Function at 0x180068060
Capabilities:
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6d8]
sub rsp, 0x7d8
mov rax, qword [0x180143ae0]
xor rax, rsp
mov qword [rbp + 0x6c0], rax
mov r10, qword [rbp + 0x748]
mov r11, r8
mov rdi, qword [rbp + 0x750]
xor esi, esi
mov ebx, dword [rsp + 0x48]
mov qword [rsp + 0x60], r8
mov r8, rdx
mov qword [rsp + 0x50], rdx
mov rdx, rcx
mov qword [rbp - 0x80], rcx
mov ecx, dword [rbp + 0x740]
mov r13d, ecx
mov qword [rbp - 0x58], r9
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x70], rdi
lea r12d, [rcx + 0x10]
cmp ecx, r12d
jae 0x180068751
mov r15, qword [rbp - 0x68]
lea r8, str.MulticastCopyBufferSubDataNV
mov r14, qword [rbp - 0x60]
lea r9, str.Track_Description_Array_for_Adjust_Properties
mov qword [rsp + 0x78], r15
movzx r15d, byte [rsp + 0x40]
mov dword [rsp + 0x68], r15d
lea eax, [r13 - 0x73]
cmp eax, 0x25
ja case.0x18006812a.121
lea r15, [0x180000000]
movzx eax, byte [r15 + rax + 0x69114]
mov ecx, dword [r15 + rax*4 + 0x690d0]
add rcx, r15
jmp rcx
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x180068139
mov rcx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
jmp case.0x18006812a.121
mov eax, dword [str.5_16]
mov dword [rbp + 0x257], eax
movzx eax, word [0x1801376bc]
mov word [rbp + 0x25b], ax
jmp case.0x18006812a.121
test rdx, rdx
jne case.0x18006812a.121
mov edi, 0xb6
cmp edi, 0xb6
je 0x1800681cc
cmp edi, 0x6cc6
jne 0x1800681fe
mov eax, ebx
mov rcx, qword [rbp + 0x6c0]
xor rcx, rsp
call fcn.1800c9c10
add rsp, 0x7d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [0x1801953a8]
lea r9, str.MAX_no_such_drive
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r10
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
mov r10, qword [rsp + 0x58]
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
add edi, 0x6c10
cmp edi, 0xd820
jbe 0x180068197
jmp case.0x18006812a.121
movzx eax, word [0x1801376d4]
mov dword [rbp + 0x252], 0x203830
mov word [rbp + 0x255], ax
movzx eax, byte [0x1801376d6]
mov byte [rbp + 0x257], al
jmp case.0x18006812a.121
mov rax, qword [r14 + 0x20]
cmp qword [rdi], rax
je 0x1800684ad
mov r15d, 0x10d
nop
mov eax, r15d
sub eax, 0x10d
je 0x180068421
sub eax, 1
je 0x180068278
cmp eax, 1
jne 0x18006848f
mov rax, qword [rdi]
mov qword [r14 + 0x20], rax
jmp 0x18006848f
cmp qword [r14 + 0x28], 0
je 0x1800682d5
mov edi, 0xc5
cmp edi, 0xc5
je 0x1800682a8
cmp edi, 0x35de
je 0x1800682a2
cmp edi, 0x6af7
jne 0x1800682bd
mov qword [r14 + 0x38], rsi
jmp 0x1800682bd
mov qword [r14 + 0x28], rsi
jmp 0x1800682bd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [r14 + 0x28]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
add edi, 0x3519
cmp edi, 0x9f4b
jbe 0x180068284
mov r10, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x70]
cmp qword [rdi], 0
jbe 0x18006848f
mov esi, 0x101
nop dword [rax]
nop dword [rax + rax]
mov eax, esi
sub eax, 0x101
je 0x18006839e
sub eax, 1
je 0x180068384
cmp eax, 1
jne 0x18006840a
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [r14 + 0x28]
call sub.VCRUNTIME140.dll_memset
cmp qword [r14 + 0x28], 0
jne 0x18006840a
mov edi, 0x10c
nop dword [rax]
cmp edi, 0x10c
