rsi, r8
cmova rsi, r8
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x50]
call fcn.180018580
mov r14, rax
mov qword [rbp + 0x50], rax
lea r8, [rdi*2 + 2]
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movabs r8, 0x7ffffffffffffffe
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x60], rdi
lea r15, [rbp + 0x50]
cmp rsi, 8
cmovae r15, r14
cmp rdi, 8
jae 0x180035a97
movups xmm6, xmmword [r15]
mov qword [rbp + 0x88], 7
jmp 0x180035ad4
mov rbx, rdi
or rbx, 7
cmp rbx, r8
cmova rbx, r8
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x70]
call fcn.180018580
mov qword [rbp + 0x70], rax
lea r8, [rdi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x88], rbx
movups xmm6, xmmword [rbp + 0x70]
mov qword [rbp + 0x80], rdi
mov rcx, qword [rbp + 0x48]
cmp rcx, 8
jb 0x180035b1b
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035b16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036525
call fcn.180092818
movups xmmword [rbp + 0x30], xmm6
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rbp + 0x40], xmm0
cmp rsi, 8
jb 0x180035b65
lea rdx, [rsi*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x180035b5d
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003656a
mov rcx, r14
call fcn.180092818
xor ebx, ebx
mov r9d, ebx
mov qword [rbp - 0x78], rbx
mov edx, ebx
mov qword [rbp - 0x68], rbx
cmp qword [0x1800ad368], rbx
jbe 0x180035e96
mov r13d, ebx
cmp r13d, 0xa
ja case.default.0x180035ba3
mov eax, r13d
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x36aa4]
add rcx, r8
jmp rcx
mov r8d, 2
lea rdx, [0x1800a4964]
lea rcx, [rbp + 0x63]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x1800a4993]
mov dword [rbp + 0x65], eax
movzx eax, byte [0x1800a4997]
mov byte [rbp + 0x69], al
mov byte [rbp + 0x6a], 0
jmp 0x180035e56
mov word [rbp + 0x6b], 0x3b65
jmp case.default.0x180035ba3
mov byte [rbp + 0x6d], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
jmp case.default.0x180035ba3
lea rax, [0x1800ad358]
cmp qword [0x1800ad370], 0x10
cmovae rax, qword [0x1800ad358]
movsx r12d, byte [rax + rdx]
mov rsi, qword [rbp + 0x40]
mov rdi, qword [rbp + 0x48]
cmp rsi, rdi
jae 0x180035c4a
lea rax, [rsi + 1]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
cmp rdi, 8
cmovae rax, qword [rbp + 0x30]
mov word [rax + rsi*2], r12w
mov word [rax + rsi*2 + 2], bx
jmp case.default.0x180035ba3
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x180036a2c
lea r15, [rsi + 1]
mov rbx, r15
or rbx, 7
cmp rbx, rdx
jbe 0x180035c79
mov rbx, rdx
jmp 0x180035c9a
mov rcx, rdi
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rdi, rax
jbe 0x180035c8f
mov rbx, rdx
jmp 0x180035c9a
lea rax, [rdi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.180018580
mov r14, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp rdi, 8
jb 0x180035d1a
mov rbx, qword [rbp + 0x30]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + r14], r12w
xor eax, eax
mov word [rsi + r14 + 2], ax
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
jb 0x180035d07
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18003652c
mov rbx, rcx
mov rcx, rbx
call fcn.180092818
mov qword [rbp + 0x30], r14
xor ebx, ebx
jmp 0x180035e56
lea rdx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + r14], r12w
xor ebx, ebx
mov word [rsi + r14 + 2], bx
mov qword [rbp + 0x30], r14
jmp 0x180035e56
mov dword [rbp - 0x54], 2
jmp case.default.0x180035ba3
mov r8d, 3
lea rdx, [0x1800a49a1]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1800a4a0c]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 3