je 0x180068346
cmp edi, 0x764c
je case.0x180068e20.17
jmp 0x180068371
mov rax, qword [0x1801953a8]
lea r9, str.PContent::Msg_PAudioConstructor
mov rcx, qword [rsp + 0x58]
mov edx, 0x6d
mov qword [rsp + 0x20], rax
lea r8d, [rdx - 0x6a]
call fcn.1800c8a10
mov ebx, 0xffffffff
add edi, 0x7540
cmp edi, 0xea80
jbe 0x180068330
jmp 0x180068405
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rdi]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r14 + 0x28], rax
jmp 0x18006840a
mov rax, qword [r14 + 0x10]
xor edx, edx
div qword [rdi]
test rdx, rdx
je 0x18006840a
mov edi, 0xe3
mov eax, edi
sub eax, 0xe3
je 0x1800683d1
sub eax, 0x27
je 0x1800683ca
cmp eax, 0x27
je case.0x180068e20.17
jmp 0x1800683f5
mov ebx, 0xffffffff
jmp 0x1800683f5
mov rax, qword [0x1801953a8]
lea r9, str.parent__separate_debug_objfile_link__NULL
mov edx, 0x72
mov qword [rsp + 0x20], rax
mov rcx, r10
lea r8d, [rdx - 0x66]
call fcn.1800c8a10
mov r10, qword [rsp + 0x58]
add edi, 0x27
cmp edi, 0x158
jb 0x1800683b1
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x58]
inc esi
cmp esi, 0x104
jb 0x1800682f0
xor esi, esi
jmp 0x18006848f
mov r9, rdx
lea rcx, [r14 + 0x10]
mov rdx, r10
mov r8d, 0x106
call fcn.180061d30
cmp eax, 1
je 0x18006848f
mov edi, 0x1c
mov eax, edi
sub eax, 0x1c
je 0x18006845e
sub eax, 0x62
je 0x180068457
cmp eax, 0x62
je case.0x180068e20.17
jmp 0x180068484
mov ebx, 0xffffffff
jmp 0x180068484
mov rax, qword [0x1801953a8]
lea r9, str._e._e__eP_ea_e16_16_4_1
mov rcx, qword [rsp + 0x58]
mov edx, 0x72
mov qword [rsp + 0x20], rax
lea r8d, [rdx - 0x6c]
call fcn.1800c8a10
add edi, 0x62
cmp edi, 0x142
jb 0x180068440
mov r10, qword [rsp + 0x58]
inc r15d
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x80]
cmp r15d, 0x110
jb 0x180068250
mov ebx, 1
mov dword [rsp + 0x48], ebx
jmp case.0x18006812a.121
mov dword [rbp - 0x78], esi
test rdx, rdx
jne case.0x18006812a.121
mov edi, 0xa4
nop dword [rax]
cmp edi, 0xa4
je 0x1800684e6
cmp edi, 0x144
je case.0x180068e20.17
jmp 0x180068518
mov rax, qword [0x1801953b0]
lea r9, str.23dwarf_evaluate_loc_desc
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r11
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
mov r11, qword [rsp + 0x60]
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
add edi, 0xa0
cmp edi, 0x1e4
jb 0x1800684d0
jmp case.0x18006812a.121
mov qword [rbp - 0x68], rsi
jmp case.0x18006812a.121
test byte [rdx + 0xc], 2
mov r14, rdx
je case.0x18006812a.121
mov edi, 0xcd
cmp edi, 0xcd
je 0x180068560
cmp edi, 0x4277
jne 0x180068589
mov eax, 0xffffffff
jmp 0x1800681a9
mov rax, qword [0x1801953a8]
lea r9, str.DataReductionProxy.HeaderTamperedHTTPS_ContentLength_JS
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r10
lea r8d, [rdx - 0x59]
call fcn.1800c8a10
mov r10, qword [rsp + 0x58]
add edi, 0x41aa
cmp edi, 0x8354
jbe 0x180068546
jmp case.0x18006812a.121
mov r14, rsi
mov qword [0x1801953a8], r8
jmp case.0x18006812a.121
cmp qword [rdi], 0x7fffffff
jbe case.0x18006812a.121
mov edi, 0x128
nop dword [rax]
mov eax, edi
sub eax, 0x128
je 0x1800685d4
cmp eax, 0x2c
je case.0x180068e20.17
jmp 0x180068606
mov rax, qword [0x1801953b0]
lea r9, str.ERROR:__fuzzer__failed_to_register_the_fuzz_target:
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r11
lea r8d, [rdx - 0x5d]
call fcn.1800c8a10
mov r11, qword [rsp + 0x60]
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
add edi, 0x2c
cmp edi, 0x180
jb 0x1800685c0
jmp case.0x18006812a.121
cmp qword [r14], 0xffffffffffffffff
jne 0x180068679
mov edi, 0x5b
cmp edi, 0x5b
je 0x180068634
cmp edi, 0x449b
je case.0x180068e20.17
jmp 0x180068666
mov rax, qword [0x1801953a8]
lea r9, str.ImageHijackCanvas::ShouldSkipImage
mov edx, 0x72
mov qword [rsp + 0x20], rax
mov rcx, r10
lea r8d, [rdx - 0x71]
call fcn.1800c8a10
mov r10, qword [rsp + 0x58]
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
add edi, 0x4440
cmp edi, 0x8880
jbe 0x180068621
mov rdi, qword [rsp + 0x70]
cmp qword [rdi], 0x7fffffff
jbe case.0x18006812a.121
mov edi, 0x7d
nop dword [rax + rax]
mov eax, edi
sub eax, 0x7d
je 0x1800686b2
sub eax, 1
je 0x1800686a7
cmp eax, 1
je case.0x180068e20.17
jmp 0x1800686d6
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
jmp 0x1800686d6
mov rax, qword [0x1801953a8]
lea r9, str.Phx::Boolean_doAssumeRestrictParameters__0
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r10
lea r8d, [rdx - 0x5d]
call fcn.1800c8a10
mov r10, qword [rsp + 0x58]
inc edi
cmp edi, 0x80
jb 0x180068690
jmp case.0x18006812a.121
movzx eax, word [0x180137850]
mov word [rbp + 0x250], ax
movzx eax, byte [0x180137852]
mov byte [rbp + 0x252], al
jmp case.0x18006812a.121
mov qword [0x1801953b0], r9
jmp case.0x18006812a.121
mov al, 1
mov dword [rsp + 0x68], eax
mov r10, qword [rsp + 0x58]
lea r8, str.MulticastCopyBufferSubDataNV
mov r11, qword [rsp + 0x60]
lea r9, str.Track_Description_Array_for_Adjust_Properties
mov rdi, qword [rsp + 0x70]
inc r13d
mov rdx, qword [rbp - 0x80]
cmp r13d, r12d
jb 0x180068102
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
mov r9, qword [rbp - 0x58]
jmp 0x180068763
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x78], rax
movzx eax, byte [rsp + 0x40]
mov dword [rsp + 0x68], eax
lea esi, [rcx + 0x86f]
mov dword [rbp - 0x74], esi
cmp ecx, esi
jae case.0x180068e20.17
mov r13d, dword [rbp - 0x6c]
mov r12, qword [rbp - 0x60]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x60]
cmp ecx, 0x280
ja 0x180068d3f
je 0x180068d33
cmp ecx, 0x182
ja 0x180068b59
je 0x180068b40
mov eax, ecx
sub eax, 0x84
je 0x180068935
sub eax, 0x11
je 0x1800688c5
sub eax, 0x6e
je 0x1800688a5
cmp eax, 0x11
jne 0x1800690a1
test r9, r9
jne 0x18006882d
mov edi, 0x69
nop word [rax + rax]
mov eax, edi
sub eax, 0x69
je 0x1800687f2
cmp eax, 1
je 0x180068556
jmp 0x180068816
mov rax, qword [0x1801953b0]
lea r9, str.struct_return_in__s__0x_s
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r11
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
mov r11, qword [rsp + 0x60]
inc edi
cmp edi, 0x6b
jb 0x1800687e0
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
cmp qword [r8], 0x7fffffff
jbe 0x1800690a1
mov edi, 0xee
nop
mov eax, edi
sub eax, 0xee
je 0x180068864
sub eax, 0x23
je 0x180068859
cmp eax, 0x23
je case.0x180068e20.17
jmp 0x18006888a
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