lea rdx, [0x1800a4a20]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180035e56
lea rcx, [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CredIsMarshaledCredentialA]
jmp 0x180035e56
mov byte [rbp + 0x50], 0
mov r8d, 3
lea rdx, [0x1800a4a47]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 4
lea rdx, [0x1800a4a61]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1800a4aff]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180035e56
mov r8d, 2
lea rdx, [0x1800a4b37]
lea rcx, [rbp + 0x61]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x63], 0
jmp 0x180035e56
mov r8d, 1
lea rdx, [0x1800a4b48]
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180035e56
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x70]
mov edx, dword [rbp - 0x54]
lea rcx, [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_GetPrivateObjectSecurity]
mov rdx, qword [rbp - 0x68]
inc r13d
lea eax, [r13 + 0x98]
cmp eax, 0xa3
jb 0x180035b84
inc rdx
mov qword [rbp - 0x68], rdx
cmp rdx, qword [0x1800ad368]
jb 0x180035b81
mov r15d, dword [rbp - 0x70]
mov r12d, dword [rbp - 0x5c]
mov r13d, 0x61
jmp 0x1800364f6
mov edx, dword [rbp - 0x80]
mov r15d, dword [rbp - 0x70]
mov r11d, 0x74
jmp 0x180036503
mov r8d, 4
lea rdx, [0x1800a4b70]
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x304], 0
mov r8d, 5
lea rdx, [0x1800a4b8b]
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x309], 0x29
jmp 0x1800364f6
mov qword [rbp - 0x20], rbx
mov rdi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
cmp rdi, rcx
jae 0x180035f21
lea rax, [rdi + 1]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
cmp rcx, 8
cmovae rax, qword [rbp + 0x30]
mov dword [rax + rdi*2], 0x74
jmp case.0x1800356c6.53
mov rax, r8
sub rax, rdi
cmp rax, 1
jb 0x180036a26
lea r15, [rdi + 1]
mov rsi, qword [rbp + 0x48]
mov rbx, r15
or rbx, 7
cmp rbx, r8
jbe 0x180035f4a
mov rbx, r8
jmp 0x180035f6b
mov rcx, rsi
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp rsi, rax
jbe 0x180035f60
mov rbx, r8
jmp 0x180035f6b
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.180018580
mov r14, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rbx
add rdi, rdi
mov r8, rdi
mov rcx, rax
cmp rsi, 8
jb 0x180035fea
mov rbx, qword [rbp + 0x30]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + rdi], 0x74
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x180035fd3
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18003656a
mov rbx, rcx
mov rcx, rbx
call fcn.180092818
mov qword [rbp + 0x30], r14
mov r15d, dword [rbp - 0x70]
xor ebx, ebx
jmp 0x1800364f6
lea rdx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov r11d, 0x74
mov dword [r14 + rdi], r11d
xor ebx, ebx
mov qword [rbp + 0x30], r14
mov edx, dword [rbp - 0x80]
mov r15d, dword [rbp - 0x70]
jmp case.0x1800356c6.53
mov ecx, dword [rdi]
shr ecx, 1
mov dword [rbp - 0x60], ecx
lea eax, [rcx - 1]
and eax, ecx
je case.0x1800356c6.53
mov ecx, eax
mov dword [rbp - 0x60], eax
dec eax
and eax, ecx
jne 0x180036021
jmp case.0x1800356c6.53
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x6f]
call fcn.180021430
test al, 1
je 0x1800360b1
mov ebx, 0x37
cmp ebx, 0x37
jne 0x18003606f
mov qword [rbp - 0x68], 0x20
lea r9d, [rbx + 0x26]
lea r8, [0x1800ad950]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x2e0]
call fcn.18001b060
dec ebx
cmp ebx, 0x34
ja 0x180036047
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x6f]
call fcn.180021430
test al, 1
lea r9, [rbp + 0x2e0]
mov ebx, 0
cmove r9, rbx
xor edx, edx