jmp 0x18006888a
mov rax, qword [0x1801953b0]
lea r9, str.acceptDropAction__:_e__dropAction_____Qt::MoveAction
mov rcx, qword [rsp + 0x60]
mov edx, 0x61
mov qword [rsp + 0x20], rax
lea r8d, [rdx - 0x5d]
call fcn.1800c8a10
add edi, 0x23
cmp edi, 0x157
jb 0x180068840
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8, qword [rsp + 0x50]
mov r13d, eax
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
test r10, r10
jne 0x1800690a1
mov edi, 0x20
mov eax, edi
sub eax, 0x20
je 0x1800688f5
sub eax, 1
je 0x1800688ea
cmp eax, 1
je case.0x180068e20.17
jmp 0x180068919
mov ebx, 0xffffffff
mov dword [rsp + 0x48], ebx
jmp 0x180068919
mov rax, qword [0x1801953b0]
lea r9, str.instr_jcc_taken:_unknown_opcode
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r11
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
mov r11, qword [rsp + 0x60]
inc edi
cmp edi, 0x23
jb 0x1800688d3
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
cmp qword [rsp + 0x78], 0xffffffffffffffff
jne 0x180068b31
xor edi, edi
mov esi, edi
cmp esi, 0xe
ja case.default.0x180068961
lea rdx, [0x180000000]
mov eax, esi
mov ecx, dword [rdx + rax*4 + 0x6913c]
add rcx, rdx
jmp rcx
mov word [rbp + 0x260], di
jmp case.default.0x180068961
lea rdx, [rbp]
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
test r15, r15
mov ecx, edi
mov r14, rax
movzx eax, byte [rsp + 0x41]
cmovne ecx, eax
mov byte [rsp + 0x41], cl
jmp case.default.0x180068961
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memset
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r15, rax
jmp case.default.0x180068961
mov r8d, 2
lea rdx, [0x180137a86]
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp case.default.0x180068961
movzx eax, byte [rsp + 0x40]
cmp r14, 0xffffffffffffffff
mov ecx, edi
cmovne ecx, eax
cmp byte [rsp + 0x41], 0
mov byte [rsp + 0x40], cl
je case.default.0x180068961
mov edi, 0x56
mov eax, edi
sub eax, 0x56
je 0x180068a1a
cmp eax, 1
jne 0x180068a23
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180068a23
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalLock]
inc edi
cmp edi, 0x58
jb 0x180068a03
xor edi, edi
jmp case.default.0x180068961
mov byte [rsp + 0x40], 1
jmp case.default.0x180068961
mov eax, dword [0x180137ada]
mov dword [rbp + 0x26a], eax
movzx eax, word [0x180137ade]
mov word [rbp + 0x26e], ax
jmp case.default.0x180068961
mov eax, 0x54
mov word [rbp + 0x272], ax
jmp case.default.0x180068961
mov word [rbp + 0x274], di
jmp case.default.0x180068961
mov word [rbp + 0x270], di
jmp case.default.0x180068961
mov byte [rsp + 0x41], 1
jmp case.default.0x180068961
cmp byte [rsp + 0x40], 0
je 0x180068ad3
mov ebx, 0x5d
nop dword [rax]
cmp ebx, 0x5d
je 0x180068ab8
cmp ebx, 0x3909
jne 0x180068ac5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x180068ac5
lea rdx, [rbp]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
add ebx, 0x38ac
cmp ebx, 0x7158
jbe 0x180068aa0
mov byte [rsp + 0x48], 0
mov ebx, dword [rsp + 0x48]
jmp case.default.0x180068961
mov r8d, 1
lea rdx, [0x180137b48]
lea rcx, [rbp + 0x260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
movabs rax, 0x4e004500530045