mov r8d, 0xbb
mov rcx, qword [0x1800ad9b8]
call fcn.180018f70
test eax, eax
je 0x180036533
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x75]
call fcn.180021430
jmp 0x1800364f6
mov byte [rbp + 0x30a], 0
jmp case.0x1800356c6.53
mov r12d, 1
mov dword [rbp - 0x5c], r12d
mov rsi, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
cmp rsi, rcx
jae 0x18003610b
lea rax, [rsi + 1]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
cmp rcx, 8
cmovae rax, qword [rbp + 0x30]
mov dword [rax + rsi*2], 0x2e
mov rdi, qword [rbp + 0x30]
jmp 0x1800361f2
mov rax, r8
sub rax, rsi
cmp rax, r12
jb 0x180036a26
lea r15, [rsi + 1]
mov r14, qword [rbp + 0x48]
mov rbx, r15
or rbx, 7
cmp rbx, r8
jbe 0x180036133
mov rbx, r8
jmp 0x180036154
mov rcx, r14
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp r14, rax
jbe 0x180036149
mov rbx, r8
jmp 0x180036154
lea rax, [rcx + r14]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.180018580
mov rdi, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rbx
add rsi, rsi
mov r8, rsi
mov rcx, rax
cmp r14, 8
jb 0x1800361c5
mov rbx, qword [rbp + 0x30]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x1800361bb
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18003656a
mov rbx, rcx
mov rcx, rbx
call fcn.180092818
jmp 0x1800361d5
lea rdx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2e
mov r11d, 0x74
movabs r8, 0x7ffffffffffffffe
mov r15d, dword [rbp - 0x70]
mov edx, dword [rbp - 0x80]
mov qword [rbp + 0x30], rdi
xor ebx, ebx
mov r14, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
cmp r14, rsi
jae 0x180036220
lea rax, [r14 + 1]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x30]
cmp rsi, 8
cmovae rax, rdi
mov dword [rax + r14*2], 0x64
jmp case.0x1800356c6.53
mov rax, r8
sub rax, r14
cmp rax, r12
jb 0x180036a26
lea r15, [r14 + 1]
mov rbx, r15
or rbx, 7
cmp rbx, r8
jbe 0x180036244
mov rbx, r8
jmp 0x180036265
mov rcx, rsi
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp rsi, rax
jbe 0x18003625a
mov rbx, r8
jmp 0x180036265
lea rax, [rsi + rcx]
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x30]
call fcn.180018580
mov rdi, rax
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rbx
add r14, r14
mov r8, r14
mov rcx, rax
cmp rsi, 8
jb 0x1800362e4
mov rbx, qword [rbp + 0x30]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + r14], 0x64
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x1800362cd
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x18003656a
mov rbx, rcx
mov rcx, rbx
call fcn.180092818
mov qword [rbp + 0x30], rdi
mov r15d, dword [rbp - 0x70]
xor ebx, ebx
jmp 0x1800364f6
lea rdx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + r14], 0x64
xor ebx, ebx
mov qword [rbp + 0x30], rdi
mov r15d, dword [rbp - 0x70]
jmp 0x1800364f6
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x2e0], xmm1
movups xmmword [rbp + 0x2f0], xmm1
mov eax, dword [r14]
cmp eax, 1
jle 0x180036340
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 8]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov dword [0x1800ad2a4], eax
mov eax, dword [r14]
cmp eax, 2
jle 0x1800363ec
mov eax, 0xbe
nop
cmp eax, 0xbe
je 0x180036368
cmp eax, 0x17e
jne 0x1800363d4
mov edx, 0x44
mov dword [rbp - 0x80], edx
jmp 0x1800363d7
mov r14d, ebx
mov rsi, rbx
mov rdi, qword [rdi + 0x10]
cmp byte [rdi], 0
je 0x1800363c9
cmp byte [rdi + 1], 0
je 0x1800363c9
mov ebx, 0x38
mov eax, ebx
sub eax, 0x38
je 0x180036396
cmp eax, 1
jne 0x1800363bc
inc r14d
inc rsi
jmp 0x1800363bc
lea r8, [rbp - 0x58]
lea rdx, str._2hx
mov rcx, rdi
call fcn.180092740
test eax, eax
je 0x1800363c9
movzx eax, byte [rbp - 0x58]
mov byte [rbp + rsi + 0x2d0], al
add rdi, 2
inc ebx
cmp ebx, 0x3a
jb 0x180036382
cmp rsi, 0x10
jl 0x180036372
mov eax, 0xbe
mov rdi, qword [rbp - 0x40]
xor ebx, ebx
mov edx, dword [rbp - 0x80]
add eax, 0xc0
cmp eax, 0x23e
jb 0x180036350
jmp 0x1800364f9
lea rdx, [0x180097fac]
lea rcx, str._ALBUMARTIST
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x18003642e
mov r9, rax
mov edx, ILClone
lea r8d, [rdx - 0xf]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
jne 0x1800364ed
mov ebx, 0x81
mov rdi, qword [rbp - 0x30]
nop word [rax + rax]
mov eax, ebx
sub eax, 0x7d
je 0x1800364cb
sub eax, 1
je 0x1800364bc
sub eax, 1
je 0x1800364a0
sub eax, 1
je 0x180036484
cmp eax, 1
jne 0x1800364d8
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
imul rdi, rax, 0x539
xor byte [rbp + 0x2d0], dil
mov rax, rdi
shr rax, 8
xor byte [rbp + 0x2d1], al
jmp 0x1800364d8
mov rax, rdi
shr rax, 0x10
xor byte [rbp + 0x2d2], al
mov rax, rdi
shr rax, 0x18
xor byte [rbp + 0x2d3], al
jmp 0x1800364d8
mov rax, rdi
shr rax, 0x20
xor byte [rbp + 0x2d4], al
mov rax, rdi
shr rax, 0x28
xor byte [rbp + 0x2d5], al
jmp 0x1800364d8
mov rax, rdi
shr rax, 0x30
xor byte [rbp + 0x2d6], al
jmp 0x1800364d8
mov rax, rdi
shr rax, 0x38
xor byte [rbp + 0x2d7], al
dec ebx
cmp ebx, 0x7c
ja 0x180036440
mov qword [rbp - 0x30], rdi
mov rdi, qword [rbp - 0x68]
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edx, dword [rbp - 0x80]
mov r11d, 0x74
mov r9, qword [rbp - 0x78]
inc edx
mov dword [rbp - 0x80], edx
mov r14, qword [rbp - 0x48]
lea r10, [0x180000000]
cmp edx, r15d
jae 0x1800365d4
mov rdi, qword [rbp - 0x40]
jmp 0x18003569c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rax, str._CCDRecord::LoadAndFixLocalHeader__Size_mismatch_in_deflated_item___will_fix_with_actual_values.
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180096892]
lea rdx, str.B_T___M___
call fcn.180092630
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9d, 0x85
mov r8, qword [rbp - 0x28]
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp - 0x50]
call fcn.180034a60
mov ebx, eax
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1800365cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800365c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036a1f
call fcn.180092818
mov eax, ebx
jmp 0x1800369bd
mov esi, dword [rbp + 0x3a0]
mov r13d, 0x64
cmp esi, r15d
jae 0x1800369e8
lea edi, [rsi - 0x26]
mov dword [rbp - 0x60], edi
nop
cmp edi, 0x2a
ja case.0x18003660d.15
movzx eax, byte [r10 + rdi + 0x36b10]
mov ecx, dword [r10 + rax*4 + 0x36ad0]
add rcx, r10
jmp rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, r13d
xor edx, edx
xor ecx, ecx
call fcn.180083070
xor edx, edx
mov ecx, 0xc7
call fcn.180011b20
xor r8d, r8d
mov edx, 0x83
xor ecx, ecx
call fcn.180051730
xor edx, edx
lea ecx, [rdx + 0x5f]
call fcn.180054150
jmp 0x18003694e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, ILFree
call fcn.1800874c0
jmp 0x18003694e
xor r8d, r8d
xor edx, edx
mov ecx, 0x113
call fcn.180082400
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xda
call fcn.18002df80
jmp 0x18003694e
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0xb]
call fcn.180029dc0
mov r8d, r13d
xor edx, edx
xor ecx, ecx
call fcn.1800866b0
xor r8d, r8d
lea edx, [r8 + 0x70]
xor ecx, ecx
call fcn.180054420
mov edx, 0x73
xor ecx, ecx
call fcn.180007820
jmp 0x18003694e
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0xca