mov qword [rbp + 0x262], rax
jmp case.default.0x180068961
mov dword [rbp + 0x270], 0x53
inc esi
lea eax, [rsi + 0xde]
cmp eax, 0xed
jb 0x180068945
mov esi, dword [rbp - 0x74]
mov ecx, dword [rbp + 0x740]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov dword [rbp - 0x70], edx
jmp 0x1800690a1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 8], eax
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
jmp 0x1800690a1
mov eax, ecx
sub eax, 0x193
je 0x180068b93
sub eax, 0x6e
je 0x180068b75
cmp eax, 0x11
je case.0x180068e20.17
jmp 0x1800690a1
mov edx, r13d
xor r8d, r8d
mov rcx, rdi
call fcn.18009c570
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
mov rax, qword [r8]
cmp qword [rbp - 0x68], rax
jae 0x180068d25
mov esi, 0x44
cmp esi, 0x44
je 0x180068c54
cmp esi, 0x94c
jne 0x180068ce6
mov rax, qword [rdi]
mov r9, rdx
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
mov eax, dword [rbp - 0x78]
mov r8, r10
mov dword [rbp - 0x50], eax
mov rcx, r11
lea rax, [rbp - 0x50]
mov dword [rsp + 0x28], 0xb1
mov qword [rsp + 0x20], rax
call fcn.18006b500
cmp eax, 1
je 0x180068ce1
mov edi, 0x106
nop word [rax + rax]
cmp edi, 0x106
je 0x180068c16
cmp edi, 0xcaa4
je case.0x180068e20.17
jmp 0x180068c41
mov rax, qword [0x1801953b0]
lea r9, str.http:__yandex.ua_yandsearch_textsearchTerms
mov rcx, qword [rsp + 0x60]
mov edx, 0x63
mov qword [rsp + 0x20], rax
lea r8d, [rdx - 0x61]
call fcn.1800c8a10
mov ebx, 0xffffffff
add edi, 0xc99e
cmp edi, 0x1933c
jbe 0x180068c00
jmp 0x180068ce1
mov rax, qword [r8]
mov edx, 0xf0
mov qword [rbp - 0x40], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x78]
mov rcx, r11
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
call fcn.180063060
cmp eax, 1
je 0x180068ce1
mov edi, 0x126
cmp edi, 0x126
je 0x180068cad
cmp edi, 0x3e04
je 0x180068ca6
cmp edi, 0x7ae2
je case.0x180068e20.17
jmp 0x180068cd3
mov ebx, 0xffffffff
jmp 0x180068cd3
mov rax, qword [0x1801953b0]
lea r9, str.WebSocketChannel::GeneratePong_Allocation_Failure
mov rcx, qword [rsp + 0x60]
mov edx, 0x63
mov qword [rsp + 0x20], rax
lea r8d, [rdx - 0x62]
call fcn.1800c8a10
add edi, 0x3cde
cmp edi, 0xb69a
jbe 0x180068c88
mov r8, qword [rsp + 0x50]
mov r10, qword [rsp + 0x58]
add esi, 0x908
mov r11, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x80]
mov r9, qword [rbp - 0x58]
cmp esi, 0x1210
jbe 0x180068ba5
mov rax, qword [r8]
cmp qword [rbp - 0x68], rax
jb 0x180068ba0
mov esi, dword [rbp - 0x74]
mov ecx, dword [rbp + 0x740]
mov ebx, 1
mov dword [rsp + 0x48], ebx
jmp 0x1800690a1
mov dword [rbp - 0x6c], 0x100
jmp 0x1800690a1
cmp ecx, 0x4fb
ja 0x180068ffb
je 0x180068df5
mov eax, ecx
sub eax, 0x2ff
je 0x180068dbf
sub eax, 0xfe
je 0x180068da4
cmp eax, 0x7f
jne 0x1800690a1
xor r9d, r9d
lea rax, [rbp + 0x250]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r8, qword [rsp + 0x50]
mov r12, rax
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x180068dcc
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x78]
lea r9, [rbp - 0x70]
xor eax, eax
mov r8d, r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
cmp r13d, dword [rbp - 0x70]
je 0x1800690a1
xor edx, edx
mov edi, edx