call fcn.180053cb0
jmp 0x18003694e
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x59]
call fcn.1800548e0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 0x4d]
call fcn.180003d00
jmp 0x18003694e
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x40
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800520d0
jmp 0x18003694e
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x19]
call fcn.180051c90
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10a
xor ecx, ecx
call fcn.1800103a0
xor r8d, r8d
xor edx, edx
mov ecx, 0x10e
call fcn.18002dbd0
jmp 0x18003694e
mov ebx, 0x6e
mov eax, ebx
sub eax, 0x6d
je case.0x18003660d.1
cmp eax, 1
jne 0x1800367a2
mov rdx, qword [0x1800ad9b8]
mov ecx, 0xbc
call fcn.180072670
lea rcx, str.SetByteArrayRegion
call fcn.180092680
xor eax, eax
mov dword [rbp - 0x80], eax
dec ebx
cmp ebx, 0x6c
ja 0x180036770
mov ebx, 0x37
nop
cmp ebx, 0x37
jne 0x1800367d8
mov qword [rbp - 0x50], 0x20
lea r9d, [rbx + 0x26]
lea r8, [0x1800ad950]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x2e0]
call fcn.18001b060
dec ebx
cmp ebx, 0x34
ja 0x1800367b0
jmp 0x18003694e
xor edx, edx
xor ecx, ecx
mov r8d, 0xed
call fcn.180075500
jmp 0x18003694e
movzx eax, byte [rbp + 0x2ef]
movzx ecx, byte [rbp + 0x2ee]
movzx r10d, byte [rbp + 0x2ed]
movzx r11d, byte [rbp + 0x2ec]
movzx ebx, byte [rbp + 0x2eb]
movzx edi, byte [rbp + 0x2ea]
movzx esi, byte [rbp + 0x2e9]
movzx r14d, byte [rbp + 0x2e8]
movzx r15d, byte [rbp + 0x2e7]
movzx r12d, byte [rbp + 0x2e6]
movzx r13d, byte [rbp + 0x2e5]
movzx r9d, byte [rbp + 0x2e2]
movzx r8d, byte [rbp + 0x2e1]
movzx edx, byte [rbp + 0x2e0]
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
movzx eax, byte [rbp + 0x2e4]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp + 0x2e3]
mov dword [rsp + 0x20], eax
lea rcx, str.information__to_the_DOCBOOK_output._Note_that_enabling_this_will_significantly
call fcn.180092680
mov edi, dword [rbp - 0x60]
mov esi, dword [rbp + 0x3a0]
mov r15d, dword [rbp - 0x70]
mov r12d, dword [rbp - 0x5c]
jmp 0x18003694e
lea r8, [rbp - 0x20]
mov edx, r12d
mov rcx, r9
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
lea rcx, [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ADVAPI32.dll_GetTrusteeNameW]
mov r8d, 0x6c
lea rdx, [rbp + 0x30]
mov rcx, r14
call fcn.180042660
mov byte [rbp - 0x80], al
jmp 0x18003694e
xor r8d, r8d
xor edx, edx
mov ecx, 0x105
call fcn.180089770
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov r9d, 0x8c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180054e40
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x76]
xor ecx, ecx
call fcn.18004d510
mov r9, qword [rbp - 0x78]
inc esi
mov dword [rbp + 0x3a0], esi
inc edi
mov dword [rbp - 0x60], edi
cmp esi, r15d
jae 0x1800369e8
mov r14, qword [rbp - 0x48]
xor ebx, ebx
lea r10, [0x180000000]
lea r13d, [rbx + 0x64]
jmp 0x1800365f0
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1800369ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800369b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036a1f
call fcn.180092818
mov eax, dword [rbp - 0x80]
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.180092fc0
movaps xmm6, xmmword [rsp + 0x430]
add rsp, 0x448
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x48]
cmp rcx, 8
jb 0x1800369ba
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800369b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800369b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180017e10
nop
call fcn.180017e10
int3