cmp edi, 0x11
ja case.0x180068e20.14
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0x69178]
add rcx, r8
jmp rcx
mov dword [rbp + 0x2b4], 0x62
jmp case.0x180068e20.14
mov eax, dword [0x180137904]
mov dword [rbp + 0x2a8], eax
movabs rax, 0x6400250064
mov qword [rbp + 0x2ac], rax
jmp case.0x180068e20.14
movabs rax, 0x72007900720069
mov word [rbp + 0x29a], dx
mov qword [rbp + 0x292], rax
jmp case.0x180068e20.14
mov qword [rbp - 0x60], rdx
jmp case.0x180068e20.14
mov dword [rbp + 0x28e], 0x720048
jmp case.0x180068e20.14
mov r8d, 2
lea rdx, [0x180137954]
lea rcx, [rbp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180068fd6
mov r8d, dword [rbp - 0x48]
lea rdx, [rbp + 0x4b0]
mov rcx, qword [rbp - 0x60]
call sub.IMM32.dll_ImmGetIMEFileNameW
mov byte [rsp + 0x48], 0
mov ebx, dword [rsp + 0x48]
jmp 0x180068fd6
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mov qword [rcx + 0x10], rdx
cmp qword [rcx + 0x18], 0x10
jb 0x180068edf
mov rax, qword [rcx]
mov byte [rax], 0
jmp case.0x180068e20.14
mov r8d, 3
lea rdx, [0x180137974]
lea rcx, [rbp + 0x288]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
mov word [rbp + 0x28e], dx
jmp case.0x180068e20.14
mov word [rbp + 0x2b4], dx
jmp case.0x180068e20.14
movabs rax, 0x5c00730025
lea rdx, [0x180137900]
mov r8d, 1
mov qword [rbp + 0x2a0], rax
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180068fd6
mov eax, PathMakeUniqueName
mov word [rbp + 0x2b2], ax
jmp case.0x180068e20.14
mov eax, dword [0x1801379a4]
mov dword [rbp + 0x2b6], eax
movzx eax, word [0x1801379a8]
mov word [rbp + 0x2ba], ax
mov eax, dword [0x1801379b2]
mov dword [rbp + 0x280], eax
movzx eax, word [0x1801379b6]
mov word [rbp + 0x284], ax
jmp case.0x180068e20.14
mov word [rbp + 0x292], dx
jmp case.0x180068e20.14
mov word [rbp + 0x286], dx
lea rcx, [rbp + 0x280]
lea rdx, [0x1801379fc]
mov r8d, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
jmp 0x180068fd6
lea rdx, [rbp + 0x280]
mov dword [rbp - 0x48], 0x104
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
inc edi
lea eax, [rdi + 0x86]
cmp eax, 0x98
jb 0x180068e03
mov r8, qword [rsp + 0x50]
mov ecx, dword [rbp + 0x740]
jmp 0x1800690a1
mov eax, ecx
sub eax, 0x57a
je 0x18006908b
sub eax, 0x7f
je 0x18006901b
cmp eax, 0x7f
je case.0x180068e20.17
jmp 0x1800690a1
cmp byte [rsp + 0x68], 0
je 0x18006907b
mov ebx, 0x28
cmp ebx, 0x28
je 0x18006903f
cmp ebx, 0xb68
jne 0x180069067
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180069067
lea r8, [rbp - 0x6c]
mov rcx, r12
lea rdx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
test eax, eax
je 0x180069067
mov r8d, 0x34
lea rdx, [rbp - 0x38]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
add ebx, 0xb40
cmp ebx, 0x1680
jbe 0x180069027
mov ecx, dword [rbp + 0x740]
mov r8, qword [rsp + 0x50]
mov byte [rsp + 0x48], 1
mov ebx, dword [rsp + 0x48]
jmp 0x1800690a1
mov eax, dword [rsp + 0x68]
test r12, r12
movzx eax, al
mov edx, 0
cmove eax, edx
mov dword [rsp + 0x68], eax
add ecx, 0x7f
mov dword [rbp + 0x740], ecx
cmp ecx, esi
jae case.0x180068e20.17
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x80]
mov r9, qword [rbp - 0x58]
jmp 0x180068784